@cortexkit/antigravity-auth-core 3.0.11 → 3.0.13

package/dist/common-auth-embedded/store/attribution.js

@@ -1,8 +1,41 @@
 import { PoolOperationError } from './errors.js';
-import { toFailure, withTransaction } from './mutate.js';
+import { toFailure, withTransaction, } from './mutate.js';
 import { LockStack } from './refresh-lock.js';
 import { refusal, requireBound, unknownRow, } from './runtime.js';
 import { isCredentialEpoch } from './schema.js';
+export function assertQuotaEpoch(id, attribution) {
+    if (!isCredentialEpoch(attribution?.credentialEpoch))
+        throw refusal('pull', id, 'invalid-input', 'the credential epoch the reading was issued for must be a positive safe integer');
+}
+// Shared by preflight and the locked commit: accepting into memory must never
+// hide a refusal the immediate writer would have returned to its caller.
+export function assertQuotaRow(id, attribution, row) {
+    if (!row)
+        throw unknownRow('pull', id);
+    if (row.invalid)
+        throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
+    if (!row.credential)
+        throw refusal('pull', id, 'no-credential', `row ${id} holds no credential`);
+    requireBound('pull', row);
+    if (row.torn ||
+        !row.hasEntry ||
+        row.credentialEpoch !== attribution.credentialEpoch ||
+        row.identity !== attribution.identity)
+        throw new PoolOperationError({
+            operation: 'pull',
+            rowId: id,
+            phase: 'pull',
+            retryable: true,
+            kind: 'attribution',
+            message: `quota for ${id} was issued for a credential the row no longer holds`,
+        });
+}
+export function mergedQuota(ctx, id, stored, observation) {
+    const merged = ctx.codec.merge(stored, observation);
+    if (!ctx.codec.validate(merged))
+        throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+    return merged;
+}
 /**
  * Merges a quota observation into a row's stored map under the store locks,
  * after attribution passes. Needs no row lock, so it is permitted from
@@ -13,37 +46,18 @@ export async function recordQuota(rt, id, attribution, observation) {
     const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
     const progress = { writes: 0 };
     try {
-        if (!isCredentialEpoch(attribution?.credentialEpoch))
-            throw refusal('pull', id, 'invalid-input', 'the credential epoch the reading was issued for must be a positive safe integer');
+        assertQuotaEpoch(id, attribution);
         await withTransaction(ctx, locks, progress, { operation: 'pull', rowId: id }, async (tx) => {
             tx.assertNotStaged(id);
             const row = tx.row(id);
-            if (!row)
-                throw unknownRow('pull', id);
-            if (row.invalid)
-                throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
             // A reading belongs to one (epoch, identity, credential). A row
             // holding no credential, or torn between the writes of a replace,
             // has no such triple on disk, so no reading is recorded for it.
-            if (!row.credential)
-                throw refusal('pull', id, 'no-credential', `row ${id} holds no credential`);
-            requireBound('pull', row);
+            assertQuotaRow(id, attribution, row);
             const entry = tx.entry(id);
-            if (row.torn ||
-                !entry ||
-                entry.credentialEpoch !== attribution.credentialEpoch ||
-                row.identity !== attribution.identity)
-                throw new PoolOperationError({
-                    operation: 'pull',
-                    rowId: id,
-                    phase: 'pull',
-                    retryable: true,
-                    kind: 'attribution',
-                    message: `quota for ${id} was issued for a credential the row no longer holds`,
-                });
-            const merged = ctx.codec.merge(entry.quota, observation);
-            if (!ctx.codec.validate(merged))
-                throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+            if (!entry)
+                throw unknownRow('pull', id);
+            const merged = mergedQuota(ctx, id, entry.quota, observation);
             tx.setEntry(id, { ...entry, quota: merged, needsFirstReading: false });
             await tx.commitConfig();
         }, 

package/dist/common-auth-embedded/store/mutate.d.ts

@@ -52,6 +52,8 @@ export type ReadResult = ({
     kind?: 'snapshot-contended';
     retryable?: true;
 };
+/** Settings need only the config classification, not a joined roster snapshot. */
+export declare function readPoolConfig(path: string): Promise<import("./schema.js").ConfigClassification>;
 /**
  * Validate config/state/config bytes without locks. Roster replacement writes
  * config before deleting old state credentials. Re-read a changed config so an

package/dist/common-auth-embedded/store/mutate.js

@@ -28,6 +28,10 @@ function parseFile(text) {
         return { exists: true, parseError };
     }
 }
+/** Settings need only the config classification, not a joined roster snapshot. */
+export async function readPoolConfig(path) {
+    return classifyConfig(parseFile(await readText(path)));
+}
 /**
  * Validate config/state/config bytes without locks. Roster replacement writes
  * config before deleting old state credentials. Re-read a changed config so an

package/dist/common-auth-embedded/store/pool.d.ts

@@ -1,3 +1,4 @@
+import type { QuotaCommitTimer } from '../quota/commit-interval.js';
 import { type Attribution } from './attribution.js';
 import type { PoolOperationError } from './errors.js';
 import type { PoolLogger } from './hooks.js';
@@ -16,6 +17,23 @@ export interface OpenPoolStoreOptions {
     configPath: string;
     statePath: string;
     quota: QuotaCodec;
+    /**
+     * Opt in to detached, coalesced quota publication, with any `quota` codec.
+     * Each accepted observation is queued whole for its row and binding, and
+     * the queue is applied in arrival order through `quota.merge` under the
+     * store locks, so the codec's own merge decides which fields a newer or
+     * older reading replaces. Accepted readings appear in read/load
+     * immediately, merged the same way; the returned promise still rejects
+     * current-row refusals before queueing. Await dispose or close at shutdown
+     * to attempt a bounded drain; readings still pending at its timeout are
+     * discarded. Normal quota commits are at least 30 seconds apart; a full
+     * queue commits early so response handling never waits for that interval.
+     */
+    coalesceQuota?: boolean;
+    /** Bounded quota drain on close/dispose, in milliseconds; defaults to 1,000. */
+    quotaDrainTimeoutMs?: number;
+    /** Monotonic clock and scheduling seam for detached quota commits. */
+    quotaCommitTimer?: QuotaCommitTimer;
     /**
      * The codec of the provider state kept beside each row's credential (see
      * `ProviderStateCodec`). Without it no row shows a provider state, and
@@ -189,6 +207,10 @@ export interface PoolStore {
     }>;
     refresh(id: string, provider: ProviderRefresh, options?: RefreshOptions): Promise<RefreshOutcome>;
     recordQuota(id: string, attribution: Attribution, observation: unknown): Promise<void>;
+    /** Drain opted-in quota publication; subsequent coalesced readings refuse. Idempotent. */
+    close(): Promise<void>;
+    /** Same bounded quota drain as close(). Does not wait for provider pull hooks. */
+    dispose(): Promise<void>;
     /** Fires a pull for a row admission refused for want of a reading. */
     requestReading(id: string): void;
     /** Resolves once every pull fired so far has settled. */

package/dist/common-auth-embedded/store/pool.js

@@ -3,6 +3,7 @@ import { initializePool, readPool, } from './mutate.js';
 import { updateProviderStateRow, } from './provider-state.js';
 import { publication, publishRoster, } from './publication.js';
 import { PullScheduler } from './pull.js';
+import { PoolQuotaWriter } from './quota-writer.js';
 import { refreshRow, } from './refresh.js';
 import { POOL_LOCK_DEFAULTS, } from './refresh-lock.js';
 import { addRow, disableRow, enableRow, recordRowIdentity, removeRow, reorderRows, replaceRow, rotateRow, } from './rows.js';
@@ -80,9 +81,21 @@ export function openPoolStore(options) {
         rowLockOptions: options.rowLockOptions ?? {},
         firePull: (id, reason) => pulls.fire(id, reason),
     };
+    const quotaWriter = options.coalesceQuota
+        ? new PoolQuotaWriter(rt, options.quotaDrainTimeoutMs, options.quotaCommitTimer)
+        : undefined;
+    const record = (id, attribution, observation) => quotaWriter
+        ? quotaWriter.record(id, attribution, observation)
+        : recordQuota(rt, id, attribution, observation);
+    rt.publishQuota = record;
+    const overlay = (result) => {
+        if (result.status === 'ready' && quotaWriter)
+            return { ...result, rows: quotaWriter.overlay(result.rows) };
+        return result;
+    };
     return {
         async load() {
-            const result = await readPool(ctx);
+            const result = overlay(await readPool(ctx));
             if (result.status === 'ready') {
                 // A torn row is no candidate, but its pull is fired too: the pull
                 // completes the row on disk before reading it, so an interrupted
@@ -96,7 +109,7 @@ export function openPoolStore(options) {
             return toLoad(result);
         },
         async read() {
-            return toLoad(await readPool(ctx));
+            return toLoad(overlay(await readPool(ctx)));
         },
         async initialize(input = {}) {
             return { status: await initializePool(ctx, input.dropKeys ?? []) };
@@ -115,7 +128,9 @@ export function openPoolStore(options) {
         updateSettings: (mutator, callOptions) => updatePoolSettings(rt, mutator, callOptions),
         recordIdentity: (id, identity, attribution, callOptions) => recordRowIdentity(rt, id, identity, attribution, callOptions),
         refresh: (id, provider, callOptions) => refreshRow(rt, id, provider, callOptions),
-        recordQuota: (id, attribution, observation) => recordQuota(rt, id, attribution, observation),
+        recordQuota: record,
+        close: () => quotaWriter?.close() ?? Promise.resolve(),
+        dispose: () => quotaWriter?.close() ?? Promise.resolve(),
         requestReading: (id) => pulls.fire(id, 'admission'),
         pullsSettled: () => pulls.settled(),
     };

package/dist/common-auth-embedded/store/pull.js

@@ -105,7 +105,9 @@ export class PullScheduler {
                     cause,
                 });
             }
-            await recordQuota(rt, id, {
+            const publish = rt.publishQuota ??
+                ((rowId, attribution, value) => recordQuota(rt, rowId, attribution, value));
+            await publish(id, {
                 credentialEpoch: request.credentialEpoch,
                 ...(request.identity !== undefined
                     ? { identity: request.identity }

package/dist/common-auth-embedded/store/quota-writer.js

@@ -0,0 +1,312 @@
+import { createLogger } from '../logger/index.js';
+import { QUOTA_COMMIT_INTERVAL_MS, quotaCommitTimer, } from '../quota/commit-interval.js';
+import { assertQuotaEpoch, assertQuotaRow, mergedQuota, } from './attribution.js';
+import { PoolOperationError } from './errors.js';
+import { toFailure, withTransaction } from './mutate.js';
+import { LockStack } from './refresh-lock.js';
+import { readRow, refusal } from './runtime.js';
+import { entryIn } from './schema.js';
+const COALESCE_MS = 100;
+/**
+ * The most readings one row keeps waiting for a flush. Hosts record a reading
+ * about every 100 ms at most, so for them a queue this long means another
+ * writer has held the store locks for many seconds. Reaching it starts
+ * a flush at once instead of waiting for the coalescing timer or a retry
+ * backoff; a further reading for the row waits for room (never dropping an
+ * older one) for as long as the store's normal lock budget, and is then
+ * refused with `lock-contention`, as the immediate writer would refuse it.
+ */
+export const POOL_QUOTA_QUEUE_LIMIT = 128;
+// Readings are queued whole per row and applied at flush in arrival order
+// through the codec's own merge, so the codec alone decides which fields a
+// newer or older reading replaces. Like the roster writer, a reading stays
+// queued until the flush that took it commits: one queued while a flush waits
+// for its locks must survive that flush.
+export class PoolQuotaWriter {
+    rt;
+    timeoutMs;
+    clock;
+    pending = new Map();
+    warned = new Set();
+    wake = new Set();
+    logger;
+    timer;
+    committedAt;
+    running;
+    closing;
+    closed = false;
+    stopped = false;
+    failures = 0;
+    constructor(rt, timeoutMs = 1_000, clock = quotaCommitTimer) {
+        this.rt = rt;
+        this.timeoutMs = timeoutMs;
+        this.clock = clock;
+        this.logger = rt.ctx.logger ?? createLogger('store');
+    }
+    async record(id, attribution, observation) {
+        try {
+            this.assertOpen(id);
+            assertQuotaEpoch(id, attribution);
+            // Snapshot before the first await: callers may reuse their headers object.
+            const publication = structuredClone({
+                id,
+                attribution,
+                observation,
+            });
+            const { row, result } = await readRow(this.rt, 'pull', id);
+            assertQuotaRow(id, publication.attribution, row);
+            // Merge into what read() shows now, so a reading the codec refuses is
+            // refused to its caller here, as the immediate writer would refuse it.
+            mergedQuota(this.rt.ctx, id, this.overlayRow({ ...row, quota: entryIn(result.config, id)?.quota })
+                .quota, publication.observation);
+            await this.room(id);
+            this.assertOpen(id);
+            // No await between the room check and the push, so the cap holds.
+            const queue = this.pending.get(id) ?? [];
+            queue.push(publication);
+            this.pending.set(id, queue);
+            if (queue.length >= POOL_QUOTA_QUEUE_LIMIT)
+                this.flushNow();
+            else
+                this.schedule(COALESCE_MS);
+        }
+        catch (error) {
+            throw toFailure(error, 'pull', id, { writes: 0 });
+        }
+    }
+    queued(id) {
+        return this.pending.get(id)?.length ?? 0;
+    }
+    // Waits while the row's queue is full, flushing at once on every wake-up,
+    // for at most the store's own lock acquisition budget.
+    async room(id) {
+        if (this.queued(id) < POOL_QUOTA_QUEUE_LIMIT)
+            return;
+        const { ctx } = this.rt;
+        const budget = Math.max(0, ...ctx.storeLocks.map((spec) => spec.timeoutMs ?? ctx.lockDefaults.timeoutMs));
+        const deadline = performance.now() + budget;
+        while (this.queued(id) >= POOL_QUOTA_QUEUE_LIMIT) {
+            this.assertOpen(id);
+            this.flushNow();
+            const left = deadline - performance.now();
+            if (left <= 0)
+                throw refusal('pull', id, 'lock-contention', `pool quota queue for ${id} is full (${POOL_QUOTA_QUEUE_LIMIT} readings) and the store locks stayed held`, true);
+            await new Promise((resolve) => {
+                const done = () => {
+                    clearTimeout(timer);
+                    this.wake.delete(done);
+                    resolve();
+                };
+                const timer = setTimeout(done, left);
+                this.wake.add(done);
+            });
+        }
+    }
+    assertOpen(id) {
+        if (this.closed)
+            throw refusal('pull', id, 'invalid-input', 'pool quota writer is closed');
+    }
+    // What read() and load() show: the stored map, then each queued reading of
+    // the row still bound to it, in arrival order through the codec's merge.
+    // A reading the codec now refuses is left out, as the flush drops it.
+    overlayRow(row) {
+        let next = row;
+        for (const publication of this.pending.get(row.id) ?? []) {
+            try {
+                assertQuotaRow(row.id, publication.attribution, row);
+                next = {
+                    ...next,
+                    quota: mergedQuota(this.rt.ctx, row.id, next.quota, publication.observation),
+                    needsFirstReading: false,
+                };
+            }
+            catch { }
+        }
+        return next;
+    }
+    overlay(rows) {
+        return rows.map((row) => this.overlayRow(row));
+    }
+    schedule(delay) {
+        if (this.running || this.timer || !this.pending.size || this.stopped)
+            return;
+        const remaining = this.closed
+            ? 0
+            : (this.committedAt ?? -Infinity) +
+                QUOTA_COMMIT_INTERVAL_MS -
+                this.clock.now();
+        this.timer = this.clock.schedule(Math.max(delay, remaining), () => {
+            this.timer = undefined;
+            return this.flush();
+        });
+        if (!this.closed)
+            this.timer.unref?.();
+    }
+    cancelTimer() {
+        this.timer?.cancel();
+        this.timer = undefined;
+    }
+    // A full queue overrides the interval: response handling must not wait for
+    // a quota commit slot. A flush already running is left to finish.
+    flushNow() {
+        if (this.running)
+            return;
+        this.cancelTimer();
+        this.flush();
+    }
+    flush() {
+        if (this.running || this.stopped || !this.pending.size)
+            return this.running ?? Promise.resolve();
+        // Every queued reading, each row's in arrival order.
+        const batch = [...this.pending.values()].flat();
+        // Short lock attempts allow retries to pick up freshly queued readings and
+        // bound shutdown even when the normal store acquisition budget is long.
+        const ctx = {
+            ...this.rt.ctx,
+            storeLocks: this.rt.ctx.storeLocks.map((spec) => ({
+                ...spec,
+                timeoutMs: Math.min(spec.timeoutMs ?? this.rt.ctx.lockDefaults.timeoutMs, 100),
+            })),
+        };
+        const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
+        this.running = (async () => {
+            try {
+                await withTransaction(ctx, locks, { writes: 0 }, { operation: 'pull', rowId: undefined }, async (tx) => {
+                    if (this.stopped)
+                        return;
+                    let changed = false;
+                    for (const publication of batch) {
+                        const { id, attribution, observation } = publication;
+                        const witness = JSON.stringify([
+                            id,
+                            attribution.credentialEpoch,
+                            attribution.identity,
+                        ]);
+                        try {
+                            tx.assertNotStaged(id);
+                            assertQuotaRow(id, attribution, tx.row(id));
+                        }
+                        catch (error) {
+                            if (!(error instanceof PoolOperationError))
+                                throw error;
+                            if (!this.warned.has(witness)) {
+                                this.warned.add(witness);
+                                this.warn('pool quota publication dropped; account binding changed', { id, kind: error.kind });
+                            }
+                            continue;
+                        }
+                        const entry = tx.entry(id);
+                        if (!entry)
+                            continue;
+                        let quota;
+                        try {
+                            quota = mergedQuota(ctx, id, entry.quota, observation);
+                        }
+                        catch (error) {
+                            // The codec accepted this reading when it was queued, but not
+                            // against what is stored now (another writer changed it).
+                            // Drop only this reading: failing the transaction would retry
+                            // the same refusal forever and hold back every other row.
+                            const key = `codec:${witness}`;
+                            if (!this.warned.has(key)) {
+                                this.warned.add(key);
+                                this.warn('pool quota publication dropped; the quota codec refused it', {
+                                    id,
+                                    error: error instanceof Error ? error.message : String(error),
+                                });
+                            }
+                            continue;
+                        }
+                        tx.setEntry(id, { ...entry, quota, needsFirstReading: false });
+                        changed = true;
+                    }
+                    if (changed && !this.stopped) {
+                        await tx.commitConfig();
+                        this.committedAt = this.clock.now();
+                    }
+                }, { completeTorn: false });
+                const flushed = new Set(batch);
+                for (const [id, queue] of this.pending) {
+                    const rest = queue.filter((publication) => !flushed.has(publication));
+                    if (rest.length)
+                        this.pending.set(id, rest);
+                    else
+                        this.pending.delete(id);
+                }
+                this.failures = 0;
+            }
+            catch (error) {
+                if (!this.stopped && this.failures++ === 0)
+                    this.warn('pool quota publication delayed; retrying', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                // Retain the mailbox on failure, including fresher readings queued meanwhile.
+            }
+            finally {
+                await locks.releaseAll();
+                this.running = undefined;
+                for (const wake of this.wake)
+                    wake();
+                const delay = this.failures
+                    ? Math.min(5_000, 100 * 2 ** Math.min(this.failures, 6)) *
+                        (0.5 + Math.random())
+                    : COALESCE_MS;
+                this.schedule(delay);
+            }
+        })();
+        return this.running;
+    }
+    warn(message, data) {
+        try {
+            this.logger.warn(message, data);
+        }
+        catch {
+            /* Logging cannot stop publication. */
+        }
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closed = true;
+        this.closing = this.drain();
+        return this.closing;
+    }
+    async drain() {
+        this.cancelTimer();
+        let deadline;
+        let wake;
+        const drained = new Promise((done) => {
+            wake = () => {
+                if (!this.pending.size)
+                    done();
+            };
+            this.wake.add(wake);
+            wake();
+        });
+        try {
+            this.flush();
+            await Promise.race([
+                drained,
+                new Promise((done) => {
+                    deadline = setTimeout(done, Math.max(0, this.timeoutMs));
+                }),
+            ]);
+        }
+        finally {
+            this.stopped = true;
+            clearTimeout(deadline);
+            this.cancelTimer();
+            this.wake.delete(wake);
+            if (this.pending.size)
+                this.warn('pool quota drain timed out; pending readings left', {
+                    accounts: this.pending.size,
+                    readings: [...this.pending.values()].reduce((sum, queue) => sum + queue.length, 0),
+                });
+            this.pending.clear();
+            // A reading waiting for room in a full queue is refused as closed when
+            // the drain ends, not when its own lock budget runs out.
+            for (const wake of this.wake)
+                wake();
+        }
+    }
+}

package/dist/common-auth-embedded/store/runtime.d.ts

@@ -1,3 +1,4 @@
+import type { Attribution } from './attribution.js';
 import { type PoolOperation, PoolOperationError } from './errors.js';
 import { type ReadResult, type StoreContext } from './mutate.js';
 import type { PoolLockOptions, PoolLockSpec } from './refresh-lock.js';
@@ -10,6 +11,7 @@ export interface StoreRuntime {
     providerLock: PoolLockSpec;
     rowLockOptions: Partial<PoolLockOptions>;
     firePull(id: string, reason: PullReason): void;
+    publishQuota?: (id: string, attribution: Attribution, observation: unknown) => Promise<void>;
 }
 /**
  * The row lock's (name, path): keyed by the row's recorded wire identity when

package/dist/common-auth-embedded/store/settings.d.ts

@@ -50,7 +50,7 @@ export type UpdateSettingsResult = {
     /** `unchanged` when the mutator left the settings as they were; nothing was written. */
     outcome: 'updated' | 'unchanged';
 };
-/** Reads the settings without taking a lock or writing anything. */
+/** Reads only the config's settings, without taking a lock or writing anything. */
 export declare function readPoolSettings(rt: StoreRuntime): Promise<SettingsRead>;
 /**
  * One locked read-modify-write of the plugin's settings in the config file

package/dist/common-auth-embedded/store/settings.js

@@ -1,8 +1,10 @@
 import { isDeepStrictEqual } from 'node:util';
 import { writeJsonAtomic } from '../fs/atomic-write.js';
+import { FileReadCache } from '../fs/file-read-cache.js';
+import { windowsPrivateFiles } from '../fs/private-files.js';
 import { PoolOperationError } from './errors.js';
 import { assertNotInsideHook, runInsideHook } from './hooks.js';
-import { notReadyError, readPool, runOperation } from './mutate.js';
+import { notReadyError, readPool, readPoolConfig, runOperation, } from './mutate.js';
 import { isRecord, POOL_KEY } from './schema.js';
 /**
  * Top-level config keys the pool owns: the legacy `version`, the legacy
@@ -58,12 +60,20 @@ function settingsRefusal(message) {
         message,
     });
 }
-/** Reads the settings without taking a lock or writing anything. */
+const settingsCache = new FileReadCache();
+/** Reads only the config's settings, without taking a lock or writing anything. */
 export async function readPoolSettings(rt) {
-    const result = await readPool(rt.ctx);
-    if (result.status === 'error')
-        return result;
-    return { status: result.status, settings: settingsOf(result.config) };
+    const read = async ([configPath = rt.ctx.configPath,] = []) => {
+        const result = await readPoolConfig(configPath);
+        if (result.status === 'error')
+            return { status: 'error', file: 'config', reason: result.reason };
+        return { status: result.status, settings: settingsOf(result.config) };
+    };
+    // Native Windows security checks cannot be replaced by a stat fingerprint.
+    const result = windowsPrivateFiles
+        ? await read()
+        : await settingsCache.read([rt.ctx.configPath], read);
+    return structuredClone(result);
 }
 /**
  * One locked read-modify-write of the plugin's settings in the config file

package/dist/model-registry.d.ts

@@ -14,7 +14,7 @@ export interface ModelLimit {
     output: number;
 }
 export type ModelModality = 'text' | 'image' | 'pdf';
-export type ModelQuotaGroup = 'gemini' | 'non-gemini';
+export type ModelQuotaGroup = 'gemini' | 'non-gemini' | 'gemini-argon';
 export interface ModelModalities {
     input: ModelModality[];
     output: ModelModality[];
@@ -61,7 +61,7 @@ export declare function getGemini35FlashAntigravityModel(tier?: ThinkingTier): s
 export declare function getGemini36FlashAntigravityModel(tier?: ThinkingTier): string;
 export declare function getGemini37FlashAntigravityModel(tier?: ThinkingTier): string;
 export declare function getGemini38FlashAntigravityModel(tier?: ThinkingTier): string;
-export declare function getQuotaGroupForModel(modelId: string): ModelQuotaGroup | undefined;
+export declare function getQuotaGroupForModel(modelId: string, hasArgonPool?: boolean): ModelQuotaGroup | undefined;
 /** Recognize Argon selectors so family-specific wire and quota policy is consistent. */
 export declare function isGeminiArgonModel(model: string): boolean;
 export declare function getGeminiArgonAntigravityModel(tier?: ThinkingTier): string;

package/dist/model-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-registry.d.ts","sourceRoot":"","sources":["../src/model-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEtE,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,cAAc,CAAC,EAAE,mBAAmB,CAAA;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAA;AACpD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,YAAY,CAAA;AAErD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,MAAM,EAAE,aAAa,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,UAAU,CAAA;IACjB,UAAU,EAAE,eAAe,CAAA;IAC3B,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IACD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACxC;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;AA4C9E,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAGD,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAsJzC,CAAA;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GACZ,wBAAwB,GAAG,SAAS,CAEtC;AAED,eAAO,MAAM,yBAAyB,uEACgC,CAAA;AAEtE,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAexD;AAyMD,eAAO,MAAM,0BAA0B,0BAEtC,CAAA;AAED,wBAAgB,yBAAyB,IAAI,wBAAwB,CAEpE;AAED,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAEzD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5D;AAED,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAQ5E;AAWD,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAE5E;AAED,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAE5E;AAED,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAE5E;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,GACd,eAAe,GAAG,SAAS,CAkB7B;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,wBAAgB,8BAA8B,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAY1E"}
+{"version":3,"file":"model-registry.d.ts","sourceRoot":"","sources":["../src/model-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEtE,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,cAAc,CAAC,EAAE,mBAAmB,CAAA;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAA;AACpD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAA;AAEtE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,MAAM,EAAE,aAAa,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,UAAU,CAAA;IACjB,UAAU,EAAE,eAAe,CAAA;IAC3B,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IACD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACxC;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;AA4C9E,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAGD,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAsJzC,CAAA;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GACZ,wBAAwB,GAAG,SAAS,CAEtC;AAED,eAAO,MAAM,yBAAyB,uEACgC,CAAA;AAEtE,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAexD;AAyMD,eAAO,MAAM,0BAA0B,0BAEtC,CAAA;AAED,wBAAgB,yBAAyB,IAAI,wBAAwB,CAEpE;AAED,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAEzD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5D;AAED,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAQ5E;AAWD,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAE5E;AAED,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAE5E;AAED,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAE5E;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,UAAQ,GACnB,eAAe,GAAG,SAAS,CAqB7B;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,wBAAgB,8BAA8B,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CAY1E"}

package/dist/model-registry.js

@@ -395,12 +395,14 @@ export function getGemini37FlashAntigravityModel(tier) {
 export function getGemini38FlashAntigravityModel(tier) {
     return getTieredAntigravityModel(GEMINI_38_FLASH_ROUTES, tier);
 }
-export function getQuotaGroupForModel(modelId) {
+export function getQuotaGroupForModel(modelId, hasArgonPool = false) {
     const normalized = modelId.toLowerCase();
-    // Argon per-model quota is retained separately: the redacted 1.3.5 quota
-    // summary does not identify an Argon weekly pool (see the fixture README).
+    // Argon per-model quota is retained separately: the model alone does not
+    // identify an Argon weekly pool, so without evidence that this account
+    // reports one the model stays ungrouped and callers fall back to the
+    // ordinary Gemini pool (see the fixture README).
     if (isGeminiArgonModel(normalized))
-        return undefined;
+        return hasArgonPool ? 'gemini-argon' : undefined;
     return (QUOTA_GROUP_BY_MODEL_ID[normalized] ??
         // Check Claude / GPT-OSS substrings BEFORE the `gemini` substring so
         // a `gemini-claude-*` alias (which is a Claude route exposed under