dsh-agy 0.1.0

package/lib/session-tawi2_uh.mjs

@@ -0,0 +1,1221 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import lockfile from "proper-lockfile";
+//#region src/oauth/constants.ts
+var constants_exports = /* @__PURE__ */ __exportAll({
+	AGY_CLIENT_ID: () => AGY_CLIENT_ID,
+	AGY_CLIENT_SECRET: () => AGY_CLIENT_SECRET,
+	AGY_DEFAULT_REDIRECT_URI: () => AGY_DEFAULT_REDIRECT_URI,
+	AGY_ENDPOINT_AUTOPUSH: () => AGY_ENDPOINT_AUTOPUSH,
+	AGY_ENDPOINT_DAILY: () => AGY_ENDPOINT_DAILY,
+	AGY_ENDPOINT_DAILY_SANDBOX: () => AGY_ENDPOINT_DAILY_SANDBOX,
+	AGY_ENDPOINT_FALLBACKS: () => AGY_ENDPOINT_FALLBACKS,
+	AGY_ENDPOINT_PROD: () => AGY_ENDPOINT_PROD,
+	AGY_ENDPOINT_SKIP_STATUSES: () => AGY_ENDPOINT_SKIP_STATUSES,
+	AGY_SCOPES: () => AGY_SCOPES,
+	AGY_VERSION_FALLBACK: () => AGY_VERSION_FALLBACK,
+	OAUTH_AUTHORIZE_URL: () => OAUTH_AUTHORIZE_URL,
+	OAUTH_TOKEN_URL: () => OAUTH_TOKEN_URL,
+	OAUTH_USERINFO_URL: () => OAUTH_USERINFO_URL,
+	fetchAgyFirstOk: () => fetchAgyFirstOk,
+	getAgyBootstrapClientMetadata: () => getAgyBootstrapClientMetadata,
+	getAgyBootstrapUserAgent: () => getAgyBootstrapUserAgent
+});
+/**
+* Antigravity (agy) OAuth and API constants.
+*
+* The client id/secret below are the public Google consumer-OAuth credentials
+* shipped inside the Antigravity desktop product and its `agy` CLI; they are
+* embedded in many public tools (see NOTICE.md). They are not secrets owned by
+* this project.
+*/
+const AGY_CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
+const AGY_CLIENT_SECRET = "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";
+/** Required scopes. `openid` must NOT be added: it routes Google into the hanging
+* `firstparty/nativeapp` consent for this client (verified by OmniRoute). */
+const AGY_SCOPES = [
+	"https://www.googleapis.com/auth/cloud-platform",
+	"https://www.googleapis.com/auth/userinfo.email",
+	"https://www.googleapis.com/auth/userinfo.profile",
+	"https://www.googleapis.com/auth/cclog",
+	"https://www.googleapis.com/auth/experimentsandconfigs"
+];
+const OAUTH_AUTHORIZE_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const OAUTH_USERINFO_URL = "https://www.googleapis.com/oauth2/v1/userinfo";
+/** Default loopback callback used by the standalone CLI listener (fixed port, like opencode). */
+const AGY_DEFAULT_REDIRECT_URI = "http://localhost:51121/oauth-callback";
+/**
+* Antigravity API endpoints. The daily runtime host (no .sandbox suffix) is the
+* live endpoint for consumer OAuth accounts — cloudcode-pa.googleapis.com
+* answers RESOURCE_EXHAUSTED for them (verified by live probe), while the
+* daily host answers 200. Order matters: first reachable non-429/403 wins.
+*/
+const AGY_ENDPOINT_DAILY = "https://daily-cloudcode-pa.googleapis.com";
+const AGY_ENDPOINT_PROD = "https://cloudcode-pa.googleapis.com";
+const AGY_ENDPOINT_DAILY_SANDBOX = "https://daily-cloudcode-pa.sandbox.googleapis.com";
+const AGY_ENDPOINT_AUTOPUSH = "https://autopush-cloudcode-pa.sandbox.googleapis.com";
+/** Runtime/bootstrap endpoint fallback order (daily first, mirroring OmniRoute). */
+const AGY_ENDPOINT_FALLBACKS = [
+	AGY_ENDPOINT_DAILY,
+	AGY_ENDPOINT_PROD,
+	AGY_ENDPOINT_DAILY_SANDBOX,
+	AGY_ENDPOINT_AUTOPUSH
+];
+/** Statuses that mean "this endpoint is not usable for this account"; skip to the next. */
+const AGY_ENDPOINT_SKIP_STATUSES = /* @__PURE__ */ new Set([429, 403]);
+/**
+* Try each runtime endpoint in order, skipping unusable ones (429/403/network).
+* Returns the first other response (2xx or a real error like 400/401); when
+* every endpoint is unusable, returns the last skipped response so the caller's
+* classifier can still produce a meaningful error.
+*/
+async function fetchAgyFirstOk(urlPath, init, fetchImpl = fetch) {
+	let lastSkipped = null;
+	for (const baseEndpoint of AGY_ENDPOINT_FALLBACKS) try {
+		const response = await fetchImpl(`${baseEndpoint}${urlPath}`, init);
+		if (!AGY_ENDPOINT_SKIP_STATUSES.has(response.status)) return response;
+		lastSkipped = response;
+	} catch {}
+	if (lastSkipped) return lastSkipped;
+	throw new Error("all agy endpoints failed");
+}
+/** Default Antigravity client version used in User-Agent strings; overridden by the
+* runtime version fetcher (see runtime/fingerprint.ts). */
+const AGY_VERSION_FALLBACK = "1.18.3";
+/** Electron-style UA used for bootstrap calls (loadCodeAssist/onboardUser). */
+function getAgyBootstrapUserAgent(version = AGY_VERSION_FALLBACK) {
+	return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Antigravity/${version} Chrome/138.0.7204.235 Electron/37.3.1 Safari/537.36`;
+}
+/** Client-Metadata payload for bootstrap calls. */
+function getAgyBootstrapClientMetadata(platform = process.platform) {
+	return `{"ideType":"ANTIGRAVITY","platform":"${platform === "win32" ? "WINDOWS" : "MACOS"}","pluginType":"GEMINI"}`;
+}
+//#endregion
+//#region src/runtime/identity.ts
+/**
+* Antigravity request/session identity generation (mirrors the active
+* OmniRoute implementation; the archived reference stopped maintaining these).
+*/
+/** One request id per upstream call: `agent/<epoch>/<8 hex>`. */
+function generateAntigravityRequestId() {
+	return `agent/${Date.now()}/${randomBytes(4).toString("hex")}`;
+}
+const FNV_OFFSET_I64 = -3750763044362895579n;
+const FNV_PRIME_I64 = 1099511628211n;
+/** 64-bit FNV-1a hash of a string (stable across processes). */
+function fnv1a64(input) {
+	let hash = FNV_OFFSET_I64;
+	for (let i = 0; i < input.length; i++) {
+		hash ^= BigInt(input.charCodeAt(i));
+		hash = BigInt.asIntN(64, hash * FNV_PRIME_I64);
+	}
+	return hash;
+}
+/**
+* Stable per-account session id: same account always derives the same id, so
+* multi-turn context caching keys consistently; unknown accounts get a fresh
+* random id.
+*/
+function deriveAntigravitySessionId(accountKey) {
+	if (!accountKey || accountKey.trim().length === 0) return null;
+	const hash = fnv1a64(accountKey.trim());
+	return `-${((hash < 0n ? -hash : hash) % 9000000000000000000n).toString()}`;
+}
+//#endregion
+//#region src/runtime/version.ts
+/**
+* Fresh Antigravity client version resolution: fetch from the product's own
+* release feeds (6h TTL, single in-flight dedupe), falling back to the pinned
+* pool. Keeps fingerprint User-Agent version strings current — a stale version
+* is the most detectable fingerprint anomaly.
+*/
+const VERSION_CACHE_TTL_MS = 216e5;
+const VERSION_FETCH_TIMEOUT_MS = 5e3;
+/** Source 1: Antigravity IDE auto-update release feed (array of {version}). */
+const IDE_RELEASE_FEED_URL = "https://antigravity-auto-updater-974169037036.us-central1.run.app/releases";
+/** Source 2: agy CLI GitHub releases (object with tag_name). */
+const CLI_RELEASE_URL = "https://api.github.com/repos/google-antigravity/antigravity-cli/releases/latest";
+function compareSemver(a, b) {
+	const pa = a.split(".").map((n) => Number(n) || 0);
+	const pb = b.split(".").map((n) => Number(n) || 0);
+	for (let i = 0; i < 3; i++) {
+		const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+}
+function pickNewestVersion(...versions) {
+	const valid = versions.filter((v) => typeof v === "string" && /^\d+\.\d+\.\d+$/.test(v));
+	if (valid.length === 0) return null;
+	return valid.reduce((best, v) => !best || compareSemver(v, best) > 0 ? v : best, null);
+}
+function parseIdeReleaseFeed(payload) {
+	if (!Array.isArray(payload)) return null;
+	return pickNewestVersion(...payload.map((entry) => entry?.version));
+}
+function parseCliRelease(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const release = payload;
+	return pickNewestVersion(release.tag_name ?? release.name);
+}
+async function fetchJsonWithTimeout(fetchImpl, url) {
+	const controller = new AbortController();
+	const timeoutId = setTimeout(() => controller.abort(), VERSION_FETCH_TIMEOUT_MS);
+	try {
+		const response = await fetchImpl(url, {
+			headers: {
+				Accept: "application/json",
+				"User-Agent": "dsh-agy/0.1"
+			},
+			signal: controller.signal
+		});
+		if (!response.ok) throw new Error(`Version source ${url} returned ${response.status}`);
+		return response.json();
+	} finally {
+		clearTimeout(timeoutId);
+	}
+}
+async function resolveProductVersion(state, fallback, sourceUrl, parse, fetchImpl) {
+	const now = Date.now();
+	if (state.cache && now - state.cache.fetchedAt < VERSION_CACHE_TTL_MS) return pickNewestVersion(state.cache.version, fallback) ?? fallback;
+	if (state.inFlight) return state.inFlight;
+	state.inFlight = (async () => {
+		let resolved = null;
+		try {
+			resolved = parse(await fetchJsonWithTimeout(fetchImpl, sourceUrl));
+		} catch {
+			resolved = null;
+		}
+		const version = pickNewestVersion(resolved, state.cache?.version, fallback) ?? fallback;
+		if (resolved) state.cache = {
+			version,
+			fetchedAt: Date.now()
+		};
+		return version;
+	})();
+	try {
+		return await state.inFlight;
+	} finally {
+		state.inFlight = null;
+	}
+}
+/** Resolve the newest known Antigravity version from the IDE feed. */
+function resolveAntigravityIdeVersion(fetchImpl = fetch) {
+	return resolveProductVersion(ideState, AGY_VERSION_FALLBACK, IDE_RELEASE_FEED_URL, parseIdeReleaseFeed, fetchImpl);
+}
+/** Resolve the newest known Antigravity version from the CLI releases. */
+function resolveAntigravityCliVersion(fetchImpl = fetch) {
+	return resolveProductVersion(cliState, AGY_VERSION_FALLBACK, CLI_RELEASE_URL, parseCliRelease, fetchImpl);
+}
+/** Best available version: newest of both sources, cached 6h. */
+async function resolveAntigravityVersion(fetchImpl = fetch) {
+	const [ide, cli] = await Promise.all([resolveAntigravityIdeVersion(fetchImpl), resolveAntigravityCliVersion(fetchImpl)]);
+	return pickNewestVersion(ide, cli) ?? "1.18.3";
+}
+/**
+* Bounded resolve for fingerprint generation: never block the failure path on
+* cold version feeds. Resolves undefined on timeout/error so callers fall
+* back to the pinned version pool; the abandoned fetch keeps running and
+* populates the 6h cache for later calls.
+*/
+async function resolveAntigravityVersionBounded(timeoutMs = 750) {
+	let timer;
+	try {
+		return await Promise.race([resolveAntigravityVersion().catch(() => void 0), new Promise((resolve) => {
+			timer = setTimeout(() => resolve(void 0), timeoutMs);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Synchronously peek at a fresh cached version (no network). */
+function peekCachedAntigravityVersion() {
+	const now = Date.now();
+	for (const state of [ideState, cliState]) if (state.cache && now - state.cache.fetchedAt < VERSION_CACHE_TTL_MS) return state.cache.version;
+}
+const ideState = { inFlight: null };
+const cliState = { inFlight: null };
+//#endregion
+//#region src/oauth/auth.ts
+const ACCESS_TOKEN_EXPIRY_BUFFER_MS = 6e4;
+/** Split the packed refresh string into its constituent refresh token and project ids. */
+function parseRefreshParts(refresh) {
+	const [refreshToken = "", projectId = "", managedProjectId = ""] = (refresh ?? "").split("|");
+	return {
+		refreshToken: refreshToken || void 0,
+		projectId: projectId || void 0,
+		managedProjectId: managedProjectId || void 0
+	};
+}
+/** Serialize refresh token parts into the stored string format. */
+function formatRefreshParts(parts) {
+	const projectSegment = parts.projectId ?? "";
+	const base = `${parts.refreshToken ?? ""}|${projectSegment}`;
+	return parts.managedProjectId ? `${base}|${parts.managedProjectId}` : base;
+}
+/** Whether the access token is expired or missing, with a buffer for clock skew. */
+function accessTokenExpired(auth) {
+	if (!auth.access || typeof auth.expires !== "number") return true;
+	return auth.expires <= Date.now() + ACCESS_TOKEN_EXPIRY_BUFFER_MS;
+}
+/** Absolute expiry timestamp from a duration; malformed durations expire immediately. */
+function calculateTokenExpiry(requestTimeMs, expiresInSeconds) {
+	const seconds = typeof expiresInSeconds === "number" ? expiresInSeconds : 3600;
+	if (Number.isNaN(seconds) || seconds <= 0) return requestTimeMs;
+	return requestTimeMs + seconds * 1e3;
+}
+//#endregion
+//#region src/oauth/refresh.ts
+var AgyTokenRefreshError = class extends Error {
+	code;
+	description;
+	status;
+	statusText;
+	constructor(options) {
+		super(options.message);
+		this.name = "AgyTokenRefreshError";
+		this.code = options.code;
+		this.description = options.description;
+		this.status = options.status;
+		this.statusText = options.statusText;
+	}
+};
+/** Parse Google token-endpoint error payloads, tolerating varied shapes. */
+function parseOAuthErrorPayload(text) {
+	if (!text) return {};
+	try {
+		const payload = JSON.parse(text);
+		if (!payload || typeof payload !== "object") return { description: text };
+		let code;
+		if (typeof payload.error === "string") code = payload.error;
+		else if (payload.error && typeof payload.error === "object") {
+			code = payload.error.status ?? payload.error.code;
+			if (!payload.error_description && payload.error.message) return {
+				code,
+				description: payload.error.message
+			};
+		}
+		const description = payload.error_description;
+		if (description) return {
+			code,
+			description
+		};
+		if (payload.error && typeof payload.error === "object" && payload.error.message) return {
+			code,
+			description: payload.error.message
+		};
+		return { code };
+	} catch {
+		return { description: text };
+	}
+}
+/**
+* Refresh the access token for an account. `revoked` means Google rejected the
+* refresh token (`invalid_grant`) — the account must be re-authenticated.
+*/
+async function refreshAccessToken(auth) {
+	const parts = parseRefreshParts(auth.refresh);
+	if (!parts.refreshToken) return {
+		type: "failed",
+		error: new AgyTokenRefreshError({
+			message: "Missing refresh token",
+			status: 400,
+			statusText: "Bad Request"
+		})
+	};
+	try {
+		const startTime = Date.now();
+		const response = await fetch(OAUTH_TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: parts.refreshToken,
+				client_id: AGY_CLIENT_ID,
+				client_secret: AGY_CLIENT_SECRET
+			})
+		});
+		if (!response.ok) {
+			const errorText = await response.text().catch(() => void 0);
+			const { code, description } = parseOAuthErrorPayload(errorText);
+			const details = [code, description ?? errorText].filter(Boolean).join(": ");
+			const baseMessage = `Agy token refresh failed (${response.status} ${response.statusText})`;
+			const message = details ? `${baseMessage} - ${details}` : baseMessage;
+			if (code === "invalid_grant") return { type: "revoked" };
+			return {
+				type: "failed",
+				error: new AgyTokenRefreshError({
+					message,
+					code,
+					description: description ?? errorText,
+					status: response.status,
+					statusText: response.statusText
+				})
+			};
+		}
+		const payload = await response.json();
+		const refreshedParts = {
+			refreshToken: payload.refresh_token ?? parts.refreshToken,
+			projectId: parts.projectId,
+			managedProjectId: parts.managedProjectId
+		};
+		return {
+			type: "success",
+			auth: {
+				access: payload.access_token,
+				expires: calculateTokenExpiry(startTime, payload.expires_in),
+				refresh: formatRefreshParts(refreshedParts)
+			}
+		};
+	} catch (error) {
+		if (error instanceof AgyTokenRefreshError) throw error;
+		return {
+			type: "failed",
+			error: new AgyTokenRefreshError({
+				message: error instanceof Error ? error.message : "Unknown refresh error",
+				status: 0,
+				statusText: ""
+			})
+		};
+	}
+}
+//#endregion
+//#region src/store/keyring.ts
+/**
+* Master-key management and AES-256-GCM secret codec for the account store.
+*
+* The master key lives in the DSH credentials document (`~/.dsh/.credentials.yaml`,
+* 0600) under `AGY_MASTER_KEY` so both the in-harness plugin (via
+* `ctx.credentials`) and the standalone `dsh-agy` CLI (direct file read) can
+* encrypt and decrypt the same account store.
+*/
+const MASTER_KEY_REF = "AGY_MASTER_KEY";
+const ENC_PREFIX$1 = "enc:v1:";
+/** AES-256-GCM codec; ciphertext format `enc:v1:<iv-b64>:<tag-b64>:<data-b64>`. */
+function createAesGcmCodec(key) {
+	if (key.length !== 32) throw new Error(`createAesGcmCodec: master key must be 32 bytes, got ${key.length}`);
+	return {
+		encrypt(plaintext) {
+			const iv = randomBytes(12);
+			const cipher = createCipheriv("aes-256-gcm", key, iv);
+			const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+			const tag = cipher.getAuthTag();
+			return `${ENC_PREFIX$1}${iv.toString("base64url")}:${tag.toString("base64url")}:${data.toString("base64url")}`;
+		},
+		decrypt(payload) {
+			if (!payload.startsWith(ENC_PREFIX$1)) throw new Error("decrypt: payload is not in encrypted format");
+			const [, , ivB64 = "", tagB64 = "", dataB64 = ""] = payload.split(":");
+			const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivB64, "base64url"));
+			decipher.setAuthTag(Buffer.from(tagB64, "base64url"));
+			return Buffer.concat([decipher.update(Buffer.from(dataB64, "base64url")), decipher.final()]).toString("utf8");
+		}
+	};
+}
+/** Derive a 32-byte key from an arbitrary master-key string (SHA-256). */
+function deriveKey(masterKey) {
+	return createHash("sha256").update(masterKey, "utf8").digest();
+}
+/** Default DSH home (`~/.dsh`), honoring `$DSH_HOME`. */
+function resolveDshHome() {
+	return process.env.DSH_HOME ? resolve(process.env.DSH_HOME) : join(homedir(), ".dsh");
+}
+function homedir() {
+	return process.env.HOME ?? process.env.USERPROFILE ?? ".";
+}
+/**
+* Minimal reader for the DSH credentials document: a flat YAML mapping of
+* `KEY: "value"` / `KEY: value` lines. Values are unquoted with JSON-style
+* escaping for double-quoted scalars; anything more complex fails loudly.
+*/
+function readCredentialsDocument(file) {
+	if (!existsSync(file)) return /* @__PURE__ */ new Map();
+	const entries = /* @__PURE__ */ new Map();
+	const text = readFileSync(file, "utf8");
+	for (const line of text.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("---")) continue;
+		const match = /^([A-Za-z_][A-Za-z0-9_]*):\s*(.*)$/.exec(trimmed);
+		if (!match) continue;
+		const [, key = "", rawValue = ""] = match;
+		let value;
+		if (rawValue.startsWith("\"")) try {
+			value = JSON.parse(rawValue);
+		} catch {
+			throw new Error(`readCredentialsDocument: invalid quoted value for "${key}" in ${file}`);
+		}
+		else if (rawValue.startsWith("'")) {
+			if (!rawValue.endsWith("'") || rawValue.length < 2) throw new Error(`readCredentialsDocument: unterminated single-quoted value for "${key}" in ${file}`);
+			value = rawValue.slice(1, -1).replace(/''/g, "'");
+		} else value = rawValue;
+		if (value.length === 0) continue;
+		entries.set(key, value);
+	}
+	return entries;
+}
+/**
+* POSIX owner-only enforcement. Windows mode bits never report 0600 (and
+* chmod is a no-op there), so the check is skipped on win32; the encrypted
+* account file and credentials document remain the only defense-in-depth
+* layer on that platform.
+*/
+function assertOwnerOnly(file) {
+	if (process.platform === "win32") return;
+	const mode = statSync(file).mode & 511;
+	if (mode !== 384) throw new Error(`dsh-agy: ${file} is readable beyond its owner (mode ${mode.toString(8)}); run "chmod 600" before starting again`);
+}
+/**
+* Load the master key from the DSH credentials document. Returns undefined when
+* the document or the reference is absent.
+*/
+function loadMasterKey(dshHome) {
+	const file = join(dshHome, ".credentials.yaml");
+	if (!existsSync(file)) return void 0;
+	assertOwnerOnly(file);
+	return readCredentialsDocument(file).get(MASTER_KEY_REF);
+}
+/**
+* Generate and persist a fresh master key (0600) in the DSH credentials document.
+*
+* Append-only + atomic rename: the DSH credentials service owns this file and
+* preserves comments and the formatting of untouched entries (and may hold
+* YAML constructs this minimal reader cannot parse). Rewriting the whole file
+* from our parsed view would silently drop those; appending keeps them.
+*/
+function persistMasterKey(dshHome, masterKey) {
+	const file = join(dshHome, ".credentials.yaml");
+	mkdirSync(dirname(file), { recursive: true });
+	const existingText = existsSync(file) ? readFileSync(file, "utf8") : "";
+	if (existingText.length > 0 && readCredentialsDocument(file).has("AGY_MASTER_KEY")) throw new Error(`persistMasterKey: ${MASTER_KEY_REF} already exists in ${file}`);
+	const entry = `${MASTER_KEY_REF}: ${JSON.stringify(masterKey)}`;
+	const next = existingText.length > 0 && !existingText.endsWith("\n") ? `${existingText}\n${entry}\n` : `${existingText}${entry}\n`;
+	const tmp = `${file}.tmp-masterkey`;
+	writeFileSync(tmp, next, { mode: 384 });
+	renameSync(tmp, file);
+}
+/**
+* Resolve (load or create) the master key for a dsh home, then build the codec.
+* Creating a key writes the credentials document; read-only setups should call
+* {@link loadMasterKey} first and surface a friendly error instead.
+*/
+function resolveMasterKeyCodec(dshHome) {
+	let masterKey = loadMasterKey(dshHome);
+	let created = false;
+	if (!masterKey) {
+		masterKey = randomBytes(32).toString("hex");
+		persistMasterKey(dshHome, masterKey);
+		created = true;
+	}
+	return {
+		codec: createAesGcmCodec(deriveKey(masterKey)),
+		created
+	};
+}
+const ENC_PREFIX = "enc:v1:";
+const properFileLock = { async withLock(file, fn) {
+	const release = await lockfile.lock(file, {
+		stale: 3e4,
+		update: 1e4,
+		retries: {
+			retries: 10,
+			factor: 1.5,
+			minTimeout: 50,
+			maxTimeout: 2e3
+		}
+	});
+	try {
+		return await fn();
+	} finally {
+		await release();
+	}
+} };
+function isEncrypted(value) {
+	return value.startsWith(ENC_PREFIX);
+}
+/** Decrypt one account's refresh field when encrypted; plaintext passes through (legacy). */
+function decryptAccount(account, codec) {
+	if (isEncrypted(account.refresh)) return {
+		...account,
+		refresh: codec.decrypt(account.refresh)
+	};
+	return account;
+}
+/** Encrypt one account's refresh field (plaintext stays plaintext if no codec change). */
+function encryptAccount(account, codec) {
+	if (!isEncrypted(account.refresh)) return {
+		...account,
+		refresh: codec.encrypt(account.refresh)
+	};
+	return account;
+}
+function decryptStorage(storage, codec) {
+	return {
+		...storage,
+		accounts: storage.accounts.map((a) => decryptAccount(a, codec))
+	};
+}
+function encryptStorage(storage, codec) {
+	return {
+		...storage,
+		accounts: storage.accounts.map((a) => encryptAccount(a, codec))
+	};
+}
+function migrateV1ToV2(v1) {
+	return {
+		version: 2,
+		accounts: v1.accounts.map((acc) => ({
+			email: acc.email,
+			refreshToken: acc.refreshToken,
+			projectId: acc.projectId,
+			managedProjectId: acc.managedProjectId,
+			addedAt: acc.addedAt,
+			lastUsed: acc.lastUsed,
+			lastSwitchReason: acc.lastSwitchReason,
+			rateLimitResetTimes: acc.isRateLimited && acc.rateLimitResetTime ? { default: acc.rateLimitResetTime } : void 0
+		})),
+		activeIndex: v1.activeIndex
+	};
+}
+function migrateV2ToV3(v2) {
+	return {
+		version: 3,
+		accounts: v2.accounts.map((acc) => ({
+			email: acc.email,
+			refresh: `${acc.refreshToken}|${acc.projectId ?? ""}|${acc.managedProjectId ?? ""}`,
+			projectId: acc.projectId,
+			managedProjectId: acc.managedProjectId,
+			addedAt: acc.addedAt,
+			lastUsed: acc.lastUsed,
+			enabled: true,
+			lastSwitchReason: acc.lastSwitchReason,
+			rateLimitResetTimes: acc.rateLimitResetTimes
+		})),
+		activeIndex: v2.activeIndex
+	};
+}
+function migrateV3ToV4(v3) {
+	return {
+		version: 4,
+		accounts: v3.accounts,
+		activeIndex: v3.activeIndex
+	};
+}
+function migrateStorage(raw) {
+	switch (raw.version) {
+		case 1: return migrateStorage(migrateV1ToV2(raw));
+		case 2: return migrateStorage(migrateV2ToV3(raw));
+		case 3: return migrateStorage(migrateV3ToV4(raw));
+		case 4: return raw;
+		default: throw new Error(`migrateStorage: unsupported storage version ${raw.version}`);
+	}
+}
+var JsonAccountStore = class {
+	file;
+	codec;
+	lock;
+	constructor(options) {
+		this.file = options.file;
+		this.codec = options.codec;
+		this.lock = options.lock ?? properFileLock;
+	}
+	/**
+	* Ensure the store document exists before locking: proper-lockfile resolves
+	* the target's realpath and fails with ENOENT when it is absent.
+	*/
+	ensureFile() {
+		if (existsSync(this.file)) return;
+		mkdirSync(dirname(this.file), { recursive: true });
+		const tmp = `${this.file}.tmp-init`;
+		writeFileSync(tmp, JSON.stringify({
+			version: 4,
+			accounts: [],
+			activeIndex: 0
+		}) + "\n", { mode: 384 });
+		renameSync(tmp, this.file);
+	}
+	async load() {
+		let text;
+		try {
+			text = readFileSync(this.file, "utf8");
+		} catch (error) {
+			if (error.code === "ENOENT") return {
+				version: 4,
+				accounts: [],
+				activeIndex: 0
+			};
+			throw error;
+		}
+		assertOwnerOnly(this.file);
+		return decryptStorage(migrateStorage(JSON.parse(text)), this.codec);
+	}
+	async save(storage) {
+		const encrypted = encryptStorage(storage, this.codec);
+		mkdirSync(dirname(this.file), { recursive: true });
+		const tmp = `${this.file}.tmp`;
+		writeFileSync(tmp, JSON.stringify(encrypted, null, 2) + "\n", { mode: 384 });
+		renameSync(tmp, this.file);
+	}
+	async mutate(fn) {
+		this.ensureFile();
+		return this.lock.withLock(this.file, async () => {
+			const storage = await this.load();
+			const result = await fn(storage);
+			await this.save(storage);
+			return result;
+		});
+	}
+};
+/** Pick the active account, falling back to the first enabled one. */
+function resolveActiveAccount(storage) {
+	const accounts = storage.accounts;
+	if (accounts.length === 0) return void 0;
+	const active = accounts[storage.activeIndex];
+	if (active && active.enabled !== false) return {
+		account: active,
+		index: storage.activeIndex
+	};
+	const fallbackIndex = accounts.findIndex((a) => a.enabled !== false);
+	if (fallbackIndex === -1) return void 0;
+	return {
+		account: accounts[fallbackIndex],
+		index: fallbackIndex
+	};
+}
+//#endregion
+//#region src/runtime/rotation.ts
+const BACKOFF_TIERS_MS = [
+	5e3,
+	1e4,
+	2e4,
+	3e4,
+	6e4
+];
+function backoffFor(consecutiveFailures, maxJitterMs = 1e3) {
+	const index = Math.min(Math.max(consecutiveFailures, 0), BACKOFF_TIERS_MS.length - 1);
+	return (BACKOFF_TIERS_MS[index] ?? BACKOFF_TIERS_MS[BACKOFF_TIERS_MS.length - 1]) + Math.floor(Math.random() * maxJitterMs);
+}
+/** Whether the account is currently in a cooldown window. */
+function isCoolingDown(account, now = Date.now()) {
+	return (account.coolingDownUntil ?? 0) > now;
+}
+/** Clear expired rate limits and cooldowns in place. */
+function clearExpiredState(account, now = Date.now()) {
+	if (account.rateLimitResetTimes) {
+		const fresh = Object.fromEntries(Object.entries(account.rateLimitResetTimes).filter(([, reset]) => reset > now));
+		account.rateLimitResetTimes = Object.keys(fresh).length > 0 ? fresh : void 0;
+	}
+	if (account.coolingDownUntil && account.coolingDownUntil <= now) {
+		account.coolingDownUntil = void 0;
+		account.cooldownReason = void 0;
+	}
+}
+/** 24h cooldown for a fully exhausted daily quota (single-account: stop hitting the wall). */
+const FULL_QUOTA_COOLDOWN_MS = 864e5;
+/**
+* Decide what to do after one failed attempt.
+* @param kind - classified failure kind.
+* @param category - 429 sub-category when kind is rate-limit.
+* @param account - the account that failed (mutated with cooldown/rate-limit state).
+* @param consecutiveFailures - consecutive failures on this account.
+* @param retryAfterMs - server-provided retry delay when present.
+*/
+function decideRotation(kind, account, consecutiveFailures, retryAfterMs, category = "unknown") {
+	const now = Date.now();
+	const backoffMs = backoffFor(consecutiveFailures);
+	switch (kind) {
+		case "rate-limit":
+			if (category === "soft_rate_limit") return {
+				action: "retry",
+				backoffMs: Math.min(retryAfterMs ?? backoffMs, 3e3)
+			};
+			if (category === "quota_exhausted") {
+				account.coolingDownUntil = now + FULL_QUOTA_COOLDOWN_MS;
+				account.cooldownReason = void 0;
+				return {
+					action: "cool",
+					backoffMs: FULL_QUOTA_COOLDOWN_MS
+				};
+			}
+			account.coolingDownUntil = now + (retryAfterMs ?? 3e5);
+			account.cooldownReason = void 0;
+			return {
+				action: "rotate",
+				backoffMs
+			};
+		case "auth-failure":
+			account.verificationRequired = true;
+			account.verificationRequiredAt = now;
+			account.verificationRequiredReason = "auth-failure";
+			account.enabled = false;
+			return { action: "revoke" };
+		case "network-error":
+			account.coolingDownUntil = now + backoffMs;
+			account.cooldownReason = "network-error";
+			return {
+				action: "rotate",
+				backoffMs
+			};
+		case "project-error":
+			account.coolingDownUntil = now + backoffMs;
+			account.cooldownReason = "project-error";
+			return {
+				action: "cool",
+				backoffMs
+			};
+		case "transient": return {
+			action: "retry",
+			backoffMs
+		};
+	}
+}
+/**
+* Pick the next account index for rotation (round-robin across enabled,
+* non-cooling accounts; falls back to the active one when all are cooling).
+*/
+function pickNextAccountIndex(accounts, currentIndex, now = Date.now()) {
+	if (accounts.length <= 1) return currentIndex;
+	const enabled = accounts.map((a, i) => ({
+		account: a,
+		index: i
+	})).filter(({ account, index }) => index !== currentIndex && account.enabled !== false && !isCoolingDown(account, now));
+	if (enabled.length === 0) return currentIndex;
+	return (enabled.find((e) => e.index > currentIndex) ?? enabled[0]).index;
+}
+//#endregion
+//#region src/runtime/fingerprint.ts
+/**
+* Device fingerprint generation for rate-limit mitigation (two layers):
+*
+* 1. Per-request randomized headers — platform/arch/SDK-client pools.
+* 2. Per-account persistent fingerprint — deviceId/sessionToken/UA snapshot
+*    with bounded history (≤5 versions, restorable), regenerated when an
+*    account's capacity looks exhausted.
+*
+* All tunable pools live in fingerprint-data.json so they can be updated
+* without a code release (the reference implementation stopped at an old
+* version string once archived — that staleness is the detectable signal).
+*/
+const DEFAULT_FINGERPRINT_DATA = {
+	comment: "Hot-updatable fingerprint data. Version pools and client strings must track the real Antigravity product; update this file (or ship an override) when a release ships. Kept out of code so stale versions never get compiled in.",
+	versionPool: [
+		"1.18.3",
+		"1.17.0",
+		"1.16.0"
+	],
+	platforms: [
+		"windows/amd64",
+		"darwin/arm64",
+		"darwin/amd64"
+	],
+	architectures: ["x64", "arm64"],
+	osVersions: {
+		"darwin": [
+			"10.15.7",
+			"11.6.8",
+			"12.6.3",
+			"13.5.2",
+			"14.2.1",
+			"14.5"
+		],
+		"win32": [
+			"10.0.19041",
+			"10.0.19042",
+			"10.0.19043",
+			"10.0.22000",
+			"10.0.22621",
+			"10.0.22631"
+		],
+		"linux": [
+			"5.15.0",
+			"5.19.0",
+			"6.1.0",
+			"6.2.0",
+			"6.5.0",
+			"6.6.0"
+		]
+	},
+	sdkClients: [
+		"google-cloud-sdk vscode_cloudshelleditor/0.1",
+		"google-cloud-sdk vscode/1.86.0",
+		"google-cloud-sdk vscode/1.87.0",
+		"google-cloud-sdk vscode/1.96.0"
+	],
+	ideTypes: ["ANTIGRAVITY"],
+	pluginTypes: ["GEMINI"]
+};
+const USER_OVERRIDE_FILE = "agy-fingerprint-data.json";
+/**
+* Effective fingerprint data: a user override at `$DSH_HOME/agy-fingerprint-data.json`
+* wins when present and parseable (hot-updatable without a code release — the
+* bundled copy is compiled in), otherwise the bundled defaults.
+*/
+let cachedData = null;
+function getFingerprintData() {
+	if (cachedData) return cachedData;
+	try {
+		const dshHome = process.env.DSH_HOME ? process.env.DSH_HOME : join(process.env.HOME ?? ".", ".dsh");
+		const overrideFile = join(dshHome, USER_OVERRIDE_FILE);
+		if (existsSync(overrideFile)) {
+			const parsed = JSON.parse(readFileSync(overrideFile, "utf8"));
+			if (parsed && Array.isArray(parsed.versionPool) && parsed.versionPool.length > 0) {
+				cachedData = parsed;
+				return cachedData;
+			}
+		}
+	} catch {}
+	cachedData = DEFAULT_FINGERPRINT_DATA;
+	return cachedData;
+}
+function randomFrom(arr) {
+	return arr[Math.floor(Math.random() * arr.length)];
+}
+function platformToDisplayName(platform) {
+	return platform.startsWith("windows") ? "WINDOWS" : "MACOS";
+}
+/** Generate a randomized device fingerprint representing one apparent device. */
+function generateFingerprint(data = getFingerprintData(), version = randomFrom(data.versionPool)) {
+	const platform = randomFrom(data.platforms);
+	return {
+		deviceId: randomUUID(),
+		sessionToken: randomBytes(16).toString("hex"),
+		userAgent: `antigravity/${version} ${platform}`,
+		apiClient: randomFrom(data.sdkClients),
+		clientMetadata: {
+			ideType: randomFrom(data.ideTypes),
+			platform: platformToDisplayName(platform),
+			pluginType: randomFrom(data.pluginTypes)
+		},
+		createdAt: Date.now()
+	};
+}
+/** Per-request randomized headers (platform + SDK client pools). */
+function getRandomizedHeaders(data = getFingerprintData(), version = randomFrom(data.versionPool)) {
+	const platform = randomFrom(data.platforms);
+	return {
+		"User-Agent": `antigravity/${version} ${platform}`,
+		"X-Goog-Api-Client": randomFrom(data.sdkClients),
+		"Client-Metadata": JSON.stringify({
+			ideType: randomFrom(data.ideTypes),
+			platform: platformToDisplayName(platform),
+			pluginType: randomFrom(data.pluginTypes)
+		})
+	};
+}
+/** Rewrite the version inside a fingerprint UA; reports whether it changed. */
+function updateFingerprintVersion(fingerprint, version) {
+	const pattern = /^(antigravity\/)([\d.]+)/;
+	const match = fingerprint.userAgent.match(pattern);
+	if (!match || match[2] === version) return false;
+	fingerprint.userAgent = fingerprint.userAgent.replace(pattern, `$1${version}`);
+	return true;
+}
+/** Append a fingerprint to the account history (bounded), then use it as current. */
+function recordFingerprintVersion(history, fingerprint, reason) {
+	return [...history ?? [], {
+		fingerprint,
+		timestamp: Date.now(),
+		reason
+	}].slice(-5);
+}
+//#endregion
+//#region src/session.ts
+/**
+* Resolve the impersonation headers for one request from the account's
+* persistent fingerprint (stable identity), falling back to full per-request
+* randomization when the account has no fingerprint yet.
+*/
+function impersonationHeadersFor(account) {
+	const fingerprint = account.fingerprint;
+	if (fingerprint) return {
+		"User-Agent": fingerprint.userAgent,
+		"X-Goog-Api-Client": fingerprint.apiClient,
+		"Client-Metadata": JSON.stringify(fingerprint.clientMetadata)
+	};
+	const randomized = getRandomizedHeaders(DEFAULT_FINGERPRINT_DATA);
+	return {
+		"User-Agent": randomized["User-Agent"],
+		"X-Goog-Api-Client": randomized["X-Goog-Api-Client"],
+		"Client-Metadata": randomized["Client-Metadata"]
+	};
+}
+var AgySessionManager = class {
+	store;
+	onRotate;
+	tokenCache = /* @__PURE__ */ new Map();
+	/** In-flight refresh promises keyed by account: concurrent requests share one refresh. */
+	refreshInFlight = /* @__PURE__ */ new Map();
+	failureCounts = /* @__PURE__ */ new Map();
+	/** Accounts whose request-time project discovery already failed (no retry per request). */
+	projectRetryFailed = /* @__PURE__ */ new Set();
+	constructor(options) {
+		this.store = options.store;
+		this.onRotate = options.onRotate;
+	}
+	accountKey(account) {
+		return account.email ?? `idx-${account.refresh}`;
+	}
+	/** Resolve a usable access token for the account, refreshing when expired. */
+	async accessTokenFor(account) {
+		const key = this.accountKey(account);
+		const cached = this.tokenCache.get(key);
+		if (cached && !accessTokenExpired({
+			access: cached.access,
+			expires: cached.expires,
+			refresh: account.refresh
+		})) return {
+			access: cached.access,
+			expires: cached.expires,
+			refresh: account.refresh
+		};
+		const inFlight = this.refreshInFlight.get(key);
+		if (inFlight) return inFlight;
+		const refreshing = (async () => {
+			const result = await refreshAccessToken({
+				access: cached?.access ?? "",
+				expires: cached?.expires ?? 0,
+				refresh: account.refresh
+			});
+			if (result.type === "success") {
+				this.tokenCache.set(key, {
+					access: result.auth.access,
+					expires: result.auth.expires
+				});
+				return result.auth;
+			}
+			if (result.type === "revoked") {
+				this.tokenCache.delete(key);
+				return;
+			}
+		})();
+		this.refreshInFlight.set(key, refreshing);
+		try {
+			return await refreshing;
+		} finally {
+			this.refreshInFlight.delete(key);
+		}
+	}
+	async pickAccount(storage) {
+		const now = Date.now();
+		for (const account of storage.accounts) clearExpiredState(account, now);
+		let resolved = resolveActiveAccount(storage);
+		if (!resolved) return void 0;
+		if (isCoolingDown(resolved.account, now)) {
+			const nextIndex = pickNextAccountIndex(storage.accounts, resolved.index, now);
+			if (nextIndex !== resolved.index) resolved = {
+				account: storage.accounts[nextIndex],
+				index: nextIndex
+			};
+		}
+		return resolved;
+	}
+	/**
+	* Adapter hook: resolve the active session (refresh if needed), healing a
+	* missing projectId at request time — the OAuth-time loadCodeAssist may have
+	* transiently failed even when the Google account owns a Cloud Code project
+	* (mirrors OmniRoute's ensureAntigravityProjectAssigned + persistence).
+	*/
+	async getSession() {
+		const storage = await this.store.load();
+		const picked = await this.pickAccount(storage);
+		if (!picked) return void 0;
+		const auth = await this.accessTokenFor(picked.account);
+		if (!auth) return void 0;
+		const key = this.accountKey(picked.account);
+		if (!picked.account.projectId && !this.projectRetryFailed.has(key)) try {
+			const { loadCodeAssist } = await import("./exchange-MhFUiBAm.mjs").then((n) => n.n);
+			const { projectId } = await loadCodeAssist(auth.access);
+			if (projectId) {
+				await this.store.mutate((s) => {
+					const account = s.accounts[picked.index];
+					if (account) {
+						account.projectId = projectId;
+						const parts = parseRefreshParts(account.refresh);
+						account.refresh = formatRefreshParts({
+							refreshToken: parts.refreshToken,
+							projectId,
+							managedProjectId: parts.managedProjectId
+						});
+					}
+				});
+				picked.account.projectId = projectId;
+			} else this.projectRetryFailed.add(key);
+		} catch {
+			this.projectRetryFailed.add(key);
+		}
+		return {
+			auth,
+			account: picked.account,
+			index: picked.index,
+			impersonation: impersonationHeadersFor(picked.account)
+		};
+	}
+	/** Adapter hook: apply rotation decisions and fingerprint regeneration. */
+	async reportFailure(kind, session, info) {
+		const storage = await this.store.load();
+		const account = storage.accounts[session.index];
+		if (!account) return;
+		const key = this.accountKey(account);
+		const consecutive = (this.failureCounts.get(key) ?? 0) + 1;
+		this.failureCounts.set(key, consecutive);
+		const decision = decideRotation(kind, account, consecutive, info?.retryAfterMs, info?.rateLimitCategory);
+		if (decision.action === "revoke") {
+			this.tokenCache.delete(key);
+			this.failureCounts.delete(key);
+			await this.store.save(storage);
+			return;
+		}
+		if (kind === "rate-limit") {
+			if (!account.fingerprint) {
+				account.fingerprint = generateFingerprint(void 0, await resolveAntigravityVersionBounded());
+				account.fingerprintHistory = recordFingerprintVersion(account.fingerprintHistory, account.fingerprint, "initial");
+			} else {
+				const cached = peekCachedAntigravityVersion();
+				if (cached) updateFingerprintVersion(account.fingerprint, cached);
+				if (consecutive >= 2) {
+					const fresh = generateFingerprint(void 0, await resolveAntigravityVersionBounded());
+					account.fingerprintHistory = recordFingerprintVersion(account.fingerprintHistory, fresh, "regenerated");
+					account.fingerprint = fresh;
+				}
+			}
+		}
+		if (decision.action === "rotate") {
+			const nextIndex = pickNextAccountIndex(storage.accounts, session.index);
+			if (nextIndex !== session.index) {
+				storage.activeIndex = nextIndex;
+				this.onRotate?.(session.index, nextIndex, kind);
+			}
+		}
+		await this.store.save(storage);
+	}
+	/** Adapter hook: reset the failure counter after a clean completion. */
+	async markSuccess(session) {
+		const account = session.account;
+		const key = this.accountKey(account);
+		this.failureCounts.delete(key);
+	}
+	/**
+	* Test call: one short streaming request against the live backend.
+	* Returns the collected text or a structured error message.
+	*/
+	async testCall(model, prompt = "Reply with exactly: OK", maxTokens = 1024) {
+		const session = await this.getSession();
+		if (!session) return {
+			ok: false,
+			error: "No agy account configured — run `dsh-agy login` first."
+		};
+		try {
+			const { toAgyRequestBody } = await import("./translate-h2bjH7ub.mjs").then((n) => n.n);
+			const { fetchAgyFirstOk } = await Promise.resolve().then(() => constants_exports);
+			const { parseAgySse } = await import("./parse-CiEzD9d_.mjs").then((n) => n.n);
+			const body = toAgyRequestBody({
+				provider: "agy",
+				model,
+				messages: [{
+					id: "test-1",
+					role: "user",
+					content: [{
+						type: "text",
+						text: prompt
+					}]
+				}],
+				maxTokens
+			}, {
+				projectId: session.account.projectId,
+				sessionId: deriveAntigravitySessionId(session.account.email) ?? void 0
+			});
+			const response = await fetchAgyFirstOk("/v1internal:streamGenerateContent?alt=sse", {
+				method: "POST",
+				headers: {
+					authorization: `Bearer ${session.auth.access}`,
+					"content-type": "application/json",
+					accept: "text/event-stream",
+					...session.impersonation
+				},
+				body: JSON.stringify(body)
+			});
+			if (!response.ok) {
+				const text = await response.text().catch(() => "");
+				return {
+					ok: false,
+					error: `HTTP ${response.status}: ${text.slice(0, 300)}`
+				};
+			}
+			if (!response.body) return {
+				ok: false,
+				error: "no response body"
+			};
+			const text = [];
+			for await (const chunk of parseAgySse(response.body)) if (chunk.type === "text-delta") text.push(chunk.text);
+			return {
+				ok: text.length > 0,
+				text: text.join(""),
+				error: text.length > 0 ? void 0 : "empty response"
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	/** Export one account as a paste-credential blob (for migration to another host). */
+	async exportBlob(index) {
+		const account = (await this.store.load()).accounts[index];
+		if (!account) return { error: "account not found" };
+		const auth = await this.accessTokenFor(account);
+		if (!auth) return { error: "refresh failed (revoked?)" };
+		const { encodeCredentialBlob } = await import("./blob-D1e7_uT1.mjs").then((n) => n.t);
+		const parts = parseRefreshParts(account.refresh);
+		return { blob: encodeCredentialBlob("agy", {
+			access_token: auth.access,
+			refresh_token: parts.refreshToken,
+			expires_in: Math.max(0, Math.round((auth.expires - Date.now()) / 1e3))
+		}) };
+	}
+	/** CLI/web helper: verify an account's credentials (refresh + userinfo). */
+	async verifyAccount(index) {
+		const account = (await this.store.load()).accounts[index];
+		if (!account) return {
+			ok: false,
+			error: "account not found"
+		};
+		const auth = await this.accessTokenFor(account);
+		if (!auth) return {
+			ok: false,
+			error: "refresh failed (revoked?)"
+		};
+		try {
+			const response = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", { headers: { Authorization: `Bearer ${auth.access}` } });
+			if (!response.ok) return {
+				ok: false,
+				error: `userinfo ${response.status}`
+			};
+			const info = await response.json();
+			await this.store.mutate((s) => {
+				const target = s.accounts[index];
+				if (target) {
+					target.enabled = true;
+					target.verificationRequired = false;
+					target.verificationRequiredAt = void 0;
+					target.verificationRequiredReason = void 0;
+					target.verificationUrl = void 0;
+				}
+			});
+			return {
+				ok: true,
+				email: info.email
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+};
+//#endregion
+export { OAUTH_TOKEN_URL as C, getAgyBootstrapUserAgent as D, getAgyBootstrapClientMetadata as E, OAUTH_AUTHORIZE_URL as S, fetchAgyFirstOk as T, AGY_CLIENT_ID as _, MASTER_KEY_REF as a, AGY_ENDPOINT_FALLBACKS as b, loadMasterKey as c, resolveMasterKeyCodec as d, calculateTokenExpiry as f, generateAntigravityRequestId as g, deriveAntigravitySessionId as h, JsonAccountStore as i, persistMasterKey as l, resolveAntigravityVersionBounded as m, generateFingerprint as n, createAesGcmCodec as o, resolveAntigravityVersion as p, recordFingerprintVersion as r, deriveKey as s, AgySessionManager as t, resolveDshHome as u, AGY_CLIENT_SECRET as v, OAUTH_USERINFO_URL as w, AGY_SCOPES as x, AGY_DEFAULT_REDIRECT_URI as y };
+
+//# sourceMappingURL=session-tawi2_uh.mjs.map