// @effect-diagnostics nodeBuiltinImport:off - node:http sends the one-shot loopback callback with no proxy, redirect handling, or response logging.import * as NodeHttp from "node:http"; import { ProviderSetupError, type ProviderInstanceId } from "@t3tools/contracts";import * as Effect from "effect/Effect"; export interface AntigravityPendingCallback {  readonly redirectUri: string;  readonly state: string;} /** Only the callback advertised by this running ACP process may receive a request. */export const validateAntigravityCallbackUrl = Effect.fn("validateAntigravityCallbackUrl")(  function* (    instanceId: ProviderInstanceId,    pending: AntigravityPendingCallback,    callbackUrl: string,  ) {    const invalid = (detail: string) =>      new ProviderSetupError({ instanceId, operation: "complete", detail });    if (callbackUrl.length > 16_384) {      return yield* invalid("The sign-in response URL is too long.");    }    const callback = yield* Effect.try({      try: () => new URL(callbackUrl),      catch: () => invalid("Paste the complete redirect URL from the Google sign-in page."),    });    const expected = new URL(pending.redirectUri);    if (      callback.protocol !== "http:" ||      callback.hostname !== "127.0.0.1" ||      callback.origin !== expected.origin ||      callback.pathname !== expected.pathname ||      callback.username !== "" ||      callback.password !== "" ||      callback.hash !== ""    ) {      return yield* invalid("This redirect URL does not belong to the current sign-in.");    }    const states = callback.searchParams.getAll("state");    if (states.length !== 1 || states[0] !== pending.state) {      return yield* invalid("This redirect URL does not belong to the current sign-in.");    }    const codes = callback.searchParams.getAll("code");    const errors = callback.searchParams.getAll("error");    if (      !(        (codes.length === 1 && Boolean(codes[0]) && errors.length === 0) ||        (errors.length === 1 && Boolean(errors[0]) && codes.length === 0)      )    ) {      return yield* invalid("The redirect URL must contain one Google sign-in response.");    }    const issuers = callback.searchParams.getAll("iss");    if (      issuers.length > 1 ||      (issuers.length === 1 && issuers[0] !== "https://accounts.google.com")    ) {      return yield* invalid("The redirect URL is not a Google sign-in response.");    }    return callback;  },); /** Sends one callback, without proxies, redirects, readiness probes, or response logging. */export const forwardAntigravityCallback = (  instanceId: ProviderInstanceId,  callback: URL,): Effect.Effect<void, ProviderSetupError> =>  Effect.callback<void, ProviderSetupError>((resume) => {    const failed = () =>      new ProviderSetupError({        instanceId,        operation: "complete",        detail: "Could not deliver the sign-in response. Start sign-in again.",      });    let response: NodeHttp.IncomingMessage | undefined;    const request = NodeHttp.request(      {        protocol: "http:",        hostname: callback.hostname,        port: callback.port,        path: `${callback.pathname}${callback.search}`,        method: "GET",        agent: false,      },      (incoming) => {        response = incoming;        incoming.once("error", () => resume(Effect.fail(failed())));        incoming.once("end", () => {          const status = incoming.statusCode ?? 0;          resume(status >= 200 && status < 300 ? Effect.void : Effect.fail(failed()));        });        incoming.resume();      },    );    request.once("error", () => resume(Effect.fail(failed())));    request.end();    return Effect.sync(() => {      request.destroy();      response?.destroy();    });  }).pipe(    Effect.timeoutOrElse({      duration: "10 seconds",      orElse: () =>        Effect.fail(          new ProviderSetupError({            instanceId,            operation: "complete",            detail: "The sign-in response timed out. Start sign-in again.",          }),        ),    }),  );