anypick 1.0.0

package/dist/providers/gemini.js

@@ -0,0 +1,471 @@
+import { AnyPickError } from "../utils/errors.js";
+import { copyFileSafe, ensureDir, pathExists, readJsonFile, writeJsonFile, writeTextFile } from "../utils/fs.js";
+import { geminiAccountAdapter, poolAdapterFor } from "../sources/account-adapters.js";
+import { readGeminiApiKeyFromEnvFile, stripEnvAuthKeys, upsertEnvFile } from "./gemini-env.js";
+import { readIdentityFromDir } from "./gemini-identity.js";
+import { antigravityApplicationRunning, assertAntigravityStateSafeToMutate, readAntigravityStateOAuthPayload } from "./gemini-antigravity-state.js";
+import { antigravityCredentialExists, antigravityKeychainSupported, deleteAntigravityOAuthCredential, hydrateAntigravityOAuthPayload, loadAntigravityOAuthCredentials, readAntigravityOAuthPayload, saveAntigravityOAuthCredential } from "./gemini-antigravity-oauth.js";
+import { rolesFromLiveDiscovery } from "./model-policy.js";
+import { geminiProxyStatus, readGeminiProxyLogs, startGeminiProxy, stopGeminiProxy } from "./gemini-proxy-lifecycle.js";
+import { listenGeminiProxy } from "./gemini-proxy/server.js";
+import { closeProxyHubBackend } from "./proxy-hub-backend.js";
+import { join } from "node:path";
+import { readFile, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { createHash } from "node:crypto";
+//#region src/providers/gemini.ts
+/**
+* Google Gemini CLI
+*
+* Live auth under ~/.gemini/:
+*   .env                 — GEMINI_API_KEY / GOOGLE_CLOUD_* (API key + Vertex)
+*   oauth_creds.json     — Login with Google OAuth tokens (when on disk)
+*   google_accounts.json — active email + history
+*   settings.json        — security.auth.selectedType (merged, not fully replaced)
+*
+* Built-in dual-protocol proxy (API key accounts):
+*   OpenAI  (/v1/responses)         → Codex
+*   Anthropic (/v1/messages)        → Claude Code
+* Translates to Google Generative Language API (generateContent).
+*
+* Notes:
+* - Personal OAuth may also live in the OS keychain; we snapshot file-based
+*   material only. API-key accounts via .env drive the proxy most reliably.
+*/
+var SNAPSHOT_FILES = [
+	".env",
+	"oauth_creds.json",
+	"google_accounts.json"
+];
+var ANTIGRAVITY_SNAPSHOT_FILE = "antigravity_oauth.json";
+var DEFAULT_PORT = 4130;
+/**
+* Identify a Gemini CLI login by its long-lived credential material.
+*
+* The refresh token, not the access token: the access token rotates hourly and
+* both the CLI and the proxy rewrite the file in place.
+*/
+async function geminiAuthFingerprint(dir) {
+	const parts = [];
+	const oauthPath = join(dir, "oauth_creds.json");
+	if (await pathExists(oauthPath)) try {
+		const creds = await readJsonFile(oauthPath);
+		if (typeof creds.refresh_token === "string" && creds.refresh_token.trim()) parts.push(`rt:${createHash("sha256").update(creds.refresh_token.trim()).digest("hex")}`);
+	} catch {}
+	const key = await readGeminiApiKeyFromEnvFile(join(dir, ".env")).catch(() => void 0);
+	if (key) parts.push(`key:${createHash("sha256").update(key).digest("hex")}`);
+	return parts.length > 0 ? parts.sort().join("|") : null;
+}
+/**
+* Antigravity exposes no email, so identify a login by its durable grant.
+* Keep the refresh token itself out of account metadata and UI output.
+*/
+function antigravityIdentity(payload) {
+	const refreshToken = payload?.token?.refresh_token?.trim();
+	return refreshToken ? `antigravity:${createHash("sha256").update(refreshToken).digest("hex").slice(0, 12)}` : void 0;
+}
+var GeminiProvider = class {
+	home;
+	saveAntigravityCredential;
+	hydrateAntigravityCredential;
+	deleteAntigravityCredential;
+	readAntigravityStateCredential;
+	id = "gemini";
+	name = "Gemini CLI";
+	shortName = "Gemini";
+	/** Gemini CLI vs Antigravity — TUI offers a source picker before mode. */
+	requiresAccountSourcePick = true;
+	description = "Manages ~/.gemini auth + OpenAI/Anthropic→Gemini proxy (Codex + Claude)";
+	defaultProxyPort = DEFAULT_PORT;
+	proxyCompatibility = "OpenAI + Anthropic → Gemini API";
+	/** The Gemini proxy cannot be driven from an OAuth-only snapshot. */
+	proxyRequiresApiKey = true;
+	async proxyApiKeyStatus(snapshotDir) {
+		try {
+			if (await readGeminiApiKeyFromEnvFile(join(snapshotDir, ".env"))) return { present: true };
+			return {
+				present: false,
+				hint: "Needs GEMINI_API_KEY in .env — OAuth-only cannot run this proxy"
+			};
+		} catch {
+			return {
+				present: false,
+				hint: "Could not read Gemini API key for this login"
+			};
+		}
+	}
+	roleDefaults() {
+		return rolesFromLiveDiscovery();
+	}
+	/** Gemini names cheap models "flash"/"lite" and strong models "pro". */
+	roleModelHints() {
+		return {
+			default: ["pro"],
+			opus: ["pro"],
+			sonnet: ["flash", "lite"],
+			haiku: ["flash", "lite"]
+		};
+	}
+	constructor(home = homedir(), saveAntigravityCredential = saveAntigravityOAuthCredential, hydrateAntigravityCredential = hydrateAntigravityOAuthPayload, deleteAntigravityCredential = deleteAntigravityOAuthCredential, readAntigravityStateCredential = readAntigravityStateOAuthPayload) {
+		this.home = home;
+		this.saveAntigravityCredential = saveAntigravityCredential;
+		this.hydrateAntigravityCredential = hydrateAntigravityCredential;
+		this.deleteAntigravityCredential = deleteAntigravityCredential;
+		this.readAntigravityStateCredential = readAntigravityStateCredential;
+	}
+	sourceAdapter(account) {
+		return geminiAccountAdapter(account);
+	}
+	poolSourceAdapter() {
+		return poolAdapterFor(this.id, this);
+	}
+	async createProxyHubBackend(ctx) {
+		const [primary, ...rest] = ctx.accounts;
+		if (!primary) throw new Error("Gemini Hub backend requires at least one account");
+		const options = primary.proxy.options ?? {};
+		const oauthSource = options.oauthSource === "gemini-cli" || options.oauthSource === "antigravity" || options.oauthSource === "auto" ? options.oauthSource : "auto";
+		const { server, endpoint } = await listenGeminiProxy({
+			host: "127.0.0.1",
+			port: 0,
+			authDir: primary.snapshotDir,
+			authDirs: rest.map((account) => account.snapshotDir),
+			authAccountNames: ctx.accounts.map((account) => account.name),
+			oauthSource,
+			antigravityOAuthFile: typeof options.antigravityOAuthFile === "string" ? options.antigravityOAuthFile : void 0,
+			upstream: typeof options.upstream === "string" ? options.upstream : void 0,
+			codeAssistUpstream: typeof options.codeAssistUpstream === "string" ? options.codeAssistUpstream : void 0,
+			token: ctx.token,
+			log: ctx.log
+		});
+		return {
+			endpoint,
+			close: () => closeProxyHubBackend(server)
+		};
+	}
+	get geminiDir() {
+		return process.env.GEMINI_CONFIG_DIR ?? join(this.home, ".gemini");
+	}
+	livePath(name) {
+		return join(this.geminiDir, name);
+	}
+	/** True when ~/.gemini holds credential material the CLI backup can snapshot. */
+	async hasGeminiCliAuth() {
+		return await this.hasApiKeyMaterial() || await pathExists(this.livePath("oauth_creds.json"));
+	}
+	/**
+	* Which source a source-less operation acts on.
+	*
+	* Gemini CLI files win whenever they exist, so restoring a CLI account always
+	* takes precedence over a lingering Antigravity keychain entry. Antigravity
+	* only surfaces when there is no CLI login at all — otherwise a user signed in
+	* through Antigravity alone would look signed out everywhere.
+	*/
+	async resolveAutoSource() {
+		if (await this.hasGeminiCliAuth()) return "gemini-cli";
+		return await antigravityCredentialExists() ? "antigravity" : null;
+	}
+	async detectLive() {
+		const cli = await this.detectGeminiCliLive();
+		if (cli.present) return cli;
+		if (!await antigravityCredentialExists()) return { present: false };
+		return {
+			present: true,
+			identity: antigravityIdentity(await this.readAntigravityStateCredential().catch(() => null)),
+			details: "antigravity oauth"
+		};
+	}
+	async detectGeminiCliLive() {
+		const hasEnv = await this.hasApiKeyMaterial();
+		const hasOauth = await pathExists(this.livePath("oauth_creds.json"));
+		if (!hasEnv && !hasOauth) return { present: false };
+		const identity = await this.readIdentity();
+		const details = [];
+		if (hasOauth) details.push("oauth");
+		if (hasEnv) details.push("api-key");
+		const authType = await this.readSelectedAuthType();
+		if (authType) details.push(authType);
+		return {
+			present: true,
+			identity,
+			details: details.join(", ")
+		};
+	}
+	/**
+	* Explicit Antigravity liveness check. Reads the macOS Keychain (or a portable
+	* file), so it MUST NOT be folded into detectLive() — that runs on every home
+	* refresh and would trigger repeated Keychain permission prompts. Only call it
+	* when the user explicitly chose the Antigravity source.
+	*/
+	async detectAntigravityLive(credentialFile) {
+		if (!credentialFile && !antigravityKeychainSupported()) throw new AnyPickError(`Antigravity accounts are not supported on ${process.platform} yet.`, "NO_LIVE_AUTH");
+		try {
+			const creds = await loadAntigravityOAuthCredentials(credentialFile);
+			if (!creds) return { present: false };
+			return {
+				present: true,
+				identity: creds.refresh_token ? antigravityIdentity({ token: { refresh_token: creds.refresh_token } }) : void 0,
+				details: "antigravity oauth"
+			};
+		} catch {
+			return { present: false };
+		}
+	}
+	/**
+	* Snapshot the Antigravity credential into the account dir.
+	*
+	* The whole credential-store payload is written, not the reduced
+	* {refresh_token, token_type} the proxy needs: restoring this account has to
+	* put the credential back into the store, and a token stripped of its access
+	* token and expiry is not the one that was saved. The proxy is unaffected —
+	* parseAntigravityOAuthCredential accepts this nested shape too.
+	*/
+	async backupAntigravity(destDir, credentialFile) {
+		if (!credentialFile && !antigravityKeychainSupported()) throw new AnyPickError(`Antigravity accounts are not supported on ${process.platform} yet.`, "NO_LIVE_AUTH");
+		const payload = await readAntigravityOAuthPayload(credentialFile);
+		if (!payload) throw new AnyPickError("No Antigravity OAuth credential found. Sign in with Antigravity first.", "NO_LIVE_AUTH");
+		await ensureDir(destDir);
+		await writeJsonFile(join(destDir, ANTIGRAVITY_SNAPSHOT_FILE), payload, 384);
+		return {
+			identity: antigravityIdentity(payload),
+			notes: "Antigravity login"
+		};
+	}
+	async detectLiveSource(source) {
+		return source === "antigravity" ? this.detectAntigravityLive() : this.detectGeminiCliLive();
+	}
+	async backupSource(source, destDir) {
+		return source === "antigravity" ? this.backupAntigravity(destDir) : this.backup(destDir);
+	}
+	async clearLiveSource(source) {
+		return source === "antigravity" ? this.clearAntigravityLive() : this.clearLive();
+	}
+	/**
+	* Drop the Antigravity credential from the OS credential store so Antigravity
+	* asks for a new sign-in. The ~/.gemini CLI files belong to the other source
+	* and are deliberately left alone.
+	*/
+	async clearAntigravityLive() {
+		if (!antigravityKeychainSupported()) throw new AnyPickError(`Antigravity accounts are not supported on ${process.platform} yet.`, "NO_LIVE_AUTH");
+		await deleteAntigravityOAuthCredential();
+	}
+	async backup(destDir) {
+		if (await this.resolveAutoSource() === "antigravity") return this.backupAntigravity(destDir);
+		await ensureDir(destDir);
+		let copied = 0;
+		for (const file of SNAPSHOT_FILES) if (await copyFileSafe(this.livePath(file), join(destDir, file))) copied += 1;
+		const authSettings = await this.readAuthSettingsSlice();
+		if (authSettings) {
+			await writeJsonFile(join(destDir, "auth-settings.json"), authSettings, 384);
+			copied += 1;
+		}
+		if (copied === 0) throw new AnyPickError("No Gemini CLI auth found under ~/.gemini (.env, oauth_creds.json, or google_accounts.json).", "NO_LIVE_AUTH");
+		const hasCred = await pathExists(join(destDir, ".env")) || await pathExists(join(destDir, "oauth_creds.json"));
+		if (!hasCred) throw new AnyPickError("Gemini google_accounts.json alone is not enough — need .env (API key) or oauth_creds.json.", "NO_LIVE_AUTH");
+		return {
+			identity: await readIdentityFromDir(destDir) ?? await this.readIdentity(),
+			notes: hasCred ? void 0 : "Partial Gemini snapshot"
+		};
+	}
+	async restore(srcDir) {
+		await ensureDir(this.geminiDir);
+		let restored = 0;
+		for (const file of SNAPSHOT_FILES) {
+			const src = join(srcDir, file);
+			if (await pathExists(src)) {
+				await copyFileSafe(src, this.livePath(file));
+				restored += 1;
+			} else await rm(this.livePath(file), { force: true }).catch(() => {});
+		}
+		const authSlicePath = join(srcDir, "auth-settings.json");
+		if (await pathExists(authSlicePath)) try {
+			const slice = await readJsonFile(authSlicePath);
+			await this.mergeAuthSettings(slice);
+			restored += 1;
+		} catch {}
+		const antigravitySnapshot = join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE);
+		if (await pathExists(antigravitySnapshot)) {
+			await this.restoreAntigravity(antigravitySnapshot);
+			restored += 1;
+		} else if (antigravityKeychainSupported()) await this.deleteAntigravityCredential().catch(() => {});
+		if (restored === 0) throw new AnyPickError(`No Gemini auth files in snapshot: ${srcDir}`, "SNAPSHOT_INVALID");
+	}
+	/**
+	* Refuse an Antigravity switch before AccountService checkpoints or mutates
+	* anything. Without this early guard, the late SQLite rejection caused core
+	* to attempt a rollback that the same running app also rejected.
+	*/
+	async preflightRestore(srcDir) {
+		const snapshotFile = join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE);
+		if (!await pathExists(snapshotFile)) return;
+		const payload = await readAntigravityOAuthPayload(snapshotFile);
+		if (!payload) throw new AnyPickError("Saved Antigravity credential has no refresh token and cannot be restored.", "ANTIGRAVITY_RESTORE_FAILED");
+		try {
+			await assertAntigravityStateSafeToMutate({ expectedPayload: payload });
+		} catch (err) {
+			if (err instanceof Error && /Antigravity is running/i.test(err.message)) throw new AnyPickError("Antigravity is still open.", {
+				code: "RESTORE_OWNER_RUNNING",
+				suggestions: ["Quit Antigravity completely, return to AnyPick, then press Enter again."]
+			});
+			throw err;
+		}
+	}
+	async restoreOwnerStatus(srcDir) {
+		if (!await pathExists(join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE))) return null;
+		return {
+			name: "Antigravity",
+			running: await antigravityApplicationRunning()
+		};
+	}
+	async accountSource(srcDir) {
+		return await pathExists(join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE)) ? {
+			id: "antigravity",
+			name: "Antigravity"
+		} : {
+			id: "gemini-cli",
+			name: "Gemini CLI"
+		};
+	}
+	async liveAccountSource(live) {
+		return live.details?.toLowerCase().includes("antigravity") ? {
+			id: "antigravity",
+			name: "Antigravity"
+		} : {
+			id: "gemini-cli",
+			name: "Gemini CLI"
+		};
+	}
+	/** Push a snapshotted Antigravity credential back into the OS credential store. */
+	async restoreAntigravity(snapshotFile) {
+		if (!antigravityKeychainSupported()) throw new AnyPickError(`Writing the Antigravity OAuth credential is not supported on ${process.platform}.`, "ANTIGRAVITY_RESTORE_FAILED");
+		const payload = await readAntigravityOAuthPayload(snapshotFile);
+		if (!payload) throw new AnyPickError("Saved Antigravity credential has no refresh token and cannot be restored.", "ANTIGRAVITY_RESTORE_FAILED");
+		await this.saveAntigravityCredential(await this.hydrateAntigravityCredential(payload));
+	}
+	/**
+	* Clear local Gemini CLI auth files so the user can sign in as someone else.
+	* Does not revoke OAuth server-side or remove OS keychain entries.
+	*/
+	async clearLive() {
+		if (await this.resolveAutoSource() === "antigravity") {
+			await this.clearAntigravityLive();
+			return;
+		}
+		for (const file of ["oauth_creds.json", "google_accounts.json"]) await rm(this.livePath(file), { force: true }).catch(() => {});
+		const envPath = this.livePath(".env");
+		if (await pathExists(envPath)) {
+			const next = await stripEnvAuthKeys(envPath);
+			if (next.trim()) await writeTextFile(envPath, next.endsWith("\n") ? next : `${next}\n`, 384);
+			else await rm(envPath, { force: true }).catch(() => {});
+		}
+		try {
+			const settingsPath = this.livePath("settings.json");
+			if (await pathExists(settingsPath)) {
+				const doc = await readJsonFile(settingsPath);
+				const security = doc.security && typeof doc.security === "object" ? { ...doc.security } : {};
+				if (security.auth && typeof security.auth === "object") {
+					const auth = { ...security.auth };
+					delete auth.selectedType;
+					if (Object.keys(auth).length === 0) delete security.auth;
+					else security.auth = auth;
+				}
+				if (Object.keys(security).length === 0) delete doc.security;
+				else doc.security = security;
+				await writeJsonFile(settingsPath, doc, 384);
+			}
+		} catch {}
+	}
+	async startProxy(ctx) {
+		return startGeminiProxy(ctx, {
+			liveDir: this.geminiDir,
+			compatibility: this.proxyCompatibility,
+			defaultPort: DEFAULT_PORT
+		});
+	}
+	async stopProxy(ctx) {
+		await stopGeminiProxy(ctx);
+	}
+	async proxyStatus(ctx) {
+		return geminiProxyStatus(ctx, this.proxyCompatibility, DEFAULT_PORT);
+	}
+	async readProxyLogs(ctx, lines = 50) {
+		return readGeminiProxyLogs(ctx, lines);
+	}
+	/**
+	* Gemini keeps no `auth.json`, so the shared default could never find a live
+	* file to compare and reported every saved account as not-live.
+	*
+	* Only credential material is compared, and only its durable part: the CLI
+	* rewrites `oauth_creds.json` on every access-token refresh, so hashing the
+	* whole file would mark the live account "changed" within the hour.
+	*/
+	async snapshotMatchesLive(snapshotDir) {
+		if (await pathExists(join(snapshotDir, ANTIGRAVITY_SNAPSHOT_FILE))) {
+			const snapshot = await readAntigravityOAuthPayload(join(snapshotDir, ANTIGRAVITY_SNAPSHOT_FILE));
+			const live = await this.readAntigravityStateCredential().catch(() => null);
+			const snapshotIdentity = antigravityIdentity(snapshot);
+			const liveIdentity = antigravityIdentity(live);
+			if (!snapshotIdentity || !liveIdentity) throw new AnyPickError("The current Antigravity login cannot be fingerprinted from unified state.", "NOT_DETERMINABLE");
+			return snapshotIdentity === liveIdentity;
+		}
+		const snap = await geminiAuthFingerprint(snapshotDir);
+		if (!snap) return false;
+		return snap === await geminiAuthFingerprint(this.geminiDir);
+	}
+	async hasApiKeyMaterial() {
+		if (process.env.GEMINI_API_KEY?.trim() || process.env.GOOGLE_API_KEY?.trim()) {}
+		const envPath = this.livePath(".env");
+		if (!await pathExists(envPath)) return Boolean(process.env.GEMINI_API_KEY?.trim() || process.env.GOOGLE_API_KEY?.trim());
+		try {
+			const raw = await readFile(envPath, "utf8");
+			return /^(?:export\s+)?(?:GEMINI_API_KEY|GOOGLE_API_KEY|GOOGLE_APPLICATION_CREDENTIALS)=/m.test(raw);
+		} catch {
+			return false;
+		}
+	}
+	async readIdentity() {
+		return readIdentityFromDir(this.geminiDir);
+	}
+	async readSelectedAuthType() {
+		try {
+			const settingsPath = this.livePath("settings.json");
+			if (!await pathExists(settingsPath)) return;
+			const auth = (await readJsonFile(settingsPath)).security?.auth;
+			return typeof auth?.selectedType === "string" ? auth.selectedType : void 0;
+		} catch {
+			return;
+		}
+	}
+	async readAuthSettingsSlice() {
+		try {
+			const settingsPath = this.livePath("settings.json");
+			if (!await pathExists(settingsPath)) return null;
+			const security = (await readJsonFile(settingsPath)).security;
+			if (!security || typeof security !== "object") return null;
+			return { security: { ...security } };
+		} catch {
+			return null;
+		}
+	}
+	async mergeAuthSettings(slice) {
+		const settingsPath = this.livePath("settings.json");
+		let doc = {};
+		if (await pathExists(settingsPath)) try {
+			doc = await readJsonFile(settingsPath);
+		} catch {
+			doc = {};
+		}
+		if (slice.security && typeof slice.security === "object") {
+			const existing = doc.security && typeof doc.security === "object" ? doc.security : {};
+			doc.security = {
+				...existing,
+				...slice.security
+			};
+		}
+		await writeJsonFile(settingsPath, doc, 384);
+	}
+};
+var geminiProvider = new GeminiProvider();
+//#endregion
+export { GeminiProvider, geminiProvider, readGeminiApiKeyFromEnvFile, upsertEnvFile };
+
+//# sourceMappingURL=gemini.js.map

package/dist/providers/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","names":[],"sources":["../../src/providers/gemini.ts"],"sourcesContent":["/**\n * Google Gemini CLI\n *\n * Live auth under ~/.gemini/:\n *   .env                 — GEMINI_API_KEY / GOOGLE_CLOUD_* (API key + Vertex)\n *   oauth_creds.json     — Login with Google OAuth tokens (when on disk)\n *   google_accounts.json — active email + history\n *   settings.json        — security.auth.selectedType (merged, not fully replaced)\n *\n * Built-in dual-protocol proxy (API key accounts):\n *   OpenAI  (/v1/responses)         → Codex\n *   Anthropic (/v1/messages)        → Claude Code\n * Translates to Google Generative Language API (generateContent).\n *\n * Notes:\n * - Personal OAuth may also live in the OS keychain; we snapshot file-based\n *   material only. API-key accounts via .env drive the proxy most reliably.\n */\n\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { readFile, rm } from 'node:fs/promises';\nimport { createHash } from 'node:crypto';\nimport type {\n  Account,\n  AccountMeta,\n  LiveAuthStatus,\n  Provider,\n  ProxyContext,\n  ProxyHubBackendContext,\n  ProxyHubBackendHandle,\n  ProxyHandle,\n  ProxyStatus,\n  SourceAdapter,\n} from '../types';\nimport { geminiAccountAdapter, poolAdapterFor } from '../sources/account-adapters';\nimport {\n  copyFileSafe,\n  ensureDir,\n  pathExists,\n  readJsonFile,\n  writeJsonFile,\n  writeTextFile,\n} from '../utils/fs';\nimport { AnyPickError } from '../utils/errors';\nimport { readGeminiApiKeyFromEnvFile, stripEnvAuthKeys } from './gemini-env';\nimport { readIdentityFromDir } from './gemini-identity';\nimport {\n  loadAntigravityOAuthCredentials,\n  readAntigravityOAuthPayload,\n  hydrateAntigravityOAuthPayload,\n  saveAntigravityOAuthCredential,\n  deleteAntigravityOAuthCredential,\n  antigravityCredentialExists,\n  antigravityKeychainSupported,\n  type AntigravityKeyringPayload,\n} from './gemini-antigravity-oauth';\nimport {\n  antigravityApplicationRunning,\n  assertAntigravityStateSafeToMutate,\n  readAntigravityStateOAuthPayload,\n} from './gemini-antigravity-state';\nimport { rolesFromLiveDiscovery } from './model-policy';\nimport {\n  startGeminiProxy,\n  stopGeminiProxy,\n  geminiProxyStatus,\n  readGeminiProxyLogs,\n} from './gemini-proxy-lifecycle';\nimport { listenGeminiProxy } from './gemini-proxy/server';\nimport { closeProxyHubBackend } from './proxy-hub-backend';\n\nconst SNAPSHOT_FILES = ['.env', 'oauth_creds.json', 'google_accounts.json'] as const;\nconst ANTIGRAVITY_SNAPSHOT_FILE = 'antigravity_oauth.json';\nconst DEFAULT_PORT = 4130;\n\n/**\n * Identify a Gemini CLI login by its long-lived credential material.\n *\n * The refresh token, not the access token: the access token rotates hourly and\n * both the CLI and the proxy rewrite the file in place.\n */\nasync function geminiAuthFingerprint(dir: string): Promise<string | null> {\n  const parts: string[] = [];\n\n  const oauthPath = join(dir, 'oauth_creds.json');\n  if (await pathExists(oauthPath)) {\n    try {\n      const creds = await readJsonFile<{ refresh_token?: unknown }>(oauthPath);\n      if (typeof creds.refresh_token === 'string' && creds.refresh_token.trim()) {\n        parts.push(`rt:${createHash('sha256').update(creds.refresh_token.trim()).digest('hex')}`);\n      }\n    } catch {\n      // Unreadable credential is no credential.\n    }\n  }\n\n  const key = await readGeminiApiKeyFromEnvFile(join(dir, '.env')).catch(() => undefined);\n  if (key) {\n    parts.push(`key:${createHash('sha256').update(key).digest('hex')}`);\n  }\n\n  return parts.length > 0 ? parts.sort().join('|') : null;\n}\n\n/**\n * Antigravity exposes no email, so identify a login by its durable grant.\n * Keep the refresh token itself out of account metadata and UI output.\n */\nfunction antigravityIdentity(payload: AntigravityKeyringPayload | null): string | undefined {\n  const refreshToken = payload?.token?.refresh_token?.trim();\n  return refreshToken\n    ? `antigravity:${createHash('sha256').update(refreshToken).digest('hex').slice(0, 12)}`\n    : undefined;\n}\n\nexport class GeminiProvider implements Provider {\n  readonly id = 'gemini';\n  readonly name = 'Gemini CLI';\n  readonly shortName = 'Gemini';\n  /** Gemini CLI vs Antigravity — TUI offers a source picker before mode. */\n  readonly requiresAccountSourcePick = true;\n  readonly description = 'Manages ~/.gemini auth + OpenAI/Anthropic→Gemini proxy (Codex + Claude)';\n  readonly defaultProxyPort = DEFAULT_PORT;\n  readonly proxyCompatibility = 'OpenAI + Anthropic → Gemini API';\n  /** The Gemini proxy cannot be driven from an OAuth-only snapshot. */\n  readonly proxyRequiresApiKey = true;\n\n  async proxyApiKeyStatus(snapshotDir: string): Promise<{ present: boolean; hint?: string }> {\n    try {\n      const key = await readGeminiApiKeyFromEnvFile(join(snapshotDir, '.env'));\n      if (key) {\n        return { present: true };\n      }\n      return {\n        present: false,\n        hint: 'Needs GEMINI_API_KEY in .env — OAuth-only cannot run this proxy',\n      };\n    } catch {\n      return { present: false, hint: 'Could not read Gemini API key for this login' };\n    }\n  }\n\n  // Model rollout differs between API-key and Code Assist OAuth accounts, so\n  // roles are resolved from the proxy's live model list.\n  roleDefaults(): Record<string, string> {\n    return rolesFromLiveDiscovery();\n  }\n\n  /** Gemini names cheap models \"flash\"/\"lite\" and strong models \"pro\". */\n  roleModelHints(): Record<string, readonly string[]> {\n    return {\n      default: ['pro'],\n      opus: ['pro'],\n      sonnet: ['flash', 'lite'],\n      haiku: ['flash', 'lite'],\n    };\n  }\n\n  constructor(\n    private readonly home = homedir(),\n    private readonly saveAntigravityCredential: (\n      payload: AntigravityKeyringPayload,\n    ) => Promise<void> = saveAntigravityOAuthCredential,\n    private readonly hydrateAntigravityCredential: (\n      payload: AntigravityKeyringPayload,\n    ) => Promise<AntigravityKeyringPayload> = hydrateAntigravityOAuthPayload,\n    private readonly deleteAntigravityCredential: () => Promise<boolean> = deleteAntigravityOAuthCredential,\n    private readonly readAntigravityStateCredential: () => Promise<AntigravityKeyringPayload | null> = readAntigravityStateOAuthPayload,\n  ) {}\n\n  sourceAdapter(account: Account): SourceAdapter {\n    return geminiAccountAdapter(account);\n  }\n\n  poolSourceAdapter(): SourceAdapter {\n    return poolAdapterFor(this.id, this);\n  }\n\n  async createProxyHubBackend(ctx: ProxyHubBackendContext): Promise<ProxyHubBackendHandle> {\n    const [primary, ...rest] = ctx.accounts;\n    if (!primary) {\n      throw new Error('Gemini Hub backend requires at least one account');\n    }\n    const options = primary.proxy.options ?? {};\n    const oauthSource =\n      options.oauthSource === 'gemini-cli' ||\n      options.oauthSource === 'antigravity' ||\n      options.oauthSource === 'auto'\n        ? options.oauthSource\n        : 'auto';\n    const { server, endpoint } = await listenGeminiProxy({\n      host: '127.0.0.1',\n      port: 0,\n      authDir: primary.snapshotDir,\n      authDirs: rest.map((account) => account.snapshotDir),\n      authAccountNames: ctx.accounts.map((account) => account.name),\n      oauthSource,\n      antigravityOAuthFile:\n        typeof options.antigravityOAuthFile === 'string' ? options.antigravityOAuthFile : undefined,\n      upstream: typeof options.upstream === 'string' ? options.upstream : undefined,\n      codeAssistUpstream:\n        typeof options.codeAssistUpstream === 'string' ? options.codeAssistUpstream : undefined,\n      token: ctx.token,\n      log: ctx.log,\n    });\n    return { endpoint, close: () => closeProxyHubBackend(server) };\n  }\n\n  private get geminiDir(): string {\n    return process.env.GEMINI_CONFIG_DIR ?? join(this.home, '.gemini');\n  }\n\n  private livePath(name: string): string {\n    return join(this.geminiDir, name);\n  }\n\n  /** True when ~/.gemini holds credential material the CLI backup can snapshot. */\n  private async hasGeminiCliAuth(): Promise<boolean> {\n    return (\n      (await this.hasApiKeyMaterial()) || (await pathExists(this.livePath('oauth_creds.json')))\n    );\n  }\n\n  /**\n   * Which source a source-less operation acts on.\n   *\n   * Gemini CLI files win whenever they exist, so restoring a CLI account always\n   * takes precedence over a lingering Antigravity keychain entry. Antigravity\n   * only surfaces when there is no CLI login at all — otherwise a user signed in\n   * through Antigravity alone would look signed out everywhere.\n   */\n  private async resolveAutoSource(): Promise<'gemini-cli' | 'antigravity' | null> {\n    if (await this.hasGeminiCliAuth()) {\n      return 'gemini-cli';\n    }\n    return (await antigravityCredentialExists()) ? 'antigravity' : null;\n  }\n\n  async detectLive(): Promise<LiveAuthStatus> {\n    const cli = await this.detectGeminiCliLive();\n    if (cli.present) {\n      return cli;\n    }\n    // Existence-only probe: reads no secret, so no Keychain prompt.\n    if (!(await antigravityCredentialExists())) {\n      return { present: false };\n    }\n    // Unified state is a local SQLite database, so it is safe to fingerprint\n    // during routine detection. Never fall back to reading the Keychain here.\n    const payload = await this.readAntigravityStateCredential().catch(() => null);\n    return {\n      present: true,\n      identity: antigravityIdentity(payload),\n      details: 'antigravity oauth',\n    };\n  }\n\n  private async detectGeminiCliLive(): Promise<LiveAuthStatus> {\n    const hasEnv = await this.hasApiKeyMaterial();\n    const hasOauth = await pathExists(this.livePath('oauth_creds.json'));\n    if (!hasEnv && !hasOauth) {\n      return { present: false };\n    }\n\n    const identity = await this.readIdentity();\n    const details: string[] = [];\n    if (hasOauth) {\n      details.push('oauth');\n    }\n    if (hasEnv) {\n      details.push('api-key');\n    }\n    const authType = await this.readSelectedAuthType();\n    if (authType) {\n      details.push(authType);\n    }\n\n    return {\n      present: true,\n      identity,\n      details: details.join(', '),\n    };\n  }\n\n  /**\n   * Explicit Antigravity liveness check. Reads the macOS Keychain (or a portable\n   * file), so it MUST NOT be folded into detectLive() — that runs on every home\n   * refresh and would trigger repeated Keychain permission prompts. Only call it\n   * when the user explicitly chose the Antigravity source.\n   */\n  async detectAntigravityLive(credentialFile?: string): Promise<LiveAuthStatus> {\n    if (!credentialFile && !antigravityKeychainSupported()) {\n      throw new AnyPickError(\n        `Antigravity accounts are not supported on ${process.platform} yet.`,\n        'NO_LIVE_AUTH',\n      );\n    }\n    try {\n      const creds = await loadAntigravityOAuthCredentials(credentialFile);\n      if (!creds) {\n        return { present: false };\n      }\n      const identity = creds.refresh_token\n        ? antigravityIdentity({ token: { refresh_token: creds.refresh_token } })\n        : undefined;\n      return { present: true, identity, details: 'antigravity oauth' };\n    } catch {\n      return { present: false };\n    }\n  }\n\n  /**\n   * Snapshot the Antigravity credential into the account dir.\n   *\n   * The whole credential-store payload is written, not the reduced\n   * {refresh_token, token_type} the proxy needs: restoring this account has to\n   * put the credential back into the store, and a token stripped of its access\n   * token and expiry is not the one that was saved. The proxy is unaffected —\n   * parseAntigravityOAuthCredential accepts this nested shape too.\n   */\n  async backupAntigravity(\n    destDir: string,\n    credentialFile?: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    if (!credentialFile && !antigravityKeychainSupported()) {\n      throw new AnyPickError(\n        `Antigravity accounts are not supported on ${process.platform} yet.`,\n        'NO_LIVE_AUTH',\n      );\n    }\n    const payload = await readAntigravityOAuthPayload(credentialFile);\n    if (!payload) {\n      throw new AnyPickError(\n        'No Antigravity OAuth credential found. Sign in with Antigravity first.',\n        'NO_LIVE_AUTH',\n      );\n    }\n    await ensureDir(destDir);\n    await writeJsonFile(join(destDir, ANTIGRAVITY_SNAPSHOT_FILE), payload, 0o600);\n    return { identity: antigravityIdentity(payload), notes: 'Antigravity login' };\n  }\n\n  async detectLiveSource(source: string): Promise<LiveAuthStatus> {\n    // Pinned to one source: `gemini-cli` must not fall through to Antigravity,\n    // or the source picker would report a login the chosen source cannot use.\n    return source === 'antigravity' ? this.detectAntigravityLive() : this.detectGeminiCliLive();\n  }\n\n  async backupSource(\n    source: string,\n    destDir: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    return source === 'antigravity' ? this.backupAntigravity(destDir) : this.backup(destDir);\n  }\n\n  async clearLiveSource(source: string): Promise<void> {\n    return source === 'antigravity' ? this.clearAntigravityLive() : this.clearLive();\n  }\n\n  /**\n   * Drop the Antigravity credential from the OS credential store so Antigravity\n   * asks for a new sign-in. The ~/.gemini CLI files belong to the other source\n   * and are deliberately left alone.\n   */\n  async clearAntigravityLive(): Promise<void> {\n    if (!antigravityKeychainSupported()) {\n      throw new AnyPickError(\n        `Antigravity accounts are not supported on ${process.platform} yet.`,\n        'NO_LIVE_AUTH',\n      );\n    }\n    await deleteAntigravityOAuthCredential();\n  }\n\n  async backup(\n    destDir: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    // Must agree with detectLive(): callers that snapshot whatever it reported\n    // live (checkpointLiveAuth, save, stash) would otherwise fail outright for\n    // an Antigravity-only login.\n    if ((await this.resolveAutoSource()) === 'antigravity') {\n      return this.backupAntigravity(destDir);\n    }\n    await ensureDir(destDir);\n    let copied = 0;\n\n    for (const file of SNAPSHOT_FILES) {\n      const ok = await copyFileSafe(this.livePath(file), join(destDir, file));\n      if (ok) {\n        copied += 1;\n      }\n    }\n\n    // Auth-related settings slice only (do not clobber MCP/hooks on restore)\n    const authSettings = await this.readAuthSettingsSlice();\n    if (authSettings) {\n      await writeJsonFile(join(destDir, 'auth-settings.json'), authSettings, 0o600);\n      copied += 1;\n    }\n\n    if (copied === 0) {\n      throw new AnyPickError(\n        'No Gemini CLI auth found under ~/.gemini (.env, oauth_creds.json, or google_accounts.json).',\n        'NO_LIVE_AUTH',\n      );\n    }\n\n    // Require at least one credential-bearing file\n    const hasCred =\n      (await pathExists(join(destDir, '.env'))) ||\n      (await pathExists(join(destDir, 'oauth_creds.json')));\n    if (!hasCred) {\n      throw new AnyPickError(\n        'Gemini google_accounts.json alone is not enough — need .env (API key) or oauth_creds.json.',\n        'NO_LIVE_AUTH',\n      );\n    }\n\n    const identity = (await readIdentityFromDir(destDir)) ?? (await this.readIdentity());\n    return {\n      identity,\n      notes: hasCred ? undefined : 'Partial Gemini snapshot',\n    };\n  }\n\n  async restore(srcDir: string): Promise<void> {\n    await ensureDir(this.geminiDir);\n    let restored = 0;\n\n    for (const file of SNAPSHOT_FILES) {\n      const src = join(srcDir, file);\n      if (await pathExists(src)) {\n        await copyFileSafe(src, this.livePath(file));\n        restored += 1;\n      } else {\n        // Clear every credential file not present in the snapshot so accounts\n        // do not mix. Previously only .env and oauth_creds.json were removed;\n        // google_accounts.json had the same stale-state risk when restoring an\n        // Antigravity-only snapshot — the ghost identity confused\n        // snapshotMatchesLive into fingerprint-matching the wrong account.\n        await rm(this.livePath(file), { force: true }).catch(() => {});\n      }\n    }\n\n    const authSlicePath = join(srcDir, 'auth-settings.json');\n    if (await pathExists(authSlicePath)) {\n      try {\n        const slice = await readJsonFile<Record<string, unknown>>(authSlicePath);\n        await this.mergeAuthSettings(slice);\n        restored += 1;\n      } catch {\n        // ignore corrupt slice\n      }\n    }\n\n    // An Antigravity credential has no home under ~/.gemini: it lives in the OS\n    // credential store. AnyPick's own proxy reads it straight from the snapshot\n    // dir, but Antigravity itself only ever reads the store — so without this\n    // write a switch changes nothing the user can see.\n    const antigravitySnapshot = join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE);\n    if (await pathExists(antigravitySnapshot)) {\n      await this.restoreAntigravity(antigravitySnapshot);\n      restored += 1;\n    } else if (antigravityKeychainSupported()) {\n      // Restoring a Gemini CLI account: clear the Antigravity credential so\n      // Antigravity itself follows the switch rather than retaining a stale\n      // login from the previous account. Best-effort — a missing or\n      // inaccessible entry is the desired end state either way (ADR 0004).\n      await this.deleteAntigravityCredential().catch(() => {});\n    }\n\n    if (restored === 0) {\n      throw new AnyPickError(`No Gemini auth files in snapshot: ${srcDir}`, 'SNAPSHOT_INVALID');\n    }\n  }\n\n  /**\n   * Refuse an Antigravity switch before AccountService checkpoints or mutates\n   * anything. Without this early guard, the late SQLite rejection caused core\n   * to attempt a rollback that the same running app also rejected.\n   */\n  async preflightRestore(srcDir: string): Promise<void> {\n    const snapshotFile = join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE);\n    if (!(await pathExists(snapshotFile))) {\n      return;\n    }\n    const payload = await readAntigravityOAuthPayload(snapshotFile);\n    if (!payload) {\n      throw new AnyPickError(\n        'Saved Antigravity credential has no refresh token and cannot be restored.',\n        'ANTIGRAVITY_RESTORE_FAILED',\n      );\n    }\n    try {\n      await assertAntigravityStateSafeToMutate({ expectedPayload: payload });\n    } catch (err) {\n      if (err instanceof Error && /Antigravity is running/i.test(err.message)) {\n        throw new AnyPickError('Antigravity is still open.', {\n          code: 'RESTORE_OWNER_RUNNING',\n          suggestions: ['Quit Antigravity completely, return to AnyPick, then press Enter again.'],\n        });\n      }\n      throw err;\n    }\n  }\n\n  async restoreOwnerStatus(srcDir: string): Promise<{ name: string; running: boolean } | null> {\n    if (!(await pathExists(join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE)))) {\n      return null;\n    }\n    return {\n      name: 'Antigravity',\n      running: await antigravityApplicationRunning(),\n    };\n  }\n\n  async accountSource(srcDir: string): Promise<{ id: string; name: string }> {\n    return (await pathExists(join(srcDir, ANTIGRAVITY_SNAPSHOT_FILE)))\n      ? { id: 'antigravity', name: 'Antigravity' }\n      : { id: 'gemini-cli', name: 'Gemini CLI' };\n  }\n\n  async liveAccountSource(live: LiveAuthStatus): Promise<{ id: string; name: string }> {\n    return live.details?.toLowerCase().includes('antigravity')\n      ? { id: 'antigravity', name: 'Antigravity' }\n      : { id: 'gemini-cli', name: 'Gemini CLI' };\n  }\n\n  /** Push a snapshotted Antigravity credential back into the OS credential store. */\n  private async restoreAntigravity(snapshotFile: string): Promise<void> {\n    if (!antigravityKeychainSupported()) {\n      throw new AnyPickError(\n        `Writing the Antigravity OAuth credential is not supported on ${process.platform}.`,\n        'ANTIGRAVITY_RESTORE_FAILED',\n      );\n    }\n    const payload = await readAntigravityOAuthPayload(snapshotFile);\n    if (!payload) {\n      throw new AnyPickError(\n        'Saved Antigravity credential has no refresh token and cannot be restored.',\n        'ANTIGRAVITY_RESTORE_FAILED',\n      );\n    }\n    // Do not hide this error. AccountService rolls the live checkpoint and\n    // active pointer back when restore rejects; pretending success leaves the\n    // UI pointing at an account Antigravity never received.\n    await this.saveAntigravityCredential(await this.hydrateAntigravityCredential(payload));\n  }\n\n  /**\n   * Clear local Gemini CLI auth files so the user can sign in as someone else.\n   * Does not revoke OAuth server-side or remove OS keychain entries.\n   */\n  async clearLive(): Promise<void> {\n    if ((await this.resolveAutoSource()) === 'antigravity') {\n      await this.clearAntigravityLive();\n      return;\n    }\n    for (const file of ['oauth_creds.json', 'google_accounts.json'] as const) {\n      await rm(this.livePath(file), { force: true }).catch(() => {});\n    }\n\n    // Strip known auth keys from .env; remove file if empty\n    const envPath = this.livePath('.env');\n    if (await pathExists(envPath)) {\n      const next = await stripEnvAuthKeys(envPath);\n      if (next.trim()) {\n        await writeTextFile(envPath, next.endsWith('\\n') ? next : `${next}\\n`, 0o600);\n      } else {\n        await rm(envPath, { force: true }).catch(() => {});\n      }\n    }\n\n    // Clear selected auth type in settings (keep the rest of user config)\n    try {\n      const settingsPath = this.livePath('settings.json');\n      if (await pathExists(settingsPath)) {\n        const doc = await readJsonFile<Record<string, unknown>>(settingsPath);\n        const security =\n          doc.security && typeof doc.security === 'object'\n            ? { ...(doc.security as Record<string, unknown>) }\n            : {};\n        if (security.auth && typeof security.auth === 'object') {\n          const auth = { ...(security.auth as Record<string, unknown>) };\n          delete auth.selectedType;\n          if (Object.keys(auth).length === 0) {\n            delete security.auth;\n          } else {\n            security.auth = auth;\n          }\n        }\n        if (Object.keys(security).length === 0) {\n          delete doc.security;\n        } else {\n          doc.security = security;\n        }\n        await writeJsonFile(settingsPath, doc, 0o600);\n      }\n    } catch {\n      // best-effort\n    }\n  }\n\n  // ── Built-in proxy (API key → Codex + Claude) ───────────────────\n\n  async startProxy(ctx: ProxyContext): Promise<ProxyHandle> {\n    return startGeminiProxy(ctx, {\n      liveDir: this.geminiDir,\n      compatibility: this.proxyCompatibility,\n      defaultPort: DEFAULT_PORT,\n    });\n  }\n\n  async stopProxy(ctx: ProxyContext): Promise<void> {\n    await stopGeminiProxy(ctx);\n  }\n\n  async proxyStatus(ctx: ProxyContext): Promise<ProxyStatus> {\n    return geminiProxyStatus(ctx, this.proxyCompatibility, DEFAULT_PORT);\n  }\n\n  async readProxyLogs(ctx: ProxyContext, lines = 50): Promise<string> {\n    return readGeminiProxyLogs(ctx, lines);\n  }\n\n  /**\n   * Gemini keeps no `auth.json`, so the shared default could never find a live\n   * file to compare and reported every saved account as not-live.\n   *\n   * Only credential material is compared, and only its durable part: the CLI\n   * rewrites `oauth_creds.json` on every access-token refresh, so hashing the\n   * whole file would mark the live account \"changed\" within the hour.\n   */\n  async snapshotMatchesLive(snapshotDir: string): Promise<boolean> {\n    if (await pathExists(join(snapshotDir, ANTIGRAVITY_SNAPSHOT_FILE))) {\n      // Compare against the local unified-state token rather than Keychain.\n      // This avoids permission prompts on every list refresh while still\n      // preventing an identity-less active pointer from choosing a snapshot.\n      const snapshot = await readAntigravityOAuthPayload(\n        join(snapshotDir, ANTIGRAVITY_SNAPSHOT_FILE),\n      );\n      const live = await this.readAntigravityStateCredential().catch(() => null);\n      const snapshotIdentity = antigravityIdentity(snapshot);\n      const liveIdentity = antigravityIdentity(live);\n      if (!snapshotIdentity || !liveIdentity) {\n        throw new AnyPickError(\n          'The current Antigravity login cannot be fingerprinted from unified state.',\n          'NOT_DETERMINABLE',\n        );\n      }\n      return snapshotIdentity === liveIdentity;\n    }\n    const snap = await geminiAuthFingerprint(snapshotDir);\n    if (!snap) {\n      return false;\n    }\n    return snap === (await geminiAuthFingerprint(this.geminiDir));\n  }\n\n  private async hasApiKeyMaterial(): Promise<boolean> {\n    if (process.env.GEMINI_API_KEY?.trim() || process.env.GOOGLE_API_KEY?.trim()) {\n      // Env may be set outside ~/.gemini — still counts as live for detect\n      // but backup prefers on-disk .env\n    }\n    const envPath = this.livePath('.env');\n    if (!(await pathExists(envPath))) {\n      return Boolean(process.env.GEMINI_API_KEY?.trim() || process.env.GOOGLE_API_KEY?.trim());\n    }\n    try {\n      const raw = await readFile(envPath, 'utf8');\n      return /^(?:export\\s+)?(?:GEMINI_API_KEY|GOOGLE_API_KEY|GOOGLE_APPLICATION_CREDENTIALS)=/m.test(\n        raw,\n      );\n    } catch {\n      return false;\n    }\n  }\n\n  private async readIdentity(): Promise<string | undefined> {\n    return readIdentityFromDir(this.geminiDir);\n  }\n\n  private async readSelectedAuthType(): Promise<string | undefined> {\n    try {\n      const settingsPath = this.livePath('settings.json');\n      if (!(await pathExists(settingsPath))) {\n        return undefined;\n      }\n      const doc = await readJsonFile<Record<string, unknown>>(settingsPath);\n      const security = doc.security as Record<string, unknown> | undefined;\n      const auth = security?.auth as Record<string, unknown> | undefined;\n      return typeof auth?.selectedType === 'string' ? auth.selectedType : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private async readAuthSettingsSlice(): Promise<Record<string, unknown> | null> {\n    try {\n      const settingsPath = this.livePath('settings.json');\n      if (!(await pathExists(settingsPath))) {\n        return null;\n      }\n      const doc = await readJsonFile<Record<string, unknown>>(settingsPath);\n      const security = doc.security as Record<string, unknown> | undefined;\n      if (!security || typeof security !== 'object') {\n        return null;\n      }\n      return { security: { ...security } };\n    } catch {\n      return null;\n    }\n  }\n\n  private async mergeAuthSettings(slice: Record<string, unknown>): Promise<void> {\n    const settingsPath = this.livePath('settings.json');\n    let doc: Record<string, unknown> = {};\n    if (await pathExists(settingsPath)) {\n      try {\n        doc = await readJsonFile<Record<string, unknown>>(settingsPath);\n      } catch {\n        doc = {};\n      }\n    }\n    if (slice.security && typeof slice.security === 'object') {\n      const existing =\n        doc.security && typeof doc.security === 'object'\n          ? (doc.security as Record<string, unknown>)\n          : {};\n      doc.security = {\n        ...existing,\n        ...(slice.security as Record<string, unknown>),\n      };\n    }\n    await writeJsonFile(settingsPath, doc, 0o600);\n  }\n}\n\nexport { readGeminiApiKeyFromEnvFile, upsertEnvFile } from './gemini-env';\n\nexport const geminiProvider = new GeminiProvider();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,IAAM,iBAAiB;CAAC;CAAQ;CAAoB;AAAsB;AAC1E,IAAM,4BAA4B;AAClC,IAAM,eAAe;;;;;;;AAQrB,eAAe,sBAAsB,KAAqC;CACxE,MAAM,QAAkB,CAAC;CAEzB,MAAM,YAAY,KAAK,KAAK,kBAAkB;CAC9C,IAAI,MAAM,WAAW,SAAS,GAC5B,IAAI;EACF,MAAM,QAAQ,MAAM,aAA0C,SAAS;EACvE,IAAI,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,GACtE,MAAM,KAAK,MAAM,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,cAAc,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG;CAE5F,QAAQ,CAER;CAGF,MAAM,MAAM,MAAM,4BAA4B,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;CACtF,IAAI,KACF,MAAM,KAAK,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG;CAGpE,OAAO,MAAM,SAAS,IAAI,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI;AACrD;;;;;AAMA,SAAS,oBAAoB,SAA+D;CAC1F,MAAM,eAAe,SAAS,OAAO,eAAe,KAAK;CACzD,OAAO,eACH,eAAe,WAAW,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,MAClF,KAAA;AACN;AAEA,IAAa,iBAAb,MAAgD;CA4C3B;CACA;CAGA;CAGA;CACA;CAnDnB,KAAc;CACd,OAAgB;CAChB,YAAqB;;CAErB,4BAAqC;CACrC,cAAuB;CACvB,mBAA4B;CAC5B,qBAA8B;;CAE9B,sBAA+B;CAE/B,MAAM,kBAAkB,aAAmE;EACzF,IAAI;GAEF,IAAI,MADc,4BAA4B,KAAK,aAAa,MAAM,CAAC,GAErE,OAAO,EAAE,SAAS,KAAK;GAEzB,OAAO;IACL,SAAS;IACT,MAAM;GACR;EACF,QAAQ;GACN,OAAO;IAAE,SAAS;IAAO,MAAM;GAA+C;EAChF;CACF;CAIA,eAAuC;EACrC,OAAO,uBAAuB;CAChC;;CAGA,iBAAoD;EAClD,OAAO;GACL,SAAS,CAAC,KAAK;GACf,MAAM,CAAC,KAAK;GACZ,QAAQ,CAAC,SAAS,MAAM;GACxB,OAAO,CAAC,SAAS,MAAM;EACzB;CACF;CAEA,YACE,OAAwB,QAAQ,GAChC,4BAEqB,gCACrB,+BAE0C,gCAC1C,8BAAuE,kCACvE,iCAAmG,kCACnG;EATiB,KAAA,OAAA;EACA,KAAA,4BAAA;EAGA,KAAA,+BAAA;EAGA,KAAA,8BAAA;EACA,KAAA,iCAAA;CAChB;CAEH,cAAc,SAAiC;EAC7C,OAAO,qBAAqB,OAAO;CACrC;CAEA,oBAAmC;EACjC,OAAO,eAAe,KAAK,IAAI,IAAI;CACrC;CAEA,MAAM,sBAAsB,KAA6D;EACvF,MAAM,CAAC,SAAS,GAAG,QAAQ,IAAI;EAC/B,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,UAAU,QAAQ,MAAM,WAAW,CAAC;EAC1C,MAAM,cACJ,QAAQ,gBAAgB,gBACxB,QAAQ,gBAAgB,iBACxB,QAAQ,gBAAgB,SACpB,QAAQ,cACR;EACN,MAAM,EAAE,QAAQ,aAAa,MAAM,kBAAkB;GACnD,MAAM;GACN,MAAM;GACN,SAAS,QAAQ;GACjB,UAAU,KAAK,KAAK,YAAY,QAAQ,WAAW;GACnD,kBAAkB,IAAI,SAAS,KAAK,YAAY,QAAQ,IAAI;GAC5D;GACA,sBACE,OAAO,QAAQ,yBAAyB,WAAW,QAAQ,uBAAuB,KAAA;GACpF,UAAU,OAAO,QAAQ,aAAa,WAAW,QAAQ,WAAW,KAAA;GACpE,oBACE,OAAO,QAAQ,uBAAuB,WAAW,QAAQ,qBAAqB,KAAA;GAChF,OAAO,IAAI;GACX,KAAK,IAAI;EACX,CAAC;EACD,OAAO;GAAE;GAAU,aAAa,qBAAqB,MAAM;EAAE;CAC/D;CAEA,IAAY,YAAoB;EAC9B,OAAO,QAAQ,IAAI,qBAAqB,KAAK,KAAK,MAAM,SAAS;CACnE;CAEA,SAAiB,MAAsB;EACrC,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;;CAGA,MAAc,mBAAqC;EACjD,OACG,MAAM,KAAK,kBAAkB,KAAO,MAAM,WAAW,KAAK,SAAS,kBAAkB,CAAC;CAE3F;;;;;;;;;CAUA,MAAc,oBAAkE;EAC9E,IAAI,MAAM,KAAK,iBAAiB,GAC9B,OAAO;EAET,OAAQ,MAAM,4BAA4B,IAAK,gBAAgB;CACjE;CAEA,MAAM,aAAsC;EAC1C,MAAM,MAAM,MAAM,KAAK,oBAAoB;EAC3C,IAAI,IAAI,SACN,OAAO;EAGT,IAAI,CAAE,MAAM,4BAA4B,GACtC,OAAO,EAAE,SAAS,MAAM;EAK1B,OAAO;GACL,SAAS;GACT,UAAU,oBAAoB,MAHV,KAAK,+BAA+B,CAAC,CAAC,YAAY,IAAI,CAGrC;GACrC,SAAS;EACX;CACF;CAEA,MAAc,sBAA+C;EAC3D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAC5C,MAAM,WAAW,MAAM,WAAW,KAAK,SAAS,kBAAkB,CAAC;EACnE,IAAI,CAAC,UAAU,CAAC,UACd,OAAO,EAAE,SAAS,MAAM;EAG1B,MAAM,WAAW,MAAM,KAAK,aAAa;EACzC,MAAM,UAAoB,CAAC;EAC3B,IAAI,UACF,QAAQ,KAAK,OAAO;EAEtB,IAAI,QACF,QAAQ,KAAK,SAAS;EAExB,MAAM,WAAW,MAAM,KAAK,qBAAqB;EACjD,IAAI,UACF,QAAQ,KAAK,QAAQ;EAGvB,OAAO;GACL,SAAS;GACT;GACA,SAAS,QAAQ,KAAK,IAAI;EAC5B;CACF;;;;;;;CAQA,MAAM,sBAAsB,gBAAkD;EAC5E,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,GACnD,MAAM,IAAI,aACR,6CAA6C,QAAQ,SAAS,QAC9D,cACF;EAEF,IAAI;GACF,MAAM,QAAQ,MAAM,gCAAgC,cAAc;GAClE,IAAI,CAAC,OACH,OAAO,EAAE,SAAS,MAAM;GAK1B,OAAO;IAAE,SAAS;IAAM,UAHP,MAAM,gBACnB,oBAAoB,EAAE,OAAO,EAAE,eAAe,MAAM,cAAc,EAAE,CAAC,IACrE,KAAA;IAC8B,SAAS;GAAoB;EACjE,QAAQ;GACN,OAAO,EAAE,SAAS,MAAM;EAC1B;CACF;;;;;;;;;;CAWA,MAAM,kBACJ,SACA,gBACqE;EACrE,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,GACnD,MAAM,IAAI,aACR,6CAA6C,QAAQ,SAAS,QAC9D,cACF;EAEF,MAAM,UAAU,MAAM,4BAA4B,cAAc;EAChE,IAAI,CAAC,SACH,MAAM,IAAI,aACR,0EACA,cACF;EAEF,MAAM,UAAU,OAAO;EACvB,MAAM,cAAc,KAAK,SAAS,yBAAyB,GAAG,SAAS,GAAK;EAC5E,OAAO;GAAE,UAAU,oBAAoB,OAAO;GAAG,OAAO;EAAoB;CAC9E;CAEA,MAAM,iBAAiB,QAAyC;EAG9D,OAAO,WAAW,gBAAgB,KAAK,sBAAsB,IAAI,KAAK,oBAAoB;CAC5F;CAEA,MAAM,aACJ,QACA,SACqE;EACrE,OAAO,WAAW,gBAAgB,KAAK,kBAAkB,OAAO,IAAI,KAAK,OAAO,OAAO;CACzF;CAEA,MAAM,gBAAgB,QAA+B;EACnD,OAAO,WAAW,gBAAgB,KAAK,qBAAqB,IAAI,KAAK,UAAU;CACjF;;;;;;CAOA,MAAM,uBAAsC;EAC1C,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,aACR,6CAA6C,QAAQ,SAAS,QAC9D,cACF;EAEF,MAAM,iCAAiC;CACzC;CAEA,MAAM,OACJ,SACqE;EAIrE,IAAK,MAAM,KAAK,kBAAkB,MAAO,eACvC,OAAO,KAAK,kBAAkB,OAAO;EAEvC,MAAM,UAAU,OAAO;EACvB,IAAI,SAAS;EAEb,KAAK,MAAM,QAAQ,gBAEjB,IAAI,MADa,aAAa,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAEpE,UAAU;EAKd,MAAM,eAAe,MAAM,KAAK,sBAAsB;EACtD,IAAI,cAAc;GAChB,MAAM,cAAc,KAAK,SAAS,oBAAoB,GAAG,cAAc,GAAK;GAC5E,UAAU;EACZ;EAEA,IAAI,WAAW,GACb,MAAM,IAAI,aACR,+FACA,cACF;EAIF,MAAM,UACH,MAAM,WAAW,KAAK,SAAS,MAAM,CAAC,KACtC,MAAM,WAAW,KAAK,SAAS,kBAAkB,CAAC;EACrD,IAAI,CAAC,SACH,MAAM,IAAI,aACR,8FACA,cACF;EAIF,OAAO;GACL,UAFgB,MAAM,oBAAoB,OAAO,KAAO,MAAM,KAAK,aAAa;GAGhF,OAAO,UAAU,KAAA,IAAY;EAC/B;CACF;CAEA,MAAM,QAAQ,QAA+B;EAC3C,MAAM,UAAU,KAAK,SAAS;EAC9B,IAAI,WAAW;EAEf,KAAK,MAAM,QAAQ,gBAAgB;GACjC,MAAM,MAAM,KAAK,QAAQ,IAAI;GAC7B,IAAI,MAAM,WAAW,GAAG,GAAG;IACzB,MAAM,aAAa,KAAK,KAAK,SAAS,IAAI,CAAC;IAC3C,YAAY;GACd,OAME,MAAM,GAAG,KAAK,SAAS,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;EAEjE;EAEA,MAAM,gBAAgB,KAAK,QAAQ,oBAAoB;EACvD,IAAI,MAAM,WAAW,aAAa,GAChC,IAAI;GACF,MAAM,QAAQ,MAAM,aAAsC,aAAa;GACvE,MAAM,KAAK,kBAAkB,KAAK;GAClC,YAAY;EACd,QAAQ,CAER;EAOF,MAAM,sBAAsB,KAAK,QAAQ,yBAAyB;EAClE,IAAI,MAAM,WAAW,mBAAmB,GAAG;GACzC,MAAM,KAAK,mBAAmB,mBAAmB;GACjD,YAAY;EACd,OAAO,IAAI,6BAA6B,GAKtC,MAAM,KAAK,4BAA4B,CAAC,CAAC,YAAY,CAAC,CAAC;EAGzD,IAAI,aAAa,GACf,MAAM,IAAI,aAAa,qCAAqC,UAAU,kBAAkB;CAE5F;;;;;;CAOA,MAAM,iBAAiB,QAA+B;EACpD,MAAM,eAAe,KAAK,QAAQ,yBAAyB;EAC3D,IAAI,CAAE,MAAM,WAAW,YAAY,GACjC;EAEF,MAAM,UAAU,MAAM,4BAA4B,YAAY;EAC9D,IAAI,CAAC,SACH,MAAM,IAAI,aACR,6EACA,4BACF;EAEF,IAAI;GACF,MAAM,mCAAmC,EAAE,iBAAiB,QAAQ,CAAC;EACvE,SAAS,KAAK;GACZ,IAAI,eAAe,SAAS,0BAA0B,KAAK,IAAI,OAAO,GACpE,MAAM,IAAI,aAAa,8BAA8B;IACnD,MAAM;IACN,aAAa,CAAC,yEAAyE;GACzF,CAAC;GAEH,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,QAAoE;EAC3F,IAAI,CAAE,MAAM,WAAW,KAAK,QAAQ,yBAAyB,CAAC,GAC5D,OAAO;EAET,OAAO;GACL,MAAM;GACN,SAAS,MAAM,8BAA8B;EAC/C;CACF;CAEA,MAAM,cAAc,QAAuD;EACzE,OAAQ,MAAM,WAAW,KAAK,QAAQ,yBAAyB,CAAC,IAC5D;GAAE,IAAI;GAAe,MAAM;EAAc,IACzC;GAAE,IAAI;GAAc,MAAM;EAAa;CAC7C;CAEA,MAAM,kBAAkB,MAA6D;EACnF,OAAO,KAAK,SAAS,YAAY,CAAC,CAAC,SAAS,aAAa,IACrD;GAAE,IAAI;GAAe,MAAM;EAAc,IACzC;GAAE,IAAI;GAAc,MAAM;EAAa;CAC7C;;CAGA,MAAc,mBAAmB,cAAqC;EACpE,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,aACR,gEAAgE,QAAQ,SAAS,IACjF,4BACF;EAEF,MAAM,UAAU,MAAM,4BAA4B,YAAY;EAC9D,IAAI,CAAC,SACH,MAAM,IAAI,aACR,6EACA,4BACF;EAKF,MAAM,KAAK,0BAA0B,MAAM,KAAK,6BAA6B,OAAO,CAAC;CACvF;;;;;CAMA,MAAM,YAA2B;EAC/B,IAAK,MAAM,KAAK,kBAAkB,MAAO,eAAe;GACtD,MAAM,KAAK,qBAAqB;GAChC;EACF;EACA,KAAK,MAAM,QAAQ,CAAC,oBAAoB,sBAAsB,GAC5D,MAAM,GAAG,KAAK,SAAS,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;EAI/D,MAAM,UAAU,KAAK,SAAS,MAAM;EACpC,IAAI,MAAM,WAAW,OAAO,GAAG;GAC7B,MAAM,OAAO,MAAM,iBAAiB,OAAO;GAC3C,IAAI,KAAK,KAAK,GACZ,MAAM,cAAc,SAAS,KAAK,SAAS,IAAI,IAAI,OAAO,GAAG,KAAK,KAAK,GAAK;QAE5E,MAAM,GAAG,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;EAErD;EAGA,IAAI;GACF,MAAM,eAAe,KAAK,SAAS,eAAe;GAClD,IAAI,MAAM,WAAW,YAAY,GAAG;IAClC,MAAM,MAAM,MAAM,aAAsC,YAAY;IACpE,MAAM,WACJ,IAAI,YAAY,OAAO,IAAI,aAAa,WACpC,EAAE,GAAI,IAAI,SAAqC,IAC/C,CAAC;IACP,IAAI,SAAS,QAAQ,OAAO,SAAS,SAAS,UAAU;KACtD,MAAM,OAAO,EAAE,GAAI,SAAS,KAAiC;KAC7D,OAAO,KAAK;KACZ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,WAAW,GAC/B,OAAO,SAAS;UAEhB,SAAS,OAAO;IAEpB;IACA,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,GACnC,OAAO,IAAI;SAEX,IAAI,WAAW;IAEjB,MAAM,cAAc,cAAc,KAAK,GAAK;GAC9C;EACF,QAAQ,CAER;CACF;CAIA,MAAM,WAAW,KAAyC;EACxD,OAAO,iBAAiB,KAAK;GAC3B,SAAS,KAAK;GACd,eAAe,KAAK;GACpB,aAAa;EACf,CAAC;CACH;CAEA,MAAM,UAAU,KAAkC;EAChD,MAAM,gBAAgB,GAAG;CAC3B;CAEA,MAAM,YAAY,KAAyC;EACzD,OAAO,kBAAkB,KAAK,KAAK,oBAAoB,YAAY;CACrE;CAEA,MAAM,cAAc,KAAmB,QAAQ,IAAqB;EAClE,OAAO,oBAAoB,KAAK,KAAK;CACvC;;;;;;;;;CAUA,MAAM,oBAAoB,aAAuC;EAC/D,IAAI,MAAM,WAAW,KAAK,aAAa,yBAAyB,CAAC,GAAG;GAIlE,MAAM,WAAW,MAAM,4BACrB,KAAK,aAAa,yBAAyB,CAC7C;GACA,MAAM,OAAO,MAAM,KAAK,+BAA+B,CAAC,CAAC,YAAY,IAAI;GACzE,MAAM,mBAAmB,oBAAoB,QAAQ;GACrD,MAAM,eAAe,oBAAoB,IAAI;GAC7C,IAAI,CAAC,oBAAoB,CAAC,cACxB,MAAM,IAAI,aACR,6EACA,kBACF;GAEF,OAAO,qBAAqB;EAC9B;EACA,MAAM,OAAO,MAAM,sBAAsB,WAAW;EACpD,IAAI,CAAC,MACH,OAAO;EAET,OAAO,SAAU,MAAM,sBAAsB,KAAK,SAAS;CAC7D;CAEA,MAAc,oBAAsC;EAClD,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,gBAAgB,KAAK,GAAG,CAG9E;EACA,MAAM,UAAU,KAAK,SAAS,MAAM;EACpC,IAAI,CAAE,MAAM,WAAW,OAAO,GAC5B,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,gBAAgB,KAAK,CAAC;EAEzF,IAAI;GACF,MAAM,MAAM,MAAM,SAAS,SAAS,MAAM;GAC1C,OAAO,oFAAoF,KACzF,GACF;EACF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAc,eAA4C;EACxD,OAAO,oBAAoB,KAAK,SAAS;CAC3C;CAEA,MAAc,uBAAoD;EAChE,IAAI;GACF,MAAM,eAAe,KAAK,SAAS,eAAe;GAClD,IAAI,CAAE,MAAM,WAAW,YAAY,GACjC;GAIF,MAAM,QADW,MADC,aAAsC,YAAY,EAAA,CAC/C,UACE;GACvB,OAAO,OAAO,MAAM,iBAAiB,WAAW,KAAK,eAAe,KAAA;EACtE,QAAQ;GACN;EACF;CACF;CAEA,MAAc,wBAAiE;EAC7E,IAAI;GACF,MAAM,eAAe,KAAK,SAAS,eAAe;GAClD,IAAI,CAAE,MAAM,WAAW,YAAY,GACjC,OAAO;GAGT,MAAM,YAAW,MADC,aAAsC,YAAY,EAAA,CAC/C;GACrB,IAAI,CAAC,YAAY,OAAO,aAAa,UACnC,OAAO;GAET,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE;EACrC,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAc,kBAAkB,OAA+C;EAC7E,MAAM,eAAe,KAAK,SAAS,eAAe;EAClD,IAAI,MAA+B,CAAC;EACpC,IAAI,MAAM,WAAW,YAAY,GAC/B,IAAI;GACF,MAAM,MAAM,aAAsC,YAAY;EAChE,QAAQ;GACN,MAAM,CAAC;EACT;EAEF,IAAI,MAAM,YAAY,OAAO,MAAM,aAAa,UAAU;GACxD,MAAM,WACJ,IAAI,YAAY,OAAO,IAAI,aAAa,WACnC,IAAI,WACL,CAAC;GACP,IAAI,WAAW;IACb,GAAG;IACH,GAAI,MAAM;GACZ;EACF;EACA,MAAM,cAAc,cAAc,KAAK,GAAK;CAC9C;AACF;AAIA,IAAa,iBAAiB,IAAI,eAAe"}

package/dist/providers/grok-proxy/auth.d.ts

@@ -0,0 +1,27 @@
+export interface GrokSession {
+    /** Access token (JWT) sent as Bearer to cli-chat-proxy. */
+    accessToken: string;
+    refreshToken: string;
+    expiresAt?: string;
+    email?: string;
+    oidcIssuer: string;
+    oidcClientId: string;
+    /** Map key in auth.json (issuer::clientId). */
+    storageKey: string;
+    raw: Record<string, unknown>;
+}
+export interface GrokAuthFile {
+    [key: string]: Record<string, unknown>;
+}
+export declare function loadGrokSession(authPath: string): Promise<GrokSession>;
+export declare function isExpired(session: GrokSession, now?: number): boolean;
+/**
+ * Ensure a valid access token, refreshing via OIDC if needed.
+ * Writes refreshed tokens back to authPath so Grok CLI stays in sync.
+ */
+export declare function ensureAccessToken(authPath: string, session?: GrokSession): Promise<{
+    token: string;
+    session: GrokSession;
+}>;
+export declare function refreshSession(authPath: string, session: GrokSession): Promise<GrokSession>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/providers/grok-proxy/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/providers/grok-proxy/auth.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAID,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAuC5E;AAeD,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,SAAa,GAAG,OAAO,CASzE;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC,CAUlD;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBjG"}