@amir83nasr/10router 0.1.0

package/src/sse/handlers/tts.js

@@ -0,0 +1,157 @@
+import {
+  extractApiKey,
+  isValidApiKey,
+  getProviderCredentials,
+  markAccountUnavailable,
+} from "../services/auth";
+import { getSettings } from "@/lib/localDb";
+import { getModelInfo, getComboModels } from "../services/model";
+import { handleTtsCore } from "open-sse/handlers/ttsCore.js";
+import { errorResponse, unavailableResponse } from "open-sse/utils/error.js";
+import { HTTP_STATUS } from "open-sse/config/runtimeConfig.js";
+import { AI_PROVIDERS } from "@/shared/constants/providers";
+import { handleComboChat } from "open-sse/services/combo.js";
+import * as log from "../utils/logger";
+
+// Derived from providers.js: any TTS provider not noAuth requires stored credentials
+const CREDENTIALED_PROVIDERS = new Set(
+  Object.entries(AI_PROVIDERS)
+    .filter(
+      ([, p]) => p.serviceKinds?.includes("tts") && !p.noAuth && p.ttsConfig?.authType !== "none",
+    )
+    .map(([id]) => id),
+);
+
+export async function handleTts(request) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return errorResponse(HTTP_STATUS.BAD_REQUEST, "Invalid JSON body");
+  }
+
+  const url = new URL(request.url);
+  const modelStr = body.model;
+  const responseFormat = url.searchParams.get("response_format") || "mp3"; // mp3 (default) | json
+  const language = body.language || ""; // Optional language hint (currently used by Gemini)
+  const style = body.style || ""; // Optional style/voice instructions (e.g. Xiaomi MiMo)
+  log.request(
+    "POST",
+    `${url.pathname} | ${modelStr} | format=${responseFormat}${language ? ` | lang=${language}` : ""}`,
+  );
+
+  const settings = await getSettings();
+  if (settings.requireApiKey) {
+    const apiKey = extractApiKey(request);
+    if (!apiKey) return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Missing API key");
+    const valid = await isValidApiKey(apiKey);
+    if (!valid) return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Invalid API key");
+  }
+
+  if (!modelStr) return errorResponse(HTTP_STATUS.BAD_REQUEST, "Missing model");
+  if (!body.input) return errorResponse(HTTP_STATUS.BAD_REQUEST, "Missing required field: input");
+
+  // Combo expansion: model may be a combo name → run fallback/round-robin across models
+  const comboModels = await getComboModels(modelStr);
+  if (comboModels) {
+    const comboStrategies = settings.comboStrategies || {};
+    const comboStrategy =
+      comboStrategies[modelStr]?.fallbackStrategy || settings.comboStrategy || "fallback";
+    const comboStickyLimit = settings.comboStickyRoundRobinLimit;
+    log.info(
+      "TTS",
+      `Combo "${modelStr}" with ${comboModels.length} models (strategy: ${comboStrategy}, sticky: ${comboStickyLimit})`,
+    );
+    return handleComboChat({
+      body,
+      models: comboModels,
+      handleSingleModel: (b, m) => handleSingleModelTts(b, m, responseFormat, language, style),
+      log,
+      comboName: modelStr,
+      comboStrategy,
+      comboStickyLimit,
+    });
+  }
+
+  return handleSingleModelTts(body, modelStr, responseFormat, language, style);
+}
+
+async function handleSingleModelTts(body, modelStr, responseFormat, language, style) {
+  const modelInfo = await getModelInfo(modelStr);
+  if (!modelInfo.provider) return errorResponse(HTTP_STATUS.BAD_REQUEST, "Invalid model format");
+
+  const { provider, model } = modelInfo;
+  log.info("ROUTING", `Provider: ${provider}, Voice: ${model}`);
+
+  // noAuth providers — no credential needed
+  if (!CREDENTIALED_PROVIDERS.has(provider)) {
+    const result = await handleTtsCore({
+      provider,
+      model,
+      input: body.input,
+      responseFormat,
+      language,
+      style,
+    });
+    if (result.success) return result.response;
+    return errorResponse(result.status || HTTP_STATUS.BAD_GATEWAY, result.error || "TTS failed");
+  }
+
+  // Credentialed providers — fallback loop (same pattern as embeddings)
+  const excludeConnectionIds = new Set();
+  let lastError = null;
+  let lastStatus = null;
+
+  while (true) {
+    const credentials = await getProviderCredentials(provider, excludeConnectionIds, model);
+
+    if (!credentials || credentials.allRateLimited) {
+      if (credentials?.allRateLimited) {
+        const msg = lastError || credentials.lastError || "Unavailable";
+        const status =
+          lastStatus || Number(credentials.lastErrorCode) || HTTP_STATUS.SERVICE_UNAVAILABLE;
+        return unavailableResponse(
+          status,
+          `[${provider}/${model}] ${msg}`,
+          credentials.retryAfter,
+          credentials.retryAfterHuman,
+        );
+      }
+      if (excludeConnectionIds.size === 0)
+        return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${provider}`);
+      return errorResponse(
+        lastStatus || HTTP_STATUS.SERVICE_UNAVAILABLE,
+        lastError || "All accounts unavailable",
+      );
+    }
+
+    log.info("AUTH", `\x1b[32mUsing ${provider} account: ${credentials.connectionName}\x1b[0m`);
+
+    const result = await handleTtsCore({
+      provider,
+      model,
+      input: body.input,
+      credentials,
+      responseFormat,
+      language,
+      style,
+    });
+
+    if (result.success) return result.response;
+
+    const { shouldFallback } = await markAccountUnavailable(
+      credentials.connectionId,
+      result.status,
+      result.error,
+      provider,
+      model,
+    );
+    if (shouldFallback) {
+      excludeConnectionIds.add(credentials.connectionId);
+      lastError = result.error;
+      lastStatus = result.status;
+      continue;
+    }
+    return result.response || errorResponse(result.status, result.error);
+  }
+}

package/src/sse/handlers/videoGeneration.js

@@ -0,0 +1,274 @@
+import {
+  getProviderCredentials,
+  markAccountUnavailable,
+  clearAccountError,
+  extractApiKey,
+  isValidApiKey,
+} from "../services/auth";
+import { getSettings, getProviderConnectionById } from "@/lib/localDb";
+import { getModelInfo } from "../services/model";
+import {
+  handleVideoProxyCore,
+  getVideoConfig,
+  sanitizeSecrets,
+} from "open-sse/handlers/videoCore.js";
+import { errorResponse, unavailableResponse } from "open-sse/utils/error.js";
+import { HTTP_STATUS } from "open-sse/config/runtimeConfig.js";
+import { updateProviderCredentials, checkAndRefreshToken } from "../services/tokenRefresh";
+import * as log from "../utils/logger";
+
+// Video generation is xAI-only today; requests without a provider prefix
+// (bare model id, or multipart bodies we deliberately don't parse) land here.
+const DEFAULT_VIDEO_PROVIDER = "xai";
+
+/**
+ * Poll requests carry no model, so the provider comes from the pinned
+ * connection (`x-connection-id`, returned on create) or an explicit
+ * `?provider=` — falling back to the historical xAI default.
+ */
+async function resolveGetProvider(request, connectionId) {
+  if (connectionId) {
+    const conn = await getProviderConnectionById(connectionId).catch(() => null);
+    if (conn?.provider && getVideoConfig(conn.provider)) return conn.provider;
+  }
+  const queried = new URL(request.url).searchParams.get("provider");
+  if (queried && getVideoConfig(queried)) return queried;
+  return DEFAULT_VIDEO_PROVIDER;
+}
+
+// Creation POSTs are billable jobs — only rotate to another account for
+// errors that upstream rejects BEFORE creating a job (auth/quota). A 5xx may
+// have created the job, so it is returned to the caller instead of re-sent.
+const CREATE_ROTATION_STATUSES = new Set([
+  HTTP_STATUS.UNAUTHORIZED,
+  HTTP_STATUS.FORBIDDEN,
+  HTTP_STATUS.RATE_LIMITED,
+]);
+
+async function requireValidApiKey(request) {
+  const apiKey = extractApiKey(request);
+  const settings = await getSettings();
+  if (settings.requireApiKey) {
+    if (!apiKey) return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Missing API key");
+    const valid = await isValidApiKey(apiKey);
+    if (!valid) return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Invalid API key");
+  }
+  return null;
+}
+
+/**
+ * Read the request body once, byte-preserving.
+ * JSON bodies are additionally parsed so the `model` provider prefix can be
+ * resolved (and stripped) — everything else is forwarded exactly as received.
+ */
+async function readForwardableBody(request) {
+  const contentType = request.headers.get("content-type") || "";
+  if (contentType.includes("application/json")) {
+    const raw = await request.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return { error: errorResponse(HTTP_STATUS.BAD_REQUEST, "Invalid JSON body") };
+    }
+    return { raw, parsed, contentType };
+  }
+  // Multipart (or any other content type): forward the exact bytes — parsing
+  // and re-encoding FormData would change the multipart boundary.
+  const buf = Buffer.from(await request.arrayBuffer());
+  return { raw: buf, parsed: null, contentType };
+}
+
+async function resolveVideoProvider(parsedBody) {
+  if (!parsedBody?.model) return { provider: DEFAULT_VIDEO_PROVIDER, model: null };
+
+  const modelStr = String(parsedBody.model);
+  const modelInfo = await getModelInfo(modelStr);
+  if (!modelInfo.provider) {
+    return {
+      error: errorResponse(
+        HTTP_STATUS.BAD_REQUEST,
+        "Combos are not supported for video generation",
+      ),
+    };
+  }
+  if (!getVideoConfig(modelInfo.provider)) {
+    // Bare model ids (no explicit "provider/" prefix) fall back to the default
+    // video provider — the prefix-less inference targets chat providers only.
+    if (!modelStr.includes("/")) {
+      return { provider: DEFAULT_VIDEO_PROVIDER, model: modelStr };
+    }
+    return {
+      error: errorResponse(
+        HTTP_STATUS.BAD_REQUEST,
+        `Provider '${modelInfo.provider}' does not support video generation`,
+      ),
+    };
+  }
+  return { provider: modelInfo.provider, model: modelInfo.model };
+}
+
+function withConnectionHeader(response, connectionId) {
+  if (!connectionId) return response;
+  const headers = new Headers(response.headers);
+  // Video jobs are account-bound upstream — clients echo this back as
+  // `x-connection-id` on GET polls so the same account is used.
+  headers.set("x-10router-connection-id", String(connectionId));
+  return new Response(response.body, { status: response.status, headers });
+}
+
+/**
+ * POST /v1/videos/{generations|edits|extensions} — async job creation proxy.
+ */
+export async function handleVideoCreate(request, action) {
+  const authError = await requireValidApiKey(request);
+  if (authError) return authError;
+
+  const bodyInfo = await readForwardableBody(request);
+  if (bodyInfo.error) return bodyInfo.error;
+
+  const resolved = await resolveVideoProvider(bodyInfo.parsed);
+  if (resolved.error) return resolved.error;
+  const { provider, model } = resolved;
+
+  // Strip the provider prefix (e.g. "xai/grok-imagine-video") before forwarding;
+  // otherwise forward the original bytes untouched.
+  let forwardBody = bodyInfo.raw;
+  if (bodyInfo.parsed && model && bodyInfo.parsed.model !== model) {
+    forwardBody = JSON.stringify({ ...bodyInfo.parsed, model });
+  }
+
+  const preferredConnectionId = request.headers.get("x-connection-id") || null;
+  const idempotencyKey = request.headers.get("idempotency-key") || null;
+
+  const excludeConnectionIds = new Set();
+  let lastError = null;
+  let lastStatus = null;
+
+  while (true) {
+    const credentials = await getProviderCredentials(provider, excludeConnectionIds, model, {
+      preferredConnectionId,
+    });
+
+    if (!credentials || credentials.allRateLimited) {
+      if (credentials?.allRateLimited) {
+        const errorMsg = lastError || credentials.lastError || "Unavailable";
+        const status =
+          lastStatus || Number(credentials.lastErrorCode) || HTTP_STATUS.SERVICE_UNAVAILABLE;
+        return unavailableResponse(
+          status,
+          `[${provider}/${model || "video"}] ${errorMsg}`,
+          credentials.retryAfter,
+          credentials.retryAfterHuman,
+        );
+      }
+      if (excludeConnectionIds.size === 0) {
+        return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${provider}`);
+      }
+      return errorResponse(
+        lastStatus || HTTP_STATUS.SERVICE_UNAVAILABLE,
+        lastError || "All accounts unavailable",
+      );
+    }
+
+    const refreshedCredentials = await checkAndRefreshToken(provider, credentials);
+
+    const result = await handleVideoProxyCore({
+      provider,
+      action,
+      rawBody: forwardBody,
+      contentType: bodyInfo.contentType || null,
+      idempotencyKey,
+      credentials: refreshedCredentials,
+      signal: request.signal,
+      log,
+      onCredentialsRefreshed: async (newCreds) => {
+        await updateProviderCredentials(credentials.connectionId, {
+          accessToken: newCreds.accessToken,
+          refreshToken: newCreds.refreshToken,
+          providerSpecificData: newCreds.providerSpecificData,
+          testStatus: "active",
+        });
+      },
+    });
+
+    if (result.success) {
+      await clearAccountError(credentials.connectionId, credentials, model);
+      log.info(
+        "VIDEO",
+        `${provider.toUpperCase()} | ${action} accepted (connection ${credentials.connectionId})`,
+      );
+      return withConnectionHeader(result.response, credentials.connectionId);
+    }
+
+    // Record the failure (dashboard shows lastError/errorCode → user sees re-auth is needed)
+    const { shouldFallback } = await markAccountUnavailable(
+      credentials.connectionId,
+      result.status,
+      sanitizeSecrets(result.error, refreshedCredentials),
+      provider,
+      model,
+    );
+
+    if (shouldFallback && CREATE_ROTATION_STATUSES.has(result.status)) {
+      excludeConnectionIds.add(credentials.connectionId);
+      lastError = result.error;
+      lastStatus = result.status;
+      continue;
+    }
+
+    return result.response;
+  }
+}
+
+/**
+ * GET /v1/videos/{request_id} — poll job status.
+ * Jobs are account-bound upstream, so no cross-account rotation here: the
+ * caller pins the creating account via `x-connection-id` (returned on create).
+ */
+export async function handleVideoGet(request, requestId) {
+  const authError = await requireValidApiKey(request);
+  if (authError) return authError;
+
+  if (!requestId) return errorResponse(HTTP_STATUS.BAD_REQUEST, "Missing video request id");
+
+  const preferredConnectionId = request.headers.get("x-connection-id") || null;
+  const provider = await resolveGetProvider(request, preferredConnectionId);
+
+  const credentials = await getProviderCredentials(provider, null, null, { preferredConnectionId });
+  if (!credentials || credentials.allRateLimited) {
+    return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${provider}`);
+  }
+
+  const refreshedCredentials = await checkAndRefreshToken(provider, credentials);
+
+  const result = await handleVideoProxyCore({
+    provider,
+    requestId,
+    credentials: refreshedCredentials,
+    signal: request.signal,
+    log,
+    onCredentialsRefreshed: async (newCreds) => {
+      await updateProviderCredentials(credentials.connectionId, {
+        accessToken: newCreds.accessToken,
+        refreshToken: newCreds.refreshToken,
+        providerSpecificData: newCreds.providerSpecificData,
+        testStatus: "active",
+      });
+    },
+  });
+
+  if (result.success) {
+    await clearAccountError(credentials.connectionId, credentials, null);
+    return withConnectionHeader(result.response, credentials.connectionId);
+  }
+
+  await markAccountUnavailable(
+    credentials.connectionId,
+    result.status,
+    sanitizeSecrets(result.error, refreshedCredentials),
+    provider,
+    null,
+  );
+  return result.response;
+}

package/src/sse/services/antigravityQuota.ts

@@ -0,0 +1,220 @@
+/**
+ * Antigravity live quota cache — in-memory, refreshed on demand.
+ * Used by auth.js pre-filter to skip accounts with exhausted model quota.
+ * Also triggered by 409/429 error handler to sync exact resetAt from upstream.
+ */
+
+import { resolveConnectionProxyConfig } from "@/lib/network/connectionProxy";
+import { getAntigravityUsage } from "open-sse/services/usage/google.js";
+import * as log from "../utils/logger";
+
+// In-memory cache: connectionId → { [modelId]: { remainingPercentage, resetAt } }
+const quotaCache = new Map<
+  string,
+  Record<string, { remainingPercentage: number; resetAt?: string }>
+>();
+// Track last refresh per connection to avoid hammering
+const lastRefreshAt = new Map<string, number>();
+// In-flight refresh promises — dedup concurrent 409/429 bursts
+const inflightRefresh = new Map<string, Promise<any>>();
+
+const MIN_REFRESH_INTERVAL_MS = 30_000; // 30s between refreshes per connection
+
+// Strike-based circuit breaker (#3681): Google's quota API can report remaining
+// quota while generation endpoints keep returning 429 (sprint/weekly dual-pool
+// mismatch). After STRIKE_THRESHOLD 429s within the window for the same
+// connection+model, treat the optimistic quota reading as untrusted and
+// cache-block that pair instead of retry-storming upstream.
+const STRIKE_WINDOW_MS = 60_000; // strikes older than this reset the count
+const STRIKE_THRESHOLD = 3;
+const STRIKE_BLOCK_MS = 15 * 60_000;
+const strikeCounts = new Map<string, { count: number; windowStart: number }>(); // "connectionId|model" → { count, windowStart (anchored at first strike) }
+const strikeBlocks = new Map<string, number>(); // "connectionId|model" → blockedUntil ms
+
+/**
+ * Re-apply active strike blocks onto a fresh quotas snapshot so the auth
+ * pre-filter (which reads this cache) keeps skipping the blocked pair across
+ * requests until the block expires — same channel as the exhausted-0% path.
+ */
+function applyActiveStrikeBlocks(
+  connectionId: string,
+  quotas: Record<string, { remainingPercentage: number; resetAt?: string }>,
+) {
+  const now = Date.now();
+  for (const [key, until] of strikeBlocks) {
+    if (!key.startsWith(`${connectionId}|`)) continue;
+    if (until <= now) {
+      strikeBlocks.delete(key);
+      continue;
+    }
+    quotas[key.slice(connectionId.length + 1)] = {
+      remainingPercentage: 0,
+      resetAt: new Date(until).toISOString(),
+    };
+  }
+  return quotas;
+}
+
+/**
+ * Clear strike state for a connection|model after a successful request, so
+ * "consecutive" strikes means consecutive. Only removes a synthesized cache
+ * entry (resetAt == our block deadline); a real upstream 0% reading stays.
+ */
+export function clearAntigravityStrikes(connectionId: string, model: string): void {
+  const key = `${connectionId}|${model}`;
+  strikeCounts.delete(key);
+  const until = strikeBlocks.get(key);
+  if (until === undefined) return;
+  strikeBlocks.delete(key);
+  const cached = quotaCache.get(connectionId);
+  if (cached?.[model]?.resetAt === new Date(until).toISOString()) {
+    delete cached[model];
+    quotaCache.set(connectionId, cached);
+  }
+}
+
+/**
+ * Get the quota cache (read-only reference for auth.js pre-filter).
+ */
+export function getAntigravityQuotaCache() {
+  return quotaCache;
+}
+
+/**
+ * Refresh quota for a single antigravity connection from upstream API.
+ * Updates in-memory cache only. Cache expiry is the upstream model resetAt.
+ * @returns {object|null} quotas map or null on failure
+ */
+export async function refreshAntigravityQuota(
+  connectionId: string,
+  accessToken: string,
+  providerSpecificData: any,
+): Promise<Record<string, { remainingPercentage: number; resetAt?: string }> | null> {
+  const now = Date.now();
+  // Coalesce concurrent refreshes before applying the interval gate.
+  const inflight = inflightRefresh.get(connectionId);
+  if (inflight) return inflight;
+
+  const lastRefresh = lastRefreshAt.get(connectionId) || 0;
+  if (now - lastRefresh < MIN_REFRESH_INTERVAL_MS) {
+    log.debug(
+      "AG_QUOTA",
+      `${connectionId.slice(0, 8)} | skip refresh (${Math.round((now - lastRefresh) / 1000)}s ago)`,
+    );
+    return quotaCache.get(connectionId) || null;
+  }
+
+  // Record every attempt so failed quota calls cannot amplify an upstream 429 burst.
+  lastRefreshAt.set(connectionId, now);
+  const promise = _doRefresh(connectionId, accessToken, providerSpecificData, now);
+  inflightRefresh.set(connectionId, promise);
+  try {
+    return await promise;
+  } finally {
+    inflightRefresh.delete(connectionId);
+  }
+}
+
+async function _doRefresh(
+  connectionId: string,
+  accessToken: string,
+  providerSpecificData: any,
+  now: number,
+): Promise<Record<string, { remainingPercentage: number; resetAt?: string }> | null> {
+  try {
+    const proxyCfg = await resolveConnectionProxyConfig(providerSpecificData || {});
+    const proxyOptions = {
+      connectionProxyEnabled: proxyCfg.connectionProxyEnabled === true,
+      connectionProxyUrl: proxyCfg.connectionProxyUrl || "",
+      connectionNoProxy: proxyCfg.connectionNoProxy || "",
+      vercelRelayUrl: proxyCfg.vercelRelayUrl || "",
+      strictProxy: proxyCfg.strictProxy === true,
+    };
+
+    const usage = await getAntigravityUsage(accessToken, providerSpecificData, proxyOptions);
+    // 401/403 usage responses can contain an empty quotas object plus message.
+    // Preserve known cache instead of replacing it with an upstream error response.
+    if (!usage?.quotas || usage.message) return null;
+
+    // Update in-memory cache. Caller logs CACHE_BLOCK only if requested model is exhausted.
+    // Strike blocks are re-asserted after every refresh so an optimistic
+    // upstream reading cannot resurrect a pair we just circuit-broke.
+    quotaCache.set(connectionId, applyActiveStrikeBlocks(connectionId, usage.quotas));
+
+    return usage.quotas;
+  } catch (e: any) {
+    log.warn("AG_QUOTA", `${connectionId.slice(0, 8)} | refresh failed: ${e.message}`);
+    return null;
+  }
+}
+
+/**
+ * Handle Antigravity 409/429 — refresh RAM cache and return model resetAt when exhausted.
+ * Called from chat handler error path.
+ * @returns {number|null} resetAt timestamp ms (for resetsAtMs passthrough) or null
+ */
+export async function handleAntigravityQuotaError(
+  connectionId: string,
+  status: number,
+  model: string,
+  accessToken: string,
+  providerSpecificData: any,
+): Promise<number | null> {
+  log.info("AG_QUOTA", `${connectionId.slice(0, 8)} | ${status} on ${model} — refreshing quota`);
+
+  // Throttle applies to error paths too: one quota request per account/30s.
+  // The first 409/429 populates cache; concurrent or repeated errors reuse it.
+  const quota = (await refreshAntigravityQuota(connectionId, accessToken, providerSpecificData))?.[
+    model
+  ];
+
+  // Strike breaker: count every 429 whose quota reading is either optimistic
+  // (remaining > 0) or unavailable (quota API 403/error). 3 within the window
+  // => the pair is unhealthy regardless of what the API claims; block 15m.
+  // 409 counts too by design: Antigravity signals pool exhaustion with 409 as
+  // well (see #3561 — "skip exhausted account/model quota before upstream
+  // retry" was motivated by 409/429 pairs), and poisoning by transient 409s
+  // requires 3 of them inside 60 seconds on the same pair.
+  if (!quota || quota.remainingPercentage > 0) {
+    const key = `${connectionId}|${model}`;
+    const now = Date.now();
+    const strike = strikeCounts.get(key);
+    // Fixed window anchored at the FIRST qualifying strike: three 429s must
+    // all land within 60s of that first one, not within 60s of each other.
+    const windowStart =
+      strike && now - strike.windowStart <= STRIKE_WINDOW_MS ? strike.windowStart : now;
+    const count = strike && windowStart === strike.windowStart ? strike.count + 1 : 1;
+    strikeCounts.set(key, { count, windowStart });
+    if (count >= STRIKE_THRESHOLD) {
+      strikeCounts.delete(key);
+      const blockedUntil = now + STRIKE_BLOCK_MS;
+      const reading = quota ? `${Math.round(quota.remainingPercentage)}%` : "unknown";
+      log.warn(
+        "AG_QUOTA",
+        `${connectionId.slice(0, 8)} | STRIKE_${status} ${model} — ${count}x 429 (quota ${reading}); CACHE_BLOCK 15m`,
+      );
+      // Synthesize a 0% entry in the shared cache so the auth pre-filter skips
+      // this pair on subsequent requests too, not just the current retry loop
+      // (the chat handler does not persist modelLock_* for this path).
+      const cached = quotaCache.get(connectionId) || {};
+      cached[model] = { remainingPercentage: 0, resetAt: new Date(blockedUntil).toISOString() };
+      quotaCache.set(connectionId, cached);
+      strikeBlocks.set(key, blockedUntil);
+      return blockedUntil;
+    }
+    return null;
+  }
+
+  // Healthy-but-exhausted reading: clear strikes and use the exact resetAt.
+  strikeCounts.delete(`${connectionId}|${model}`);
+  if (!quota.resetAt) return null;
+
+  const resetMs = new Date(quota.resetAt).getTime();
+  if (resetMs <= Date.now()) return null;
+
+  log.warn(
+    "AG_QUOTA",
+    `${connectionId.slice(0, 8)} | UPSTREAM_${status} ${model} — quota exhausted; CACHE_BLOCK until ${quota.resetAt}`,
+  );
+  return resetMs;
+}