@cortexkit/antigravity-auth-core 3.0.29 → 3.0.31

package/dist/common-auth-embedded/claustrum/usage.js

@@ -0,0 +1,145 @@
+import { ClaustrumCredentialError } from '@cortexkit/claustrum-client';
+function plain(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        (Object.getPrototypeOf(value) === Object.prototype ||
+            Object.getPrototypeOf(value) === null));
+}
+/** One queue per custody connection, shared by every hub member on it. */
+export class ScopedUsageReporter {
+    options;
+    #queue = new Map();
+    #latest = new Map();
+    #errors = new Set();
+    #timer;
+    #running;
+    #closing = false;
+    #stopped = false;
+    #dropped = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    state() {
+        return {
+            pending: this.#queue.size,
+            inFlight: this.#running !== undefined,
+            dropped: this.#dropped,
+        };
+    }
+    report(credentialId, reading) {
+        if (this.#closing || !this.options.client.reportUsageScoped)
+            return;
+        try {
+            if (!this.options.owns(credentialId)) {
+                this.#dropped++;
+                return;
+            }
+            if (!plain(reading) || 'credentialId' in reading || 'vouched' in reading)
+                throw new Error('invalid reading');
+            const json = JSON.stringify(reading);
+            if (Buffer.byteLength(json, 'utf8') > 15_360)
+                throw new Error('oversized reading');
+            // Snapshot now: a caller mutating its reply metadata later cannot change
+            // an already validated queued reading, including its ordering timestamp.
+            const copy = JSON.parse(json);
+            if (!plain(copy) ||
+                'credentialId' in copy ||
+                'vouched' in copy ||
+                typeof copy.observedAtMs !== 'number' ||
+                !Number.isFinite(copy.observedAtMs))
+                throw new Error('invalid reading');
+            if (copy.observedAtMs <= (this.#latest.get(credentialId) ?? -Infinity)) {
+                this.#dropped++;
+                return;
+            }
+            if (this.#queue.has(credentialId))
+                this.#dropped++;
+            this.#latest.set(credentialId, copy.observedAtMs);
+            this.#queue.set(credentialId, copy);
+            if (!this.#timer && !this.#running) {
+                this.#timer = this.options.setTimeout(() => {
+                    this.#timer = undefined;
+                    this.#flush();
+                }, 1_000);
+                this.#timer.unref?.();
+            }
+        }
+        catch {
+            this.#dropped++;
+        }
+    }
+    forget(credentialId) {
+        if (this.#queue.delete(credentialId))
+            this.#dropped++;
+        this.#latest.delete(credentialId);
+    }
+    #flush() {
+        if (this.#running || !this.#queue.size || this.#stopped)
+            return this.#running;
+        // Start on a microtask even during close, so all failures stay off the
+        // provider request path and only one send can be in flight on this client.
+        const running = Promise.resolve().then(async () => {
+            while (!this.#stopped && this.#queue.size) {
+                const entry = this.#queue.entries().next().value;
+                if (!entry)
+                    break;
+                const [credentialId, reading] = entry;
+                this.#queue.delete(credentialId);
+                try {
+                    const enrollmentToken = await this.options.token();
+                    if (this.#stopped || !this.options.owns(credentialId)) {
+                        if (!this.#stopped)
+                            this.#dropped++;
+                        continue;
+                    }
+                    await this.options.client.reportUsageScoped?.({
+                        credentialId,
+                        reading,
+                        enrollmentToken,
+                    });
+                }
+                catch (error) {
+                    if (!this.#stopped)
+                        this.#dropped++;
+                    this.#log(error);
+                }
+            }
+        });
+        this.#running = running;
+        void running.finally(() => {
+            this.#running = undefined;
+        });
+        return running;
+    }
+    #log(error) {
+        // Only codes from credential refusals are exposed. Transport messages,
+        // arbitrary thrown objects and reply contents can contain secrets.
+        let code = 'transport_error';
+        try {
+            if (error instanceof ClaustrumCredentialError)
+                code = /^[a-z][a-z0-9_]{0,63}$/.test(error.code) ? error.code : code;
+            if (this.#errors.has(code))
+                return;
+            this.#errors.add(code);
+            this.options.logger.debug('claustrum usage report dropped', { code });
+        }
+        catch {
+            // A caller's logger must not turn best-effort reporting into a rejection.
+        }
+    }
+    /** Start the final flush; the custody's existing shutdown drain bounds it. */
+    close() {
+        this.#closing = true;
+        if (this.#timer)
+            this.options.clearTimeout(this.#timer);
+        this.#timer = undefined;
+        return this.#flush();
+    }
+    drop() {
+        this.#stopped = true;
+        this.#dropped += this.#queue.size + (this.#running ? 1 : 0);
+        this.#running = undefined;
+        this.#queue.clear();
+        this.#latest.clear();
+    }
+}

package/dist/common-auth-embedded/commands/builtins.d.ts

@@ -41,6 +41,11 @@ export interface QuotaSectionOptions {
     check?(ids: readonly string[], invocation: CommandInvocation): Promise<void>;
 }
 export interface RoutingSectionOptions {
+    /**
+     * Show how long the plugin may wait for the current account's limit to
+     * reset before switching. Opt in only when the plugin supports that policy.
+     */
+    sameAccountWait?: boolean;
     /**
      * Further `routing.mode` values the plugin routes as `ordered` with the
      * former main row moved (`main-first`, `fallback-first`), offered between

package/dist/common-auth-embedded/commands/builtins.js

@@ -468,6 +468,44 @@ function routingSection(options, snap) {
                     : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
+    if (options.routing?.sameAccountWait) {
+        const waitLabel = 'Longest wait on the same account';
+        const waitChoices = [
+            { value: '0', label: "Don't wait" },
+            { value: '15', label: '15 minutes' },
+            { value: 'max', label: 'Until the cache expires' },
+        ];
+        const rawWait = record(snap.settings.routing).maxSameAccountWait;
+        const wait = String(rawWait === 0 || rawWait === 'max' ? rawWait : 15);
+        const waitName = (value) => waitChoices.find((choice) => choice.value === value)?.label ?? value;
+        lines.push(`${waitLabel}: ${waitName(wait)}`);
+        actions.push({
+            id: 'maxSameAccountWait',
+            label: waitLabel,
+            group: ACTIONS_GROUP,
+            knobs: [
+                {
+                    kind: 'choice',
+                    id: 'maxSameAccountWait',
+                    label: waitLabel,
+                    choices: waitChoices,
+                    value: wait,
+                },
+            ],
+            run: async ({ values }) => {
+                const value = String(values.maxSameAccountWait);
+                const maxSameAccountWait = value === 'max' ? 'max' : Number(value);
+                await store.updateSettings((settings) => {
+                    settings.routing = {
+                        ...record(settings.routing),
+                        maxSameAccountWait,
+                    };
+                    return undefined;
+                }, locks);
+                return `${waitLabel} set to ${waitName(value)}.`;
+            },
+        });
+    }
     return {
         id: 'routing',
         slot: 'routing',

package/dist/common-auth-embedded/fs/file-read-cache.js

@@ -1,9 +1,10 @@
-import { lstat } from 'node:fs/promises';
+import { lstat, stat } from 'node:fs/promises';
 import { resolve } from 'node:path';
-async function identity(path) {
+async function identity(path, followSymlinks) {
     try {
-        const metadata = await lstat(path);
-        // Do not follow a symlink: its target can change without changing the link.
+        // Match the reader: private readers reject links, while readFile follows
+        // them and needs the target's identity, not the link's identity.
+        const metadata = await (followSymlinks ? stat(path) : lstat(path));
         return metadata.isFile() ? metadata : undefined;
     }
     catch (error) {
@@ -23,11 +24,15 @@ function sameIdentity(left, right) {
 }
 /** Process-local reads, capped at 64 path sets with one value per resolved set. */
 export class FileReadCache {
+    #followSymlinks;
     #entries = new Map();
+    constructor(options = {}) {
+        this.#followSymlinks = options.followSymlinks ?? false;
+    }
     async read(paths, read, validateHit) {
         const resolvedPaths = paths.map((path) => resolve(path));
         const key = JSON.stringify(resolvedPaths);
-        const probed = await Promise.all(resolvedPaths.map(identity));
+        const probed = await Promise.all(resolvedPaths.map((path) => identity(path, this.#followSymlinks)));
         const identities = probed.every((entry) => entry !== undefined)
             ? probed
             : undefined;

package/dist/common-auth-embedded/fs/private-files.d.ts

@@ -21,6 +21,11 @@ export declare class PrivateFileError extends Error {
     orphanPath?: string;
     constructor(path: string, stage: string, cause: unknown);
 }
+/** Native sharing and delete-pending errors reveal neither ownership nor expiry. */
+export declare function isWindowsSharingViolation(error: unknown): error is PrivateFileError & {
+    reason: 'io-error';
+    win32Code: 32 | 303;
+};
 export declare function privateOperation<T>(path: string, stage: string, operation: () => Promise<T>): Promise<T>;
 /** Tests only: policy options used by safe-parent checks that pass none. */
 export declare function setSafeParentOptionsForTest(options?: PosixOwnerOnlyPathAsyncOptions): void;

package/dist/common-auth-embedded/fs/private-files.js

@@ -93,6 +93,13 @@ export class PrivateFileError extends Error {
         this.reason = detail?.reason;
     }
 }
+/** Native sharing and delete-pending errors reveal neither ownership nor expiry. */
+export function isWindowsSharingViolation(error) {
+    return (windowsPrivateFiles &&
+        error instanceof PrivateFileError &&
+        error.reason === 'io-error' &&
+        (error.win32Code === 32 || error.win32Code === 303));
+}
 export async function privateOperation(path, stage, operation) {
     try {
         return await operation();

package/dist/common-auth-embedded/fs/refresh-file-lock.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { lstat, mkdir, open, readFile, rename, rm, stat, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
+import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, isWindowsSharingViolation, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
 /**
  * Create a new owner-only file and write `text` into it, failing with EEXIST if
@@ -367,54 +367,109 @@ export async function acquireRefreshFileLockWithClock(options) {
         else
             await rm(path, { recursive: true, force: true }).catch(() => { });
     }
-    async function releaseEvictionMarker() {
-        if (await ownsEvictionMarker()) {
-            await removeLeaseObject(evictPath);
+    function isRetryableRemoval(error, path) {
+        if (!windowsPrivateFiles ||
+            !(error instanceof PrivateFileError) ||
+            error.stage !== 'remove' ||
+            error.path !== path)
+            return false;
+        // Native sharing/delete-pending errors use isWindowsSharingViolation.
+        // node:fs rm supplies only errno: EBUSY/EPERM can also mean a sharing refusal.
+        return (isWindowsSharingViolation(error) ||
+            (error.win32Code === undefined &&
+                error.reason === undefined &&
+                (error.code === 'EBUSY' || error.code === 'EPERM')));
+    }
+    async function removeOwnedLeaseObject(path, stillOwned, deadline = performance.now() + EVICT_TTL + 1_000) {
+        let original;
+        let delayMs = 5;
+        while (await stillOwned()) {
+            try {
+                await removeLeaseObject(path);
+                return;
+            }
+            catch (error) {
+                if (!isRetryableRemoval(error, path))
+                    throw error;
+                original ??= error;
+            }
+            const remainingMs = deadline - performance.now();
+            if (remainingMs <= 0)
+                throw original;
+            await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+            if (performance.now() >= deadline)
+                throw original;
+            delayMs = Math.min(delayMs * 2, 50);
         }
     }
+    async function releaseEvictionMarker(deadline) {
+        let ownedDirectory;
+        await removeOwnedLeaseObject(evictPath, async () => {
+            if (!windowsPrivateFiles)
+                return ownsEvictionMarker();
+            const current = await lstat(evictPath).catch((error) => {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                return undefined;
+            });
+            if (!current ||
+                (ownedDirectory && !sameMarkerDirectory(ownedDirectory, current)))
+                return false;
+            if (await ownsEvictionMarker()) {
+                ownedDirectory = current;
+                return true;
+            }
+            if (!ownedDirectory)
+                return false;
+            // Recursive rm can delete owner.json before the directory delete fails.
+            // Only that same, now-ownerless directory is still ours to clean up.
+            try {
+                await stat(evictOwnerPath);
+                return false;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                return true;
+            }
+        }, deadline);
+    }
     // Returns whether the directory at the marker path was still the one this
     // process created when its owner write failed. Only then is the failure ours
     // to report: a gone or replaced directory is a lost race.
-    async function removeOwnMarkerAfterFailedOwnerWrite(created) {
+    async function removeOwnMarkerAfterFailedOwnerWrite(created, deadline) {
         // Best effort only: never throws, so the original owner-write error below
         // keeps explaining the failure. Removes the directory this process just
         // created when its owner write failed, and leaves a contender's
         // replacement alone when the identities differ.
         if (!created)
             return false;
-        let current;
-        try {
-            const st = await lstat(evictPath);
-            current = { dev: st.dev, ino: st.ino, birthtimeMs: st.birthtimeMs };
-        }
-        catch {
-            // Renamed away by a contender's steal: nothing of ours left to clean.
-            return false;
-        }
-        if (!sameMarkerDirectory(created, current))
-            return false;
-        // Remove only an ownerless directory. An owner file that appeared after
-        // our failed write belongs to someone: ours goes through
-        // releaseEvictionMarker in the caller, and a contender's must stay, since
-        // it may be holding the marker right now.
+        let stillOurs = false;
         try {
-            await stat(evictOwnerPath);
-            return true;
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                return true;
-        }
-        try {
-            await removeLeaseObject(evictPath);
+            await removeOwnedLeaseObject(evictPath, async () => {
+                stillOurs = false;
+                const st = await lstat(evictPath).catch(() => undefined);
+                if (!st || !sameMarkerDirectory(created, st))
+                    return false;
+                stillOurs = true;
+                // Recheck both identity and absence of an owner before every attempt;
+                // a contender's replacement or newly published owner must stay.
+                try {
+                    await stat(evictOwnerPath);
+                    return false;
+                }
+                catch (error) {
+                    return error.code === 'ENOENT';
+                }
+            }, deadline);
         }
         catch {
             // A removal failure keeps the stale marker recoverable later; it must
             // never mask the original owner-write error.
         }
-        return true;
+        return stillOurs;
     }
-    async function tryAcquireEvictionMarker() {
+    async function tryAcquireEvictionMarker(deadline) {
         if (windowsPrivateFiles)
             await createPrivateDirectoryExclusive(evictPath);
         else
@@ -455,11 +510,11 @@ export async function acquireRefreshFileLockWithClock(options) {
             // A race code while our own directory is still in place is not a lost
             // race but a write that fails here every time: report it, rather than
             // retrying the same failure until a deadline hides the cause.
-            const stillOurs = await removeOwnMarkerAfterFailedOwnerWrite(created);
+            const stillOurs = await removeOwnMarkerAfterFailedOwnerWrite(created, deadline);
             if (isLostMarkerRaceError(error) && !stillOurs)
                 return false;
             try {
-                await releaseEvictionMarker();
+                await releaseEvictionMarker(deadline);
             }
             catch {
                 // Removal must never mask the original owner-write error.
@@ -470,7 +525,7 @@ export async function acquireRefreshFileLockWithClock(options) {
             await options.onStep('eviction-marker-acquired');
         return true;
     }
-    async function recoverStaleEvictionMarker() {
+    async function recoverStaleEvictionMarker(deadline) {
         let evictStat;
         try {
             evictStat = await stat(evictPath);
@@ -529,12 +584,26 @@ export async function acquireRefreshFileLockWithClock(options) {
         }
         if (options.onStep)
             await options.onStep('stale-marker-claimed');
-        await removeLeaseObject(claimedPath);
+        const claimedIdentity = windowsPrivateFiles
+            ? await lstat(claimedPath)
+            : undefined;
+        // The unique renamed claim is ours, not the current marker path where a
+        // successor may already be working.
+        await removeOwnedLeaseObject(claimedPath, async () => {
+            if (!claimedIdentity)
+                return true;
+            const current = await lstat(claimedPath).catch((error) => {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                return undefined;
+            });
+            return !!current && sameMarkerDirectory(claimedIdentity, current);
+        }, deadline);
         return 'recovered';
     }
-    async function withEvictionMarker(action) {
+    async function withEvictionMarker(action, deadline) {
         try {
-            if (!(await tryAcquireEvictionMarker()))
+            if (!(await tryAcquireEvictionMarker(deadline)))
                 return false;
         }
         catch (error) {
@@ -555,12 +624,28 @@ export async function acquireRefreshFileLockWithClock(options) {
             }
             throw error;
         }
+        let actionFailed = false;
+        let actionError;
         try {
             await action();
         }
-        finally {
-            await releaseEvictionMarker();
+        catch (error) {
+            actionFailed = true;
+            actionError = error;
+        }
+        try {
+            await releaseEvictionMarker(deadline);
+        }
+        catch (error) {
+            // Cleanup sharing failures must not replace the lock's original
+            // sharing refusal when both removals exhaust the same deadline.
+            if (isRetryableRemoval(actionError, lockPath) &&
+                isRetryableRemoval(error, evictPath))
+                throw actionError;
+            throw error;
         }
+        if (actionFailed)
+            throw actionError;
         return true;
     }
     // Marker loss after a write may mean another contender has taken over.
@@ -847,6 +932,7 @@ export async function acquireRefreshFileLockWithClock(options) {
             // wall-clock adjustments cannot extend the retry deadline.
             const deadline = performance.now() + EVICT_TTL + 1_000;
             let delayMs = 5;
+            let removalError;
             for (;;) {
                 try {
                     let removalConfirmed = false;
@@ -873,7 +959,7 @@ export async function acquireRefreshFileLockWithClock(options) {
                             return;
                         await removeLeaseObject(lockPath);
                         removalConfirmed = true;
-                    });
+                    }, deadline);
                     if (markerAcquired) {
                         if (windowsPrivateFiles && !removalConfirmed)
                             throw new PrivateFileError(lockPath, 'release-not-confirmed', {
@@ -884,25 +970,34 @@ export async function acquireRefreshFileLockWithClock(options) {
                     }
                     if (signal?.aborted)
                         return;
-                    await recoverStaleEvictionMarker();
+                    await recoverStaleEvictionMarker(deadline);
                 }
                 catch (error) {
-                    if (windowsPrivateFiles)
-                        throw error;
-                    return;
+                    if (!isRetryableRemoval(error, lockPath)) {
+                        if (windowsPrivateFiles)
+                            throw error;
+                        return;
+                    }
+                    // Like rename, a fenced delete can be refused by a reader's Windows
+                    // handle without invalidating ownership. Drop the marker, back off,
+                    // and re-confirm the owner under a new marker before trying again.
+                    removalError ??= error;
                 }
                 const remainingMs = deadline - performance.now();
                 if (remainingMs <= 0)
                     break;
                 await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+                if (windowsPrivateFiles && performance.now() >= deadline)
+                    break;
                 delayMs = Math.min(delayMs * 2, 50);
             }
             // Do not delete by pathname without the marker: bounded retries leave the
             // lease to expire rather than risking removal of a successor's lock.
             if (windowsPrivateFiles)
-                throw new PrivateFileError(lockPath, 'release-not-confirmed', {
-                    code: 'ETIMEDOUT',
-                });
+                throw (removalError ??
+                    new PrivateFileError(lockPath, 'release-not-confirmed', {
+                        code: 'ETIMEDOUT',
+                    }));
         },
     };
 }

package/dist/common-auth-embedded/fs/with-lock.js

@@ -1,5 +1,5 @@
 import { join, resolve } from 'node:path';
-import { PrivateFileError, windowsPrivateFiles } from './private-files.js';
+import { isWindowsSharingViolation, } from './private-files.js';
 import { acquireRefreshFileLock } from './refresh-file-lock.js';
 export function lockPathFor(target, name) {
     return `${target}.${name}.lock`;
@@ -21,10 +21,7 @@ export class LockOwnershipError extends Error {
     }
 }
 function isChangingLockRead(error, target, name) {
-    if (!windowsPrivateFiles ||
-        !(error instanceof PrivateFileError) ||
-        error.reason !== 'io-error' ||
-        (error.win32Code !== 32 && error.win32Code !== 303) ||
+    if (!isWindowsSharingViolation(error) ||
         (error.stage !== 'read' && error.stage !== 'verify'))
         return false;
     const path = resolve(lockPathFor(target, name));

package/dist/common-auth-embedded/routing/admission.d.ts

@@ -23,11 +23,16 @@ export interface AdmissionInput extends ExclusionInputs {
     scope?: string;
     /** Labels the scope requires an entry for; defaults to `['primary']`. */
     requiredLabels?: readonly string[];
+    /**
+     * One-dispatch exemptions keyed by row; waive only gate 4. The caller first
+     * validates the current account incarnation and checkpointed reset times.
+     */
+    liftedWindows?: ReadonlyMap<string, readonly WindowRef[]>;
     now: number;
     /**
-     * Called synchronously, once per refusal at gates 2 to 4, with the row id.
+     * Called synchronously once per row needing a pull, including lifted windows.
      * Its return value is ignored and never awaited, so a pull the caller
-     * starts from here cannot delay the refusal.
+     * starts from here cannot delay admission or a refusal.
      */
     requestPull?: (rowId: string) => void;
 }

package/dist/common-auth-embedded/routing/admission.js

@@ -14,7 +14,7 @@
 //   3. a required label with no entry is unknown: refused, pull requested;
 //   4. a reading at or beyond 100% whose reset is missing, unparsable or not
 //      after `now` cannot confirm the exhaustion, so the window is unknown:
-//      refused, pull requested;
+//      refused unless lifted for this wake dispatch; either way, pull requested;
 //   5. a reading at or beyond 100% with a future reset is exhausted: refused.
 // Gates 4 and 5 look at every projected limit, not only the required labels.
 // Stage 2 judges the credit budget across the stage-1 survivors: a row whose
@@ -36,7 +36,7 @@ export function exclusionFor(id, inputs, now) {
     }
     return undefined;
 }
-function judgeStageOne(id, projection, requiredLabels, now) {
+function judgeStageOne(id, projection, requiredLabels, now, liftedWindows) {
     if (projection.limits.length === 0) {
         return {
             id,
@@ -60,7 +60,8 @@ function judgeStageOne(id, projection, requiredLabels, now) {
     }
     const exhausted = projection.limits.filter(readsExhausted);
     for (const limit of exhausted) {
-        if (futureResetAt(limit, now) === undefined) {
+        if (futureResetAt(limit, now) === undefined &&
+            !liftedWindows.some((window) => window.scope === limit.scope && window.label === limit.label)) {
             return {
                 id,
                 stage: 1,
@@ -94,6 +95,7 @@ export function admit(input) {
     const excluded = [];
     const refused = [];
     const survivors = [];
+    const needsPull = new Set();
     for (const row of input.rows) {
         const exclusion = exclusionFor(row.id, input, input.now);
         if (exclusion) {
@@ -105,7 +107,12 @@ export function admit(input) {
             continue;
         }
         const projection = projectQuota(row.quota, scope);
-        const refusal = judgeStageOne(row.id, projection, requiredLabels, input.now);
+        const lifted = input.liftedWindows?.get(row.id) ?? [];
+        if (projection.limits.some((limit) => readsExhausted(limit) &&
+            futureResetAt(limit, input.now) === undefined &&
+            lifted.some((window) => window.scope === limit.scope && window.label === limit.label)))
+            needsPull.add(row.id);
+        const refusal = judgeStageOne(row.id, projection, requiredLabels, input.now, lifted);
         if (refusal) {
             refused.push(refusal);
             continue;
@@ -133,9 +140,12 @@ export function admit(input) {
     const order = new Map(input.rows.map((row, index) => [row.id, index]));
     const byInput = (left, right) => (order.get(left.id) ?? 0) - (order.get(right.id) ?? 0);
     refused.sort(byInput);
-    const pulls = refused
-        .filter((refusal) => 'pullRequested' in refusal)
-        .map((refusal) => refusal.id);
+    for (const refusal of refused)
+        if ('pullRequested' in refusal)
+            needsPull.add(refusal.id);
+    const pulls = input.rows
+        .filter((row) => needsPull.has(row.id))
+        .map((row) => row.id);
     for (const id of pulls)
         input.requestPull?.(id);
     return { admitted, refused, excluded, pulls };