dsh-agy 0.2.3 → 0.2.5

package/lib/import-Dmeiu2Xb.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-Dmeiu2Xb.mjs","names":[],"sources":["../src/oauth/authorize.ts","../src/cli/import.ts"],"sourcesContent":["/** Build the Antigravity OAuth authorization URL with PKCE and project metadata. */\n\nimport {\n  AGY_SCOPES,\n  OAUTH_AUTHORIZE_URL,\n  resolveAgyClientCredentials,\n} from './constants.ts'\nimport { encodeState, generatePkcePair } from './pkce.ts'\n\nexport interface AntigravityAuthorization {\n  url: string\n  verifier: string\n  projectId: string\n  /** Raw state payload embedded in the URL (for server-side binding). */\n  state: string\n}\n\n/**\n * Build the Google OAuth authorization URL for the Antigravity client.\n * The `state` payload carries the PKCE verifier and an optional project id so a\n * headless callback can be pasted back verbatim.\n * @param redirectUri - loopback callback URI (harness webServer route or CLI listener).\n * @param projectId - optional Antigravity project id to bind this login to.\n */\nexport async function authorizeAntigravity(\n  redirectUri: string,\n  projectId = '',\n): Promise<AntigravityAuthorization> {\n  const { verifier, challenge } = generatePkcePair()\n\n  const url = new URL(OAUTH_AUTHORIZE_URL)\n  const { clientId } = resolveAgyClientCredentials()\n  url.searchParams.set('client_id', clientId)\n  url.searchParams.set('response_type', 'code')\n  url.searchParams.set('redirect_uri', redirectUri)\n  url.searchParams.set('scope', AGY_SCOPES.join(' '))\n  url.searchParams.set('code_challenge', challenge)\n  url.searchParams.set('code_challenge_method', 'S256')\n  const state = encodeState({ verifier, projectId: projectId || '' })\n  url.searchParams.set('state', state)\n  url.searchParams.set('access_type', 'offline')\n  url.searchParams.set('prompt', 'consent')\n\n  return { url: url.toString(), verifier, projectId: projectId || '', state }\n}\n","/**\n * Import agy credentials: parse the `agy` CLI auth.json token file or a\n * paste credential blob, enrich with the Code Assist backend (email/project),\n * and persist into the account store. Adapted from OmniRoute's agyAuthImport\n * (MIT, see NOTICE.md).\n */\nimport { randomUUID } from 'node:crypto'\nimport { AGY_ENDPOINT_FALLBACKS, getAgyBootstrapClientMetadata, getAgyBootstrapUserAgent } from '../oauth/constants.ts'\nimport { decodeCredentialBlob } from '../oauth/blob.ts'\nimport { normalizeProxyUrl, proxiedFetch } from '../proxy.ts'\nimport type { AccountStore } from '../store/accounts.ts'\nimport type { ManagedAccount } from '../types.ts'\n\nexport class AgyAuthFileError extends Error {\n  status: number\n  code: string\n\n  constructor(message: string, status = 400, code = 'invalid_request') {\n    super(message)\n    this.name = 'AgyAuthFileError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport interface ParsedAgyAuth {\n  accessToken: string\n  refreshToken: string\n  tokenType: string\n  expiresAt: string | null\n  authMethod: string | null\n  clientId?: string | null\n}\n\nexport interface EnrichedAgyAuth extends ParsedAgyAuth {\n  email: string | null\n  projectId: string | null\n  clientId?: string | null\n}\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : {}\n}\n\nfunction toNonEmptyString(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed ? trimmed : null\n}\n\n/**\n * Parse the agy CLI token file: tokens nest under `.token` with an ISO\n * `expiry` string and no id_token; a flat top-level shape is accepted too.\n */\nexport function parseAndValidateAgyToken(raw: unknown): ParsedAgyAuth {\n  const doc = toRecord(raw)\n  const token = toRecord(doc.token ?? doc)\n\n  const accessToken = toNonEmptyString(token.access_token)\n  const refreshToken = toNonEmptyString(token.refresh_token)\n  if (!accessToken) throw new AgyAuthFileError('access_token is missing or empty in the agy token file', 400, 'missing_access_token')\n  if (!refreshToken) throw new AgyAuthFileError('refresh_token is missing or empty in the agy token file', 400, 'missing_refresh_token')\n\n  let expiresAt: string | null = null\n  const isoExpiry = toNonEmptyString(token.expiry) ?? toNonEmptyString(token.expires_at)\n  if (isoExpiry) {\n    const ms = new Date(isoExpiry).getTime()\n    expiresAt = Number.isNaN(ms) ? null : new Date(ms).toISOString()\n  } else if (typeof token.expiry_date === 'number' && Number.isFinite(token.expiry_date)) {\n    expiresAt = new Date(token.expiry_date).toISOString()\n  }\n\n  return {\n    accessToken,\n    refreshToken,\n    tokenType: toNonEmptyString(token.token_type) ?? 'Bearer',\n    expiresAt,\n    authMethod: toNonEmptyString(doc.auth_method) ?? toNonEmptyString(token.auth_method),\n    clientId: toNonEmptyString(token.client_id) ?? toNonEmptyString(doc.client_id) ?? toNonEmptyString(token.clientId) ?? toNonEmptyString(doc.clientId),\n  }\n}\n\n/** Best-effort enrichment: email (userinfo) + projectId (loadCodeAssist), time-boxed. */\nexport async function enrichWithAntigravityBackend(parsed: ParsedAgyAuth): Promise<EnrichedAgyAuth> {\n  let email: string | null = null\n  let projectId: string | null = null\n\n  const controller = new AbortController()\n  const timer = setTimeout(() => controller.abort(), 8000)\n  try {\n    const res = await proxiedFetch('https://www.googleapis.com/oauth2/v1/userinfo?alt=json', {\n      headers: { Authorization: `Bearer ${parsed.accessToken}` },\n      signal: controller.signal,\n    })\n    if (res.ok) {\n      email = toNonEmptyString(toRecord(await res.json()).email)\n    }\n  } catch {\n    // best effort — email stays null\n  } finally {\n    clearTimeout(timer)\n  }\n\n  const loadController = new AbortController()\n  const loadTimer = setTimeout(() => loadController.abort(), 8000)\n  try {\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${parsed.accessToken}`,\n      'Content-Type': 'application/json',\n      'User-Agent': getAgyBootstrapUserAgent(),\n      'Client-Metadata': getAgyBootstrapClientMetadata(),\n    }\n    for (const endpoint of AGY_ENDPOINT_FALLBACKS) {\n      try {\n        const res = await proxiedFetch(`${endpoint}/v1internal:loadCodeAssist`, {\n          method: 'POST',\n          headers,\n          body: JSON.stringify({ metadata: { ideType: 'ANTIGRAVITY' } }),\n          signal: loadController.signal,\n        })\n        if (!res.ok) continue\n        const data = toRecord(await res.json())\n        const project = data.cloudaicompanionProject\n        projectId = (typeof project === 'string' ? toNonEmptyString(project) : null)\n          ?? toNonEmptyString(toRecord(project).id)\n        if (projectId) break\n      } catch {\n        // try next endpoint\n      }\n    }\n  } catch {\n    // best effort — projectId stays null\n  } finally {\n    clearTimeout(loadTimer)\n  }\n\n  return {\n    ...parsed,\n    email,\n    projectId,\n    clientId: parsed.clientId ?? null,\n  }\n}\n\n/** Parse either a raw token document or a paste blob into an enriched account. */\nexport async function parseImportSource(source: unknown, kind: 'json' | 'blob'): Promise<EnrichedAgyAuth> {\n  if (kind === 'blob') {\n    if (typeof source !== 'string') throw new AgyAuthFileError('blob must be a string', 400, 'invalid_blob')\n    const blob = decodeCredentialBlob(source)\n    return enrichWithAntigravityBackend(\n      parseAndValidateAgyToken({ token: blob.tokens, auth_method: 'paste-blob' }),\n    )\n  }\n  return enrichWithAntigravityBackend(parseAndValidateAgyToken(source))\n}\n\n/** Batch-import many sources (CLI multi-file / web multi-line paste). Each item\n * is independent: a failure is collected, the rest still import. */\nexport async function importManySources(\n  items: Array<{ source: unknown; kind: 'json' | 'blob' }>,\n  store: AccountStore,\n  options: { email?: string; overwriteExisting?: boolean; proxy?: string } = {},\n): Promise<{ imported: number; replaced: number; errors: string[] }> {\n  const result = { imported: 0, replaced: 0, errors: [] as string[] }\n  for (const item of items) {\n    try {\n      const enriched = await parseImportSource(item.source, item.kind)\n      const { created } = await upsertImportedAccount(store, enriched, options)\n      if (created) result.imported++\n      else result.replaced++\n    } catch (error) {\n      result.errors.push(error instanceof Error ? error.message : String(error))\n    }\n  }\n  return result\n}\n\n/** Upsert the account into the store, deduping by email. */\nexport async function upsertImportedAccount(\n  store: AccountStore,\n  enriched: EnrichedAgyAuth,\n  options: { email?: string; overwriteExisting?: boolean; proxy?: string } = {},\n): Promise<{ account: ManagedAccount; created: boolean }> {\n  const resolvedEmail = options.email || enriched.email\n  const refresh = `${enriched.refreshToken}|${enriched.projectId ?? ''}`\n  // Normalize proxy if explicitly provided (empty -> clear -> undefined)\n  let normalizedProxy: string | undefined\n  let proxyProvided = options.proxy !== undefined\n  if (proxyProvided) {\n    const raw = options.proxy ?? ''\n    if (!raw.trim()) normalizedProxy = undefined\n    else normalizedProxy = normalizeProxyUrl(raw)\n  }\n\n  return store.mutate((storage) => {\n    const existingIndex = resolvedEmail\n      ? storage.accounts.findIndex((a) => a.email?.toLowerCase() === resolvedEmail.toLowerCase())\n      : -1\n\n    if (existingIndex !== -1) {\n      if (!options.overwriteExisting) {\n        throw new AgyAuthFileError(\n          'An agy account for this email already exists. Pass --overwrite to replace it.',\n          409,\n          'duplicate_account',\n        )\n      }\n      const existing = storage.accounts[existingIndex]!\n      const updated: ManagedAccount = {\n        ...existing,\n        id: existing.id || randomUUID(),\n        refresh,\n        email: existing.email ?? resolvedEmail ?? undefined,\n        clientId: enriched.clientId ? enriched.clientId : existing.clientId,\n        addedAt: existing.addedAt,\n        lastUsed: Date.now(),\n        enabled: true,\n        verificationRequired: false,\n        verificationRequiredAt: undefined,\n        verificationRequiredReason: undefined,\n      }\n      if (proxyProvided) {\n        if (normalizedProxy) updated.proxy = normalizedProxy\n        else delete (updated as { proxy?: string }).proxy\n      }\n      storage.accounts[existingIndex] = updated\n      return { account: storage.accounts[existingIndex]!, created: false }\n    }\n\n    const account: ManagedAccount = {\n      id: randomUUID(),\n      email: resolvedEmail ?? undefined,\n      refresh,\n      projectId: enriched.projectId ?? undefined,\n      clientId: enriched.clientId ?? undefined,\n      addedAt: Date.now(),\n      lastUsed: Date.now(),\n      enabled: true,\n      ...(normalizedProxy ? { proxy: normalizedProxy } : {}),\n    }\n    // When proxy was explicitly cleared (empty string) for new account, just omit proxy field\n    storage.accounts.push(account)\n    if (storage.activeIndex >= storage.accounts.length - 1 && storage.accounts.length === 1) {\n      storage.activeIndex = 0\n    }\n    return { account, created: true }\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBA,eAAsB,qBACpB,aACA,YAAY,IACuB;CACnC,MAAM,EAAE,UAAU,cAAc,iBAAiB;CAEjD,MAAM,MAAM,IAAI,IAAI,mBAAmB;CACvC,MAAM,EAAE,aAAa,4BAA4B;CACjD,IAAI,aAAa,IAAI,aAAa,QAAQ;CAC1C,IAAI,aAAa,IAAI,iBAAiB,MAAM;CAC5C,IAAI,aAAa,IAAI,gBAAgB,WAAW;CAChD,IAAI,aAAa,IAAI,SAAS,WAAW,KAAK,GAAG,CAAC;CAClD,IAAI,aAAa,IAAI,kBAAkB,SAAS;CAChD,IAAI,aAAa,IAAI,yBAAyB,MAAM;CACpD,MAAM,QAAQ,YAAY;EAAE;EAAU,WAAW,aAAa;CAAG,CAAC;CAClE,IAAI,aAAa,IAAI,SAAS,KAAK;CACnC,IAAI,aAAa,IAAI,eAAe,SAAS;CAC7C,IAAI,aAAa,IAAI,UAAU,SAAS;CAExC,OAAO;EAAE,KAAK,IAAI,SAAS;EAAG;EAAU,WAAW,aAAa;EAAI;CAAM;AAC5E;;;;;;;;;AC/BA,IAAa,mBAAb,cAAsC,MAAM;CAC1C;CACA;CAEA,YAAY,SAAiB,SAAS,KAAK,OAAO,mBAAmB;EACnE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAgBA,SAAS,SAAS,OAAyC;CACzD,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,CAAC;AAC7G;AAEA,SAAS,iBAAiB,OAA+B;CACvD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,UAAU,UAAU;AAC7B;;;;;AAMA,SAAgB,yBAAyB,KAA6B;CACpE,MAAM,MAAM,SAAS,GAAG;CACxB,MAAM,QAAQ,SAAS,IAAI,SAAS,GAAG;CAEvC,MAAM,cAAc,iBAAiB,MAAM,YAAY;CACvD,MAAM,eAAe,iBAAiB,MAAM,aAAa;CACzD,IAAI,CAAC,aAAa,MAAM,IAAI,iBAAiB,0DAA0D,KAAK,sBAAsB;CAClI,IAAI,CAAC,cAAc,MAAM,IAAI,iBAAiB,2DAA2D,KAAK,uBAAuB;CAErI,IAAI,YAA2B;CAC/B,MAAM,YAAY,iBAAiB,MAAM,MAAM,KAAK,iBAAiB,MAAM,UAAU;CACrF,IAAI,WAAW;EACb,MAAM,KAAK,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ;EACvC,YAAY,OAAO,MAAM,EAAE,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,YAAY;CACjE,OAAO,IAAI,OAAO,MAAM,gBAAgB,YAAY,OAAO,SAAS,MAAM,WAAW,GACnF,YAAY,IAAI,KAAK,MAAM,WAAW,CAAC,CAAC,YAAY;CAGtD,OAAO;EACL;EACA;EACA,WAAW,iBAAiB,MAAM,UAAU,KAAK;EACjD;EACA,YAAY,iBAAiB,IAAI,WAAW,KAAK,iBAAiB,MAAM,WAAW;EACnF,UAAU,iBAAiB,MAAM,SAAS,KAAK,iBAAiB,IAAI,SAAS,KAAK,iBAAiB,MAAM,QAAQ,KAAK,iBAAiB,IAAI,QAAQ;CACrJ;AACF;;AAGA,eAAsB,6BAA6B,QAAiD;CAClG,IAAI,QAAuB;CAC3B,IAAI,YAA2B;CAE/B,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB,WAAW,MAAM,GAAG,GAAI;CACvD,IAAI;EACF,MAAM,MAAM,MAAM,aAAa,0DAA0D;GACvF,SAAS,EAAE,eAAe,UAAU,OAAO,cAAc;GACzD,QAAQ,WAAW;EACrB,CAAC;EACD,IAAI,IAAI,IACN,QAAQ,iBAAiB,SAAS,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK;CAE7D,QAAQ,CAER,UAAU;EACR,aAAa,KAAK;CACpB;CAEA,MAAM,iBAAiB,IAAI,gBAAgB;CAC3C,MAAM,YAAY,iBAAiB,eAAe,MAAM,GAAG,GAAI;CAC/D,IAAI;EACF,MAAM,UAAkC;GACtC,eAAe,UAAU,OAAO;GAChC,gBAAgB;GAChB,cAAc,yBAAyB;GACvC,mBAAmB,8BAA8B;EACnD;EACA,KAAK,MAAM,YAAY,wBACrB,IAAI;GACF,MAAM,MAAM,MAAM,aAAa,GAAG,SAAS,6BAA6B;IACtE,QAAQ;IACR;IACA,MAAM,KAAK,UAAU,EAAE,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7D,QAAQ,eAAe;GACzB,CAAC;GACD,IAAI,CAAC,IAAI,IAAI;GAEb,MAAM,UADO,SAAS,MAAM,IAAI,KAAK,CAClB,CAAC,CAAC;GACrB,aAAa,OAAO,YAAY,WAAW,iBAAiB,OAAO,IAAI,SAClE,iBAAiB,SAAS,OAAO,CAAC,CAAC,EAAE;GAC1C,IAAI,WAAW;EACjB,QAAQ,CAER;CAEJ,QAAQ,CAER,UAAU;EACR,aAAa,SAAS;CACxB;CAEA,OAAO;EACL,GAAG;EACH;EACA;EACA,UAAU,OAAO,YAAY;CAC/B;AACF;;AAGA,eAAsB,kBAAkB,QAAiB,MAAiD;CACxG,IAAI,SAAS,QAAQ;EACnB,IAAI,OAAO,WAAW,UAAU,MAAM,IAAI,iBAAiB,yBAAyB,KAAK,cAAc;EAEvG,OAAO,6BACL,yBAAyB;GAAE,OAFhB,qBAAqB,MAEK,CAAC,CAAC;GAAQ,aAAa;EAAa,CAAC,CAC5E;CACF;CACA,OAAO,6BAA6B,yBAAyB,MAAM,CAAC;AACtE;;;AAIA,eAAsB,kBACpB,OACA,OACA,UAA2E,CAAC,GACT;CACnE,MAAM,SAAS;EAAE,UAAU;EAAG,UAAU;EAAG,QAAQ,CAAC;CAAc;CAClE,KAAK,MAAM,QAAQ,OACjB,IAAI;EAEF,MAAM,EAAE,YAAY,MAAM,sBAAsB,OAAO,MADhC,kBAAkB,KAAK,QAAQ,KAAK,IAAI,GACE,OAAO;EACxE,IAAI,SAAS,OAAO;OACf,OAAO;CACd,SAAS,OAAO;EACd,OAAO,OAAO,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;CAC3E;CAEF,OAAO;AACT;;AAGA,eAAsB,sBACpB,OACA,UACA,UAA2E,CAAC,GACpB;CACxD,MAAM,gBAAgB,QAAQ,SAAS,SAAS;CAChD,MAAM,UAAU,GAAG,SAAS,aAAa,GAAG,SAAS,aAAa;CAElE,IAAI;CACJ,IAAI,gBAAgB,QAAQ,UAAU,KAAA;CACtC,IAAI,eAAe;EACjB,MAAM,MAAM,QAAQ,SAAS;EAC7B,IAAI,CAAC,IAAI,KAAK,GAAG,kBAAkB,KAAA;OAC9B,kBAAkB,kBAAkB,GAAG;CAC9C;CAEA,OAAO,MAAM,QAAQ,YAAY;EAC/B,MAAM,gBAAgB,gBAClB,QAAQ,SAAS,WAAW,MAAM,EAAE,OAAO,YAAY,MAAM,cAAc,YAAY,CAAC,IACxF;EAEJ,IAAI,kBAAkB,IAAI;GACxB,IAAI,CAAC,QAAQ,mBACX,MAAM,IAAI,iBACR,iFACA,KACA,mBACF;GAEF,MAAM,WAAW,QAAQ,SAAS;GAClC,MAAM,UAA0B;IAC9B,GAAG;IACH,IAAI,SAAS,MAAM,WAAW;IAC9B;IACA,OAAO,SAAS,SAAS,iBAAiB,KAAA;IAC1C,UAAU,SAAS,WAAW,SAAS,WAAW,SAAS;IAC3D,SAAS,SAAS;IAClB,UAAU,KAAK,IAAI;IACnB,SAAS;IACT,sBAAsB;IACtB,wBAAwB,KAAA;IACxB,4BAA4B,KAAA;GAC9B;GACA,IAAI,eAAe;IACjB,IAAI,iBAAiB,QAAQ,QAAQ;SAChC,OAAQ,QAA+B;GAC9C;GACA,QAAQ,SAAS,iBAAiB;GAClC,OAAO;IAAE,SAAS,QAAQ,SAAS;IAAiB,SAAS;GAAM;EACrE;EAEA,MAAM,UAA0B;GAC9B,IAAI,WAAW;GACf,OAAO,iBAAiB,KAAA;GACxB;GACA,WAAW,SAAS,aAAa,KAAA;GACjC,UAAU,SAAS,YAAY,KAAA;GAC/B,SAAS,KAAK,IAAI;GAClB,UAAU,KAAK,IAAI;GACnB,SAAS;GACT,GAAI,kBAAkB,EAAE,OAAO,gBAAgB,IAAI,CAAC;EACtD;EAEA,QAAQ,SAAS,KAAK,OAAO;EAC7B,IAAI,QAAQ,eAAe,QAAQ,SAAS,SAAS,KAAK,QAAQ,SAAS,WAAW,GACpF,QAAQ,cAAc;EAExB,OAAO;GAAE;GAAS,SAAS;EAAK;CAClC,CAAC;AACH"}

package/lib/index.mjs

@@ -1,5 +1,5 @@
-import { u as isAgyDisabled } from "./accounts-BvX5zmPa.mjs";
-import { t as createAgyRuntime } from "./plugin-common-Bmz4Ife-.mjs";
+import { d as isAgyDisabled } from "./accounts-Blqno5Te.mjs";
+import { t as createAgyRuntime } from "./plugin-common-CP6Czgh9.mjs";
 //#region src/index.ts
 const name = "dsh-agy";
 const inject = ["llm"];

package/lib/models-3VFg0nRK.mjs

@@ -0,0 +1,137 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { D as getAgyBootstrapUserAgent, b as AGY_ENDPOINT_FALLBACKS } from "./accounts-Blqno5Te.mjs";
+import { i as proxiedFetch } from "./proxy-DQPIwUov.mjs";
+import { i as isLevelThinkingModel, n as catalogModel, r as isChatCallableModelId, t as AGY_PUBLIC_MODELS } from "./catalog-DVHPJjfc.mjs";
+import { ReasoningEffortId } from "@deepseek-ai/dsh-llm";
+//#region src/adapter/models.ts
+/**
+* Model discovery: dynamic `v1internal:fetchAvailableModels` as the primary
+* source (fresh ids + per-model quotaInfo), the pinned catalog merged in for
+* capability metadata, and catalog fallback when the endpoint is unreachable.
+*/
+var models_exports = /* @__PURE__ */ __exportAll({
+	AGY_PROVIDER: () => "agy",
+	catalogModelList: () => catalogModelList,
+	fetchAvailableModels: () => fetchAvailableModels,
+	listAgyModels: () => listAgyModels,
+	mergeModelCatalog: () => mergeModelCatalog,
+	resolveAgyModel: () => resolveAgyModel
+});
+/** Level-thinking: single id + selectable low/medium/high via thinkingLevel. Default is UI hint, not wire default. */
+const LEVEL_REASONING = Object.freeze({
+	efforts: Object.freeze([
+		{
+			id: ReasoningEffortId("low"),
+			name: "Low"
+		},
+		{
+			id: ReasoningEffortId("medium"),
+			name: "Medium"
+		},
+		{
+			id: ReasoningEffortId("high"),
+			name: "High"
+		}
+	]),
+	defaultEffort: ReasoningEffortId("medium")
+});
+/**
+* Input modalities per model. Image support follows the catalog's own
+* `supportsVision` metadata for known models (gpt-oss-120b-medium is text-only
+* there); unknown dynamic ids default to vision-capable — the upstream schema
+* accepts inlineData across the board, and a wrong guess surfaces as a clear
+* upstream 400 instead of a silent drop.
+*/
+const AGY_INPUT_MODALITIES = ["text", "image"];
+const AGY_TEXT_ONLY_MODALITIES = ["text"];
+function inputModalitiesFor(meta) {
+	return [...(meta ? meta.supportsVision === true : true) ? AGY_INPUT_MODALITIES : AGY_TEXT_ONLY_MODALITIES];
+}
+/** Fetch the account's available models from the first reachable endpoint. */
+async function fetchAvailableModels(accessToken, projectId, fetchImpl = proxiedFetch) {
+	let lastError = null;
+	const body = projectId ? { project: projectId } : {};
+	for (const baseEndpoint of AGY_ENDPOINT_FALLBACKS) try {
+		const response = await fetchImpl(`${baseEndpoint}/v1internal:fetchAvailableModels`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				"Content-Type": "application/json",
+				"User-Agent": getAgyBootstrapUserAgent()
+			},
+			body: JSON.stringify(body)
+		});
+		if (response.ok) return await response.json();
+		lastError = /* @__PURE__ */ new Error(`fetchAvailableModels ${response.status} at ${baseEndpoint}`);
+	} catch (error) {
+		lastError = error;
+	}
+	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error("fetchAvailableModels: all endpoints failed");
+}
+/** Merge dynamic ids with catalog metadata; non-chat models and unknowns keep minimal info. */
+function mergeModelCatalog(dynamic) {
+	const entries = [];
+	for (const [id, entry] of Object.entries(dynamic.models ?? {})) {
+		if (!isChatCallableModelId(id)) continue;
+		const meta = catalogModel(id);
+		const displayName = (entry.displayName && entry.displayName !== id ? entry.displayName : void 0) ?? meta?.name ?? entry.displayName ?? entry.modelName ?? id;
+		entries.push({
+			provider: "agy",
+			id,
+			name: displayName,
+			inputModalities: inputModalitiesFor(meta),
+			...meta ? { context: { contextWindow: meta.contextLength } } : {}
+		});
+	}
+	return entries;
+}
+/** Catalog-only model list used when the endpoint is unreachable. */
+function catalogModelList() {
+	return AGY_PUBLIC_MODELS.map((model) => ({
+		provider: "agy",
+		id: model.id,
+		name: model.name,
+		inputModalities: inputModalitiesFor(model),
+		context: { contextWindow: model.contextLength }
+	}));
+}
+/** Adapter-facing listing: dynamic first, catalog fallback. */
+async function listAgyModels(accessToken, projectId, fetchImpl = proxiedFetch) {
+	if (!accessToken) return catalogModelList();
+	try {
+		const merged = mergeModelCatalog(await fetchAvailableModels(accessToken, projectId, fetchImpl));
+		return merged.length > 0 ? merged : catalogModelList();
+	} catch {
+		return catalogModelList();
+	}
+}
+/** Resolve one exact model's metadata (catalog-backed; dynamic ids pass through). */
+function resolveAgyModel(provider, model) {
+	const meta = catalogModel(model);
+	if (isLevelThinkingModel(model)) return {
+		provider,
+		id: model,
+		name: meta?.name ?? model,
+		inputModalities: inputModalitiesFor(meta),
+		context: { contextWindow: meta?.contextLength ?? 1048576 },
+		defaultMaxTokens: meta?.maxOutputTokens ?? 65536,
+		reasoning: {
+			...LEVEL_REASONING,
+			efforts: [...LEVEL_REASONING.efforts]
+		}
+	};
+	return {
+		provider,
+		id: model,
+		name: meta?.name ?? model,
+		inputModalities: inputModalitiesFor(meta),
+		...meta ? {
+			context: { contextWindow: meta.contextLength },
+			defaultMaxTokens: meta.maxOutputTokens
+		} : {}
+	};
+}
+//#endregion
+export { resolveAgyModel as i, listAgyModels as n, models_exports as r, catalogModelList as t };
+
+//# sourceMappingURL=models-3VFg0nRK.mjs.map

package/lib/models-3VFg0nRK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models-3VFg0nRK.mjs","names":[],"sources":["../src/adapter/models.ts"],"sourcesContent":["/**\n * Model discovery: dynamic `v1internal:fetchAvailableModels` as the primary\n * source (fresh ids + per-model quotaInfo), the pinned catalog merged in for\n * capability metadata, and catalog fallback when the endpoint is unreachable.\n */\n\nimport { ReasoningEffortId, type LlmModelInfo, type LlmModelReasoningInfo, type LlmResolvedModelInfo, type ModelModality } from '@deepseek-ai/dsh-llm'\nimport { AGY_ENDPOINT_FALLBACKS, getAgyBootstrapUserAgent } from '../oauth/constants.ts'\nimport { proxiedFetch } from '../proxy.ts'\nimport { AGY_PUBLIC_MODELS, catalogModel, isChatCallableModelId, isLevelThinkingModel } from './catalog.ts'\n\nexport const AGY_PROVIDER = 'agy'\n\n/** Level-thinking: single id + selectable low/medium/high via thinkingLevel. Default is UI hint, not wire default. */\nconst LEVEL_REASONING: LlmModelReasoningInfo = Object.freeze({\n  efforts: Object.freeze([\n    { id: ReasoningEffortId('low'), name: 'Low' },\n    { id: ReasoningEffortId('medium'), name: 'Medium' },\n    { id: ReasoningEffortId('high'), name: 'High' },\n  ] as const),\n  defaultEffort: ReasoningEffortId('medium'),\n} as const)\n\n/**\n * Input modalities per model. Image support follows the catalog's own\n * `supportsVision` metadata for known models (gpt-oss-120b-medium is text-only\n * there); unknown dynamic ids default to vision-capable — the upstream schema\n * accepts inlineData across the board, and a wrong guess surfaces as a clear\n * upstream 400 instead of a silent drop.\n */\nconst AGY_INPUT_MODALITIES = ['text', 'image'] as const\nconst AGY_TEXT_ONLY_MODALITIES = ['text'] as const\n\nfunction inputModalitiesFor(meta: { supportsVision?: boolean } | undefined): ModelModality[] {\n  return [...(meta ? meta.supportsVision === true : true) ? AGY_INPUT_MODALITIES : AGY_TEXT_ONLY_MODALITIES]\n}\n\nexport interface DiscoveredModelEntry {\n  quotaInfo?: {\n    remainingFraction?: number\n    resetTime?: string\n  }\n  displayName?: string\n  modelName?: string\n}\n\nexport interface DiscoveredModels {\n  models?: Record<string, DiscoveredModelEntry>\n}\n\n/** Fetch the account's available models from the first reachable endpoint. */\nexport async function fetchAvailableModels(\n  accessToken: string,\n  projectId?: string,\n  fetchImpl: typeof fetch = proxiedFetch,\n): Promise<DiscoveredModels> {\n  let lastError: unknown = null\n  const body = projectId ? { project: projectId } : {}\n  for (const baseEndpoint of AGY_ENDPOINT_FALLBACKS) {\n    try {\n      const response = await fetchImpl(`${baseEndpoint}/v1internal:fetchAvailableModels`, {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'Content-Type': 'application/json',\n          'User-Agent': getAgyBootstrapUserAgent(),\n        },\n        body: JSON.stringify(body),\n      })\n      if (response.ok) {\n        return (await response.json()) as DiscoveredModels\n      }\n      lastError = new Error(`fetchAvailableModels ${response.status} at ${baseEndpoint}`)\n    } catch (error) {\n      lastError = error\n    }\n  }\n  throw lastError instanceof Error ? lastError : new Error('fetchAvailableModels: all endpoints failed')\n}\n\n/** Merge dynamic ids with catalog metadata; non-chat models and unknowns keep minimal info. */\nexport function mergeModelCatalog(dynamic: DiscoveredModels): LlmModelInfo[] {\n  const entries: LlmModelInfo[] = []\n  for (const [id, entry] of Object.entries(dynamic.models ?? {})) {\n    if (!isChatCallableModelId(id)) continue\n    const meta = catalogModel(id)\n    const rawDisplayName = entry.displayName && entry.displayName !== id ? entry.displayName : undefined\n    const displayName = rawDisplayName ?? meta?.name ?? entry.displayName ?? entry.modelName ?? id\n    entries.push({\n      provider: AGY_PROVIDER,\n      id,\n      name: displayName,\n      inputModalities: inputModalitiesFor(meta),\n      ...(meta ? { context: { contextWindow: meta.contextLength } } : {}),\n    })\n  }\n  return entries\n}\n\n/** Catalog-only model list used when the endpoint is unreachable. */\nexport function catalogModelList(): LlmModelInfo[] {\n  return AGY_PUBLIC_MODELS.map((model) => ({\n    provider: AGY_PROVIDER,\n    id: model.id,\n    name: model.name,\n    inputModalities: inputModalitiesFor(model),\n    context: { contextWindow: model.contextLength },\n  }))\n}\n\n/** Adapter-facing listing: dynamic first, catalog fallback. */\nexport async function listAgyModels(\n  accessToken: string | undefined,\n  projectId: string | undefined,\n  fetchImpl: typeof fetch = proxiedFetch,\n): Promise<readonly LlmModelInfo[]> {\n  if (!accessToken) return catalogModelList()\n  try {\n    const dynamic = await fetchAvailableModels(accessToken, projectId, fetchImpl)\n    const merged = mergeModelCatalog(dynamic)\n    return merged.length > 0 ? merged : catalogModelList()\n  } catch {\n    return catalogModelList()\n  }\n}\n\n/** Resolve one exact model's metadata (catalog-backed; dynamic ids pass through). */\nexport function resolveAgyModel(provider: string, model: string): LlmResolvedModelInfo {\n  const meta = catalogModel(model)\n  if (isLevelThinkingModel(model)) {\n    return {\n      provider,\n      id: model,\n      name: meta?.name ?? model,\n      inputModalities: inputModalitiesFor(meta),\n      context: { contextWindow: meta?.contextLength ?? 1048576 },\n      defaultMaxTokens: meta?.maxOutputTokens ?? 65536,\n      // Return a shallow copy so callers cannot mutate the frozen singleton.\n      reasoning: { ...LEVEL_REASONING, efforts: [...LEVEL_REASONING.efforts] },\n    }\n  }\n  return {\n    provider,\n    id: model,\n    name: meta?.name ?? model,\n    inputModalities: inputModalitiesFor(meta),\n    ...(meta ? { context: { contextWindow: meta.contextLength }, defaultMaxTokens: meta.maxOutputTokens } : {}),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAcA,MAAM,kBAAyC,OAAO,OAAO;CAC3D,SAAS,OAAO,OAAO;EACrB;GAAE,IAAI,kBAAkB,KAAK;GAAG,MAAM;EAAM;EAC5C;GAAE,IAAI,kBAAkB,QAAQ;GAAG,MAAM;EAAS;EAClD;GAAE,IAAI,kBAAkB,MAAM;GAAG,MAAM;EAAO;CAChD,CAAU;CACV,eAAe,kBAAkB,QAAQ;AAC3C,CAAU;;;;;;;;AASV,MAAM,uBAAuB,CAAC,QAAQ,OAAO;AAC7C,MAAM,2BAA2B,CAAC,MAAM;AAExC,SAAS,mBAAmB,MAAiE;CAC3F,OAAO,CAAC,IAAI,OAAO,KAAK,mBAAmB,OAAO,QAAQ,uBAAuB,wBAAwB;AAC3G;;AAgBA,eAAsB,qBACpB,aACA,WACA,YAA0B,cACC;CAC3B,IAAI,YAAqB;CACzB,MAAM,OAAO,YAAY,EAAE,SAAS,UAAU,IAAI,CAAC;CACnD,KAAK,MAAM,gBAAgB,wBACzB,IAAI;EACF,MAAM,WAAW,MAAM,UAAU,GAAG,aAAa,mCAAmC;GAClF,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IAChB,cAAc,yBAAyB;GACzC;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,CAAC;EACD,IAAI,SAAS,IACX,OAAQ,MAAM,SAAS,KAAK;EAE9B,4BAAY,IAAI,MAAM,wBAAwB,SAAS,OAAO,MAAM,cAAc;CACpF,SAAS,OAAO;EACd,YAAY;CACd;CAEF,MAAM,qBAAqB,QAAQ,4BAAY,IAAI,MAAM,4CAA4C;AACvG;;AAGA,SAAgB,kBAAkB,SAA2C;CAC3E,MAAM,UAA0B,CAAC;CACjC,KAAK,MAAM,CAAC,IAAI,UAAU,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG;EAC9D,IAAI,CAAC,sBAAsB,EAAE,GAAG;EAChC,MAAM,OAAO,aAAa,EAAE;EAE5B,MAAM,eADiB,MAAM,eAAe,MAAM,gBAAgB,KAAK,MAAM,cAAc,KAAA,MACrD,MAAM,QAAQ,MAAM,eAAe,MAAM,aAAa;EAC5F,QAAQ,KAAK;GACX,UAAA;GACA;GACA,MAAM;GACN,iBAAiB,mBAAmB,IAAI;GACxC,GAAI,OAAO,EAAE,SAAS,EAAE,eAAe,KAAK,cAAc,EAAE,IAAI,CAAC;EACnE,CAAC;CACH;CACA,OAAO;AACT;;AAGA,SAAgB,mBAAmC;CACjD,OAAO,kBAAkB,KAAK,WAAW;EACvC,UAAA;EACA,IAAI,MAAM;EACV,MAAM,MAAM;EACZ,iBAAiB,mBAAmB,KAAK;EACzC,SAAS,EAAE,eAAe,MAAM,cAAc;CAChD,EAAE;AACJ;;AAGA,eAAsB,cACpB,aACA,WACA,YAA0B,cACQ;CAClC,IAAI,CAAC,aAAa,OAAO,iBAAiB;CAC1C,IAAI;EAEF,MAAM,SAAS,kBAAkB,MADX,qBAAqB,aAAa,WAAW,SAAS,CACpC;EACxC,OAAO,OAAO,SAAS,IAAI,SAAS,iBAAiB;CACvD,QAAQ;EACN,OAAO,iBAAiB;CAC1B;AACF;;AAGA,SAAgB,gBAAgB,UAAkB,OAAqC;CACrF,MAAM,OAAO,aAAa,KAAK;CAC/B,IAAI,qBAAqB,KAAK,GAC5B,OAAO;EACL;EACA,IAAI;EACJ,MAAM,MAAM,QAAQ;EACpB,iBAAiB,mBAAmB,IAAI;EACxC,SAAS,EAAE,eAAe,MAAM,iBAAiB,QAAQ;EACzD,kBAAkB,MAAM,mBAAmB;EAE3C,WAAW;GAAE,GAAG;GAAiB,SAAS,CAAC,GAAG,gBAAgB,OAAO;EAAE;CACzE;CAEF,OAAO;EACL;EACA,IAAI;EACJ,MAAM,MAAM,QAAQ;EACpB,iBAAiB,mBAAmB,IAAI;EACxC,GAAI,OAAO;GAAE,SAAS,EAAE,eAAe,KAAK,cAAc;GAAG,kBAAkB,KAAK;EAAgB,IAAI,CAAC;CAC3G;AACF"}

package/lib/{plugin-common-Bmz4Ife-.mjs → plugin-common-CP6Czgh9.mjs}

@@ -1,7 +1,8 @@
-import { A as AgyPoolBlockedError, _ as generateAntigravityRequestId, a as loadMasterKey, c as resolveMasterKeyCodec, g as deriveAntigravitySessionId, i as deriveKey, k as AgyAuthError, l as AgySessionManager, m as resolveAntigravityVersion, n as MASTER_KEY_REF, o as persistMasterKey, r as createAesGcmCodec, s as resolveDshHome, t as JsonAccountStore, w as fetchAgyFirstOk } from "./accounts-BvX5zmPa.mjs";
-import { r as setThoughtSignature, t as toAgyRequestBody } from "./translate-C1SMdm5J.mjs";
+import { A as AgyPoolBlockedError, T as fetchAgyFirstOk, _ as deriveAntigravitySessionId, a as deriveKey, c as resolveDshHome, h as resolveAntigravityVersion, i as createAesGcmCodec, k as AgyAuthError, l as resolveMasterKeyCodec, o as loadMasterKey, r as MASTER_KEY_REF, s as persistMasterKey, t as JsonAccountStore, u as AgySessionManager, v as generateAntigravityRequestId } from "./accounts-Blqno5Te.mjs";
+import { n as isProxyUnreachableError } from "./proxy-DQPIwUov.mjs";
+import { r as setThoughtSignature, t as toAgyRequestBody } from "./translate-Zf1mdBri.mjs";
 import { t as parseAgySse } from "./parse-D8bV2yqa.mjs";
-import { i as resolveAgyModel, n as listAgyModels, t as catalogModelList } from "./models-I1UAEk9x.mjs";
+import { i as resolveAgyModel, n as listAgyModels, t as catalogModelList } from "./models-3VFg0nRK.mjs";
 import { randomBytes } from "node:crypto";
 import { LlmAdapter, LlmError, ProviderRequestId, QUOTA_EXCEEDED_CODE, attributionHeaders } from "@deepseek-ai/dsh-llm";
 //#region src/runtime/classify.ts
@@ -114,6 +115,10 @@ function classifyFetchError(error) {
 		kind: "network-error",
 		message
 	};
+	if (isProxyUnreachableError(error)) return {
+		kind: "proxy-unreachable",
+		message
+	};
 	return {
 		kind: "network-error",
 		message
@@ -127,6 +132,15 @@ function classifyFetchError(error) {
 * parsing, failure classification, and rotation reporting. All wire details
 * live in translate.ts / parse.ts / models.ts.
 */
+/** Collect image refs from user-message content only (spec scope: user images; tool-result nesting out of scope). */
+function collectImageRefs(options) {
+	const refs = [];
+	for (const message of options.messages) {
+		if (message.role !== "user") continue;
+		for (const block of message.content) if (block.type === "image") refs.push(block.attachment);
+	}
+	return refs;
+}
 const UPSTREAM_ERROR_CODE = "UPSTREAM";
 /** Build the impersonation headers for one request (per-request randomization applied by the shell). */
 function buildRequestHeaders(session) {
@@ -163,7 +177,31 @@ var AgyAdapter = class extends LlmAdapter {
 	async resolveModel(provider, model) {
 		return resolveAgyModel(provider, model);
 	}
+	/**
+	* Pre-resolve every image attachment into base64 bytes before translation.
+	* Image input hard-fails with UNSUPPORTED_CONTENT (terminal, never retried)
+	* when the store is missing or a read fails — silently dropping images and
+	* sending text-only is the exact failure mode this path exists to prevent.
+	*/
+	async resolveRequestImages(options) {
+		const refs = collectImageRefs(options);
+		const images = /* @__PURE__ */ new Map();
+		if (refs.length === 0) return images;
+		const store = this.options.resolveAttachments?.();
+		if (!store) throw new LlmError("agy image input requires the durable attachment service (in-harness plugin only)", "UNSUPPORTED_CONTENT");
+		for (const ref of refs) try {
+			const stored = await store.readImage(ref);
+			images.set(ref.attachmentId, {
+				mediaType: stored.ref.mediaType,
+				data: Buffer.from(stored.data).toString("base64")
+			});
+		} catch (cause) {
+			throw new LlmError(`agy image attachment "${ref.attachmentId}" could not be loaded: ${cause instanceof Error ? cause.message : String(cause)}`, "UNSUPPORTED_CONTENT", { cause: cause instanceof Error ? cause : void 0 });
+		}
+		return images;
+	}
 	async *stream(options) {
+		const images = await this.resolveRequestImages(options);
 		let session;
 		try {
 			session = await this.options.getSession(options.model);
@@ -187,7 +225,8 @@ var AgyAdapter = class extends LlmAdapter {
 		if (!session) throw new LlmError("No agy account configured — run `dsh-agy login` to authenticate.", "NO_CREDENTIAL");
 		const body = toAgyRequestBody(options, {
 			projectId: session.account.projectId,
-			sessionId: deriveAntigravitySessionId(session.account.email) ?? void 0
+			sessionId: deriveAntigravitySessionId(session.account.email) ?? void 0,
+			...images.size > 0 ? { images } : {}
 		});
 		const headers = buildRequestHeaders(session);
 		let response;
@@ -301,11 +340,12 @@ async function createAgyRuntime(ctx) {
 		adapter: new AgyAdapter({
 			getSession: (model) => sessions.getSession(model),
 			reportFailure: (kind, session, info) => sessions.reportFailure(kind, session, info),
-			markSuccess: (session) => sessions.markSuccess(session)
+			markSuccess: (session) => sessions.markSuccess(session),
+			resolveAttachments: () => ctx.get("attachments")
 		})
 	};
 }
 //#endregion
 export { createAgyRuntime as t };
 
-//# sourceMappingURL=plugin-common-Bmz4Ife-.mjs.map
+//# sourceMappingURL=plugin-common-CP6Czgh9.mjs.map

package/lib/plugin-common-CP6Czgh9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-common-CP6Czgh9.mjs","names":[],"sources":["../src/runtime/classify.ts","../src/adapter/adapter.ts","../src/plugin-common.ts"],"sourcesContent":["/**\n * Upstream failure classification: HTTP status + headers + body → FailureKind.\n * Conservative by design: only auth-failure may revoke an account; everything\n * else cools, rotates, or retries.\n */\n\nimport type { FailureKind } from '../types.ts'\nimport { isProxyUnreachableError } from '../proxy.ts'\n\nexport interface ClassifiedError {\n  kind: FailureKind\n  status?: number\n  /** Server-provided retry delay (ms), when the response carried it. */\n  retryAfterMs?: number\n  /** Server-provided absolute reset time, when the response carried it. */\n  resetTime?: string\n  message?: string\n  /** 429 sub-category, present when kind is rate-limit. */\n  rateLimitCategory?: RateLimitCategory\n}\n\n/**\n * 429 sub-category (mirrors CLIProxyAPI/OmniRoute's classify429):\n * - soft_rate_limit: transient burst, retry immediately on the same account\n * - rate_limited:    per-minute limit, short cooldown then retry (same account\n *                    when there is no other)\n * - quota_exhausted: daily/plan quota gone, long cooldown (24h)\n * - unknown:         exponential backoff\n */\nexport type RateLimitCategory = 'soft_rate_limit' | 'rate_limited' | 'quota_exhausted' | 'unknown'\n\nconst QUOTA_EXHAUSTED_KEYWORDS = [\n  'quota_exhausted',\n  'quota exhausted',\n  'quota reached',\n  'enable overages',\n  'individual quota',\n]\n\n/** Classify a 429 body into the four upstream categories. */\nexport function classifyRateLimit(\n  bodyText: string | undefined,\n  retryAfterMs: number | undefined,\n): RateLimitCategory {\n  const text = (bodyText ?? '').toLowerCase()\n  if (QUOTA_EXHAUSTED_KEYWORDS.some((keyword) => text.includes(keyword))) {\n    return 'quota_exhausted'\n  }\n  if (retryAfterMs !== undefined && retryAfterMs < 3000) {\n    return 'soft_rate_limit'\n  }\n  if (retryAfterMs !== undefined) {\n    return 'rate_limited'\n  }\n  // No explicit retry hint: \"quota\" wording → daily quota, otherwise unknown.\n  return text.includes('quota') || text.includes('resource_exhausted') ? 'quota_exhausted' : 'unknown'\n}\n\nconst RATE_LIMIT_RESET_FIELDS = ['resetTime', 'reset_time', 'resetAt', 'quotaResetTime'] as const\n\nfunction extractResetTime(bodyText: string | undefined): string | undefined {\n  if (!bodyText) return undefined\n  try {\n    const data = JSON.parse(bodyText) as Record<string, unknown>\n    for (const field of RATE_LIMIT_RESET_FIELDS) {\n      const value = data[field]\n      if (typeof value === 'string' && value) return value\n      if (typeof value === 'number' && Number.isFinite(value)) {\n        // Unix ms when large, seconds when small (relative to now).\n        return value > 1_000_000_000_000 ? new Date(value).toISOString() : new Date(Date.now() + value * 1000).toISOString()\n      }\n    }\n    const quotaInfo = data.quotaInfo as Record<string, unknown> | undefined\n    if (quotaInfo && typeof quotaInfo.resetTime === 'string') return quotaInfo.resetTime\n  } catch {\n    // not JSON — no reset info\n  }\n  return undefined\n}\n\nfunction parseRetryAfter(header: string | null): number | undefined {\n  if (!header) return undefined\n  const seconds = Number(header)\n  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1000\n  const date = Date.parse(header)\n  if (!Number.isNaN(date)) return Math.max(0, date - Date.now())\n  return undefined\n}\n\n/** Classify a completed HTTP response (non-2xx). */\nexport function classifyHttpError(\n  status: number,\n  headers: Headers,\n  bodyText?: string,\n): ClassifiedError {\n  const retryAfterMs = parseRetryAfter(headers.get('retry-after'))\n  const resetTime = extractResetTime(bodyText)\n\n  if (status === 429) {\n    const category = classifyRateLimit(bodyText, retryAfterMs)\n    return {\n      kind: 'rate-limit',\n      rateLimitCategory: category,\n      status,\n      retryAfterMs,\n      resetTime,\n      message: bodyText ? bodyText.slice(0, 200) : undefined,\n    }\n  }\n  if (status === 401) {\n    return { kind: 'auth-failure', status, message: bodyText ? bodyText.slice(0, 200) : undefined }\n  }\n  if (status === 403) {\n    // Google also reports quota walls as 403 RESOURCE_EXHAUSTED, and the\n    // endpoint fallback chain ends on hosts answering 403 for \"no license\"\n    // (not bad auth). Only treat a 403 as auth-failure when the body carries\n    // no quota wording — a false revoke permanently disables the account.\n    const category = classifyRateLimit(bodyText, undefined)\n    if (category === 'quota_exhausted') {\n      return {\n        kind: 'rate-limit',\n        rateLimitCategory: category,\n        status,\n        message: bodyText ? bodyText.slice(0, 200) : undefined,\n      }\n    }\n    return { kind: 'auth-failure', status, message: bodyText ? bodyText.slice(0, 200) : undefined }\n  }\n  if (status === 404) {\n    // Model/route missing — nothing to rotate for; surface as transient request error.\n    return { kind: 'transient', status, message: bodyText ? bodyText.slice(0, 200) : undefined }\n  }\n  if (status >= 500) {\n    return { kind: 'transient', status, retryAfterMs, message: bodyText ? bodyText.slice(0, 200) : undefined }\n  }\n  if (status === 400) {\n    // A 400 is a request-construction error (permanent — retrying sends the\n    // same broken payload). Only capacity-style phrases are recoverable\n    // (context overflow / model unavailable), mirroring OmniRoute's\n    // classifyProviderError: everything else surfaces as a terminal\n    // request-error so rotation does not waste attempts.\n    const text = (bodyText ?? '').toLowerCase()\n    const recoverable = (\n      (text.includes('context') && (text.includes('overflow') || text.includes('too long') || text.includes('exceeded')))\n      || (text.includes('model') && (text.includes('not found') || text.includes('unavailable') || text.includes('not supported')))\n    )\n    if (recoverable) {\n      return { kind: 'transient', status, message: bodyText ? bodyText.slice(0, 200) : undefined }\n    }\n    return { kind: 'request-error', status, message: bodyText ? bodyText.slice(0, 200) : undefined }\n  }\n  // 400-range others (401 handled above): request-level errors, no rotation semantics.\n  return { kind: 'transient', status, message: bodyText ? bodyText.slice(0, 200) : undefined }\n}\n\n/** Classify a fetch-level failure (DNS, refused, timeout, abort). */\nexport function classifyFetchError(error: unknown): ClassifiedError {\n  const message = error instanceof Error ? error.message : String(error)\n  if (error instanceof DOMException && error.name === 'AbortError') {\n    return { kind: 'network-error', message }\n  }\n  if (isProxyUnreachableError(error)) {\n    return { kind: 'proxy-unreachable', message }\n  }\n  return { kind: 'network-error', message }\n}\n\n/** Classify the result of a refresh attempt (shared by adapter + verify paths). */\nexport function classifyRefreshFailure(status: number, code?: string): ClassifiedError {\n  if (code === 'invalid_grant') return { kind: 'auth-failure', status, message: code }\n  if (status === 429) return { kind: 'rate-limit', status, message: code }\n  if (status >= 500) return { kind: 'transient', status, message: code }\n  return { kind: 'transient', status, message: code }\n}\n\nexport type { FailureKind }\n","/**\n * AgyAdapter: the DSH seam. A thin orchestrator over the deep modules —\n * account session resolution (shell-provided), request translation, SSE\n * parsing, failure classification, and rotation reporting. All wire details\n * live in translate.ts / parse.ts / models.ts.\n */\n\nimport {\n  LlmAdapter,\n  LlmError,\n  ProviderRequestId,\n  QUOTA_EXCEEDED_CODE,\n  attributionHeaders,\n} from '@deepseek-ai/dsh-llm'\nimport type {\n  GenerateOptions,\n  LlmModelInfo,\n  LlmProviderInfo,\n  LlmResolvedModelInfo,\n  StreamChunk,\n  ToolSchema,\n} from '@deepseek-ai/dsh-llm'\nimport { AgyAuthError, AgyPoolBlockedError } from '../types.ts'\nimport type { AgyAccountSession, FailureKind, ManagedAccount, OAuthAuthDetails } from '../types.ts'\nimport type { RateLimitCategory } from '../runtime/classify.ts'\nimport { fetchAgyFirstOk } from '../oauth/constants.ts'\nimport { classifyFetchError, classifyHttpError } from '../runtime/classify.ts'\nimport { deriveAntigravitySessionId, generateAntigravityRequestId } from '../runtime/identity.ts'\nimport { setThoughtSignature } from '../runtime/signature-cache.ts'\nimport { toAgyRequestBody } from './translate.ts'\nimport type { AgyResolvedImage } from './translate.ts'\nimport { parseAgySse } from './parse.ts'\nimport { AGY_PROVIDER, catalogModelList, listAgyModels, resolveAgyModel } from './models.ts'\n\nexport type { AgyAccountSession }\n\n/**\n * Structural view of the harness attachment service (ctx.attachments).\n * Deliberately not an import of @deepseek-ai/dsh-attachment: the CLI bundle\n * must stay free of harness runtime dependencies, and the real store\n * satisfies this shape.\n */\nexport interface AgyAttachmentStore {\n  readImage(ref: {\n    attachmentId: string\n    mediaType: string\n  }): Promise<{ ref: { mediaType: string }; data: Uint8Array }>\n}\n\n/** Collect image refs from user-message content only (spec scope: user images; tool-result nesting out of scope). */\nfunction collectImageRefs(options: GenerateOptions): Array<{ attachmentId: string; mediaType: string }> {\n  const refs: Array<{ attachmentId: string; mediaType: string }> = []\n  for (const message of options.messages) {\n    if (message.role !== 'user') continue\n    for (const block of message.content) {\n      if (block.type === 'image') refs.push(block.attachment)\n    }\n  }\n  return refs\n}\n\nexport interface AgyAdapterOptions {\n  /** Resolve the active account for a request (model-aware: family-scoped quota ranking). */\n  getSession(model?: string): Promise<AgyAccountSession | undefined>\n  /** Report a classified upstream failure so the shell can cool/rotate/revoke. */\n  reportFailure(\n    kind: FailureKind,\n    session: AgyAccountSession,\n    info?: {\n      retryAfterMs?: number\n      status?: number\n      rateLimitCategory?: RateLimitCategory\n      /** Server-reported absolute reset time; drives precise cooldowns. */\n      resetTime?: string\n      /** Requested model id; drives family-scoped rate-limit bookkeeping. */\n      model?: string\n    },\n  ): Promise<void>\n  /** Report a clean stream completion (resets the failure counter). */\n  markSuccess?(session: AgyAccountSession): Promise<void>\n  /** Resolve the harness attachment store; undefined outside the harness (standalone CLI). */\n  resolveAttachments?(): AgyAttachmentStore | undefined\n}\n\nconst UPSTREAM_ERROR_CODE = 'UPSTREAM'\n\n/** Build the impersonation headers for one request (per-request randomization applied by the shell). */\nexport function buildRequestHeaders(session: AgyAccountSession): Record<string, string> {\n  return {\n    authorization: `Bearer ${session.auth.access}`,\n    'content-type': 'application/json',\n    accept: 'text/event-stream',\n    'x-goog-request-id': generateAntigravityRequestId(),\n    ...attributionHeaders(),\n    ...session.impersonation,\n  }\n}\n\nexport class AgyAdapter extends LlmAdapter {\n  private readonly options: AgyAdapterOptions\n\n  constructor(options: AgyAdapterOptions) {\n    super()\n    this.options = options\n  }\n\n  override providerInfo(_provider: string): LlmProviderInfo {\n    return { id: AGY_PROVIDER, name: 'Antigravity (agy)' }\n  }\n\n  override async listModels(_provider: string): Promise<readonly LlmModelInfo[]> {\n    try {\n      const session = await this.options.getSession()\n      return await listAgyModels(session?.auth.access, session?.account.projectId)\n    } catch (error) {\n      if (error instanceof AgyPoolBlockedError || error instanceof AgyAuthError) {\n        return catalogModelList()\n      }\n      throw error\n    }\n  }\n\n  override async resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo> {\n    return resolveAgyModel(provider, model)\n  }\n\n  /**\n   * Pre-resolve every image attachment into base64 bytes before translation.\n   * Image input hard-fails with UNSUPPORTED_CONTENT (terminal, never retried)\n   * when the store is missing or a read fails — silently dropping images and\n   * sending text-only is the exact failure mode this path exists to prevent.\n   */\n  private async resolveRequestImages(options: GenerateOptions): Promise<Map<string, AgyResolvedImage>> {\n    const refs = collectImageRefs(options)\n    const images = new Map<string, AgyResolvedImage>()\n    if (refs.length === 0) return images\n    const store = this.options.resolveAttachments?.()\n    if (!store) {\n      throw new LlmError(\n        'agy image input requires the durable attachment service (in-harness plugin only)',\n        'UNSUPPORTED_CONTENT',\n      )\n    }\n    for (const ref of refs) {\n      try {\n        const stored = await store.readImage(ref)\n        images.set(ref.attachmentId, {\n          mediaType: stored.ref.mediaType,\n          data: Buffer.from(stored.data).toString('base64'),\n        })\n      } catch (cause) {\n        throw new LlmError(\n          `agy image attachment \"${ref.attachmentId}\" could not be loaded: ${cause instanceof Error ? cause.message : String(cause)}`,\n          'UNSUPPORTED_CONTENT',\n          { cause: cause instanceof Error ? cause : undefined },\n        )\n      }\n    }\n    return images\n  }\n\n  override async *stream(options: GenerateOptions): AsyncIterable<StreamChunk> {\n    // Spec D1 sequence: resolve images first — a locally-failing image request\n    // must surface UNSUPPORTED_CONTENT (user story 8) instead of being masked\n    // by account-pool errors, and must not touch pool state at all.\n    const images = await this.resolveRequestImages(options)\n    let session: AgyAccountSession | undefined\n    try {\n      session = await this.options.getSession(options.model)\n    } catch (error) {\n      if (error instanceof AgyAuthError) {\n        if (error.kind === 'transport') {\n          throw new LlmError(error.message, 'TRANSPORT', { cause: error })\n        }\n        if (error.kind === 'rate-limit') {\n          throw new LlmError(error.message, 'RATE_LIMIT', {\n            requestId: ProviderRequestId(generateAntigravityRequestId()),\n          })\n        }\n        throw new LlmError(error.message, 'INVALID_CREDENTIAL', { cause: error })\n      }\n      if (error instanceof AgyPoolBlockedError) {\n        if (error.kind === 'quota-exhausted') {\n          throw new LlmError(error.message, QUOTA_EXCEEDED_CODE)\n        }\n        const delta = Math.ceil(error.blockedUntil - Date.now())\n        const providerRetryAfterMs = Number.isFinite(delta) && delta > 0 ? delta : 1\n        throw new LlmError(error.message, 'RATE_LIMIT', {\n          providerRetryAfterMs,\n          requestId: ProviderRequestId(generateAntigravityRequestId()),\n        })\n      }\n      throw error\n    }\n    if (!session) {\n      throw new LlmError(\n        'No agy account configured — run `dsh-agy login` to authenticate.',\n        'NO_CREDENTIAL',\n      )\n    }\n\n    const body = toAgyRequestBody(options, {\n      projectId: session.account.projectId,\n      sessionId: deriveAntigravitySessionId(session.account.email) ?? undefined,\n      ...(images.size > 0 ? { images } : {}),\n    })\n    const headers = buildRequestHeaders(session)\n\n    let response: Response\n    try {\n      response = await fetchAgyFirstOk('/v1internal:streamGenerateContent?alt=sse', {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(body),\n        signal: options.signal,\n      })\n    } catch (error) {\n      const classified = classifyFetchError(error)\n      await this.options.reportFailure(classified.kind, session)\n      throw new LlmError(classified.message ?? 'agy fetch failed', 'TRANSPORT', { cause: error })\n    }\n\n    if (!response.ok) {\n      const bodyText = await response.text().catch(() => undefined)\n      const classified = classifyHttpError(response.status, response.headers, bodyText)\n      await this.options.reportFailure(classified.kind, session, {\n        retryAfterMs: classified.retryAfterMs,\n        status: response.status,\n        rateLimitCategory: classified.rateLimitCategory,\n        resetTime: classified.resetTime,\n        model: options.model,\n      })\n      if (classified.kind === 'rate-limit') {\n        // soft/rate limits are retryable by the harness (RATE_LIMIT + delay);\n        // daily quota exhaustion is terminal (QUOTA, 24h cooldown already set).\n        if (classified.rateLimitCategory === 'quota_exhausted') {\n          throw new LlmError(\n            `agy daily quota exhausted (${response.status}): ${classified.message ?? ''}`,\n            QUOTA_EXCEEDED_CODE,\n          )\n        }\n        throw new LlmError(\n          `agy rate-limited (${response.status}): ${classified.message ?? ''}`,\n          'RATE_LIMIT',\n          {\n            providerRetryAfterMs: classified.retryAfterMs ?? undefined,\n            requestId: ProviderRequestId(generateAntigravityRequestId()),\n          },\n        )\n      }\n      if (classified.kind === 'auth-failure') {\n        throw new LlmError(\n          `agy authentication failed (${response.status}) — run \\`dsh-agy login\\``,\n          'INVALID_CREDENTIAL',\n        )\n      }\n      throw new LlmError(\n        `agy upstream error (${response.status}): ${classified.message ?? ''}`,\n        UPSTREAM_ERROR_CODE,\n      )\n    }\n\n    if (!response.body) {\n      throw new LlmError('agy stream returned no body', UPSTREAM_ERROR_CODE)\n    }\n\n    try {\n      yield* parseAgySse(response.body, {\n        signal: options.signal,\n        onToolSignature: (toolCallId, signature) => {\n          setThoughtSignature(toolCallId, signature)\n        },\n      })\n      await this.options.markSuccess?.(session)\n    } catch (error) {\n      if (error instanceof DOMException && error.name === 'AbortError') {\n        throw new LlmError('agy stream aborted', 'ABORTED', { cause: error })\n      }\n      await this.options.reportFailure('network-error', session)\n      throw new LlmError(\n        error instanceof Error ? error.message : 'agy stream parse failed',\n        UPSTREAM_ERROR_CODE,\n        { cause: error },\n      )\n    }\n  }\n}\n\nexport type { ToolSchema }\n","/**\n * Shared runtime construction for the in-harness plugin entries: master-key\n * codec resolution (credentials seam first, credentials document fallback),\n * account store, session manager, and adapter. Used by the main plugin\n * (adapter registration) and the web plugin (route registration) so both\n * entries operate on the same store.\n */\n\nimport { randomBytes } from 'node:crypto'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { AgyAdapter } from './adapter/adapter.ts'\nimport type { AgyAttachmentStore } from './adapter/adapter.ts'\nimport { AGY_PROVIDER } from './adapter/models.ts'\nimport { resolveAntigravityVersion } from './runtime/version.ts'\nimport { AgySessionManager } from './session.ts'\nimport { JsonAccountStore } from './store/accounts.ts'\nimport type { AccountStore } from './store/accounts.ts'\nimport {\n  MASTER_KEY_REF,\n  createAesGcmCodec,\n  deriveKey,\n  loadMasterKey,\n  persistMasterKey,\n  resolveDshHome,\n  resolveMasterKeyCodec,\n} from './store/keyring.ts'\nimport type { SecretCodec } from './store/keyring.ts'\n\nexport interface CredentialsSeam {\n  resolve(ref: string): Promise<{ value: string } | undefined>\n  set(ref: string, value: string): Promise<void>\n}\n\nfunction codecFrom(masterKey: string): SecretCodec {\n  return createAesGcmCodec(deriveKey(masterKey))\n}\n\n/** Resolve or create the master key, preferring the credentials seam when available. */\nexport async function resolveCodec(ctx: Context): Promise<{ codec: SecretCodec; created: boolean }> {\n  const dshHome = resolveDshHome()\n  const credentials = ctx.get('credentials') as CredentialsSeam | undefined\n\n  if (credentials) {\n    const resolved = await credentials.resolve(MASTER_KEY_REF)\n    if (resolved) return { codec: codecFrom(resolved.value), created: false }\n    const fileKey = loadMasterKey(dshHome)\n    if (fileKey) return { codec: codecFrom(fileKey), created: false }\n    const fresh = randomBytes(32).toString('hex')\n    try {\n      await credentials.set(MASTER_KEY_REF, fresh)\n      return { codec: codecFrom(fresh), created: true }\n    } catch {\n      // Read-only shadowing: persist to the credentials document directly.\n      persistMasterKey(dshHome, fresh)\n      return { codec: codecFrom(fresh), created: true }\n    }\n  }\n\n  return resolveMasterKeyCodec(dshHome)\n}\n\n/** Build the store, session manager, and adapter for one plugin entry. */\nexport async function createAgyRuntime(ctx: Context): Promise<{\n  store: AccountStore\n  sessions: AgySessionManager\n  adapter: AgyAdapter\n}> {\n  // Warm the version cache (non-blocking) so fingerprint generation inside\n  // the rate-limit path never waits on a cold feed.\n  void resolveAntigravityVersion().catch(() => {})\n  const { codec } = await resolveCodec(ctx)\n  const dshHome = resolveDshHome()\n  const store = new JsonAccountStore({ file: `${dshHome}/agy-accounts.json`, codec })\n  const sessions = new AgySessionManager({ store })\n  // Optional background health probe (DSH_AGY_HEALTH_INTERVAL_MS), off by default.\n  const healthIntervalMs = Number(process.env.DSH_AGY_HEALTH_INTERVAL_MS ?? 0)\n  if (Number.isFinite(healthIntervalMs) && healthIntervalMs > 0) {\n    sessions.startHealthProbe(healthIntervalMs)\n  }\n  const adapter = new AgyAdapter({\n    getSession: (model) => sessions.getSession(model),\n    reportFailure: (kind, session, info) => sessions.reportFailure(kind, session, info),\n    markSuccess: (session) => sessions.markSuccess(session),\n    resolveAttachments: () => ctx.get('attachments') as AgyAttachmentStore | undefined,\n  })\n  return { store, sessions, adapter }\n}\n\nexport { AGY_PROVIDER }\n"],"mappings":";;;;;;;;AA+BA,MAAM,2BAA2B;CAC/B;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAgB,kBACd,UACA,cACmB;CACnB,MAAM,QAAQ,YAAY,GAAA,CAAI,YAAY;CAC1C,IAAI,yBAAyB,MAAM,YAAY,KAAK,SAAS,OAAO,CAAC,GACnE,OAAO;CAET,IAAI,iBAAiB,KAAA,KAAa,eAAe,KAC/C,OAAO;CAET,IAAI,iBAAiB,KAAA,GACnB,OAAO;CAGT,OAAO,KAAK,SAAS,OAAO,KAAK,KAAK,SAAS,oBAAoB,IAAI,oBAAoB;AAC7F;AAEA,MAAM,0BAA0B;CAAC;CAAa;CAAc;CAAW;AAAgB;AAEvF,SAAS,iBAAiB,UAAkD;CAC1E,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,IAAI;EACF,MAAM,OAAO,KAAK,MAAM,QAAQ;EAChC,KAAK,MAAM,SAAS,yBAAyB;GAC3C,MAAM,QAAQ,KAAK;GACnB,IAAI,OAAO,UAAU,YAAY,OAAO,OAAO;GAC/C,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEpD,OAAO,QAAQ,eAAoB,IAAI,KAAK,KAAK,CAAC,CAAC,YAAY,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,GAAI,CAAC,CAAC,YAAY;EAEvH;EACA,MAAM,YAAY,KAAK;EACvB,IAAI,aAAa,OAAO,UAAU,cAAc,UAAU,OAAO,UAAU;CAC7E,QAAQ,CAER;AAEF;AAEA,SAAS,gBAAgB,QAA2C;CAClE,IAAI,CAAC,QAAQ,OAAO,KAAA;CACpB,MAAM,UAAU,OAAO,MAAM;CAC7B,IAAI,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG,OAAO,UAAU;CAC/D,MAAM,OAAO,KAAK,MAAM,MAAM;CAC9B,IAAI,CAAC,OAAO,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AAE/D;;AAGA,SAAgB,kBACd,QACA,SACA,UACiB;CACjB,MAAM,eAAe,gBAAgB,QAAQ,IAAI,aAAa,CAAC;CAC/D,MAAM,YAAY,iBAAiB,QAAQ;CAE3C,IAAI,WAAW,KAEb,OAAO;EACL,MAAM;EACN,mBAHe,kBAAkB,UAAU,YAGjB;EAC1B;EACA;EACA;EACA,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;CAC/C;CAEF,IAAI,WAAW,KACb,OAAO;EAAE,MAAM;EAAgB;EAAQ,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;CAAU;CAEhG,IAAI,WAAW,KAAK;EAKlB,MAAM,WAAW,kBAAkB,UAAU,KAAA,CAAS;EACtD,IAAI,aAAa,mBACf,OAAO;GACL,MAAM;GACN,mBAAmB;GACnB;GACA,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;EAC/C;EAEF,OAAO;GAAE,MAAM;GAAgB;GAAQ,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;EAAU;CAChG;CACA,IAAI,WAAW,KAEb,OAAO;EAAE,MAAM;EAAa;EAAQ,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;CAAU;CAE7F,IAAI,UAAU,KACZ,OAAO;EAAE,MAAM;EAAa;EAAQ;EAAc,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;CAAU;CAE3G,IAAI,WAAW,KAAK;EAMlB,MAAM,QAAQ,YAAY,GAAA,CAAI,YAAY;EAK1C,IAHG,KAAK,SAAS,SAAS,MAAM,KAAK,SAAS,UAAU,KAAK,KAAK,SAAS,UAAU,KAAK,KAAK,SAAS,UAAU,MAC5G,KAAK,SAAS,OAAO,MAAM,KAAK,SAAS,WAAW,KAAK,KAAK,SAAS,aAAa,KAAK,KAAK,SAAS,eAAe,IAG1H,OAAO;GAAE,MAAM;GAAa;GAAQ,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;EAAU;EAE7F,OAAO;GAAE,MAAM;GAAiB;GAAQ,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;EAAU;CACjG;CAEA,OAAO;EAAE,MAAM;EAAa;EAAQ,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG,IAAI,KAAA;CAAU;AAC7F;;AAGA,SAAgB,mBAAmB,OAAiC;CAClE,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACrE,IAAI,iBAAiB,gBAAgB,MAAM,SAAS,cAClD,OAAO;EAAE,MAAM;EAAiB;CAAQ;CAE1C,IAAI,wBAAwB,KAAK,GAC/B,OAAO;EAAE,MAAM;EAAqB;CAAQ;CAE9C,OAAO;EAAE,MAAM;EAAiB;CAAQ;AAC1C;;;;;;;;;;ACnHA,SAAS,iBAAiB,SAA8E;CACtG,MAAM,OAA2D,CAAC;CAClE,KAAK,MAAM,WAAW,QAAQ,UAAU;EACtC,IAAI,QAAQ,SAAS,QAAQ;EAC7B,KAAK,MAAM,SAAS,QAAQ,SAC1B,IAAI,MAAM,SAAS,SAAS,KAAK,KAAK,MAAM,UAAU;CAE1D;CACA,OAAO;AACT;AAyBA,MAAM,sBAAsB;;AAG5B,SAAgB,oBAAoB,SAAoD;CACtF,OAAO;EACL,eAAe,UAAU,QAAQ,KAAK;EACtC,gBAAgB;EAChB,QAAQ;EACR,qBAAqB,6BAA6B;EAClD,GAAG,mBAAmB;EACtB,GAAG,QAAQ;CACb;AACF;AAEA,IAAa,aAAb,cAAgC,WAAW;CACzC;CAEA,YAAY,SAA4B;EACtC,MAAM;EACN,KAAK,UAAU;CACjB;CAEA,aAAsB,WAAoC;EACxD,OAAO;GAAE,IAAA;GAAkB,MAAM;EAAoB;CACvD;CAEA,MAAe,WAAW,WAAqD;EAC7E,IAAI;GACF,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW;GAC9C,OAAO,MAAM,cAAc,SAAS,KAAK,QAAQ,SAAS,QAAQ,SAAS;EAC7E,SAAS,OAAO;GACd,IAAI,iBAAiB,uBAAuB,iBAAiB,cAC3D,OAAO,iBAAiB;GAE1B,MAAM;EACR;CACF;CAEA,MAAe,aAAa,UAAkB,OAA8C;EAC1F,OAAO,gBAAgB,UAAU,KAAK;CACxC;;;;;;;CAQA,MAAc,qBAAqB,SAAkE;EACnG,MAAM,OAAO,iBAAiB,OAAO;EACrC,MAAM,yBAAS,IAAI,IAA8B;EACjD,IAAI,KAAK,WAAW,GAAG,OAAO;EAC9B,MAAM,QAAQ,KAAK,QAAQ,qBAAqB;EAChD,IAAI,CAAC,OACH,MAAM,IAAI,SACR,oFACA,qBACF;EAEF,KAAK,MAAM,OAAO,MAChB,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,UAAU,GAAG;GACxC,OAAO,IAAI,IAAI,cAAc;IAC3B,WAAW,OAAO,IAAI;IACtB,MAAM,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,QAAQ;GAClD,CAAC;EACH,SAAS,OAAO;GACd,MAAM,IAAI,SACR,yBAAyB,IAAI,aAAa,yBAAyB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KACxH,uBACA,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,KAAA,EAAU,CACtD;EACF;EAEF,OAAO;CACT;CAEA,OAAgB,OAAO,SAAsD;EAI3E,MAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;EACtD,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,KAAK,QAAQ,WAAW,QAAQ,KAAK;EACvD,SAAS,OAAO;GACd,IAAI,iBAAiB,cAAc;IACjC,IAAI,MAAM,SAAS,aACjB,MAAM,IAAI,SAAS,MAAM,SAAS,aAAa,EAAE,OAAO,MAAM,CAAC;IAEjE,IAAI,MAAM,SAAS,cACjB,MAAM,IAAI,SAAS,MAAM,SAAS,cAAc,EAC9C,WAAW,kBAAkB,6BAA6B,CAAC,EAC7D,CAAC;IAEH,MAAM,IAAI,SAAS,MAAM,SAAS,sBAAsB,EAAE,OAAO,MAAM,CAAC;GAC1E;GACA,IAAI,iBAAiB,qBAAqB;IACxC,IAAI,MAAM,SAAS,mBACjB,MAAM,IAAI,SAAS,MAAM,SAAS,mBAAmB;IAEvD,MAAM,QAAQ,KAAK,KAAK,MAAM,eAAe,KAAK,IAAI,CAAC;IACvD,MAAM,uBAAuB,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,QAAQ;IAC3E,MAAM,IAAI,SAAS,MAAM,SAAS,cAAc;KAC9C;KACA,WAAW,kBAAkB,6BAA6B,CAAC;IAC7D,CAAC;GACH;GACA,MAAM;EACR;EACA,IAAI,CAAC,SACH,MAAM,IAAI,SACR,oEACA,eACF;EAGF,MAAM,OAAO,iBAAiB,SAAS;GACrC,WAAW,QAAQ,QAAQ;GAC3B,WAAW,2BAA2B,QAAQ,QAAQ,KAAK,KAAK,KAAA;GAChE,GAAI,OAAO,OAAO,IAAI,EAAE,OAAO,IAAI,CAAC;EACtC,CAAC;EACD,MAAM,UAAU,oBAAoB,OAAO;EAE3C,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,gBAAgB,6CAA6C;IAC5E,QAAQ;IACR;IACA,MAAM,KAAK,UAAU,IAAI;IACzB,QAAQ,QAAQ;GAClB,CAAC;EACH,SAAS,OAAO;GACd,MAAM,aAAa,mBAAmB,KAAK;GAC3C,MAAM,KAAK,QAAQ,cAAc,WAAW,MAAM,OAAO;GACzD,MAAM,IAAI,SAAS,WAAW,WAAW,oBAAoB,aAAa,EAAE,OAAO,MAAM,CAAC;EAC5F;EAEA,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,WAAW,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;GAC5D,MAAM,aAAa,kBAAkB,SAAS,QAAQ,SAAS,SAAS,QAAQ;GAChF,MAAM,KAAK,QAAQ,cAAc,WAAW,MAAM,SAAS;IACzD,cAAc,WAAW;IACzB,QAAQ,SAAS;IACjB,mBAAmB,WAAW;IAC9B,WAAW,WAAW;IACtB,OAAO,QAAQ;GACjB,CAAC;GACD,IAAI,WAAW,SAAS,cAAc;IAGpC,IAAI,WAAW,sBAAsB,mBACnC,MAAM,IAAI,SACR,8BAA8B,SAAS,OAAO,KAAK,WAAW,WAAW,MACzE,mBACF;IAEF,MAAM,IAAI,SACR,qBAAqB,SAAS,OAAO,KAAK,WAAW,WAAW,MAChE,cACA;KACE,sBAAsB,WAAW,gBAAgB,KAAA;KACjD,WAAW,kBAAkB,6BAA6B,CAAC;IAC7D,CACF;GACF;GACA,IAAI,WAAW,SAAS,gBACtB,MAAM,IAAI,SACR,8BAA8B,SAAS,OAAO,4BAC9C,oBACF;GAEF,MAAM,IAAI,SACR,uBAAuB,SAAS,OAAO,KAAK,WAAW,WAAW,MAClE,mBACF;EACF;EAEA,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,SAAS,+BAA+B,mBAAmB;EAGvE,IAAI;GACF,OAAO,YAAY,SAAS,MAAM;IAChC,QAAQ,QAAQ;IAChB,kBAAkB,YAAY,cAAc;KAC1C,oBAAoB,YAAY,SAAS;IAC3C;GACF,CAAC;GACD,MAAM,KAAK,QAAQ,cAAc,OAAO;EAC1C,SAAS,OAAO;GACd,IAAI,iBAAiB,gBAAgB,MAAM,SAAS,cAClD,MAAM,IAAI,SAAS,sBAAsB,WAAW,EAAE,OAAO,MAAM,CAAC;GAEtE,MAAM,KAAK,QAAQ,cAAc,iBAAiB,OAAO;GACzD,MAAM,IAAI,SACR,iBAAiB,QAAQ,MAAM,UAAU,2BACzC,qBACA,EAAE,OAAO,MAAM,CACjB;EACF;CACF;AACF;;;;;;;;;;AC7PA,SAAS,UAAU,WAAgC;CACjD,OAAO,kBAAkB,UAAU,SAAS,CAAC;AAC/C;;AAGA,eAAsB,aAAa,KAAiE;CAClG,MAAM,UAAU,eAAe;CAC/B,MAAM,cAAc,IAAI,IAAI,aAAa;CAEzC,IAAI,aAAa;EACf,MAAM,WAAW,MAAM,YAAY,QAAQ,cAAc;EACzD,IAAI,UAAU,OAAO;GAAE,OAAO,UAAU,SAAS,KAAK;GAAG,SAAS;EAAM;EACxE,MAAM,UAAU,cAAc,OAAO;EACrC,IAAI,SAAS,OAAO;GAAE,OAAO,UAAU,OAAO;GAAG,SAAS;EAAM;EAChE,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;EAC5C,IAAI;GACF,MAAM,YAAY,IAAI,gBAAgB,KAAK;GAC3C,OAAO;IAAE,OAAO,UAAU,KAAK;IAAG,SAAS;GAAK;EAClD,QAAQ;GAEN,iBAAiB,SAAS,KAAK;GAC/B,OAAO;IAAE,OAAO,UAAU,KAAK;IAAG,SAAS;GAAK;EAClD;CACF;CAEA,OAAO,sBAAsB,OAAO;AACtC;;AAGA,eAAsB,iBAAiB,KAIpC;CAGD,0BAA+B,CAAC,CAAC,YAAY,CAAC,CAAC;CAC/C,MAAM,EAAE,UAAU,MAAM,aAAa,GAAG;CACxC,MAAM,UAAU,eAAe;CAC/B,MAAM,QAAQ,IAAI,iBAAiB;EAAE,MAAM,GAAG,QAAQ;EAAqB;CAAM,CAAC;CAClF,MAAM,WAAW,IAAI,kBAAkB,EAAE,MAAM,CAAC;CAEhD,MAAM,mBAAmB,OAAO,QAAQ,IAAI,8BAA8B,CAAC;CAC3E,IAAI,OAAO,SAAS,gBAAgB,KAAK,mBAAmB,GAC1D,SAAS,iBAAiB,gBAAgB;CAQ5C,OAAO;EAAE;EAAO;EAAU,SAAA,IANN,WAAW;GAC7B,aAAa,UAAU,SAAS,WAAW,KAAK;GAChD,gBAAgB,MAAM,SAAS,SAAS,SAAS,cAAc,MAAM,SAAS,IAAI;GAClF,cAAc,YAAY,SAAS,YAAY,OAAO;GACtD,0BAA0B,IAAI,IAAI,aAAa;EACjD,CACgC;CAAE;AACpC"}

package/lib/proxy-DQPIwUov.mjs

@@ -0,0 +1,269 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { EnvHttpProxyAgent, ProxyAgent } from "undici";
+import { createConnection } from "node:net";
+//#region src/proxy.ts
+/**
+* Proxy-aware fetch: per-account proxy (http/https/socks5) + env fallback.
+* - account.proxy present => per-account dispatcher (fail-closed, not affected by NO_PROXY)
+* - otherwise => EnvHttpProxyAgent (honours HTTP_PROXY/HTTPS_PROXY/NO_PROXY)
+* Applied per-request via dispatcher option so the host's global dispatcher stays untouched.
+*/
+var proxy_exports = /* @__PURE__ */ __exportAll({
+	_envAgentForTest: () => envAgent,
+	dispatcherForAsync: () => dispatcherForAsync,
+	isProxyReachable: () => isProxyReachable,
+	isProxyUnreachableError: () => isProxyUnreachableError,
+	normalizeProxyUrl: () => normalizeProxyUrl,
+	proxiedFetch: () => proxiedFetch,
+	proxyUrlForLogs: () => proxyUrlForLogs,
+	tagProxyUnreachable: () => tagProxyUnreachable
+});
+const envAgent = new EnvHttpProxyAgent();
+const dispatcherCache = /* @__PURE__ */ new Map();
+const SUPPORTED = /* @__PURE__ */ new Set([
+	"http:",
+	"https:",
+	"socks5:",
+	"socks5h:"
+]);
+function defaultPort(protocol) {
+	if (protocol === "https:") return "443";
+	if (protocol === "socks5:" || protocol === "socks5h:") return "1080";
+	return "8080";
+}
+function normalizeProxyUrl(proxyUrl) {
+	let raw = proxyUrl.trim();
+	if (!raw) throw new Error("[proxy] empty proxy URL");
+	if (raw.toLowerCase().startsWith("socks://")) raw = "socks5://" + raw.slice(8);
+	const familyMatch = raw.match(/\?family=(ipv4|ipv6)$/);
+	const familySuffix = familyMatch ? familyMatch[0] : "";
+	const baseRaw = familySuffix ? raw.slice(0, -familySuffix.length) : raw;
+	let parsed;
+	try {
+		parsed = new URL(baseRaw);
+	} catch {
+		throw new Error(`[proxy] invalid proxy URL: ${proxyUrlForLogs(proxyUrl)}`);
+	}
+	let protocol = parsed.protocol.toLowerCase();
+	if (protocol === "socks5h:") protocol = "socks5:";
+	if (!SUPPORTED.has(protocol) && protocol !== "socks5:") {
+		if (!SUPPORTED.has(parsed.protocol.toLowerCase())) throw new Error(`[proxy] unsupported protocol: ${parsed.protocol}`);
+	}
+	if (![
+		"http:",
+		"https:",
+		"socks5:"
+	].includes(protocol)) throw new Error(`[proxy] unsupported protocol: ${parsed.protocol}`);
+	if (!parsed.hostname) throw new Error("[proxy] missing host");
+	let port = parsed.port;
+	if (!port) port = defaultPort(protocol);
+	const portNum = Number(port);
+	if (!Number.isInteger(portNum) || portNum < 1 || portNum > 65535) throw new Error("[proxy] invalid port");
+	const auth = parsed.username ? `${encodeURIComponent(parsed.username)}${parsed.password ? `:${encodeURIComponent(parsed.password)}` : ""}@` : "";
+	const normalizedBase = `${protocol}//${auth}${parsed.hostname}:${port}`;
+	return familySuffix ? `${normalizedBase}${familySuffix}` : normalizedBase;
+}
+function proxyUrlForLogs(proxyUrl) {
+	try {
+		const fam = proxyUrl.match(/\?family=(ipv4|ipv6)$/);
+		const base = fam ? proxyUrl.slice(0, -fam[0].length) : proxyUrl;
+		const u = new URL(base);
+		const port = u.port || defaultPort(u.protocol);
+		return `${u.protocol}//${u.hostname}:${port}`;
+	} catch {
+		return proxyUrl;
+	}
+}
+const PROXY_UNREACHABLE_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"ENETUNREACH",
+	"EHOSTUNREACH",
+	"EPIPE",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_SOCKET"
+]);
+function isLoopbackUrl(url) {
+	try {
+		const h = (typeof url === "string" ? new URL(url) : url).hostname.toLowerCase();
+		return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "::ffff:127.0.0.1";
+	} catch {
+		return false;
+	}
+}
+function isProxyUnreachableError(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let cur = err;
+	for (let depth = 0; cur && depth < 5 && !seen.has(cur); depth++) {
+		seen.add(cur);
+		if (cur && typeof cur === "object") {
+			const code = cur.code;
+			if (typeof code === "string" && PROXY_UNREACHABLE_CODES.has(code)) return true;
+			const errorCode = cur.errorCode;
+			if (errorCode === "proxy_unreachable" || errorCode === "PROXY_UNREACHABLE") return true;
+			if (cur.statusCode === 503) {
+				const m = cur.message;
+				if (typeof m === "string" && m.includes("Proxy unreachable")) return true;
+			}
+			const msg = cur.message;
+			if (typeof msg === "string") {
+				if (msg.includes("proxy_unreachable") || msg.includes("PROXY_UNREACHABLE")) return true;
+				for (const c of PROXY_UNREACHABLE_CODES) if (msg.includes(c)) return true;
+			}
+		}
+		cur = cur?.cause;
+		if (!cur && err?.errors && depth === 0) {
+			const errs = err.errors;
+			if (Array.isArray(errs)) {
+				for (const e of errs) if (isProxyUnreachableError(e)) return true;
+			}
+		}
+	}
+	return false;
+}
+function tagProxyUnreachable(err) {
+	if (isProxyUnreachableError(err)) {
+		const e = err;
+		e.code = "PROXY_UNREACHABLE";
+		e.errorCode = "proxy_unreachable";
+	}
+	return err;
+}
+const FAST_FAIL_TIMEOUT_MS = 2e3;
+const HEALTHY_TTL_MS = 3e4;
+const UNHEALTHY_TTL_MS = 2e3;
+const healthCache = /* @__PURE__ */ new Map();
+const healthInflight = /* @__PURE__ */ new Map();
+function tcpCheck(host, port, timeoutMs) {
+	return new Promise((resolve) => {
+		const socket = createConnection({
+			host,
+			port
+		}, () => {
+			socket.destroy();
+			resolve(true);
+		});
+		socket.setTimeout(timeoutMs);
+		socket.on("error", () => resolve(false));
+		socket.on("timeout", () => {
+			socket.destroy();
+			resolve(false);
+		});
+	});
+}
+async function isProxyReachable(proxyUrl, timeoutMs = FAST_FAIL_TIMEOUT_MS) {
+	const key = normalizeProxyUrl(proxyUrl);
+	const cached = healthCache.get(key);
+	if (cached && Date.now() - cached.at < cached.ttl) return cached.healthy;
+	const existing = healthInflight.get(key);
+	if (existing) return existing;
+	let url;
+	try {
+		const base = key.replace(/\?family=(ipv4|ipv6)$/, "");
+		url = new URL(base);
+	} catch {
+		healthCache.set(key, {
+			healthy: false,
+			at: Date.now(),
+			ttl: UNHEALTHY_TTL_MS
+		});
+		return false;
+	}
+	const probe = tcpCheck(url.hostname.replace(/^\[/, "").replace(/\]$/, ""), Number(url.port || defaultPort(url.protocol)), timeoutMs).then((healthy) => {
+		healthCache.set(key, {
+			healthy,
+			at: Date.now(),
+			ttl: healthy ? HEALTHY_TTL_MS : UNHEALTHY_TTL_MS
+		});
+		return healthy;
+	});
+	healthInflight.set(key, probe);
+	try {
+		return await probe;
+	} finally {
+		if (healthInflight.get(key) === probe) healthInflight.delete(key);
+	}
+}
+async function createSocksDispatcher(proxyUrl, dispatcherOpts) {
+	const { SocksProxyAgent } = await import("socks-proxy-agent");
+	return new SocksProxyAgent(proxyUrl);
+}
+function createHttpDispatcher(proxyUrl, dispatcherOpts) {
+	const clean = proxyUrl.replace(/\?family=(ipv4|ipv6)$/, "");
+	return new ProxyAgent({
+		uri: clean,
+		proxyTunnel: true,
+		...dispatcherOpts
+	});
+}
+const DISPATCHER_OPTS = {
+	headersTimeout: 3e4,
+	bodyTimeout: 3e4,
+	connectTimeout: 1e4,
+	keepAliveTimeout: 1,
+	keepAliveMaxTimeout: 1,
+	pipelining: 0
+};
+async function dispatcherForAsync(proxyUrl) {
+	if (!proxyUrl) return envAgent;
+	const normalized = normalizeProxyUrl(proxyUrl);
+	const cached = dispatcherCache.get(normalized);
+	if (cached) return cached;
+	const famClean = normalized.replace(/\?family=(ipv4|ipv6)$/, "");
+	let dispatcher;
+	if (famClean.startsWith("socks5:")) dispatcher = await createSocksDispatcher(normalized, DISPATCHER_OPTS);
+	else dispatcher = createHttpDispatcher(normalized, DISPATCHER_OPTS);
+	dispatcherCache.set(normalized, dispatcher);
+	return dispatcher;
+}
+function getTargetUrlString(input) {
+	if (typeof input === "string") return input;
+	try {
+		if (input instanceof URL) return input.toString();
+		if (typeof input.url === "string") return input.url;
+	} catch {}
+	return "";
+}
+/** fetch() that respects per-account proxyUrl (when given) otherwise env. */
+const proxiedFetch = async (input, init, opts) => {
+	const proxyUrl = opts?.proxyUrl ?? init?.proxyUrl;
+	const cleanInit = { ...init };
+	if (cleanInit.proxyUrl) delete cleanInit.proxyUrl;
+	if (!proxyUrl) return fetch(input, {
+		...cleanInit,
+		dispatcher: envAgent
+	});
+	const targetStr = getTargetUrlString(input);
+	if (targetStr && isLoopbackUrl(targetStr)) return fetch(input, cleanInit);
+	try {
+		if (!await isProxyReachable(proxyUrl)) {
+			const err = /* @__PURE__ */ new Error(`[Proxy Fast-Fail] Proxy unreachable: ${proxyUrlForLogs(proxyUrl)}`);
+			err.code = "PROXY_UNREACHABLE";
+			err.errorCode = "proxy_unreachable";
+			err.statusCode = 503;
+			throw err;
+		}
+	} catch (e) {
+		if (e?.errorCode === "proxy_unreachable") throw e;
+		if (e instanceof Error && e.message.startsWith("[proxy]")) throw e;
+	}
+	let dispatcher;
+	try {
+		dispatcher = await dispatcherForAsync(proxyUrl);
+	} catch (e) {
+		throw tagProxyUnreachable(e);
+	}
+	try {
+		return await fetch(input, {
+			...cleanInit,
+			dispatcher
+		});
+	} catch (err) {
+		throw tagProxyUnreachable(err);
+	}
+};
+//#endregion
+export { proxyUrlForLogs as a, proxiedFetch as i, isProxyUnreachableError as n, proxy_exports as o, normalizeProxyUrl as r, isProxyReachable as t };
+
+//# sourceMappingURL=proxy-DQPIwUov.mjs.map