@cortexkit/antigravity-auth-core 2.2.1 → 3.0.1

package/dist/account-manager.js

@@ -1,10 +1,12 @@
 import { createHash } from 'node:crypto';
+import { rowRefKey, sameRowRef } from "./account-identity.js";
+import { AccountRepositoryError, applyCooldownObservation, applyRateLimitObservation, applySwitch, } from "./account-repository.js";
+import { AccountSelector, clampNonNegativeInt, } from "./account-selector.js";
 import { AccountStorageLockContentionError } from "./account-storage.js";
 import { formatRefreshParts, parseRefreshParts } from "./auth.js";
-import { generateFingerprint, MAX_FINGERPRINT_HISTORY, updateFingerprintVersion, } from "./fingerprint.js";
-import { getQuotaGroupForModel } from "./model-registry.js";
+import { generateFingerprint, updateFingerprintVersion, } from "./fingerprint.js";
 import { normalizeLegacyCachedQuota, } from "./quota-types.js";
-import { getHealthTracker, getTokenTracker, selectHybridAccount, } from "./rotation.js";
+import { getHealthTracker, getTokenTracker, HealthScoreTracker, TokenBucketTracker, } from "./rotation.js";
 function isStorageLockContention(error) {
     if (error instanceof AccountStorageLockContentionError)
         return true;
@@ -13,13 +15,7 @@ function isStorageLockContention(error) {
         message.includes('ELOCKED'));
 }
 export { calculateBackoffMs, computeSoftQuotaCacheTtlMs, parseRateLimitReason, } from "./rotation.js";
-import { calculateBackoffMs } from "./rotation.js";
-function clampNonNegativeInt(value, fallback) {
-    if (typeof value !== 'number' || !Number.isFinite(value)) {
-        return fallback;
-    }
-    return value < 0 ? 0 : Math.floor(value);
-}
+export { resolveQuotaGroup } from "./account-selector.js";
 /**
  * Opaque identity for a refresh token.
  *
@@ -30,107 +26,150 @@ function clampNonNegativeInt(value, fallback) {
 function quotaAccountIdentity(refreshToken) {
     return createHash('sha256').update(refreshToken).digest('hex').slice(0, 16);
 }
-function getQuotaKey(family, headerStyle, model) {
-    if (family === 'claude') {
-        return 'claude';
-    }
-    const base = headerStyle === 'gemini-cli' ? 'gemini-cli' : 'gemini-antigravity';
-    if (model) {
-        return `${base}:${model}`;
+/** Applies a coalesced row write to the metadata read under the row lock. */
+function applyPendingRowWrite(metadata, pending) {
+    let next = metadata;
+    const resets = {};
+    const cleared = [];
+    for (const [key, value] of pending.rateLimits) {
+        if (value === 'clear')
+            cleared.push(key);
+        else
+            resets[key] = value;
+    }
+    if (Object.keys(resets).length > 0) {
+        next = applyRateLimitObservation(next, resets);
+    }
+    if (cleared.length > 0 && next.rateLimitResetTimes != null) {
+        const rates = { ...next.rateLimitResetTimes };
+        for (const key of cleared)
+            delete rates[key];
+        next = { ...next, rateLimitResetTimes: rates };
+    }
+    if (pending.cooldown !== undefined) {
+        next = applyCooldownObservation(next, pending.cooldown.value);
+    }
+    if (pending.switchReason !== undefined) {
+        next = applySwitch(next, pending.switchReason);
+    }
+    if (pending.lastUsed !== undefined && pending.lastUsed > next.lastUsed) {
+        next = { ...next, lastUsed: pending.lastUsed };
+    }
+    return next;
+}
+/**
+ * Repository failures a save reports but does not fail on: the write was
+ * about a credential the row no longer holds (it is dropped, as intended),
+ * or it met lock contention and was queued again for the next save.
+ */
+const TOLERATED_FAILURES = new Set([
+    'attribution',
+    'unknown-row',
+    'lock-contention',
+]);
+/**
+ * Thrown by a save, flush or dispose of a repository-backed manager when a
+ * write failed. `message` and `failure` are the first failure; `report`
+ * holds every failure the repository reported while draining.
+ */
+export class AccountManagerPersistError extends Error {
+    failure;
+    report;
+    constructor(failure, report) {
+        super(failure.message);
+        this.name = 'AccountManagerPersistError';
+        this.failure = failure;
+        this.report = report;
     }
-    return base;
 }
-function isRateLimitedForQuotaKey(account, key, now) {
-    const resetTime = account.rateLimitResetTimes[key];
-    return resetTime !== undefined && now() < resetTime;
+function present(value) {
+    return value === null ? undefined : value;
 }
-function isRateLimitedForFamily(account, family, now, model) {
-    if (family === 'claude') {
-        return isRateLimitedForQuotaKey(account, 'claude', now);
+function quotaGroupsOf(quota) {
+    if (quota?.cachedQuota == null)
+        return undefined;
+    const groups = {};
+    for (const [name, group] of Object.entries(quota.cachedQuota)) {
+        groups[name] = {
+            modelCount: group.modelCount,
+            ...(group.remainingFraction != null
+                ? { remainingFraction: group.remainingFraction }
+                : {}),
+            ...(group.resetTime != null ? { resetTime: group.resetTime } : {}),
+            ...(group.windows != null
+                ? {
+                    windows: group.windows.map((window) => ({
+                        window: window.window,
+                        remainingFraction: window.remainingFraction,
+                        resetTime: window.resetTime,
+                    })),
+                }
+                : {}),
+        };
     }
-    const antigravityIsLimited = isRateLimitedForHeaderStyle(account, family, 'antigravity', now, model);
-    const cliIsLimited = isRateLimitedForHeaderStyle(account, family, 'gemini-cli', now, model);
-    return antigravityIsLimited && cliIsLimited;
+    return groups;
 }
-function isRateLimitedForHeaderStyle(account, family, headerStyle, now, model) {
-    clearExpiredRateLimits(account, now);
-    if (family === 'claude') {
-        return isRateLimitedForQuotaKey(account, 'claude', now);
-    }
-    // Check model-specific quota first if provided
-    if (model) {
-        const modelKey = getQuotaKey(family, headerStyle, model);
-        if (isRateLimitedForQuotaKey(account, modelKey, now)) {
-            return true;
-        }
+function storedQuotaGroups(groups) {
+    const stored = {};
+    for (const [name, group] of Object.entries(groups)) {
+        if (group === undefined)
+            continue;
+        stored[name] = {
+            modelCount: group.modelCount,
+            ...(group.remainingFraction !== undefined
+                ? { remainingFraction: group.remainingFraction }
+                : {}),
+            ...(group.resetTime !== undefined ? { resetTime: group.resetTime } : {}),
+            ...(group.windows !== undefined
+                ? { windows: group.windows.map((window) => ({ ...window })) }
+                : {}),
+        };
     }
-    // Then check base family quota
-    const baseKey = getQuotaKey(family, headerStyle);
-    return isRateLimitedForQuotaKey(account, baseKey, now);
+    return stored;
 }
-function clearExpiredRateLimits(account, clock) {
-    const now = clock();
-    const keys = Object.keys(account.rateLimitResetTimes);
-    for (const key of keys) {
-        const resetTime = account.rateLimitResetTimes[key];
-        if (resetTime !== undefined && now >= resetTime) {
-            delete account.rateLimitResetTimes[key];
-        }
-    }
+/** Why a repository row cannot be routed to, or undefined when it can. */
+function unroutableReason(row) {
+    if (row.invalid !== undefined)
+        return `invalid ${row.invalid}`;
+    if (row.torn)
+        return 'torn';
+    if (row.unbound)
+        return `unbound credential (${row.stamp})`;
+    if (row.credential === undefined)
+        return 'no credential';
+    if (row.metadata.status === 'dropped') {
+        return `metadata not shown (${row.metadata.reason})`;
+    }
+    if (row.metadata.status === 'absent')
+        return 'metadata absent';
+    return undefined;
+}
+/** When the account's newest access evidence was observed, if ever. */
+function accessEvidenceTime(account) {
+    const times = [
+        account.verificationRequiredAt,
+        account.accountIneligibleAt,
+        account.eligibilityStateUpdatedAt,
+    ].filter((time) => time !== undefined);
+    return times.length === 0 ? undefined : Math.max(...times);
 }
 /**
- * Resolve the quota group for soft quota checks.
- *
- * When a model string is available we use the model-registry lookup first,
- * then fall back to substring matching. When model is null/undefined we
- * fall back based on family:
- * - Claude → "non-gemini" quota group
- * - Gemini → "gemini" quota group
- *
- * @param family - The model family ("claude" | "gemini")
- * @param model - Optional model string for precise resolution
- * @returns The QuotaGroup to use for soft quota checks
+ * The request counts of the later day; on the same day, the larger count of
+ * each family, since both only ever grow within a day.
  */
-export function resolveQuotaGroup(family, model) {
-    if (model) {
-        const registryGroup = getQuotaGroupForModel(model);
-        if (registryGroup)
-            return registryGroup;
-        const lower = model.toLowerCase();
-        // Check Claude / GPT-OSS substrings BEFORE the `gemini` substring so
-        // a `gemini-claude-*` alias (Claude route exposed under a `gemini-`
-        // namespace) attributes to the non-gemini pool. The model-registry
-        // check above already handles registered aliases; this substring
-        // fallback mirrors the same precedence rule for unregistered models.
-        if (lower.includes('claude') || lower.includes('gpt-oss')) {
-            return 'non-gemini';
-        }
-        if (lower.includes('gemini'))
-            return 'gemini';
-    }
-    return family === 'claude' ? 'non-gemini' : 'gemini';
-}
-function isOverSoftQuotaThreshold(account, family, thresholdPercent, cacheTtlMs, now, model) {
-    if (thresholdPercent >= 100)
-        return false;
-    if (!account.cachedQuota)
-        return false;
-    if (account.cachedQuotaUpdatedAt == null)
-        return false;
-    const age = now() - account.cachedQuotaUpdatedAt;
-    if (age > cacheTtlMs)
-        return false;
-    const quotaGroup = resolveQuotaGroup(family, model);
-    const groupData = account.cachedQuota[quotaGroup];
-    if (groupData?.remainingFraction == null)
-        return false;
-    const remainingFraction = Math.max(0, Math.min(1, groupData.remainingFraction));
-    const usedPercent = (1 - remainingFraction) * 100;
-    const isOverThreshold = usedPercent >= thresholdPercent;
-    return isOverThreshold;
+function laterCounts(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    if (a.date !== b.date)
+        return a.date > b.date ? a : b;
+    return {
+        date: a.date,
+        claude: Math.max(a.claude, b.claude),
+        gemini: Math.max(a.gemini, b.gemini),
+    };
 }
-const ACCOUNT_SESSION_STATE_TTL_MS = 24 * 60 * 60 * 1000;
-const MAX_ACCOUNT_SESSION_STATES = 256;
 /**
  * In-memory multi-account manager with sticky account selection.
  *
@@ -138,55 +177,83 @@ const MAX_ACCOUNT_SESSION_STATES = 256;
  * Rate limits are tracked per-model-family (claude/gemini) so an account
  * rate-limited for Claude can still be used for Gemini.
  *
- * Source of truth for the pool is `antigravity-accounts.json`.
+ * Persists either to the pre-store pool file `antigravity-accounts.json`
+ * (whole-pool snapshots through an `AccountStorageStore`) or, when built with
+ * `fromRepository`, to the account repository, where every change is an
+ * attributed write on the row and credential the account was loaded from.
  */
 export class AccountManager {
-    accounts = [];
-    cursorByFamily = { claude: 0, gemini: 0 };
-    currentAccountIndexByFamily = {
-        claude: -1,
-        gemini: -1,
-    };
-    sessionOffsetApplied = {
-        claude: false,
-        gemini: false,
-    };
-    lastToastAccountIndex = -1;
-    lastToastTime = 0;
+    /**
+     * Owns all of this manager's selection state: its accounts, the
+     * selection, cursors, session pins, trackers, toast and usage counts.
+     * The manager itself handles credentials and persistence.
+     */
+    selection;
+    /**
+     * The selector's accounts in pool order: a view of its array, not a copy
+     * and not a second list.
+     */
+    get accounts() {
+        return this.selection.rows;
+    }
     savePending = false;
     saveTimeout = null;
     saveInFlight = null;
     disposed = false;
     savePromiseResolvers = [];
-    sessionStartTime;
-    sessionRequestCounts = new Map();
-    sessionUsedAccounts = new Set();
-    requestSessionStates = new Map();
     store;
+    repository;
+    /** Coalesced absolute-state writes per repository credential. */
+    pendingRowWrites = new Map();
+    /** Latest selection per routing target, written at the next save. */
+    pendingSelections = new Map();
     storagePath;
+    /** A promise chain that applies reloads in request order. */
+    reloading = Promise.resolve();
     onDiagnostic;
     now;
-    random;
-    pid;
     constructor(authFallback, stored, options) {
+        if ((options.store === undefined) === (options.repository === undefined)) {
+            throw new Error('AccountManager needs exactly one of a pool-file store and an account repository');
+        }
+        if (options.repository !== undefined && (stored || authFallback)) {
+            throw new Error('a repository-backed AccountManager is loaded with AccountManager.fromRepository');
+        }
         this.store = options.store;
+        this.repository = options.repository;
         this.storagePath = options.storagePath ?? '';
         this.onDiagnostic = options.onDiagnostic;
         this.now = options.now ?? (() => Date.now());
-        this.random = options.random ?? (() => Math.random());
-        this.pid = options.pid ?? process.pid;
-        this.sessionStartTime = this.now();
+        const repositoryBacked = options.repository !== undefined;
+        this.selection = new AccountSelector({
+            sink: repositoryBacked
+                ? this.repositorySink()
+                : {
+                    requestSave: () => this.requestSaveToDisk(),
+                    usage: () => this.requestSaveToDisk(),
+                    stale: (account, label) => this.ignoreStale(account, label),
+                },
+            // A repository-backed manager gets its own new trackers. A pool-file
+            // manager without supplied trackers shares the process-wide ones
+            // (`getHealthTracker`, `getTokenTracker`), as it always has.
+            healthTracker: options.healthTracker ??
+                (repositoryBacked ? new HealthScoreTracker() : getHealthTracker),
+            tokenTracker: options.tokenTracker ??
+                (repositoryBacked ? new TokenBucketTracker() : getTokenTracker),
+            now: this.now,
+            random: options.random ?? (() => Math.random()),
+            pid: options.pid ?? process.pid,
+            onDiagnostic: options.onDiagnostic,
+        });
         const authParts = authFallback
             ? parseRefreshParts(authFallback.refresh)
             : null;
         if (stored && stored.accounts.length === 0) {
-            this.accounts = [];
-            this.cursorByFamily = { claude: 0, gemini: 0 };
             return;
         }
         if (stored && stored.accounts.length > 0) {
             const baseNow = this.now();
-            this.accounts = stored.accounts
+            const accounts = stored.accounts
                 .map((acc, index) => {
                 if (!acc.refreshToken || typeof acc.refreshToken !== 'string') {
                     return null;
@@ -245,20 +312,21 @@ export class AccountManager {
             // Saved fingerprints may carry an older version string; this ensures
             // they always reflect the latest fetched (or fallback) version.
             let fingerprintVersionChanged = false;
-            for (const acc of this.accounts) {
+            for (const acc of accounts) {
                 if (acc.fingerprint && updateFingerprintVersion(acc.fingerprint)) {
                     fingerprintVersionChanged = true;
                 }
             }
+            // The stored selection is resolved against the stored accounts, before
+            // an auth-fallback account is added.
             const legacyCursor = clampNonNegativeInt(stored.activeIndex, 0);
-            if (this.accounts.length > 0) {
-                const defaultIndex = legacyCursor % this.accounts.length;
-                this.currentAccountIndexByFamily.claude =
-                    clampNonNegativeInt(stored.activeIndexByFamily?.claude, defaultIndex) % this.accounts.length;
-                this.currentAccountIndexByFamily.gemini =
-                    clampNonNegativeInt(stored.activeIndexByFamily?.gemini, defaultIndex) % this.accounts.length;
-                this.cursorByFamily.claude = this.currentAccountIndexByFamily.claude;
-                this.cursorByFamily.gemini = this.currentAccountIndexByFamily.gemini;
+            const selection = {};
+            if (accounts.length > 0) {
+                const defaultIndex = legacyCursor % accounts.length;
+                for (const family of ['claude', 'gemini']) {
+                    selection[family] =
+                        clampNonNegativeInt(stored.activeIndexByFamily?.[family], defaultIndex) % accounts.length;
+                }
             }
             // Persist updated fingerprint versions to disk
             if (fingerprintVersionChanged) {
@@ -266,11 +334,11 @@ export class AccountManager {
             }
             // If current auth isn't in the loaded accounts, add it to the pool
             if (authFallback && authParts?.refreshToken) {
-                const hasMatching = this.accounts.some((acc) => acc.parts.refreshToken === authParts.refreshToken);
+                const hasMatching = accounts.some((acc) => acc.parts.refreshToken === authParts.refreshToken);
                 if (!hasMatching) {
                     const now = this.now();
                     const newAccount = {
-                        index: this.accounts.length,
+                        index: accounts.length,
                         email: undefined,
                         addedAt: now,
                         lastUsed: 0,
@@ -283,16 +351,17 @@ export class AccountManager {
                         fingerprint: generateFingerprint(),
                         fingerprintHistory: [],
                     };
-                    this.accounts.push(newAccount);
+                    accounts.push(newAccount);
                 }
             }
+            this.selection.resetAccounts(accounts, selection);
             return;
         }
         if (authFallback) {
             const parts = parseRefreshParts(authFallback.refresh);
             if (parts.refreshToken) {
                 const now = this.now();
-                this.accounts = [
+                this.selection.resetAccounts([
                     {
                         index: 0,
                         email: undefined,
@@ -305,142 +374,573 @@ export class AccountManager {
                         rateLimitResetTimes: {},
                         touchedForQuota: {},
                     },
-                ];
-                this.cursorByFamily = { claude: 0, gemini: 0 };
-                this.currentAccountIndexByFamily.claude = 0;
-                this.currentAccountIndexByFamily.gemini = 0;
+                ], { claude: 0, gemini: 0 });
             }
         }
     }
-    getAccountCount() {
-        return this.getEnabledAccounts().length;
-    }
-    getTotalAccountCount() {
-        return this.accounts.length;
-    }
-    getEnabledAccounts() {
-        return this.accounts.filter((account) => account.enabled !== false);
-    }
-    getEffectiveSoftQuotaThreshold(thresholdPercent) {
-        // Soft-quota protection only has a purpose when another enabled account
-        // exists to rotate to. Never block the sole usable account.
-        return this.getEnabledAccounts().length > 1 ? thresholdPercent : 100;
+    /**
+     * Where a repository-backed manager's selector reports transitions. Each
+     * becomes a write attributed to the exact account it was decided for.
+     * Rate limits, cooldowns, switches, `lastUsed` and selections are queued
+     * and coalesced until the next save; request counts, enabled flags,
+     * access verdicts and fingerprints are written immediately.
+     */
+    repositorySink() {
+        return {
+            rateLimit: (account, key, resetAt) => this.queueRowWrite(account, (pending) => {
+                pending.rateLimits.set(key, resetAt);
+            }),
+            cooldown: (account, value) => this.queueRowWrite(account, (pending) => {
+                pending.cooldown = { value };
+            }),
+            switched: (account, reason) => this.queueRowWrite(account, (pending) => {
+                pending.switchReason = reason;
+            }),
+            lastUsed: (account, at) => this.queueRowWrite(account, (pending) => {
+                pending.lastUsed = Math.max(pending.lastUsed ?? 0, at);
+            }),
+            selection: (family, account) => this.queueSelection(family, account),
+            usage: (account, family, at) => this.dispatch(account, 'request count', (repository, ref) => repository.recordUsage(ref, { family, at })),
+            enabled: (account, enabled) => this.dispatch(account, 'enabled flag', (repository, ref) => repository.setEnabled(ref, { enabled, actor: 'user' })),
+            accessVerdict: (account, verdict) => this.persistAccessVerdict(account, verdict),
+            fingerprint: (account) => this.persistFingerprint(account),
+            requestSave: () => this.requestSaveToDisk(),
+            stale: (account, label) => this.ignoreStale(account, label),
+        };
     }
-    getAccountsSnapshot() {
-        return this.accounts.map((a) => ({
-            ...a,
-            parts: { ...a.parts },
-            rateLimitResetTimes: { ...a.rateLimitResetTimes },
-        }));
+    /**
+     * A manager over a ready repository read. Rows with missing or unsafe
+     * credentials, or absent/dropped provider metadata, are excluded from
+     * serving and reported through `onDiagnostic`. Stored row references
+     * choose the active account; legacy numeric positions in the account list
+     * are used only when no stored reference selects an admitted row.
+     */
+    static fromRepository(read, options) {
+        if (read.status !== 'ready') {
+            throw new Error(`the account repository is not ready (${read.status}); resolve it before routing`);
+        }
+        const manager = new AccountManager(undefined, null, options);
+        manager.loadRepositoryRows(read);
+        return manager;
     }
-    getRequestSessionState(identity) {
-        const now = this.now();
-        this.pruneRequestSessionStates(now, identity.id);
-        const existing = this.requestSessionStates.get(identity.id);
-        if (existing) {
-            existing.lastAccessedAt = now;
-            if (identity.parentId) {
-                existing.parentId = identity.parentId;
-            }
-            return existing;
-        }
-        const state = {
-            parentId: identity.parentId ?? null,
-            currentAccountIndexByFamily: { claude: -1, gemini: -1 },
-            cursorByFamily: { ...this.cursorByFamily },
-            offsetAppliedByFamily: { claude: false, gemini: false },
-            usedAccounts: new Set(),
-            lastAccessedAt: now,
+    /**
+     * The account a ready repository row describes, or undefined (reported
+     * through `onDiagnostic`) for a row that cannot be routed to. `fingerprint`
+     * says whether the stored fingerprint was kept, generated because the row
+     * had none, or brought to the current runtime version.
+     */
+    accountFromRow(row, index, baseNow) {
+        const reason = unroutableReason(row);
+        const credential = row.credential;
+        if (reason !== undefined || credential === undefined) {
+            this.onDiagnostic?.('Skipped an account row that cannot be routed to', {
+                rowId: row.ref.id,
+                reason: reason ?? 'no credential',
+            });
+            return undefined;
+        }
+        const meta = row.metadata.status === 'present' ? row.metadata.metadata : undefined;
+        const quota = row.quota.status === 'present' ? row.quota.quota : undefined;
+        const rateLimitResetTimes = {};
+        for (const [key, value] of Object.entries(meta?.rateLimitResetTimes ?? {})) {
+            if (typeof value === 'number')
+                rateLimitResetTimes[key] = value;
+        }
+        const projectId = present(meta?.projectId);
+        const managedProjectId = present(meta?.managedProjectId);
+        const counts = present(meta?.dailyRequestCounts);
+        const account = {
+            index,
+            ref: row.ref,
+            email: present(meta?.email),
+            label: present(meta?.label),
+            addedAt: meta?.addedAt ?? row.storeAddedAt ?? baseNow,
+            lastUsed: meta?.lastUsed ?? 0,
+            parts: {
+                refreshToken: credential.refreshToken,
+                projectId,
+                managedProjectId,
+            },
+            projectId,
+            managedProjectId,
+            access: credential.accessToken,
+            expires: credential.expiresAt,
+            enabled: row.enabled,
+            rateLimitResetTimes,
+            lastSwitchReason: present(meta?.lastSwitchReason),
+            coolingDownUntil: present(meta?.coolingDownUntil),
+            cooldownReason: present(meta?.cooldownReason),
+            touchedForQuota: {},
+            // Copy the fingerprint before storing it: the manager updates it in
+            // place, and the caller owns the read.
+            fingerprint: structuredClone(present(meta?.fingerprint)),
+            fingerprintHistory: structuredClone(present(meta?.fingerprintHistory)) ?? [],
+            cachedQuota: normalizeLegacyCachedQuota(quotaGroupsOf(quota)),
+            cachedQuotaAccountId: present(quota?.cachedQuotaAccountId),
+            cachedQuotaUpdatedAt: present(quota?.cachedQuotaUpdatedAt),
+            capturedTierId: present(meta?.capturedTierId),
+            capturedPaidTierId: present(meta?.capturedPaidTierId),
+            capturedTierAt: present(meta?.capturedTierAt),
+            capturedTierSchemaVersion: present(meta?.capturedTierSchemaVersion),
+            dailyRequestCounts: counts === undefined
+                ? undefined
+                : {
+                    date: counts.date,
+                    claude: counts.claude,
+                    gemini: counts.gemini,
+                },
+            verificationRequired: present(meta?.verificationRequired),
+            verificationRequiredAt: present(meta?.verificationRequiredAt),
+            verificationRequiredReason: present(meta?.verificationRequiredReason),
+            verificationUrl: present(meta?.verificationUrl),
+            accountIneligible: present(meta?.accountIneligible),
+            accountIneligibleAt: present(meta?.accountIneligibleAt),
+            accountIneligibleReason: present(meta?.accountIneligibleReason),
+            eligibilityStateUpdatedAt: present(meta?.eligibilityStateUpdatedAt),
+        };
+        if (account.fingerprint === undefined) {
+            account.fingerprint = generateFingerprint();
+            return { account, fingerprint: 'generated' };
+        }
+        if (updateFingerprintVersion(account.fingerprint)) {
+            return { account, fingerprint: 'updated' };
+        }
+        return { account, fingerprint: 'kept' };
+    }
+    /** The stored selection's index for `family` among `accounts`. */
+    routedIndex(accounts, routing, family) {
+        const count = accounts.length;
+        const indexOf = (ref) => {
+            if (ref == null)
+                return undefined;
+            const found = accounts.findIndex((account) => account.ref !== undefined && sameRowRef(account.ref, ref));
+            return found < 0 ? undefined : found;
         };
-        this.requestSessionStates.set(identity.id, state);
-        return state;
-    }
-    pruneRequestSessionStates(now, preservedId) {
-        const expiry = now - ACCOUNT_SESSION_STATE_TTL_MS;
-        for (const [id, state] of this.requestSessionStates) {
-            if (id !== preservedId && state.lastAccessedAt < expiry) {
-                this.requestSessionStates.delete(id);
+        const defaultIndex = indexOf(routing?.activeRow) ??
+            clampNonNegativeInt(routing?.activeIndex, 0) % count;
+        return (indexOf(routing?.activeRowByFamily?.[family]) ??
+            clampNonNegativeInt(routing?.activeIndexByFamily?.[family], defaultIndex) % count);
+    }
+    loadRepositoryRows(read) {
+        const baseNow = this.now();
+        const accounts = [];
+        const generated = [];
+        const versionUpdated = [];
+        for (const row of read.rows) {
+            const built = this.accountFromRow(row, accounts.length, baseNow);
+            if (built === undefined)
+                continue;
+            if (built.fingerprint === 'generated')
+                generated.push(built.account);
+            if (built.fingerprint === 'updated')
+                versionUpdated.push(built.account);
+            accounts.push(built.account);
+        }
+        const selection = {};
+        if (accounts.length > 0) {
+            for (const family of ['claude', 'gemini']) {
+                selection[family] = this.routedIndex(accounts, read.routing, family);
             }
         }
-        if (this.requestSessionStates.size < MAX_ACCOUNT_SESSION_STATES ||
-            this.requestSessionStates.has(preservedId)) {
-            return;
+        this.selection.resetAccounts(accounts, selection);
+        // Persist each generated or version-updated fingerprint.
+        for (const account of [...generated, ...versionUpdated]) {
+            this.persistFingerprint(account);
         }
-        let oldestId = null;
-        let oldestAccess = Number.POSITIVE_INFINITY;
-        for (const [id, state] of this.requestSessionStates) {
-            if (id !== preservedId && state.lastAccessedAt < oldestAccess) {
-                oldestId = id;
-                oldestAccess = state.lastAccessedAt;
+    }
+    /**
+     * Brings a repository-backed manager up to date with a newer ready read.
+     *
+     * Accounts are matched by their exact ref (row id, credential epoch and
+     * identity, absence included), never by position. An account whose ref is
+     * unchanged stays the same object, with its ref object, its session pins,
+     * health, token balance and the other in-memory state; only what the read
+     * stores is refreshed, newest evidence winning (see `refreshFromRow`). The
+     * ref an account is matched under is the one it holds now, so an account
+     * this manager refreshed through `refreshAccount` is matched under its
+     * successor ref and keeps its pins. A row whose credential was replaced or
+     * re-added by anything else, or that is new, becomes a new account. An
+     * account the read no longer holds under its ref leaves the manager: pins
+     * and selections on it are dropped, writes still queued for it are
+     * discarded, and any later write about the old object is ignored rather
+     * than sent. A read that is not ready throws and leaves the manager as it
+     * was.
+     *
+     * This method applies the read it is given and does not flush or read
+     * itself. The caller must flush this manager's queued writes before
+     * taking the read, and must apply reads in the order they were taken: an
+     * older read applied after a newer one would bring back accounts and refs
+     * the pool no longer holds (the store's ref fences still refuse their
+     * writes). `refreshFromRepository` does all of this.
+     */
+    reloadFromRepository(read) {
+        if (this.repository === undefined) {
+            throw new Error('reloadFromRepository needs a repository-backed manager');
+        }
+        if (read.status !== 'ready') {
+            throw new Error(`the account repository is not ready (${read.status}); the manager keeps its accounts`);
+        }
+        const baseNow = this.now();
+        const fresh = [];
+        const fingerprintOf = new Map();
+        for (const row of read.rows) {
+            const built = this.accountFromRow(row, fresh.length, baseNow);
+            if (built === undefined)
+                continue;
+            fingerprintOf.set(built.account, built.fingerprint);
+            fresh.push(built.account);
+        }
+        const { added } = this.selection.replaceAccounts(fresh, {
+            keyOf: (account) => account.ref === undefined ? undefined : rowRefKey(account.ref),
+            refresh: (prior, account) => this.refreshFromRow(prior, account, fingerprintOf.get(account) ?? 'kept'),
+            // A selection on an account that left falls back to the stored one,
+            // as at load; it is not written back.
+            selectionFallback: (family, accounts) => this.routedIndex(accounts, read.routing, family),
+        });
+        const live = new Set(this.accounts.flatMap((account) => account.ref === undefined ? [] : [rowRefKey(account.ref)]));
+        for (const key of [...this.pendingRowWrites.keys()]) {
+            if (!live.has(key))
+                this.pendingRowWrites.delete(key);
+        }
+        for (const account of added) {
+            if (fingerprintOf.get(account) !== 'kept')
+                this.persistFingerprint(account);
+        }
+    }
+    /**
+     * Flushes this manager's queued writes, takes a fresh read of the
+     * repository and applies it with `reloadFromRepository`. Calls run one at
+     * a time in the order they were made, so a later call always applies a
+     * read taken after the earlier one's. A flush failure is thrown before
+     * anything is read; a read that is not ready throws and changes nothing.
+     */
+    refreshFromRepository() {
+        const repository = this.repository;
+        if (repository === undefined) {
+            return Promise.reject(new Error('refreshFromRepository needs a repository-backed manager'));
+        }
+        const run = this.reloading.then(async () => {
+            await this.flushSaveToDisk();
+            this.reloadFromRepository(await repository.read());
+        });
+        this.reloading = run.catch(() => { });
+        return run;
+    }
+    /**
+     * Refreshes an unchanged account's stored fields from a newer read,
+     * keeping what this manager knows to be newer: the later `lastUsed`,
+     * access token and evidence times (quota, tier, access verdicts), the
+     * later reset of each rate limit, a cooldown or switch it has queued but
+     * not yet written, a rate-limit clear it has queued, and request counts
+     * of the later day (the larger count per family on the same day). A
+     * fingerprint the read lacks keeps the one this manager generated.
+     */
+    refreshFromRow(prior, fresh, fingerprint) {
+        const pending = prior.ref === undefined
+            ? undefined
+            : this.pendingRowWrites.get(rowRefKey(prior.ref));
+        const newer = (a, b) => (a ?? Number.NEGATIVE_INFINITY) >= (b ?? Number.NEGATIVE_INFINITY);
+        prior.email = fresh.email;
+        prior.label = fresh.label;
+        prior.addedAt = fresh.addedAt;
+        prior.lastUsed = Math.max(prior.lastUsed, fresh.lastUsed);
+        prior.parts = fresh.parts;
+        prior.projectId = fresh.projectId;
+        prior.managedProjectId = fresh.managedProjectId;
+        if (newer(fresh.expires, prior.expires)) {
+            prior.access = fresh.access;
+            prior.expires = fresh.expires;
+        }
+        prior.enabled = fresh.enabled;
+        const rates = { ...fresh.rateLimitResetTimes };
+        for (const [key, value] of Object.entries(prior.rateLimitResetTimes)) {
+            const stored = rates[key];
+            if (value !== undefined && (stored === undefined || value > stored)) {
+                rates[key] = value;
             }
         }
-        if (oldestId) {
-            this.requestSessionStates.delete(oldestId);
+        for (const [key, value] of pending?.rateLimits ?? []) {
+            if (value === 'clear')
+                delete rates[key];
+        }
+        prior.rateLimitResetTimes = rates;
+        if (pending?.cooldown === undefined) {
+            prior.coolingDownUntil = fresh.coolingDownUntil;
+            prior.cooldownReason = fresh.cooldownReason;
+        }
+        if (pending?.switchReason === undefined) {
+            prior.lastSwitchReason = fresh.lastSwitchReason;
+        }
+        if (fingerprint !== 'generated') {
+            prior.fingerprint = fresh.fingerprint;
+            prior.fingerprintHistory = fresh.fingerprintHistory;
+        }
+        if (newer(fresh.cachedQuotaUpdatedAt, prior.cachedQuotaUpdatedAt)) {
+            prior.cachedQuota = fresh.cachedQuota;
+            prior.cachedQuotaAccountId = fresh.cachedQuotaAccountId;
+            prior.cachedQuotaUpdatedAt = fresh.cachedQuotaUpdatedAt;
+        }
+        if (newer(fresh.capturedTierAt, prior.capturedTierAt)) {
+            prior.capturedTierId = fresh.capturedTierId;
+            prior.capturedPaidTierId = fresh.capturedPaidTierId;
+            prior.capturedTierAt = fresh.capturedTierAt;
+            prior.capturedTierSchemaVersion = fresh.capturedTierSchemaVersion;
+        }
+        if (newer(accessEvidenceTime(fresh), accessEvidenceTime(prior))) {
+            prior.verificationRequired = fresh.verificationRequired;
+            prior.verificationRequiredAt = fresh.verificationRequiredAt;
+            prior.verificationRequiredReason = fresh.verificationRequiredReason;
+            prior.verificationUrl = fresh.verificationUrl;
+            prior.accountIneligible = fresh.accountIneligible;
+            prior.accountIneligibleAt = fresh.accountIneligibleAt;
+            prior.accountIneligibleReason = fresh.accountIneligibleReason;
+            prior.eligibilityStateUpdatedAt = fresh.eligibilityStateUpdatedAt;
+        }
+        prior.dailyRequestCounts = laterCounts(prior.dailyRequestCounts, fresh.dailyRequestCounts);
+    }
+    /**
+     * Adopt one current row with the selected account's exact row ID,
+     * credential epoch and authenticated identity after its bearer changes.
+     * General reloads keep the token with the later expiry; here the stored
+     * token and expiry always win. Keep selection, request counts, and pending
+     * rate-limit/cooldown observations attributed to that unchanged row ref.
+     * This writes nothing and cannot restore missing provider metadata.
+     */
+    adoptCurrentRow(account, row) {
+        if (this.repository === undefined ||
+            !this.accounts.includes(account) ||
+            account.ref === undefined ||
+            !sameRowRef(account.ref, row.ref) ||
+            !account.enabled ||
+            !row.enabled ||
+            !row.usable ||
+            unroutableReason(row) !== undefined)
+            return false;
+        const fresh = this.accountFromRow(row, account.index, this.now());
+        if (fresh === undefined)
+            return false;
+        this.refreshFromRow(account, fresh.account, fresh.fingerprint);
+        account.access = fresh.account.access;
+        account.expires = fresh.account.expires;
+        return true;
+    }
+    // ========== Repository writes ==========
+    /**
+     * Starts one attributed repository write about `account`. Its failure is
+     * reported here and kept by the repository for the next flush, which
+     * decides whether a save fails.
+     */
+    dispatch(account, label, write) {
+        const repository = this.repository;
+        const ref = account.ref;
+        if (repository === undefined || ref === undefined)
+            return;
+        if (!this.selection.has(account)) {
+            this.ignoreStale(account, label);
+            return;
         }
+        write(repository, ref).catch((error) => {
+            this.onDiagnostic?.(`Account ${label} was not persisted`, {
+                rowId: ref.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        });
     }
-    getActiveIndex(family, identity) {
-        return identity
-            ? this.getRequestSessionState(identity).currentAccountIndexByFamily[family]
-            : this.currentAccountIndexByFamily[family];
+    /**
+     * A write about an account that left the manager at a reload (its
+     * credential was replaced or its row removed) is not sent: it was decided
+     * for a credential the pool no longer holds under this manager.
+     */
+    ignoreStale(account, label) {
+        this.onDiagnostic?.(`Account ${label} ignored: the account is no longer loaded`, account.ref === undefined ? undefined : { rowId: account.ref.id });
     }
-    setActiveIndex(family, index, identity) {
-        if (!identity) {
-            this.currentAccountIndexByFamily[family] = index;
+    /** Queues an absolute-state change of `account` for the next save. */
+    queueRowWrite(account, change) {
+        if (this.repository === undefined || account.ref === undefined)
+            return;
+        if (!this.selection.has(account)) {
+            this.ignoreStale(account, 'state change');
             return;
         }
-        const state = this.getRequestSessionState(identity);
-        state.currentAccountIndexByFamily[family] = index;
-        if (!state.parentId) {
-            // Preserve a useful persisted starting point without coupling active root sessions.
-            this.currentAccountIndexByFamily[family] = index;
+        const key = rowRefKey(account.ref);
+        let pending = this.pendingRowWrites.get(key);
+        if (pending === undefined) {
+            pending = { ref: account.ref, rateLimits: new Map() };
+            this.pendingRowWrites.set(key, pending);
         }
+        change(pending);
+        this.requestSaveToDisk();
     }
-    getCursor(family, identity) {
-        return identity
-            ? this.getRequestSessionState(identity).cursorByFamily[family]
-            : this.cursorByFamily[family];
-    }
-    advanceCursor(family, identity) {
-        const nextGlobalCursor = this.cursorByFamily[family] + 1;
-        this.cursorByFamily[family] = nextGlobalCursor;
-        if (identity) {
-            this.getRequestSessionState(identity).cursorByFamily[family] += 1;
+    /** Merges a write that met lock contention back into the queue. */
+    requeueRowWrite(failed) {
+        const key = rowRefKey(failed.ref);
+        const newer = this.pendingRowWrites.get(key);
+        if (newer === undefined) {
+            this.pendingRowWrites.set(key, failed);
         }
+        else {
+            for (const [rateKey, value] of failed.rateLimits) {
+                if (!newer.rateLimits.has(rateKey))
+                    newer.rateLimits.set(rateKey, value);
+            }
+            newer.cooldown ??= failed.cooldown;
+            newer.switchReason ??= failed.switchReason;
+            if (failed.lastUsed !== undefined &&
+                (newer.lastUsed === undefined || failed.lastUsed > newer.lastUsed)) {
+                newer.lastUsed = failed.lastUsed;
+            }
+        }
+        this.requestSaveToDisk();
     }
-    getUsedAccounts(identity) {
-        return identity
-            ? this.getRequestSessionState(identity).usedAccounts
-            : this.sessionUsedAccounts;
+    /**
+     * Queues the pool-wide selection of `family` for the next save. Claude's
+     * selection is also recorded as the `active` target, the single active
+     * account the pool file kept before it tracked families separately.
+     */
+    queueSelection(family, account) {
+        if (this.repository === undefined)
+            return;
+        const ref = account?.ref ?? null;
+        this.pendingSelections.set(family, ref);
+        if (family === 'claude')
+            this.pendingSelections.set('active', ref);
+        this.requestSaveToDisk();
     }
-    preferAccountOutsideParent(accounts, family, identity) {
-        if (!identity) {
-            return accounts;
+    persistFingerprint(account) {
+        const fingerprint = account.fingerprint;
+        if (fingerprint === undefined)
+            return;
+        const history = [...(account.fingerprintHistory ?? [])];
+        this.dispatch(account, 'fingerprint', (repository, ref) => repository.recordFingerprint(ref, { fingerprint, history }));
+    }
+    persistAccessVerdict(account, verdict) {
+        this.dispatch(account, 'access verdict', (repository, ref) => repository.recordAccessVerdict(ref, verdict));
+    }
+    /** Starts every queued coalesced write. */
+    dispatchQueuedWrites() {
+        const repository = this.repository;
+        if (repository === undefined)
+            return;
+        const rows = [...this.pendingRowWrites.values()];
+        const selections = [...this.pendingSelections];
+        this.pendingRowWrites = new Map();
+        this.pendingSelections = new Map();
+        for (const pending of rows) {
+            repository
+                .updateMetadata(pending.ref, (current, row) => ({
+                kind: 'set',
+                metadata: applyPendingRowWrite(current ?? { addedAt: row.storeAddedAt ?? this.now(), lastUsed: 0 }, pending),
+            }))
+                .catch((error) => {
+                if (error instanceof AccountRepositoryError &&
+                    error.failure.kind === 'lock-contention' &&
+                    !error.failure.ambiguous) {
+                    this.requeueRowWrite(pending);
+                }
+            });
+        }
+        for (const [target, ref] of selections) {
+            repository.selectAccount(target, ref).catch(() => {
+                // Reported by the flush that follows.
+            });
+        }
+    }
+    /**
+     * Starts the queued writes and waits until the repository has drained
+     * every write, including the ones started immediately (usage, access,
+     * removal). Throws `AccountManagerPersistError` for the first failure that
+     * is not tolerated; every failure is reported through `onDiagnostic`.
+     */
+    async flushRepositoryWrites() {
+        const repository = this.repository;
+        if (repository === undefined)
+            return;
+        this.dispatchQueuedWrites();
+        const report = await repository.flush();
+        for (const failure of report.failures) {
+            this.onDiagnostic?.('Account repository write failed', {
+                operation: failure.operation,
+                kind: failure.kind,
+                rowId: failure.rowId,
+                ambiguous: failure.ambiguous,
+                message: failure.message,
+            });
         }
-        const parentId = this.getRequestSessionState(identity).parentId;
-        if (!parentId) {
-            return accounts;
+        const primary = report.failures.find((failure) => !TOLERATED_FAILURES.has(failure.kind));
+        if (primary !== undefined)
+            throw new AccountManagerPersistError(primary, report);
+    }
+    /**
+     * Refreshes the account's credential through the repository: the only
+     * path by which a successor token is stored. A rotation updates the
+     * account's bearer and ref (an identity learnt by the refresh is part of
+     * it) and reads the committed refresh token back; a contradicted identity
+     * disables the account in memory, as the store disabled its row.
+     */
+    async refreshAccount(account, options) {
+        const repository = this.repository;
+        const ref = account.ref;
+        if (repository === undefined || ref === undefined) {
+            throw new Error('refreshAccount needs a repository-backed account');
+        }
+        const outcome = await repository.refresh(ref, options);
+        if (outcome.status === 'rotated') {
+            account.ref = outcome.ref;
+            account.access = outcome.accessToken;
+            account.expires = outcome.expiresAt;
+            const read = await repository.read();
+            if (read.status === 'ready') {
+                const row = read.rows.find((candidate) => sameRowRef(candidate.ref, outcome.ref));
+                if (row?.credential !== undefined) {
+                    account.parts = {
+                        ...account.parts,
+                        refreshToken: row.credential.refreshToken,
+                    };
+                }
+            }
         }
-        const parentState = this.requestSessionStates.get(parentId);
-        const parentIndex = parentState?.currentAccountIndexByFamily[family] ?? -1;
-        if (parentIndex < 0) {
-            return accounts;
+        else if (outcome.status === 'identity-contradicted') {
+            account.access = undefined;
+            account.expires = undefined;
+            this.selection.setEnabledInMemory(account, false);
         }
-        const isolated = accounts.filter((account) => account.index !== parentIndex);
-        return isolated.length > 0 ? isolated : accounts;
+        return outcome;
+    }
+    /**
+     * The health scores this manager selects with, keyed by its current
+     * account indexes. Record request outcomes here, not in the process-wide
+     * tracker, for a repository-backed manager.
+     */
+    get healthTracker() {
+        return this.selection.healthTracker;
+    }
+    /** The token balances this manager selects with; see `healthTracker`. */
+    get tokenTracker() {
+        return this.selection.tokenTracker;
+    }
+    // ========== Selection, owned by `this.selection` ==========
+    getAccountCount() {
+        return this.selection.getAccountCount();
+    }
+    getTotalAccountCount() {
+        return this.selection.getTotalAccountCount();
+    }
+    getEnabledAccounts() {
+        return this.selection.getEnabledAccounts();
+    }
+    /** Copies of the accounts, each with its own credential parts and rate limits. */
+    getAccountsSnapshot() {
+        return this.accounts.map((a) => ({
+            ...a,
+            parts: { ...a.parts },
+            rateLimitResetTimes: { ...a.rateLimitResetTimes },
+        }));
     }
     deleteSessionState(sessionId) {
-        this.requestSessionStates.delete(sessionId);
+        this.selection.deleteSessionState(sessionId);
     }
     getCurrentAccountForFamily(family, identity) {
-        const currentIndex = this.getActiveIndex(family, identity);
-        if (currentIndex >= 0 && currentIndex < this.accounts.length) {
-            const account = this.accounts[currentIndex] ?? null;
-            // Only return account if it's enabled - disabled accounts should not be selected
-            if (account && account.enabled !== false) {
-                return account;
-            }
-        }
-        return null;
+        return this.selection.getCurrentAccountForFamily(family, identity);
     }
     /**
      * Numeric active indexes for each model family. Exposed so callers
@@ -449,29 +949,20 @@ export class AccountManager {
      * through the account-lookup layer.
      */
     getActiveIndexByFamily(identity) {
-        return {
-            claude: this.getActiveIndex('claude', identity),
-            gemini: this.getActiveIndex('gemini', identity),
-        };
+        return this.selection.getActiveIndexByFamily(identity);
     }
     markSwitched(account, reason, family, identity) {
-        account.lastSwitchReason = reason;
-        this.setActiveIndex(family, account.index, identity);
+        this.selection.markSwitched(account, reason, family, identity);
     }
     /**
      * Check if we should show an account switch toast.
      * Debounces repeated toasts for the same account.
      */
     shouldShowAccountToast(accountIndex, debounceMs = 30000) {
-        const now = this.now();
-        if (accountIndex !== this.lastToastAccountIndex) {
-            return true;
-        }
-        return now - this.lastToastTime >= debounceMs;
+        return this.selection.shouldShowAccountToast(accountIndex, debounceMs);
     }
     markToastShown(accountIndex) {
-        this.lastToastAccountIndex = accountIndex;
-        this.lastToastTime = this.now();
+        this.selection.markToastShown(accountIndex);
     }
     getCurrentOrNextForFamily(family, model, strategy = 'sticky', headerStyle = 'antigravity', pidOffsetEnabled = false, softQuotaThresholdPercent = 100, softQuotaCacheTtlMs = 10 * 60 * 1000, identity, 
     /**
@@ -483,132 +974,15 @@ export class AccountManager {
      * wait path.
      */
     excludeIndexes) {
-        const quotaKey = getQuotaKey(family, headerStyle, model);
-        const effectiveSoftQuotaThreshold = this.getEffectiveSoftQuotaThreshold(softQuotaThresholdPercent);
-        // OpenCode may run many root and child sessions concurrently in one plugin
-        // process. Pin each exact session until its account becomes unavailable.
-        if (identity) {
-            const pinned = this.getCurrentAccountForFamily(family, identity);
-            if (pinned) {
-                clearExpiredRateLimits(pinned, this.now);
-                const unavailable = (excludeIndexes?.has(pinned.index) ?? false) ||
-                    isRateLimitedForHeaderStyle(pinned, family, headerStyle, this.now, model) ||
-                    isOverSoftQuotaThreshold(pinned, family, effectiveSoftQuotaThreshold, softQuotaCacheTtlMs, this.now, model) ||
-                    this.isAccountCoolingDown(pinned);
-                if (!unavailable) {
-                    this.markTouchedForQuota(pinned, quotaKey);
-                    return pinned;
-                }
-            }
-        }
-        if (strategy === 'round-robin') {
-            const next = this.getNextForFamily(family, model, headerStyle, effectiveSoftQuotaThreshold, softQuotaCacheTtlMs, identity, excludeIndexes);
-            if (next) {
-                this.markTouchedForQuota(next, quotaKey);
-                this.setActiveIndex(family, next.index, identity);
-            }
-            return next;
-        }
-        if (strategy === 'hybrid') {
-            const healthTracker = getHealthTracker();
-            const tokenTracker = getTokenTracker();
-            const eligibleAccounts = this.preferAccountOutsideParent(this.accounts.filter((acc) => acc.enabled !== false && !excludeIndexes?.has(acc.index)), family, identity);
-            const accountsWithMetrics = eligibleAccounts.map((acc) => {
-                clearExpiredRateLimits(acc, this.now);
-                return {
-                    index: acc.index,
-                    lastUsed: acc.lastUsed,
-                    healthScore: healthTracker.getScore(acc.index),
-                    isRateLimited: isRateLimitedForHeaderStyle(acc, family, headerStyle, this.now, model) ||
-                        isOverSoftQuotaThreshold(acc, family, effectiveSoftQuotaThreshold, softQuotaCacheTtlMs, this.now, model),
-                    isCoolingDown: this.isAccountCoolingDown(acc),
-                };
-            });
-            // Get current account index for stickiness
-            const currentIndex = this.getActiveIndex(family, identity);
-            const selectedIndex = selectHybridAccount(accountsWithMetrics, tokenTracker, currentIndex, 50, this.now);
-            if (selectedIndex !== null) {
-                const selected = this.accounts[selectedIndex];
-                if (selected) {
-                    selected.lastUsed = this.now();
-                    this.markTouchedForQuota(selected, quotaKey);
-                    this.setActiveIndex(family, selected.index, identity);
-                    return selected;
-                }
-            }
-        }
-        // Fallback: sticky selection (used when hybrid finds no candidates)
-        // PID-based offset for multi-session distribution (opt-in)
-        // Different sessions (PIDs) will prefer different starting accounts
-        const offsetApplied = identity
-            ? this.getRequestSessionState(identity).offsetAppliedByFamily
-            : this.sessionOffsetApplied;
-        if (pidOffsetEnabled &&
-            !offsetApplied[family] &&
-            this.accounts.length > 1) {
-            const pidOffset = this.pid % this.accounts.length;
-            const activeIndex = this.getActiveIndex(family, identity);
-            const baseIndex = activeIndex >= 0 ? activeIndex : this.getCursor(family, identity);
-            const newIndex = (baseIndex + pidOffset) % this.accounts.length;
-            this.onDiagnostic?.('Applying PID account offset', {
-                pid: this.pid,
-                offset: pidOffset,
-                family,
-                fromIndex: baseIndex,
-                toIndex: newIndex,
-            });
-            this.setActiveIndex(family, newIndex, identity);
-            offsetApplied[family] = true;
-        }
-        const current = this.getCurrentAccountForFamily(family, identity);
-        if (current && !excludeIndexes?.has(current.index)) {
-            clearExpiredRateLimits(current, this.now);
-            const isLimitedForRequestedStyle = isRateLimitedForHeaderStyle(current, family, headerStyle, this.now, model);
-            const isOverThreshold = isOverSoftQuotaThreshold(current, family, effectiveSoftQuotaThreshold, softQuotaCacheTtlMs, this.now, model);
-            if (!isLimitedForRequestedStyle &&
-                !isOverThreshold &&
-                !this.isAccountCoolingDown(current)) {
-                this.markTouchedForQuota(current, quotaKey);
-                return current;
-            }
-        }
-        const next = this.getNextForFamily(family, model, headerStyle, effectiveSoftQuotaThreshold, softQuotaCacheTtlMs, identity, excludeIndexes);
-        if (next) {
-            this.markTouchedForQuota(next, quotaKey);
-            this.setActiveIndex(family, next.index, identity);
-        }
-        return next;
+        return this.selection.getCurrentOrNextForFamily(family, model, strategy, headerStyle, pidOffsetEnabled, softQuotaThresholdPercent, softQuotaCacheTtlMs, identity, excludeIndexes);
     }
     getNextForFamily(family, model, headerStyle = 'antigravity', softQuotaThresholdPercent = 100, softQuotaCacheTtlMs = 10 * 60 * 1000, identity, 
     /** Indexes ruled out by the caller (e.g. killswitch pre-filter). */
     excludeIndexes) {
-        const effectiveSoftQuotaThreshold = this.getEffectiveSoftQuotaThreshold(softQuotaThresholdPercent);
-        const allAvailable = this.accounts.filter((account) => {
-            clearExpiredRateLimits(account, this.now);
-            return (account.enabled !== false &&
-                !excludeIndexes?.has(account.index) &&
-                !isRateLimitedForHeaderStyle(account, family, headerStyle, this.now, model) &&
-                !isOverSoftQuotaThreshold(account, family, effectiveSoftQuotaThreshold, softQuotaCacheTtlMs, this.now, model) &&
-                !this.isAccountCoolingDown(account));
-        });
-        const available = this.preferAccountOutsideParent(allAvailable, family, identity);
-        if (available.length === 0) {
-            return null;
-        }
-        const usedAccounts = this.getUsedAccounts(identity);
-        const sessionUsed = available.filter((account) => usedAccounts.has(account.index));
-        const candidates = sessionUsed.length > 0 ? sessionUsed : available;
-        const cursor = this.getCursor(family, identity);
-        const account = candidates[cursor % candidates.length];
-        if (!account) {
-            return null;
-        }
-        this.advanceCursor(family, identity);
-        return account;
+        return this.selection.getNextForFamily(family, model, headerStyle, softQuotaThresholdPercent, softQuotaCacheTtlMs, identity, excludeIndexes);
     }
     markRateLimited(account, retryAfterMs, family, headerStyle = 'antigravity', model) {
-        const key = getQuotaKey(family, headerStyle, model);
-        account.rateLimitResetTimes[key] = this.now() + retryAfterMs;
+        this.selection.markRateLimited(account, retryAfterMs, family, headerStyle, model);
     }
     /**
      * Mark an account as used after a successful API request.
@@ -616,167 +990,58 @@ export class AccountManager {
      * Should be called AFTER request completion, not during account selection.
      */
     markAccountUsed(accountIndex) {
-        const account = this.accounts.find((a) => a.index === accountIndex);
-        if (account) {
-            account.lastUsed = this.now();
-        }
+        this.selection.markAccountUsed(accountIndex);
     }
     recordSessionUsage(accountIndex, identity) {
-        this.getUsedAccounts(identity).add(accountIndex);
+        this.selection.recordSessionUsage(accountIndex, identity);
     }
     wasUsedInSession(accountIndex, identity) {
-        return this.getUsedAccounts(identity).has(accountIndex);
+        return this.selection.wasUsedInSession(accountIndex, identity);
     }
     shouldProactivelyRotate(family, model, thresholdPercent, cacheTtlMs, identity) {
-        if (thresholdPercent <= 0)
-            return false;
-        const current = this.getCurrentAccountForFamily(family, identity);
-        if (!current?.cachedQuota || current.cachedQuotaUpdatedAt == null)
-            return false;
-        const age = this.now() - current.cachedQuotaUpdatedAt;
-        if (age > cacheTtlMs)
-            return false;
-        const quotaGroup = resolveQuotaGroup(family, model);
-        const groupData = current.cachedQuota[quotaGroup];
-        if (groupData?.remainingFraction == null)
-            return false;
-        const remainingPercent = Math.max(0, Math.min(100, groupData.remainingFraction * 100));
-        return remainingPercent < thresholdPercent;
+        return this.selection.shouldProactivelyRotate(family, model, thresholdPercent, cacheTtlMs, identity);
     }
     proactivelyRotateForFamily(family, model, headerStyle, softQuotaThresholdPercent, softQuotaCacheTtlMs, identity) {
-        const currentIndex = this.getActiveIndex(family, identity);
-        const candidates = this.preferAccountOutsideParent(this.accounts.filter((acc) => {
-            if (acc.enabled === false)
-                return false;
-            if (acc.index === currentIndex)
-                return false;
-            clearExpiredRateLimits(acc, this.now);
-            if (isRateLimitedForHeaderStyle(acc, family, headerStyle, this.now, model))
-                return false;
-            if (isOverSoftQuotaThreshold(acc, family, softQuotaThresholdPercent, softQuotaCacheTtlMs, this.now, model))
-                return false;
-            if (this.isAccountCoolingDown(acc))
-                return false;
-            return true;
-        }), family, identity);
-        if (candidates.length === 0)
-            return null;
-        const usedAccounts = this.getUsedAccounts(identity);
-        const warmCandidates = candidates.filter((account) => usedAccounts.has(account.index));
-        const pool = warmCandidates.length > 0 ? warmCandidates : candidates;
-        const quotaGroup = resolveQuotaGroup(family, model);
-        pool.sort((a, b) => {
-            const aRemaining = a.cachedQuota?.[quotaGroup]?.remainingFraction ?? 0;
-            const bRemaining = b.cachedQuota?.[quotaGroup]?.remainingFraction ?? 0;
-            return bRemaining - aRemaining;
-        });
-        const selected = pool[0];
-        if (!selected)
-            return null;
-        const quotaKey = getQuotaKey(family, headerStyle, model);
-        this.markTouchedForQuota(selected, quotaKey);
-        this.setActiveIndex(family, selected.index, identity);
-        return selected;
+        return this.selection.proactivelyRotateForFamily(family, model, headerStyle, softQuotaThresholdPercent, softQuotaCacheTtlMs, identity);
     }
     markRateLimitedWithReason(account, family, headerStyle, model, reason, retryAfterMs, failureTtlMs = 3600_000) {
-        const now = this.now();
-        // TTL-based reset: if last failure was more than failureTtlMs ago, reset count
-        if (account.lastFailureTime !== undefined &&
-            now - account.lastFailureTime > failureTtlMs) {
-            account.consecutiveFailures = 0;
-        }
-        const failures = (account.consecutiveFailures ?? 0) + 1;
-        account.consecutiveFailures = failures;
-        account.lastFailureTime = now;
-        const backoffMs = calculateBackoffMs(reason, failures - 1, retryAfterMs, this.random);
-        const key = getQuotaKey(family, headerStyle, model);
-        account.rateLimitResetTimes[key] = now + backoffMs;
-        return backoffMs;
+        return this.selection.markRateLimitedWithReason(account, family, headerStyle, model, reason, retryAfterMs, failureTtlMs);
     }
     markRequestSuccess(account) {
-        if (account.consecutiveFailures) {
-            account.consecutiveFailures = 0;
-        }
+        this.selection.markRequestSuccess(account);
     }
     clearAllRateLimitsForFamily(family, model) {
-        for (const account of this.accounts) {
-            if (family === 'claude') {
-                delete account.rateLimitResetTimes.claude;
-            }
-            else {
-                const antigravityKey = getQuotaKey(family, 'antigravity', model);
-                const cliKey = getQuotaKey(family, 'gemini-cli', model);
-                delete account.rateLimitResetTimes[antigravityKey];
-                delete account.rateLimitResetTimes[cliKey];
-            }
-            account.consecutiveFailures = 0;
-        }
+        this.selection.clearAllRateLimitsForFamily(family, model);
     }
     shouldTryOptimisticReset(family, model) {
-        const minWaitMs = this.getMinWaitTimeForFamily(family, model);
-        return minWaitMs > 0 && minWaitMs <= 2_000;
+        return this.selection.shouldTryOptimisticReset(family, model);
     }
     markAccountCoolingDown(account, cooldownMs, reason) {
-        account.coolingDownUntil = this.now() + cooldownMs;
-        account.cooldownReason = reason;
+        this.selection.markAccountCoolingDown(account, cooldownMs, reason);
     }
     isAccountCoolingDown(account) {
-        if (account.coolingDownUntil === undefined) {
-            return false;
-        }
-        if (this.now() >= account.coolingDownUntil) {
-            this.clearAccountCooldown(account);
-            return false;
-        }
-        return true;
+        return this.selection.isAccountCoolingDown(account);
     }
     clearAccountCooldown(account) {
-        delete account.coolingDownUntil;
-        delete account.cooldownReason;
+        this.selection.clearAccountCooldown(account);
     }
     getAccountCooldownReason(account) {
-        return this.isAccountCoolingDown(account)
-            ? account.cooldownReason
-            : undefined;
+        return this.selection.getAccountCooldownReason(account);
     }
     markTouchedForQuota(account, quotaKey) {
-        account.touchedForQuota[quotaKey] = this.now();
+        this.selection.markTouchedForQuota(account, quotaKey);
     }
     isFreshForQuota(account, quotaKey) {
-        const touchedAt = account.touchedForQuota[quotaKey];
-        if (!touchedAt)
-            return true;
-        const resetTime = account.rateLimitResetTimes[quotaKey];
-        if (resetTime && touchedAt < resetTime)
-            return true;
-        return false;
+        return this.selection.isFreshForQuota(account, quotaKey);
     }
     getFreshAccountsForQuota(quotaKey, family, model) {
-        return this.accounts.filter((acc) => {
-            clearExpiredRateLimits(acc, this.now);
-            return (acc.enabled !== false &&
-                this.isFreshForQuota(acc, quotaKey) &&
-                !isRateLimitedForFamily(acc, family, this.now, model) &&
-                !this.isAccountCoolingDown(acc));
-        });
+        return this.selection.getFreshAccountsForQuota(quotaKey, family, model);
     }
     isRateLimitedForHeaderStyle(account, family, headerStyle, model) {
-        return isRateLimitedForHeaderStyle(account, family, headerStyle, this.now, model);
+        return this.selection.isRateLimitedForHeaderStyle(account, family, headerStyle, model);
     }
     getAvailableHeaderStyle(account, family, model) {
-        clearExpiredRateLimits(account, this.now);
-        if (family === 'claude') {
-            return isRateLimitedForHeaderStyle(account, family, 'antigravity', this.now)
-                ? null
-                : 'antigravity';
-        }
-        if (!isRateLimitedForHeaderStyle(account, family, 'antigravity', this.now, model)) {
-            return 'antigravity';
-        }
-        if (!isRateLimitedForHeaderStyle(account, family, 'gemini-cli', this.now, model)) {
-            return 'gemini-cli';
-        }
-        return null;
+        return this.selection.getAvailableHeaderStyle(account, family, model);
     }
     /**
      * Check if any OTHER account has antigravity quota available for the given family/model.
@@ -791,198 +1056,62 @@ export class AccountManager {
      * @returns true if any other enabled, non-cooling-down account has antigravity available
      */
     hasOtherAccountWithAntigravityAvailable(currentAccountIndex, family, model) {
-        // Claude has no gemini-cli fallback - always return false
-        // (This method is only relevant for Gemini's dual quota pools)
-        if (family === 'claude') {
-            return false;
-        }
-        return this.accounts.some((acc) => {
-            // Skip current account
-            if (acc.index === currentAccountIndex) {
-                return false;
-            }
-            // Skip disabled accounts
-            if (acc.enabled === false) {
-                return false;
-            }
-            // Skip cooling down accounts
-            if (this.isAccountCoolingDown(acc)) {
-                return false;
-            }
-            // Clear expired rate limits before checking
-            clearExpiredRateLimits(acc, this.now);
-            // Check if antigravity is available for this account
-            return !isRateLimitedForHeaderStyle(acc, family, 'antigravity', this.now, model);
-        });
+        return this.selection.hasOtherAccountWithAntigravityAvailable(currentAccountIndex, family, model);
     }
     setAccountEnabled(accountIndex, enabled) {
-        const account = this.accounts[accountIndex];
-        if (!account) {
-            return false;
-        }
-        if (enabled && account.accountIneligible) {
-            return false;
-        }
-        account.enabled = enabled;
-        if (!enabled) {
-            for (const family of Object.keys(this.currentAccountIndexByFamily)) {
-                if (this.currentAccountIndexByFamily[family] === accountIndex) {
-                    const next = this.accounts.find((a, i) => i !== accountIndex && a.enabled !== false);
-                    this.currentAccountIndexByFamily[family] = next?.index ?? -1;
-                }
-            }
-        }
-        this.requestSaveToDisk();
-        return true;
+        return this.selection.setAccountEnabled(accountIndex, enabled);
     }
     markAccountVerificationRequired(accountIndex, reason, verifyUrl) {
-        const account = this.accounts[accountIndex];
-        if (!account) {
-            return false;
-        }
-        const timestamp = this.now();
-        account.verificationRequired = true;
-        account.verificationRequiredAt = timestamp;
-        account.verificationRequiredReason = reason?.trim() || undefined;
-        if (account.accountIneligible === true ||
-            account.accountIneligibleAt !== undefined ||
-            account.accountIneligibleReason !== undefined) {
-            account.accountIneligible = false;
-            account.accountIneligibleAt = undefined;
-            account.accountIneligibleReason = undefined;
-            account.eligibilityStateUpdatedAt = timestamp;
-        }
-        const normalizedVerifyUrl = verifyUrl?.trim();
-        if (normalizedVerifyUrl) {
-            account.verificationUrl = normalizedVerifyUrl;
-        }
-        if (account.enabled !== false) {
-            this.setAccountEnabled(accountIndex, false);
-        }
-        else {
-            this.requestSaveToDisk();
-        }
-        return true;
+        return this.selection.markAccountVerificationRequired(accountIndex, reason, verifyUrl);
     }
     markAccountIneligible(accountIndex, reason) {
-        const account = this.accounts[accountIndex];
-        if (!account) {
-            return false;
-        }
-        const timestamp = this.now();
-        account.accountIneligible = true;
-        account.accountIneligibleAt = timestamp;
-        account.accountIneligibleReason =
-            reason?.trim() || 'Google marked this account as ineligible.';
-        account.eligibilityStateUpdatedAt = timestamp;
-        account.verificationRequired = false;
-        account.verificationRequiredAt = undefined;
-        account.verificationRequiredReason = undefined;
-        account.verificationUrl = undefined;
-        if (account.enabled !== false) {
-            this.setAccountEnabled(accountIndex, false);
-        }
-        else {
-            this.requestSaveToDisk();
-        }
-        return true;
+        return this.selection.markAccountIneligible(accountIndex, reason);
     }
     clearAccountAccessBlocks(accountIndex, enableAccount = false) {
-        const account = this.accounts[accountIndex];
-        if (!account) {
-            return false;
-        }
-        const wasVerificationRequired = account.verificationRequired === true;
-        const wasIneligible = account.accountIneligible === true;
-        const hadMetadata = wasVerificationRequired ||
-            wasIneligible ||
-            account.verificationRequiredAt !== undefined ||
-            account.verificationRequiredReason !== undefined ||
-            account.verificationUrl !== undefined ||
-            account.accountIneligibleAt !== undefined ||
-            account.accountIneligibleReason !== undefined ||
-            account.eligibilityStateUpdatedAt !== undefined;
-        account.verificationRequired = false;
-        account.verificationRequiredAt = undefined;
-        account.verificationRequiredReason = undefined;
-        account.verificationUrl = undefined;
-        account.accountIneligible = false;
-        account.accountIneligibleAt = undefined;
-        account.accountIneligibleReason = undefined;
-        if (wasIneligible || account.eligibilityStateUpdatedAt !== undefined) {
-            account.eligibilityStateUpdatedAt = this.now();
-        }
-        if (enableAccount &&
-            (wasVerificationRequired || wasIneligible) &&
-            account.enabled === false) {
-            this.setAccountEnabled(accountIndex, true);
-        }
-        else if (hadMetadata) {
-            this.requestSaveToDisk();
-        }
-        return true;
+        return this.selection.clearAccountAccessBlocks(accountIndex, enableAccount);
     }
     removeAccountByIndex(accountIndex) {
-        if (accountIndex < 0 || accountIndex >= this.accounts.length) {
+        const accounts = this.accounts;
+        if (accountIndex < 0 || accountIndex >= accounts.length) {
             return false;
         }
-        const account = this.accounts[accountIndex];
+        const account = accounts[accountIndex];
         if (!account) {
             return false;
         }
         return this.removeAccount(account);
     }
     removeAccount(account) {
-        const idx = this.accounts.indexOf(account);
-        if (idx < 0) {
+        if (!this.selection.has(account)) {
             return false;
         }
-        this.accounts.splice(idx, 1);
-        this.accounts.forEach((acc, index) => {
-            acc.index = index;
-        });
-        if (this.accounts.length === 0) {
-            this.cursorByFamily = { claude: 0, gemini: 0 };
-            this.currentAccountIndexByFamily.claude = -1;
-            this.currentAccountIndexByFamily.gemini = -1;
-            this.requestSessionStates.clear();
-            return true;
-        }
-        for (const family of ['claude', 'gemini']) {
-            if (this.cursorByFamily[family] > idx) {
-                this.cursorByFamily[family] -= 1;
+        // Fenced on the account's credential: a row replaced or re-added since
+        // it was loaded is refused rather than removed.
+        this.dispatch(account, 'removal', (repository, ref) => repository.remove(ref));
+        for (const [key, pending] of this.pendingRowWrites) {
+            if (account.ref !== undefined && sameRowRef(pending.ref, account.ref)) {
+                this.pendingRowWrites.delete(key);
             }
-            this.cursorByFamily[family] =
-                this.cursorByFamily[family] % this.accounts.length;
-            if (this.currentAccountIndexByFamily[family] > idx) {
-                this.currentAccountIndexByFamily[family] -= 1;
-            }
-            if (this.currentAccountIndexByFamily[family] >= this.accounts.length) {
-                this.currentAccountIndexByFamily[family] = -1;
-            }
-            for (const state of this.requestSessionStates.values()) {
-                const currentIndex = state.currentAccountIndexByFamily[family];
-                if (currentIndex === idx) {
-                    state.currentAccountIndexByFamily[family] = -1;
-                }
-                else if (currentIndex > idx) {
-                    state.currentAccountIndexByFamily[family] -= 1;
-                }
-                if (state.cursorByFamily[family] > idx) {
-                    state.cursorByFamily[family] -= 1;
-                }
-                state.cursorByFamily[family] %= this.accounts.length;
-            }
-        }
-        for (const state of this.requestSessionStates.values()) {
-            state.usedAccounts = new Set([...state.usedAccounts]
-                .filter((accountIndex) => accountIndex !== idx)
-                .map((accountIndex) => accountIndex > idx ? accountIndex - 1 : accountIndex));
         }
-        return true;
+        return this.selection.removeAccount(account);
     }
     updateFromAuth(account, auth) {
         const parts = parseRefreshParts(auth.refresh);
+        // Only the projects packed into the host's refresh string are recorded;
+        // the refresh token itself reaches the repository only through
+        // `refreshAccount`.
+        const projectChange = {
+            ...(parts.projectId !== undefined && parts.projectId !== account.projectId
+                ? { projectId: parts.projectId }
+                : {}),
+            ...(parts.managedProjectId !== undefined &&
+                parts.managedProjectId !== account.managedProjectId
+                ? { managedProjectId: parts.managedProjectId }
+                : {}),
+        };
+        if (Object.keys(projectChange).length > 0) {
+            this.dispatch(account, 'project', (repository, ref) => repository.recordProject(ref, projectChange));
+        }
         // Preserve existing projectId/managedProjectId if not in the new parts
         account.parts = {
             ...parts,
@@ -1005,48 +1134,15 @@ export class AccountManager {
         };
     }
     getMinWaitTimeForFamily(family, model, headerStyle, strict) {
-        const available = this.accounts.filter((a) => {
-            clearExpiredRateLimits(a, this.now);
-            return (a.enabled !== false &&
-                (strict && headerStyle
-                    ? !isRateLimitedForHeaderStyle(a, family, headerStyle, this.now, model)
-                    : !isRateLimitedForFamily(a, family, this.now, model)));
-        });
-        if (available.length > 0) {
-            return 0;
-        }
-        const waitTimes = [];
-        for (const a of this.accounts) {
-            if (family === 'claude') {
-                const t = a.rateLimitResetTimes.claude;
-                if (t !== undefined)
-                    waitTimes.push(Math.max(0, t - this.now()));
-            }
-            else if (strict && headerStyle) {
-                const key = getQuotaKey(family, headerStyle, model);
-                const t = a.rateLimitResetTimes[key];
-                if (t !== undefined)
-                    waitTimes.push(Math.max(0, t - this.now()));
-            }
-            else {
-                // For Gemini, account becomes available when EITHER pool expires for this model/family
-                const antigravityKey = getQuotaKey(family, 'antigravity', model);
-                const cliKey = getQuotaKey(family, 'gemini-cli', model);
-                const t1 = a.rateLimitResetTimes[antigravityKey];
-                const t2 = a.rateLimitResetTimes[cliKey];
-                const accountWait = Math.min(t1 !== undefined ? Math.max(0, t1 - this.now()) : Infinity, t2 !== undefined ? Math.max(0, t2 - this.now()) : Infinity);
-                if (accountWait !== Infinity)
-                    waitTimes.push(accountWait);
-            }
-        }
-        return waitTimes.length > 0 ? Math.min(...waitTimes) : 0;
+        return this.selection.getMinWaitTimeForFamily(family, model, headerStyle, strict);
     }
     getAccounts() {
-        return [...this.accounts];
+        return this.selection.getAccounts();
     }
     buildStorageSnapshot() {
-        const claudeIndex = Math.max(0, this.currentAccountIndexByFamily.claude);
-        const geminiIndex = Math.max(0, this.currentAccountIndexByFamily.gemini);
+        const active = this.selection.getActiveIndexByFamily();
+        const claudeIndex = Math.max(0, active.claude);
+        const geminiIndex = Math.max(0, active.gemini);
         return {
             version: 4,
             accounts: this.accounts.map((a) => ({
@@ -1095,7 +1191,17 @@ export class AccountManager {
         };
     }
     async saveToDisk() {
-        await this.store.saveMerged(this.storagePath, this.buildStorageSnapshot());
+        if (this.repository !== undefined) {
+            await this.flushRepositoryWrites();
+            return;
+        }
+        await this.requireStore().saveMerged(this.storagePath, this.buildStorageSnapshot());
+    }
+    requireStore() {
+        if (this.store === undefined) {
+            throw new Error('this AccountManager persists through its repository');
+        }
+        return this.store;
     }
     /**
      * Persist via full-file replace (no merge). Required after destructive
@@ -1103,8 +1209,14 @@ export class AccountManager {
      * mergeAccountStorage re-reading it from disk.
      */
     async saveToDiskReplace() {
+        // A repository-backed manager removes rows by attributed `remove`
+        // writes, so nothing can bring a removed row back; draining suffices.
+        if (this.repository !== undefined) {
+            await this.flushRepositoryWrites();
+            return;
+        }
         const snapshot = this.buildStorageSnapshot();
-        await this.store.mutate(this.storagePath, () => snapshot);
+        await this.requireStore().mutate(this.storagePath, () => snapshot);
     }
     requestSaveToDisk() {
         if (this.disposed || this.savePending) {
@@ -1118,6 +1230,12 @@ export class AccountManager {
         }, 1000);
     }
     async flushSaveToDisk() {
+        // Writes such as request counts start immediately rather than waiting
+        // for a scheduled save, so a repository-backed flush always drains.
+        if (this.repository !== undefined) {
+            await this.drainRepository();
+            return;
+        }
         if (!this.savePending) {
             await this.saveInFlight;
             return;
@@ -1134,16 +1252,53 @@ export class AccountManager {
             clearTimeout(this.saveTimeout);
             this.saveTimeout = null;
         }
+        if (this.repository !== undefined) {
+            await this.drainRepository();
+            return;
+        }
         if (this.savePending) {
             await this.executeSave();
         }
         await this.saveInFlight;
     }
+    /**
+     * Cancels a scheduled save and drains every repository write now. A
+     * failure rejects every waiting flush and is thrown to the caller.
+     */
+    async drainRepository() {
+        if (this.saveTimeout) {
+            clearTimeout(this.saveTimeout);
+            this.saveTimeout = null;
+        }
+        this.savePending = false;
+        const resolvers = this.savePromiseResolvers;
+        this.savePromiseResolvers = [];
+        await this.saveInFlight;
+        await this.settleRepositoryDrain(resolvers);
+    }
+    async settleRepositoryDrain(resolvers) {
+        try {
+            await this.flushRepositoryWrites();
+        }
+        catch (error) {
+            for (const { reject } of resolvers)
+                reject(error);
+            throw error;
+        }
+        for (const { resolve } of resolvers)
+            resolve();
+    }
     async executeSave() {
         this.savePending = false;
         this.saveTimeout = null;
         const resolvers = this.savePromiseResolvers;
         this.savePromiseResolvers = [];
+        if (this.repository !== undefined) {
+            // A scheduled save has no caller to throw to: its failures reach
+            // waiting flushes and the diagnostics.
+            await this.settleRepositoryDrain(resolvers).catch(() => { });
+            return;
+        }
         try {
             await this.saveToDisk();
             for (const { resolve } of resolvers) {
@@ -1175,30 +1330,7 @@ export class AccountManager {
      * @returns The new fingerprint, or null if account not found
      */
     regenerateAccountFingerprint(accountIndex) {
-        const account = this.accounts[accountIndex];
-        if (!account)
-            return null;
-        // Save current fingerprint to history if it exists
-        if (account.fingerprint) {
-            const historyEntry = {
-                fingerprint: account.fingerprint,
-                timestamp: this.now(),
-                reason: 'regenerated',
-            };
-            if (!account.fingerprintHistory) {
-                account.fingerprintHistory = [];
-            }
-            // Add to beginning of history (most recent first)
-            account.fingerprintHistory.unshift(historyEntry);
-            // Trim to max history size
-            if (account.fingerprintHistory.length > MAX_FINGERPRINT_HISTORY) {
-                account.fingerprintHistory = account.fingerprintHistory.slice(0, MAX_FINGERPRINT_HISTORY);
-            }
-        }
-        // Generate and assign new fingerprint
-        account.fingerprint = generateFingerprint();
-        this.requestSaveToDisk();
-        return account.fingerprint;
+        return this.selection.regenerateAccountFingerprint(accountIndex);
     }
     /**
      * Restore a fingerprint from history for an account.
@@ -1207,32 +1339,7 @@ export class AccountManager {
      * @returns The restored fingerprint, or null if account/history not found
      */
     restoreAccountFingerprint(accountIndex, historyIndex) {
-        const account = this.accounts[accountIndex];
-        if (!account)
-            return null;
-        const history = account.fingerprintHistory;
-        if (!history || historyIndex < 0 || historyIndex >= history.length) {
-            return null;
-        }
-        // Capture the fingerprint to restore BEFORE modifying history
-        const fingerprintToRestore = history[historyIndex].fingerprint;
-        // Save current fingerprint to history before restoring (if it exists)
-        if (account.fingerprint) {
-            const historyEntry = {
-                fingerprint: account.fingerprint,
-                timestamp: this.now(),
-                reason: 'restored',
-            };
-            account.fingerprintHistory.unshift(historyEntry);
-            // Trim to max history size
-            if (account.fingerprintHistory.length > MAX_FINGERPRINT_HISTORY) {
-                account.fingerprintHistory = account.fingerprintHistory.slice(0, MAX_FINGERPRINT_HISTORY);
-            }
-        }
-        // Restore the fingerprint
-        account.fingerprint = { ...fingerprintToRestore, createdAt: this.now() };
-        this.requestSaveToDisk();
-        return account.fingerprint;
+        return this.selection.restoreAccountFingerprint(accountIndex, historyIndex);
     }
     /**
      * Get fingerprint history for an account.
@@ -1240,11 +1347,7 @@ export class AccountManager {
      * @returns Array of fingerprint versions, or empty array if not found
      */
     getAccountFingerprintHistory(accountIndex) {
-        const account = this.accounts[accountIndex];
-        if (!account?.fingerprintHistory) {
-            return [];
-        }
-        return [...account.fingerprintHistory];
+        return this.selection.getAccountFingerprintHistory(accountIndex);
     }
     updateQuotaCache(accountIndex, quotaGroups, expectedRefreshToken) {
         const account = this.accounts[accountIndex];
@@ -1258,6 +1361,15 @@ export class AccountManager {
         // a different account after an index shift.
         account.cachedQuotaAccountId = quotaAccountIdentity(account.parts.refreshToken);
         account.cachedQuotaUpdatedAt = this.now();
+        // A separate attributed write from the tier; the per-model readings the
+        // store keeps are left as they are because this reading carries none.
+        const reading = {
+            schemaVersion: 1,
+            cachedQuotaAccountId: account.cachedQuotaAccountId,
+            cachedQuota: storedQuotaGroups(quotaGroups),
+            cachedQuotaUpdatedAt: account.cachedQuotaUpdatedAt,
+        };
+        this.dispatch(account, 'quota reading', (repository, ref) => repository.recordQuota(ref, reading));
     }
     /**
      * Apply a subset of fields from a quota-fetch `updatedAccount` result onto
@@ -1292,148 +1404,107 @@ export class AccountManager {
         if (patch.capturedTierSchemaVersion !== undefined) {
             account.capturedTierSchemaVersion = patch.capturedTierSchemaVersion;
         }
+        const tier = {};
+        if (patch.capturedTierId !== undefined)
+            tier.capturedTierId = patch.capturedTierId;
+        if (patch.capturedPaidTierId !== undefined) {
+            tier.capturedPaidTierId = patch.capturedPaidTierId;
+        }
+        if (patch.capturedTierAt !== undefined)
+            tier.capturedTierAt = patch.capturedTierAt;
+        if (patch.capturedTierSchemaVersion !== undefined) {
+            tier.capturedTierSchemaVersion = patch.capturedTierSchemaVersion;
+        }
+        if (Object.keys(tier).length === 0)
+            return;
+        this.dispatch(account, 'tier', (repository, ref) => repository.updateMetadata(ref, (current, row) => {
+            const base = current ?? {
+                addedAt: row.storeAddedAt ?? this.now(),
+                lastUsed: 0,
+            };
+            // A capture older than the stored one does not replace it.
+            if (patch.capturedTierAt !== undefined &&
+                typeof base.capturedTierAt === 'number' &&
+                patch.capturedTierAt < base.capturedTierAt) {
+                return { kind: 'keep' };
+            }
+            return { kind: 'set', metadata: { ...base, ...tier } };
+        }));
     }
     /**
      * Record a successful API request for an account.
      * Tracks per model family with daily reset.
      */
     recordRequest(accountIndex, family) {
-        const account = this.accounts[accountIndex];
-        if (!account)
-            return;
-        const today = new Date(this.now()).toISOString().slice(0, 10);
-        if (!account.dailyRequestCounts ||
-            account.dailyRequestCounts.date !== today) {
-            account.dailyRequestCounts = { date: today, claude: 0, gemini: 0 };
-        }
-        account.dailyRequestCounts[family]++;
-        account.lastUsed = this.now();
-        // Also track for session
-        this.recordSessionRequest(accountIndex, family);
+        this.selection.recordRequest(accountIndex, family);
     }
     /**
      * Get request counts for an account for today.
      */
     getDailyRequestCounts(accountIndex) {
-        const account = this.accounts[accountIndex];
-        if (!account?.dailyRequestCounts)
-            return null;
-        const today = new Date(this.now()).toISOString().slice(0, 10);
-        if (account.dailyRequestCounts.date !== today)
-            return null;
-        return { ...account.dailyRequestCounts };
+        return this.selection.getDailyRequestCounts(accountIndex);
     }
     /**
      * Get total daily request counts across all accounts for a model family.
      */
     getTotalDailyRequests(family) {
-        const today = new Date(this.now()).toISOString().slice(0, 10);
-        let total = 0;
-        for (const account of this.accounts) {
-            if (account.dailyRequestCounts?.date === today) {
-                total += account.dailyRequestCounts[family];
-            }
-        }
-        return total;
+        return this.selection.getTotalDailyRequests(family);
     }
     /**
      * Get a summary of daily request distribution across accounts.
      * Returns accounts sorted by request count (descending).
      */
     getDailyRequestSummary(family) {
-        const today = new Date(this.now()).toISOString().slice(0, 10);
-        const result = [];
-        for (const account of this.accounts) {
-            const count = account.dailyRequestCounts?.date === today
-                ? account.dailyRequestCounts[family]
-                : 0;
-            if (count > 0) {
-                result.push({ index: account.index, email: account.email, count });
-            }
-        }
-        return result.sort((a, b) => b.count - a.count);
+        return this.selection.getDailyRequestSummary(family);
     }
     /**
      * Record a request for the current session (in-memory only).
      */
     recordSessionRequest(accountIndex, family) {
-        const key = String(accountIndex);
-        const current = this.sessionRequestCounts.get(key) ?? {
-            claude: 0,
-            gemini: 0,
-        };
-        current[family]++;
-        this.sessionRequestCounts.set(key, current);
+        this.selection.recordSessionRequest(accountIndex, family);
     }
     /**
      * Get a summary of the current session's request usage.
      */
     getSessionSummary() {
-        const durationMs = this.now() - this.sessionStartTime;
-        const durationMinutes = Math.round(durationMs / 60000);
-        const durationHours = durationMs / 3600000;
-        let totalClaude = 0;
-        let totalGemini = 0;
-        const perAccount = [];
-        for (const [key, counts] of this.sessionRequestCounts) {
-            const idx = Number(key);
-            const account = this.accounts[idx];
-            totalClaude += counts.claude;
-            totalGemini += counts.gemini;
-            if (counts.claude > 0 || counts.gemini > 0) {
-                perAccount.push({
-                    index: idx,
-                    email: account?.email,
-                    claude: counts.claude,
-                    gemini: counts.gemini,
-                });
-            }
-        }
-        const totalRequests = totalClaude + totalGemini;
-        const requestsPerHour = durationHours > 0 ? Math.round(totalRequests / durationHours) : 0;
-        return {
-            durationMinutes,
-            totalClaude,
-            totalGemini,
-            requestsPerHour,
-            accountsUsed: perAccount.length,
-            perAccount: perAccount.sort((a, b) => b.claude + b.gemini - (a.claude + a.gemini)),
-        };
+        return this.selection.getSessionSummary();
     }
     isAccountOverSoftQuota(account, family, thresholdPercent, cacheTtlMs, model) {
-        return isOverSoftQuotaThreshold(account, family, this.getEffectiveSoftQuotaThreshold(thresholdPercent), cacheTtlMs, this.now, model);
+        return this.selection.isAccountOverSoftQuota(account, family, thresholdPercent, cacheTtlMs, model);
     }
+    /**
+     * The accounts a quota check should cover. For a repository-backed
+     * manager each target carries the ref its account is loaded under,
+     * captured now, before any quota work starts; an account without a ref
+     * has no row to attribute a reading to and is left out rather than
+     * matched by position, email or token.
+     */
     getAccountsForQuotaCheck() {
-        return this.accounts.map((a) => ({
-            email: a.email,
-            refreshToken: a.parts.refreshToken,
-            projectId: a.parts.projectId ?? a.projectId,
-            managedProjectId: a.parts.managedProjectId ?? a.managedProjectId,
-            addedAt: a.addedAt,
-            lastUsed: a.lastUsed,
-            enabled: a.enabled,
-        }));
+        const targets = [];
+        for (const a of this.accounts) {
+            const target = {
+                email: a.email,
+                refreshToken: a.parts.refreshToken,
+                projectId: a.parts.projectId ?? a.projectId,
+                managedProjectId: a.parts.managedProjectId ?? a.managedProjectId,
+                addedAt: a.addedAt,
+                lastUsed: a.lastUsed,
+                enabled: a.enabled,
+            };
+            if (this.repository === undefined) {
+                targets.push(target);
+            }
+            else if (a.ref !== undefined) {
+                targets.push({ ...target, rowRef: a.ref });
+            }
+        }
+        return targets;
     }
     getOldestQuotaCacheAge() {
-        let oldest = null;
-        for (const acc of this.accounts) {
-            if (acc.enabled === false)
-                continue;
-            if (acc.cachedQuotaUpdatedAt == null)
-                return null;
-            const age = this.now() - acc.cachedQuotaUpdatedAt;
-            if (oldest === null || age > oldest)
-                oldest = age;
-        }
-        return oldest;
+        return this.selection.getOldestQuotaCacheAge();
     }
     areAllAccountsOverSoftQuota(family, thresholdPercent, cacheTtlMs, model) {
-        if (thresholdPercent >= 100)
-            return false;
-        const enabled = this.accounts.filter((a) => a.enabled !== false);
-        if (enabled.length <= 1)
-            return false;
-        return enabled.every((a) => isOverSoftQuotaThreshold(a, family, thresholdPercent, cacheTtlMs, this.now, model));
+        return this.selection.areAllAccountsOverSoftQuota(family, thresholdPercent, cacheTtlMs, model);
     }
     /**
      * Get minimum wait time until any account's soft quota resets.
@@ -1442,39 +1513,7 @@ export class AccountManager {
      * Returns null if no resetTime data is available.
      */
     getMinWaitTimeForSoftQuota(family, thresholdPercent, cacheTtlMs, model) {
-        if (thresholdPercent >= 100)
-            return 0;
-        const enabled = this.accounts.filter((a) => a.enabled !== false);
-        if (enabled.length === 0)
-            return null;
-        if (enabled.length === 1)
-            return 0;
-        // If any account is available (not over threshold), no wait needed
-        const available = enabled.filter((a) => !isOverSoftQuotaThreshold(a, family, thresholdPercent, cacheTtlMs, this.now, model));
-        if (available.length > 0)
-            return 0;
-        // All accounts are over threshold - find earliest reset time
-        // For gemini family, we MUST have the model to distinguish pro vs flash quotas.
-        // Fail-open (return null = no wait info) if model is missing to avoid blocking on wrong quota.
-        if (!model && family !== 'claude')
-            return null;
-        const quotaGroup = resolveQuotaGroup(family, model);
-        const now = this.now();
-        const waitTimes = [];
-        for (const acc of enabled) {
-            const groupData = acc.cachedQuota?.[quotaGroup];
-            if (groupData?.resetTime) {
-                const resetTimestamp = Date.parse(groupData.resetTime);
-                if (Number.isFinite(resetTimestamp)) {
-                    waitTimes.push(Math.max(0, resetTimestamp - now));
-                }
-            }
-        }
-        if (waitTimes.length === 0)
-            return null;
-        const minWait = Math.min(...waitTimes);
-        // Treat 0 as stale cache (resetTime in the past) → fail-open to avoid spin loop
-        return minWait === 0 ? null : minWait;
+        return this.selection.getMinWaitTimeForSoftQuota(family, thresholdPercent, cacheTtlMs, model);
     }
 }
 //# sourceMappingURL=account-manager.js.map