dsh-antigravity-auth 0.1.0

package/lib/types/video.d.ts

@@ -0,0 +1,42 @@
+/** Gated workspace-video understanding proof of concept. */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import type { FileSystem } from '@deepseek-ai/dsh-fs';
+import { HarnessError } from '@deepseek-ai/dsh-llm';
+import type { TokenUsage } from '@deepseek-ai/dsh-llm';
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
+import type { CredentialCoordinator, HostCredential } from './credential-coordinator.ts';
+import { type PrivateTransport } from './private-transport.ts';
+export declare const name = "antigravity-video";
+export declare const inject: string[];
+export declare const ANALYZE_VIDEO_TOOL_NAME = "analyze_video";
+export declare const UNDERSTAND_VIDEO_TOOL_NAME = "analyze_video";
+export declare const ANTIGRAVITY_VIDEO_ENDPOINT: `${string}/v1internal:generateContent`;
+export declare const ANTIGRAVITY_VIDEO_MODEL = "antigravity-gemini-3.7-flash";
+export declare const ANTIGRAVITY_VIDEO_SETTINGS_NAMESPACE: import("@deepseek-ai/dsh-settings").SettingsNamespace;
+export interface AntigravityVideoSettings {
+    readonly enabled: boolean;
+    readonly model: string;
+    readonly maxBytes?: number;
+}
+export interface Config extends AntigravityVideoSettings {
+}
+export declare const Config: z<Config>;
+export interface AntigravityVideoToolOptions {
+    readonly auth: Pick<CredentialCoordinator, 'credential'> | {
+        credential(signal?: AbortSignal): Promise<HostCredential | undefined>;
+    };
+    readonly fs: Pick<FileSystem, 'resolve' | 'contains' | 'readBytes' | 'lstat' | 'stat'>;
+    readonly settings?: () => AntigravityVideoSettings;
+    readonly transport?: PrivateTransport;
+}
+export declare class AntigravityVideoError extends HarnessError {
+}
+export interface VideoAnalysisResult {
+    readonly text: string;
+    readonly usage?: TokenUsage;
+}
+export declare function createAntigravityVideoTools(options: AntigravityVideoToolOptions): readonly ToolDefinition[];
+export declare function buildVideoPayload(prompt: string, model: string, credential: Pick<HostCredential, 'projectId'>, data: Uint8Array): Record<string, unknown>;
+export declare function apply(ctx?: Context, config?: Config): void;
+//# sourceMappingURL=video.d.ts.map

package/lib/types/video.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"video.d.ts","sourceRoot":"","sources":["../../src/video.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAGxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAkB,cAAc,EAAkB,MAAM,wBAAwB,CAAA;AAG5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACxF,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAA;AAM/B,eAAO,MAAM,IAAI,sBAAsB,CAAA;AACvC,eAAO,MAAM,MAAM,UAAqC,CAAA;AACxD,eAAO,MAAM,uBAAuB,kBAAkB,CAAA;AACtD,eAAO,MAAM,0BAA0B,kBAA0B,CAAA;AACjE,eAAO,MAAM,0BAA0B,wCAAmE,CAAA;AAC1G,eAAO,MAAM,uBAAuB,iCAAiC,CAAA;AACrE,eAAO,MAAM,oCAAoC,uDAAyC,CAAA;AAE1F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,MAAO,SAAQ,wBAAwB;CAAG;AAE3D,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAI3B,CAAA;AAEF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG;QAAE,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;KAAE,CAAA;IACpI,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC,CAAA;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAA;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;CACtC;AAED,qBAAa,qBAAsB,SAAQ,YAAY;CAAG;AAE1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;CAC5B;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,2BAA2B,GAAG,SAAS,cAAc,EAAE,CA0B3G;AAmCD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,EAC7C,IAAI,EAAE,UAAU,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczB;AAED,wBAAgB,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,GAAE,MAAsF,GAAG,IAAI,CA4BzI"}

package/lib/types/wire-identity.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The only identity seam for Antigravity private requests.
+ *
+ * The community transport snapshot owns the audited provider framing. This
+ * module owns the provider headers that identify that framing and carries the
+ * truthful DSH application identity in a plugin-owned secondary header. No
+ * caller may supply, suppress, rename, or replace either identity.
+ */
+export declare const DSH_ATTRIBUTION_HEADER: "X-DeepSeek-Harness-Attribution";
+export declare const AGY_PROVIDER_USER_AGENT: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Antigravity/1.18.3 Chrome/138.0.7204.235 Electron/37.3.1 Safari/537.36";
+export declare const ANTIGRAVITY_WIRE_ORIGIN: string;
+export declare const ANTIGRAVITY_WIRE_ORIGINS: readonly string[];
+export declare const ANTIGRAVITY_WIRE_PATHS: readonly string[];
+export type WireHeaderPair = readonly [name: string, value: string];
+export interface WireIdentityHeaders {
+    readonly 'User-Agent': string;
+    readonly 'X-Goog-Api-Client': string;
+    readonly 'Client-Metadata': string;
+    readonly [DSH_ATTRIBUTION_HEADER]: string;
+}
+export interface WireRequest {
+    /** Host-only OAuth access token; it is never included in an error message. */
+    readonly authorization: string;
+    /** JSON request bytes. The community framing decides length vs chunked encoding. */
+    readonly body: string | Uint8Array;
+}
+export declare class WireIdentityError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Build the fixed provider identity plus the one required DSH carrier. */
+export declare function buildWireIdentityHeaders(): WireIdentityHeaders;
+export interface WireIdentity {
+    /** The immutable provider and secondary attribution headers. */
+    headers(): WireIdentityHeaders;
+    /**
+     * Build the exact header sequence used by the audited HTTP/1.1 framing.
+     * The caller supplies only the endpoint, bearer value, and body; arbitrary
+     * header injection is intentionally not part of this interface.
+     */
+    headerPairs(url: string, request: WireRequest): readonly WireHeaderPair[];
+    /** Serialize the provider-fixed request as literal HTTP/1.1 bytes. */
+    serialize(url: string, request: WireRequest): Uint8Array;
+}
+/** Create one immutable identity policy for all private operation callers. */
+export declare function createWireIdentity(): WireIdentity;
+/** Validate one complete, provider-fixed Wire Identity header set. */
+export declare function assertWireIdentityInvariant(value: unknown): asserts value is WireIdentityHeaders;
+//# sourceMappingURL=wire-identity.d.ts.map

package/lib/types/wire-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-identity.d.ts","sourceRoot":"","sources":["../../src/wire-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,eAAO,MAAM,sBAAsB,EAAG,gCAAyC,CAAA;AAC/E,eAAO,MAAM,uBAAuB,2JAAoC,CAAA;AACxE,eAAO,MAAM,uBAAuB,QAAuC,CAAA;AAC3E,eAAO,MAAM,wBAAwB,mBAGnC,CAAA;AACF,eAAO,MAAM,sBAAsB,mBAMjC,CAAA;AAKF,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AAEnE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;CACnC;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBAET,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,IAAI,mBAAmB,CAY9D;AAED,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,OAAO,IAAI,mBAAmB,CAAA;IAC9B;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,SAAS,cAAc,EAAE,CAAA;IACzE,sEAAsE;IACtE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,UAAU,CAAA;CACzD;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,IAAI,YAAY,CAiDjD;AAED,sEAAsE;AACtE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CA2BhG"}

package/lib/video.js

@@ -0,0 +1,320 @@
+import { i as createAntigravityAuthService, t as mountCapabilityLifecycle } from "./capability-lifecycle--tgGKajs.js";
+import { d as privateStatusError, i as DEFAULT_PRIVATE_RESPONSE_BYTES, l as createPrivateTransport, m as PrivateTransportError, p as readPrivateText } from "./private-transport-urF138qW.js";
+import { ANTIGRAVITY_WIRE_ORIGIN } from "./wire-identity.js";
+import { t as classifyPrivateFailure } from "./private-failure-B9vzUkQ7.js";
+import { admitWorkspaceVideo } from "./media-admission.js";
+import { resolveModelWithTier } from "@cortexkit/antigravity-auth-core";
+import { Buffer } from "node:buffer";
+import { HarnessError } from "@deepseek-ai/dsh-llm";
+import z from "@deepseek-ai/schemastery";
+import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
+//#region src/video.ts
+/** Gated workspace-video understanding proof of concept. */
+const name = "antigravity-video";
+const inject = [
+	"tools",
+	"fs",
+	"antigravityAuth"
+];
+const ANALYZE_VIDEO_TOOL_NAME = "analyze_video";
+const UNDERSTAND_VIDEO_TOOL_NAME = ANALYZE_VIDEO_TOOL_NAME;
+const ANTIGRAVITY_VIDEO_ENDPOINT = `${ANTIGRAVITY_WIRE_ORIGIN}/v1internal:generateContent`;
+const ANTIGRAVITY_VIDEO_MODEL = "antigravity-gemini-3.7-flash";
+const ANTIGRAVITY_VIDEO_SETTINGS_NAMESPACE = settingsNamespace("antigravity-video");
+const Config = z.object({
+	enabled: z.boolean().default(true),
+	model: z.string().default(ANTIGRAVITY_VIDEO_MODEL),
+	maxBytes: z.number().step(1).min(1).max(33554432).default(33554432)
+});
+var AntigravityVideoError = class extends HarnessError {};
+function createAntigravityVideoTools(options) {
+	const fixedOptions = {
+		...options,
+		transport: options.transport ?? createPrivateTransport({ maxRequestBytes: 50331648 })
+	};
+	return [{
+		name: ANALYZE_VIDEO_TOOL_NAME,
+		description: "Analyze an explicit MP4 file inside the active workspace with the gated Antigravity video POC.",
+		parameters: {
+			type: "object",
+			properties: {
+				path: {
+					type: "string",
+					minLength: 1,
+					maxLength: 4096
+				},
+				prompt: {
+					type: "string",
+					minLength: 1,
+					maxLength: 16384
+				},
+				model: {
+					type: "string",
+					maxLength: 256
+				}
+			},
+			required: ["path", "prompt"],
+			additionalProperties: false
+		},
+		output: {
+			schema: videoSchema,
+			render: (_args, value) => [{
+				type: "text",
+				text: value.text
+			}],
+			presentationMeta: (_args, value) => value
+		},
+		execute: async (args, exec) => executeVideo(fixedOptions, args, exec),
+		isConcurrencySafe: () => false
+	}];
+}
+async function executeVideo(options, rawArgs, exec) {
+	const settings = options.settings?.() ?? {
+		enabled: true,
+		model: "antigravity-gemini-3.7-flash"
+	};
+	if (!settings.enabled) throw new AntigravityVideoError("Antigravity Video is disabled by its capability gate", "VIDEO_DISABLED");
+	const args = parseArgs(rawArgs, settings);
+	const agent = requireAgent(exec);
+	const credential = await options.auth.credential(exec.signal);
+	if (credential === void 0) throw new AntigravityVideoError("Antigravity Video requires a logged-in account", "VIDEO_AUTH_REQUIRED");
+	const cwd = workspaceCwd(agent);
+	const admitted = await admitWorkspaceVideo({
+		fs: options.fs,
+		...settings.maxBytes === void 0 ? {} : { maxVideoBytes: settings.maxBytes }
+	}, cwd, args.path, exec.signal);
+	const transport = options.transport;
+	if (transport === void 0) throw new AntigravityVideoError("The Antigravity Video transport is unavailable", "VIDEO_FAILED");
+	let response;
+	try {
+		response = await transport.request({
+			url: ANTIGRAVITY_VIDEO_ENDPOINT,
+			accessToken: credential.accessToken,
+			body: JSON.stringify(buildVideoPayload(args.prompt, args.model, credential, admitted.data)),
+			signal: exec.signal
+		});
+	} catch (error) {
+		throw toVideoError(error);
+	}
+	const statusError = privateStatusError(response.status);
+	if (statusError !== void 0) {
+		await response.body?.cancel().catch(() => {});
+		throw toVideoError(statusError);
+	}
+	let value;
+	try {
+		value = JSON.parse(await readPrivateText(response, {
+			signal: exec.signal,
+			maxBytes: DEFAULT_PRIVATE_RESPONSE_BYTES
+		}));
+	} catch (error) {
+		throw toVideoError(error);
+	}
+	const text = extractText(value);
+	if (text === void 0) throw new AntigravityVideoError("Antigravity Video returned no text understanding", "VIDEO_RESPONSE_EMPTY");
+	const usage = extractUsage(value);
+	return {
+		text,
+		...usage === void 0 ? {} : { usage }
+	};
+}
+function buildVideoPayload(prompt, model, credential, data) {
+	const project = credential.projectId === "inductive-dreamer-qrkws" || !credential.projectId ? void 0 : credential.projectId;
+	const resolved = resolveModelWithTier(model, { cli_first: false });
+	const wireModel = resolved.actualModel.startsWith("gemini-3.7-flash") ? "gemini-3-flash" : resolved.actualModel;
+	return {
+		...project === void 0 ? {} : { project },
+		model: wireModel,
+		request: { contents: [{
+			role: "user",
+			parts: [{ text: prompt }, { inlineData: {
+				mimeType: "video/mp4",
+				data: Buffer.from(data).toString("base64")
+			} }]
+		}] }
+	};
+}
+function apply(ctx, config = {
+	enabled: true,
+	model: ANTIGRAVITY_VIDEO_MODEL,
+	maxBytes: 33554432
+}) {
+	if (ctx === void 0) return;
+	const candidate = ctx;
+	if (candidate.tools === void 0 || candidate.fs === void 0) return;
+	let current = () => config;
+	let lifecycle;
+	installSettingsSection(ctx, ANTIGRAVITY_VIDEO_SETTINGS_NAMESPACE, Config, config, {
+		setSource: (source) => {
+			current = source;
+			lifecycle?.sync();
+		},
+		onChange: () => {
+			lifecycle?.sync();
+		}
+	});
+	const provided = candidate.get?.("antigravityAuth");
+	const auth = isAuthService(provided) ? provided : createAntigravityAuthService();
+	lifecycle = mountCapabilityLifecycle({
+		ctx,
+		auth,
+		id: "video",
+		enabled: () => current().enabled,
+		register: () => {
+			const disposers = createAntigravityVideoTools({
+				auth,
+				fs: candidate.fs,
+				settings: current
+			}).map((tool) => candidate.tools.register(tool));
+			return () => {
+				for (const dispose of disposers.reverse()) dispose();
+			};
+		},
+		ownsAuth: auth !== provided,
+		label: "antigravity-video: tool lifecycle"
+	});
+}
+function isAuthService(value) {
+	return isRecord(value) && typeof value.credential === "function" && typeof value.status === "function";
+}
+function extractText(value) {
+	const output = [];
+	let outputLength = 0;
+	const visit = (item, depth = 0) => {
+		if (depth > 32 || outputLength >= 65536) return;
+		if (Array.isArray(item)) {
+			for (const child of item) visit(child, depth + 1);
+			return;
+		}
+		if (!isRecord(item)) return;
+		if (Array.isArray(item.parts)) for (const part of item.parts) {
+			if (!isRecord(part) || typeof part.text !== "string" || hasControl(part.text)) continue;
+			const text = part.text.slice(0, 65536 - outputLength);
+			output.push(text);
+			outputLength += text.length;
+		}
+		if (isRecord(item.response)) visit(item.response, depth + 1);
+		if (isRecord(item.content)) visit(item.content, depth + 1);
+		if (Array.isArray(item.candidates)) visit(item.candidates, depth + 1);
+		if (isRecord(item.serverContent)) visit(item.serverContent, depth + 1);
+		if (isRecord(item.modelTurn)) visit(item.modelTurn, depth + 1);
+	};
+	visit(value);
+	const text = output.join("").trim();
+	return text.length === 0 ? void 0 : text.slice(0, 65536);
+}
+function extractUsage(value) {
+	const visit = (item, depth = 0) => {
+		if (depth > 32) return void 0;
+		if (Array.isArray(item)) {
+			for (const child of item) {
+				const result = visit(child, depth + 1);
+				if (result !== void 0) return result;
+			}
+			return;
+		}
+		if (!isRecord(item)) return void 0;
+		const raw = isRecord(item.usageMetadata) ? item.usageMetadata : isRecord(item.usage_metadata) ? item.usage_metadata : isRecord(item.usage) ? item.usage : void 0;
+		if (raw !== void 0) {
+			const input = safeCount(raw.promptTokenCount ?? raw.inputTokenCount);
+			const output = safeCount(raw.candidatesTokenCount ?? raw.outputTokenCount);
+			const cached = safeCount(raw.cachedContentTokenCount ?? raw.cacheReadTokens);
+			const reasoning = safeCount(raw.thoughtsTokenCount ?? raw.reasoningTokenCount);
+			if (input !== void 0 || output !== void 0 || cached !== void 0 || reasoning !== void 0) return {
+				inputTokens: input ?? 0,
+				outputTokens: output ?? 0,
+				...cached === void 0 ? {} : { cacheReadTokens: cached },
+				...reasoning === void 0 ? {} : { reasoningTokens: reasoning }
+			};
+		}
+		for (const key of [
+			"response",
+			"candidates",
+			"serverContent"
+		]) {
+			const result = visit(item[key], depth + 1);
+			if (result !== void 0) return result;
+		}
+	};
+	return visit(value);
+}
+function safeCount(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function parseArgs(value, settings) {
+	if (!isRecord(value) || hasExtra(value, [
+		"path",
+		"prompt",
+		"model"
+	]) || typeof value.path !== "string" || typeof value.prompt !== "string" || value.path.length === 0 || value.path.length > 4096 || value.prompt.trim().length === 0 || value.prompt.length > 16384) throw new AntigravityVideoError("analyze_video expects a closed path and prompt object", "INVALID_ARGS");
+	const model = value.model === void 0 ? settings.model : value.model;
+	if (typeof model !== "string" || model.trim().length === 0 || model.length > 256) throw new AntigravityVideoError("The video model is invalid", "INVALID_ARGS");
+	return {
+		path: value.path,
+		prompt: value.prompt.trim().slice(0, 16384),
+		model: model.trim()
+	};
+}
+function requireAgent(exec) {
+	if (exec.agent === void 0) throw new AntigravityVideoError("Video analysis requires an active workspace", "VIDEO_WORKSPACE_REQUIRED");
+	workspaceCwd(exec.agent);
+	return exec.agent;
+}
+function workspaceCwd(agent) {
+	const cwd = agent.session.header.cwd;
+	if (typeof cwd !== "string" || cwd.length === 0) throw new AntigravityVideoError("Video analysis requires an active workspace", "VIDEO_WORKSPACE_REQUIRED");
+	return cwd;
+}
+const VIDEO_FAILURE_CODES = {
+	authentication: "VIDEO_AUTH_REQUIRED",
+	forbidden: "VIDEO_FORBIDDEN",
+	"rate-limited": "VIDEO_RATE_LIMITED",
+	cancelled: "VIDEO_CANCELLED",
+	timeout: "VIDEO_TIMEOUT",
+	"attribution-rejected": "VIDEO_PROTOCOL_DRIFT",
+	"protocol-drift": "VIDEO_PROTOCOL_DRIFT",
+	"response-limit": "VIDEO_PROTOCOL_DRIFT",
+	"request-limit": "VIDEO_PROTOCOL_DRIFT",
+	upstream: "VIDEO_FAILED",
+	network: "VIDEO_FAILED",
+	failed: "VIDEO_FAILED"
+};
+function toVideoError(error) {
+	if (error instanceof AntigravityVideoError) return error;
+	if (error instanceof PrivateTransportError) return new AntigravityVideoError("The Antigravity Video request failed safely", VIDEO_FAILURE_CODES[classifyPrivateFailure(error)]);
+	return new AntigravityVideoError("The Antigravity Video request failed safely", "VIDEO_FAILED");
+}
+function hasControl(value) {
+	for (const character of value) {
+		const code = character.charCodeAt(0);
+		if (code < 32 || code === 127) return true;
+	}
+	return false;
+}
+function hasExtra(value, allowed) {
+	return Object.keys(value).some((key) => !allowed.includes(key));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const videoSchema = {
+	type: "object",
+	properties: {
+		text: { type: "string" },
+		usage: {
+			type: "object",
+			properties: {
+				inputTokens: { type: "integer" },
+				outputTokens: { type: "integer" },
+				cacheReadTokens: { type: "integer" },
+				reasoningTokens: { type: "integer" }
+			},
+			required: ["inputTokens", "outputTokens"],
+			additionalProperties: false
+		}
+	},
+	required: ["text"],
+	additionalProperties: false
+};
+//#endregion
+export { ANALYZE_VIDEO_TOOL_NAME, ANTIGRAVITY_VIDEO_ENDPOINT, ANTIGRAVITY_VIDEO_MODEL, ANTIGRAVITY_VIDEO_SETTINGS_NAMESPACE, AntigravityVideoError, Config, UNDERSTAND_VIDEO_TOOL_NAME, apply, buildVideoPayload, createAntigravityVideoTools, inject, name };

package/lib/wire-identity.js

@@ -0,0 +1,162 @@
+import { ANTIGRAVITY_ENDPOINT, ANTIGRAVITY_ENDPOINT_PROD, ANTIGRAVITY_HEADERS, buildAgyCliHeaderPairs } from "@cortexkit/antigravity-auth-core";
+import { Buffer } from "node:buffer";
+import { attributionHeaders } from "@deepseek-ai/dsh-llm";
+//#region src/wire-identity.ts
+/**
+* The only identity seam for Antigravity private requests.
+*
+* The community transport snapshot owns the audited provider framing. This
+* module owns the provider headers that identify that framing and carries the
+* truthful DSH application identity in a plugin-owned secondary header. No
+* caller may supply, suppress, rename, or replace either identity.
+*/
+const DSH_ATTRIBUTION_HEADER = "X-DeepSeek-Harness-Attribution";
+const AGY_PROVIDER_USER_AGENT = ANTIGRAVITY_HEADERS["User-Agent"];
+const ANTIGRAVITY_WIRE_ORIGIN = new URL(ANTIGRAVITY_ENDPOINT).origin;
+const ANTIGRAVITY_WIRE_ORIGINS = Object.freeze([new URL(ANTIGRAVITY_ENDPOINT).origin, new URL(ANTIGRAVITY_ENDPOINT_PROD).origin]);
+const ANTIGRAVITY_WIRE_PATHS = Object.freeze([
+	"/v1internal:loadCodeAssist",
+	"/v1internal:streamGenerateContent",
+	"/v1internal:generateContent",
+	"/v1internal:retrieveUserQuotaSummary",
+	"/v1internal:fetchAvailableModels"
+]);
+const MAX_HEADER_VALUE_LENGTH = 1024;
+const ATTRIBUTION_KEYS = /* @__PURE__ */ new Set(["user-agent", "User-Agent"]);
+var WireIdentityError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "WireIdentityError";
+		this.code = code;
+	}
+};
+/** Build the fixed provider identity plus the one required DSH carrier. */
+function buildWireIdentityHeaders() {
+	const attribution = readAttributionValue();
+	const provider = {
+		"User-Agent": ANTIGRAVITY_HEADERS["User-Agent"],
+		"X-Goog-Api-Client": ANTIGRAVITY_HEADERS["X-Goog-Api-Client"],
+		"Client-Metadata": ANTIGRAVITY_HEADERS["Client-Metadata"]
+	};
+	for (const [name, value] of Object.entries(provider)) assertSafeHeaderValue(name, value, "WIRE_PROVIDER_HEADER_UNSAFE");
+	return Object.freeze({
+		...provider,
+		[DSH_ATTRIBUTION_HEADER]: attribution
+	});
+}
+/** Create one immutable identity policy for all private operation callers. */
+function createWireIdentity() {
+	const headers = buildWireIdentityHeaders();
+	const headerPairs = (url, request) => {
+		assertHttpsEndpoint(url);
+		assertClosedObject(request, ["authorization", "body"], "WIRE_REQUEST_OVERRIDE");
+		if (typeof request.body !== "string" && !(request.body instanceof Uint8Array)) throw new WireIdentityError("WIRE_REQUEST_BODY_INVALID", "The private request body is not bounded bytes");
+		const authorization = validateAuthorization(request.authorization);
+		const basePairs = buildAgyCliHeaderPairs(url, {
+			method: "POST",
+			body: request.body,
+			headers: {
+				"User-Agent": headers["User-Agent"],
+				Authorization: authorization,
+				"Content-Type": "application/json",
+				"Accept-Encoding": "gzip"
+			}
+		});
+		const result = [];
+		for (const pair of basePairs) {
+			const immutablePair = Object.freeze([pair[0], pair[1]]);
+			result.push(immutablePair);
+			if (pair[0] === "User-Agent") result.push(Object.freeze(["X-Goog-Api-Client", headers["X-Goog-Api-Client"]]), Object.freeze(["Client-Metadata", headers["Client-Metadata"]]), Object.freeze([DSH_ATTRIBUTION_HEADER, headers[DSH_ATTRIBUTION_HEADER]]));
+		}
+		return Object.freeze(result);
+	};
+	const serialize = (url, request) => {
+		const parsed = new URL(url);
+		const pairs = headerPairs(url, request);
+		const body = typeof request.body === "string" ? Buffer.from(request.body) : Buffer.from(request.body);
+		const lines = pairs.map(([name, value]) => `${name}: ${value}`).join("\r\n");
+		const head = Buffer.from(`POST ${parsed.pathname}${parsed.search} HTTP/1.1\r\n${lines}\r\n\r\n`);
+		if (!pairs.some(([name]) => name === "Transfer-Encoding")) return body.byteLength === 0 ? head : Buffer.concat([head, body]);
+		if (body.byteLength === 0) return Buffer.concat([head, Buffer.from("0\r\n\r\n")]);
+		return Buffer.concat([
+			head,
+			Buffer.from(`${body.byteLength.toString(16)}\r\n`),
+			body,
+			Buffer.from("\r\n0\r\n\r\n")
+		]);
+	};
+	return Object.freeze({
+		headers: () => headers,
+		headerPairs,
+		serialize
+	});
+}
+/** Validate one complete, provider-fixed Wire Identity header set. */
+function assertWireIdentityInvariant(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new WireIdentityError("WIRE_IDENTITY_INVARIANT", "Wire identity headers must be an object");
+	const headers = value;
+	const expected = [
+		"Client-Metadata",
+		"User-Agent",
+		"X-Goog-Api-Client",
+		DSH_ATTRIBUTION_HEADER
+	].sort();
+	const keys = Object.keys(headers).sort();
+	if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new WireIdentityError("WIRE_IDENTITY_INVARIANT", "Wire identity headers contain an unexpected field");
+	if (headers["User-Agent"] !== ANTIGRAVITY_HEADERS["User-Agent"] || headers["X-Goog-Api-Client"] !== ANTIGRAVITY_HEADERS["X-Goog-Api-Client"] || headers["Client-Metadata"] !== ANTIGRAVITY_HEADERS["Client-Metadata"]) throw new WireIdentityError("WIRE_IDENTITY_INVARIANT", "Wire identity provider headers changed");
+	if (headers["X-DeepSeek-Harness-Attribution"] === ANTIGRAVITY_HEADERS["User-Agent"]) throw new WireIdentityError("WIRE_IDENTITY_INVARIANT", "Wire identity attribution was replaced by the provider");
+	for (const key of expected) {
+		const header = headers[key];
+		if (typeof header !== "string") throw new WireIdentityError("WIRE_IDENTITY_INVARIANT", "Wire identity contains a non-text field");
+		assertSafeHeaderValue(key, header, "WIRE_IDENTITY_INVARIANT");
+	}
+}
+function readAttributionValue() {
+	let value;
+	try {
+		value = attributionHeaders();
+	} catch {
+		throw new WireIdentityError("WIRE_ATTRIBUTION_UNAVAILABLE", "DSH attribution could not be constructed");
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new WireIdentityError("WIRE_ATTRIBUTION_INVALID", "DSH attribution returned an invalid header set");
+	const keys = Object.keys(value);
+	if (keys.length === 0) throw new WireIdentityError("WIRE_ATTRIBUTION_MISSING", "DSH attribution did not contain a User-Agent");
+	for (const key of keys) if (!ATTRIBUTION_KEYS.has(key)) throw new WireIdentityError("WIRE_ATTRIBUTION_UNEXPECTED", "DSH attribution contained an unapproved header");
+	const lower = value["user-agent"];
+	const title = value["User-Agent"];
+	if (lower !== void 0 && title !== void 0) throw new WireIdentityError("WIRE_ATTRIBUTION_DUPLICATE", "DSH attribution contained duplicate User-Agent fields");
+	const attribution = lower ?? title;
+	if (attribution === void 0) throw new WireIdentityError("WIRE_ATTRIBUTION_MISSING", "DSH attribution did not contain a User-Agent");
+	if (attribution === ANTIGRAVITY_HEADERS["User-Agent"]) throw new WireIdentityError("WIRE_ATTRIBUTION_PROVIDER_OVERRIDE", "DSH attribution was replaced by the Antigravity provider identity");
+	assertSafeHeaderValue(DSH_ATTRIBUTION_HEADER, attribution, "WIRE_ATTRIBUTION_UNSAFE");
+	return attribution;
+}
+function validateAuthorization(value) {
+	if (typeof value !== "string" || !/^Bearer\s+\S+$/u.test(value)) throw new WireIdentityError("WIRE_REQUEST_UNSAFE_AUTHORIZATION", "The private request authorization value is invalid");
+	assertSafeHeaderValue("Authorization", value, "WIRE_REQUEST_UNSAFE_AUTHORIZATION");
+	return value;
+}
+function assertSafeHeaderValue(name, value, code) {
+	if (typeof value !== "string" || value.length === 0 || value.length > MAX_HEADER_VALUE_LENGTH) throw new WireIdentityError(code, `${name} is outside the safe header-value bounds`);
+	for (let index = 0; index < value.length; index += 1) {
+		const codePoint = value.charCodeAt(index);
+		if (codePoint < 32 || codePoint === 127) throw new WireIdentityError(code, `${name} contains an unsafe header character`);
+	}
+}
+function assertHttpsEndpoint(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new WireIdentityError("WIRE_REQUEST_ENDPOINT_INVALID", "The private request endpoint is invalid");
+	}
+	if (parsed.protocol !== "https:" || !ANTIGRAVITY_WIRE_ORIGINS.some((origin) => origin === parsed.origin) || !ANTIGRAVITY_WIRE_PATHS.some((path) => path === parsed.pathname) || parsed.search.length > 0 && parsed.search !== "?alt=sse" || parsed.hash.length > 0) throw new WireIdentityError("WIRE_REQUEST_ENDPOINT_INVALID", "The private request endpoint is not allowlisted");
+}
+function assertClosedObject(value, allowedKeys, code) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new WireIdentityError(code, "The wire identity input must be a closed object");
+	const allowed = new Set(allowedKeys);
+	for (const key of Object.keys(value)) if (!allowed.has(key)) throw new WireIdentityError(code, "The wire identity input contains an unapproved override");
+}
+//#endregion
+export { AGY_PROVIDER_USER_AGENT, ANTIGRAVITY_WIRE_ORIGIN, ANTIGRAVITY_WIRE_ORIGINS, ANTIGRAVITY_WIRE_PATHS, DSH_ATTRIBUTION_HEADER, WireIdentityError, assertWireIdentityInvariant, buildWireIdentityHeaders, createWireIdentity };