Backend-Selected Authentication Recovery

Backend-Selected Authentication Recovery An architecture diagram generated by Archify. LazyWebSidecar · _client_compat.py · Architecture component · no keepalive LazyWebSidecar _client_compat.py no keepalive WebRuntime · auth_coord · persistence · Web cookie recovery · primary or sidecar WebRuntime auth_coord · persistence primary or sidecar Web Refresh · AuthRefreshCoordinator · Web cookie recovery · single flight Web Refresh AuthRefreshCoordinator single flight Recovery Ladder · PSIDTS · headless · remint · Web cookie recovery · Web cookies Recovery Ladder PSIDTS · headless · remint Web cookies NotebookLMClient · refresh_auth dispatch · Architecture component · authoritative _auth NotebookLMClient refresh_auth dispatch authoritative _auth client.raw · selected wire adapter · Architecture component · no cross-backend fallback client.raw selected wire adapter no cross-backend fallback AuthTokens · mutable · aliased · Web cookie recovery · client-owned AuthTokens mutable · aliased client-owned ProfileStore · cookie + master-token records · Web cookie recovery · atomic lock-guarded I/O ProfileStore cookie + master-token records atomic lock-guarded I/O AndroidRuntime · bearer_provider field · Android bearer authority · no Web cookie I/O AndroidRuntime bearer_provider field no Web cookie I/O BearerProvider · generation-fenced cache · Android bearer authority · compare-and-clear BearerProvider generation-fenced cache compare-and-clear Google OAuth · Android scope mint · Android bearer authority Google OAuth Android scope mint MasterToken · durable bootstrap · Android bearer authority · redacted repr MasterToken durable bootstrap redacted repr deprecated rpc_call lazy materialise selects WebRawAPI AndroidRawAPI refresh_auth escalate mutate in place load · merge persist refresh_auth gpsoauth new generation Web cookie recovery Android bearer authority Legend Backend Database Cloud Security

Backend dispatch

  • • refresh_auth uses WebRuntime.auth_coord on Web and AndroidRuntime.bearer_provider on Android
  • • Android re-mints by generation; its Web ladder exists only after the compatibility runtime is materialised

Raw access guardrail

  • • WebRawAPI accepts Web RPCMethod values; AndroidRawAPI accepts explicit gRPC descriptors
  • • Android calls do not build Web transport; only deprecated rpc_call materialises the sidecar's WebRuntime

Credential ownership

  • • NotebookLMClient._auth remains the authoritative mutable AuthTokens instance
  • • Web persists cookies; Android performs no cookie I/O and uses MasterToken only to mint its bearer