@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.1

package/dist/src/plugin/shared/vault-request-credentials.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Vault-held accounts for the shared request engine, used by OpenCode 1 and
+ * OpenCode 2 alike: selection rows built from the vault's selectable routes,
+ * the engine's `vault` credential domain over a vault account source, and
+ * the rows' durable selection state in the vault's credential-free
+ * provider-state file.
+ *
+ * A row carries the route and selection bookkeeping only; no token, refresh
+ * token, project or local repository reference. Every physical send asks
+ * the source for a fresh receipt for the selected row's route and uses that
+ * receipt's token and project for that send only; a 401 is reported against
+ * the exact receipt that served it. Nothing is refreshed locally, cached or
+ * written to a row.
+ *
+ * The module imports no host SDK and no composition root: the source is the
+ * core vault account source (or anything with the same operations).
+ */
+import { AccountSelector, type AntigravityQuotaCheckReport, type AntigravityVaultAccountSource, type QuotaState, type QuotaSummary, type SelectableAccount, type SelectionSink, type VaultProviderStateCommitResult, type VaultProviderStateFile, type VaultRouteRef, type VaultStateAttribution } from '@cortexkit/antigravity-auth-core';
+import type { VaultRequestCredentials } from './request-services.ts';
+/** The vault account source operations a vault request path uses. */
+export type VaultRequestSource = Pick<AntigravityVaultAccountSource, 'refresh' | 'routes' | 'admit' | 'reportServedStatus'>;
+/** The vault account source operations durable selection state uses. */
+export type VaultStateSource = Pick<AntigravityVaultAccountSource, 'attribution' | 'commitState'>;
+/**
+ * A vault-backed pool row: selection metadata plus the vault route it was
+ * listed under.
+ */
+export type VaultAccountRow = SelectableAccount & {
+    route: VaultRouteRef;
+};
+/**
+ * Selection rows for the vault's selectable routes, in roster order, with
+ * no selection history.
+ */
+export declare function vaultAccountRows(routes: readonly VaultRouteRef[]): VaultAccountRow[];
+/**
+ * A vault row's identity for `AccountSelector.replaceAccounts`: its route,
+ * credential and asserted account. A route that now names another
+ * credential or account is a different row.
+ */
+export declare function vaultAccountRowKey(row: VaultAccountRow): string;
+/**
+ * Keeps a vault row's in-memory selection state across a roster re-read and
+ * takes only the route's display fields from the fresh roster. A kept row's
+ * in-memory state is the newest there is; stored state (see
+ * `createVaultSelectionState`) is restored only onto rows that are new.
+ */
+export declare function refreshVaultAccountRow(prior: VaultAccountRow, fresh: VaultAccountRow): void;
+/**
+ * The shared engine's `vault` credential domain over a vault account source.
+ * `onAdmitted` receives each receipt's non-secret attribution, taken by the
+ * same source, with the row it was taken for (see
+ * `createVaultSelectionState`).
+ */
+export declare function createVaultRequestCredentials(source: Pick<VaultRequestSource, 'admit' | 'reportServedStatus'>, onAdmitted?: {
+    readonly source: Pick<VaultStateSource, 'attribution'>;
+    admitted(row: VaultAccountRow, attribution: VaultStateAttribution): void;
+}): VaultRequestCredentials<VaultAccountRow>;
+export interface VaultSelectionStateOptions {
+    /** The vault source's attribution-fenced state commit. */
+    readonly source: Pick<VaultStateSource, 'commitState'>;
+    /** Reads the provider-state file the source commits to. */
+    readonly readState: () => Promise<VaultProviderStateFile>;
+    readonly now?: () => number;
+    /** Receives a refused or failed write; the observation is then dropped. */
+    readonly onError?: (error: unknown) => void;
+}
+export interface VaultSelectionState {
+    /** The selector's sink: every reported transition marks its row changed. */
+    readonly sink: SelectionSink<VaultAccountRow>;
+    /** Records the receipt attribution that last served `row`. */
+    admitted(row: VaultAccountRow, attribution: VaultStateAttribution): void;
+    /**
+     * Restores stored selection state onto fresh rows. A row takes state only
+     * when that state was last written for the same asserted account, route
+     * and credential; state of another account, route or credential is left
+     * alone.
+     */
+    hydrate(rows: readonly VaultAccountRow[]): Promise<void>;
+    /**
+     * Writes each changed row's selection state, attributed to the receipt
+     * that last served it. A row not yet served in this process has no
+     * attribution and stays changed until it is. The source refuses a write
+     * whose credential, account or record version the vault no longer serves,
+     * and the change is dropped rather than re-attributed.
+     */
+    flush(): Promise<void>;
+    /** Records a quota reading taken with the receipt `attribution` names. */
+    recordQuota(attribution: VaultStateAttribution, quota: QuotaState): Promise<VaultProviderStateCommitResult>;
+}
+/**
+ * Durable selection state for vault rows, kept in the vault source's
+ * credential-free provider-state file by asserted account. The selector
+ * stays the only selection policy: this only saves and restores the fields
+ * it already maintains.
+ */
+export declare function createVaultSelectionState(options: VaultSelectionStateOptions): VaultSelectionState;
+export interface VaultAccountPoolOptions {
+    readonly source: VaultRequestSource;
+    /**
+     * Makes the pool's selection state durable (see
+     * `createVaultSelectionState`): the same source's attribution and fenced
+     * commit, and a reader of the provider-state file it commits to. Without
+     * it, selection state lives in memory only.
+     */
+    readonly durable?: {
+        readonly source: VaultStateSource;
+        readonly readState: () => Promise<VaultProviderStateFile>;
+        /** Receives a refused or failed state write. */
+        readonly onError?: (error: unknown) => void;
+    };
+    readonly now?: () => number;
+}
+/**
+ * One host location's vault-held accounts for the shared request engine:
+ * the one `AccountSelector` over the vault's routes, the engine's vault
+ * credentials, and (with `readState`) the selector's durable state. Both
+ * OpenCode hosts build their vault request path on this, so a location has
+ * exactly one authoritative selector and one place its state is saved.
+ */
+export interface VaultAccountPool {
+    readonly selector: AccountSelector<VaultAccountRow>;
+    readonly credentials: VaultRequestCredentials<VaultAccountRow>;
+    /** The durable selection state, when the pool has a state file. */
+    readonly state: VaultSelectionState | undefined;
+    /**
+     * Brings the rows up to date with the source's roster: the first call
+     * reads the roster from the vault (a failed read is retried by the next
+     * call); later calls take the source's last committed routes. New rows
+     * get their stored state; kept rows keep their in-memory state.
+     */
+    sync(): Promise<void>;
+    /** Re-reads the roster from the vault now, then syncs the rows. */
+    refresh(): Promise<void>;
+    /** Writes pending selection state. */
+    flush(): Promise<void>;
+}
+export declare function createVaultAccountPool(options: VaultAccountPoolOptions): VaultAccountPool;
+/**
+ * A quota reading for one vault account, as the vault quota check returns
+ * it: the summary, and the credential-free attribution of the admission
+ * whose answer produced it (absent when none did).
+ */
+export interface VaultQuotaAnswer {
+    readonly quota: QuotaSummary;
+    readonly quotaAttribution?: VaultStateAttribution;
+}
+/** The stored quota reading for a summary taken at `at`. */
+export declare function vaultQuotaState(quota: QuotaSummary, at: number): QuotaState;
+/**
+ * Checks quota for every row of a durable vault pool and records each
+ * reading through the source's provider-state commit, attributed to the
+ * admission that produced it. A row counts as checked only when its reading
+ * was written; a reading with an error, without an attribution, or whose
+ * write the source refuses (another credential, account or a newer record
+ * version) is not checked and is not shown. A written reading is also put
+ * on the row that is still at that route, credential and account. An
+ * aborted `signal` stops the check; the remaining rows are not checked.
+ */
+export declare function checkVaultQuota(input: {
+    readonly pool: Pick<VaultAccountPool, 'selector' | 'state'>;
+    /** One vault account's quota check (the shared vault quota helper). */
+    readonly fetchReading: (ref: VaultRouteRef, signal: AbortSignal) => Promise<VaultQuotaAnswer>;
+    readonly signal: AbortSignal;
+    readonly now?: () => number;
+    readonly onError?: (error: unknown) => void;
+}): Promise<AntigravityQuotaCheckReport>;
+//# sourceMappingURL=vault-request-credentials.d.ts.map

package/dist/src/plugin/shared/vault-request-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-request-credentials.d.ts","sourceRoot":"","sources":["../../../../src/plugin/shared/vault-request-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAGlB,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,kCAAkC,CAAA;AAEzC,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,uBAAuB,CAAA;AAE9B,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,6BAA6B,EAC7B,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,oBAAoB,CACtD,CAAA;AAED,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,6BAA6B,EAC7B,aAAa,GAAG,aAAa,CAC9B,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG;IAChD,KAAK,EAAE,aAAa,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,aAAa,EAAE,GAC/B,eAAe,EAAE,CAUnB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAM/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,eAAe,GACrB,IAAI,CAIN;AA+BD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,oBAAoB,CAAC,EAChE,UAAU,CAAC,EAAE;IACX,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;IACtD,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAA;CACzE,GACA,uBAAuB,CAAC,eAAe,CAAC,CAY1C;AAoLD,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;IACtD,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CAC5C;AAED,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAA;IACxE;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD;;;;;;OAMG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,0EAA0E;IAC1E,WAAW,CACT,WAAW,EAAE,qBAAqB,EAClC,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,8BAA8B,CAAC,CAAA;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CA0FrB;AAMD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;QACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAA;QACzD,gDAAgD;QAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;KAC5C,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,CAAA;IACnD,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC,eAAe,CAAC,CAAA;IAC9D,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,CAAA;IAC/C;;;;;OAKG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,mEAAmE;IACnE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,sCAAsC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CAwElB;AAMD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;CAClD;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAgB3E;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAAC,CAAA;IAC3D,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,CACrB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CAC5C,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAoCvC"}

package/dist/src/plugin/shared/vault-request-credentials.js

@@ -0,0 +1,485 @@
+/**
+ * Vault-held accounts for the shared request engine, used by OpenCode 1 and
+ * OpenCode 2 alike: selection rows built from the vault's selectable routes,
+ * the engine's `vault` credential domain over a vault account source, and
+ * the rows' durable selection state in the vault's credential-free
+ * provider-state file.
+ *
+ * A row carries the route and selection bookkeeping only; no token, refresh
+ * token, project or local repository reference. Every physical send asks
+ * the source for a fresh receipt for the selected row's route and uses that
+ * receipt's token and project for that send only; a 401 is reported against
+ * the exact receipt that served it. Nothing is refreshed locally, cached or
+ * written to a row.
+ *
+ * The module imports no host SDK and no composition root: the source is the
+ * core vault account source (or anything with the same operations).
+ */
+import { AccountSelector, } from '@cortexkit/antigravity-auth-core';
+/**
+ * Selection rows for the vault's selectable routes, in roster order, with
+ * no selection history.
+ */
+export function vaultAccountRows(routes) {
+    return routes.map((route, index) => ({
+        index,
+        enabled: true,
+        lastUsed: 0,
+        rateLimitResetTimes: {},
+        touchedForQuota: {},
+        route,
+        ...(route.email !== undefined ? { email: route.email } : {}),
+    }));
+}
+/**
+ * A vault row's identity for `AccountSelector.replaceAccounts`: its route,
+ * credential and asserted account. A route that now names another
+ * credential or account is a different row.
+ */
+export function vaultAccountRowKey(row) {
+    return JSON.stringify([
+        row.route.routeId,
+        row.route.credentialId,
+        row.route.accountIdentity,
+    ]);
+}
+/**
+ * Keeps a vault row's in-memory selection state across a roster re-read and
+ * takes only the route's display fields from the fresh roster. A kept row's
+ * in-memory state is the newest there is; stored state (see
+ * `createVaultSelectionState`) is restored only onto rows that are new.
+ */
+export function refreshVaultAccountRow(prior, fresh) {
+    prior.route = fresh.route;
+    if (fresh.email === undefined)
+        delete prior.email;
+    else
+        prior.email = fresh.email;
+}
+/**
+ * One physical send's grant from one vault receipt. The access token is a
+ * non-enumerable property, as the source served it, so spreading or
+ * serializing a grant never copies it.
+ */
+class VaultSendGrant {
+    credentialId;
+    accountIdentity;
+    recordVersion;
+    projectId;
+    report401;
+    constructor(admission, report) {
+        Object.defineProperty(this, 'accessToken', {
+            value: admission.accessToken,
+            enumerable: false,
+        });
+        this.credentialId = admission.credentialId;
+        this.accountIdentity = admission.accountIdentity;
+        this.recordVersion = admission.recordVersion;
+        this.projectId = admission.projectId;
+        this.report401 = report;
+    }
+}
+/**
+ * The shared engine's `vault` credential domain over a vault account source.
+ * `onAdmitted` receives each receipt's non-secret attribution, taken by the
+ * same source, with the row it was taken for (see
+ * `createVaultSelectionState`).
+ */
+export function createVaultRequestCredentials(source, onAdmitted) {
+    return {
+        domain: 'vault',
+        async admit({ account, signal }) {
+            const admission = await source.admit(account.route, signal);
+            if (onAdmitted)
+                onAdmitted.admitted(account, onAdmitted.source.attribution(admission));
+            return new VaultSendGrant(admission, (status) => source.reportServedStatus(admission, status));
+        },
+    };
+}
+function present(value) {
+    return value === null ? undefined : value;
+}
+function storedResets(resets) {
+    const stored = {};
+    for (const [key, at] of Object.entries(resets))
+        if (typeof at === 'number')
+            stored[key] = at;
+    return stored;
+}
+/** The row's quota groups from a stored quota reading. */
+function cachedQuotaOf(quota) {
+    const groups = quota.cachedQuota;
+    if (groups == null)
+        return undefined;
+    const out = {};
+    for (const name of ['gemini', 'non-gemini']) {
+        const group = groups[name];
+        if (group === undefined)
+            continue;
+        out[name] = {
+            modelCount: group.modelCount,
+            ...(group.remainingFraction != null
+                ? { remainingFraction: group.remainingFraction }
+                : {}),
+            ...(group.resetTime != null ? { resetTime: group.resetTime } : {}),
+            ...(group.windows != null
+                ? {
+                    windows: group.windows.map((window) => ({
+                        window: window.window,
+                        remainingFraction: window.remainingFraction,
+                        resetTime: window.resetTime,
+                    })),
+                }
+                : {}),
+        };
+    }
+    return out;
+}
+/** The row's durable selection fields as provider metadata. */
+function durableSelectionOf(row) {
+    return {
+        lastUsed: row.lastUsed,
+        ...(row.lastSwitchReason !== undefined
+            ? { lastSwitchReason: row.lastSwitchReason }
+            : {}),
+        rateLimitResetTimes: storedResets(row.rateLimitResetTimes),
+        ...(row.coolingDownUntil !== undefined
+            ? { coolingDownUntil: row.coolingDownUntil }
+            : {}),
+        ...(row.cooldownReason !== undefined
+            ? { cooldownReason: row.cooldownReason }
+            : {}),
+        ...(row.fingerprint !== undefined
+            ? { fingerprint: structuredClone(row.fingerprint) }
+            : {}),
+        ...(row.fingerprintHistory !== undefined
+            ? { fingerprintHistory: structuredClone(row.fingerprintHistory) }
+            : {}),
+        ...(row.verificationRequired !== undefined
+            ? { verificationRequired: row.verificationRequired }
+            : {}),
+        ...(row.verificationRequiredAt !== undefined
+            ? { verificationRequiredAt: row.verificationRequiredAt }
+            : {}),
+        ...(row.verificationRequiredReason !== undefined
+            ? { verificationRequiredReason: row.verificationRequiredReason }
+            : {}),
+        ...(row.verificationUrl !== undefined
+            ? { verificationUrl: row.verificationUrl }
+            : {}),
+        ...(row.accountIneligible !== undefined
+            ? { accountIneligible: row.accountIneligible }
+            : {}),
+        ...(row.accountIneligibleAt !== undefined
+            ? { accountIneligibleAt: row.accountIneligibleAt }
+            : {}),
+        ...(row.accountIneligibleReason !== undefined
+            ? { accountIneligibleReason: row.accountIneligibleReason }
+            : {}),
+        ...(row.eligibilityStateUpdatedAt !== undefined
+            ? { eligibilityStateUpdatedAt: row.eligibilityStateUpdatedAt }
+            : {}),
+        ...(row.dailyRequestCounts !== undefined
+            ? { dailyRequestCounts: { ...row.dailyRequestCounts } }
+            : {}),
+    };
+}
+/** Puts stored selection fields onto a fresh row. */
+function applyDurableSelection(row, metadata) {
+    row.lastUsed = metadata.lastUsed;
+    const reason = present(metadata.lastSwitchReason);
+    if (reason !== undefined)
+        row.lastSwitchReason = reason;
+    const resets = present(metadata.rateLimitResetTimes);
+    if (resets !== undefined) {
+        const copy = {};
+        for (const [key, at] of Object.entries(resets))
+            if (typeof at === 'number')
+                copy[key] = at;
+        row.rateLimitResetTimes = copy;
+    }
+    const until = present(metadata.coolingDownUntil);
+    const cooldownReason = present(metadata.cooldownReason);
+    if (until !== undefined && cooldownReason !== undefined) {
+        row.coolingDownUntil = until;
+        row.cooldownReason = cooldownReason;
+    }
+    const fingerprint = present(metadata.fingerprint);
+    if (fingerprint !== undefined)
+        row.fingerprint = structuredClone(fingerprint);
+    const history = present(metadata.fingerprintHistory);
+    if (history !== undefined)
+        row.fingerprintHistory = structuredClone(history);
+    const verification = present(metadata.verificationRequired);
+    if (verification !== undefined)
+        row.verificationRequired = verification;
+    const verificationAt = present(metadata.verificationRequiredAt);
+    if (verificationAt !== undefined)
+        row.verificationRequiredAt = verificationAt;
+    const verificationReason = present(metadata.verificationRequiredReason);
+    if (verificationReason !== undefined)
+        row.verificationRequiredReason = verificationReason;
+    const verificationUrl = present(metadata.verificationUrl);
+    if (verificationUrl !== undefined)
+        row.verificationUrl = verificationUrl;
+    const ineligible = present(metadata.accountIneligible);
+    if (ineligible !== undefined)
+        row.accountIneligible = ineligible;
+    const ineligibleAt = present(metadata.accountIneligibleAt);
+    if (ineligibleAt !== undefined)
+        row.accountIneligibleAt = ineligibleAt;
+    const ineligibleReason = present(metadata.accountIneligibleReason);
+    if (ineligibleReason !== undefined)
+        row.accountIneligibleReason = ineligibleReason;
+    const eligibilityAt = present(metadata.eligibilityStateUpdatedAt);
+    if (eligibilityAt !== undefined)
+        row.eligibilityStateUpdatedAt = eligibilityAt;
+    const counts = present(metadata.dailyRequestCounts);
+    if (counts !== undefined)
+        row.dailyRequestCounts = { ...counts };
+}
+/** Whether stored state was written for exactly this row's route and credential. */
+function stateBelongsTo(state, row) {
+    return (state.observed.routeId === row.route.routeId &&
+        state.observed.credentialId === row.route.credentialId);
+}
+/**
+ * Durable selection state for vault rows, kept in the vault source's
+ * credential-free provider-state file by asserted account. The selector
+ * stays the only selection policy: this only saves and restores the fields
+ * it already maintains.
+ */
+export function createVaultSelectionState(options) {
+    const now = options.now ?? (() => Date.now());
+    const attributions = new WeakMap();
+    const changed = new Set();
+    let writing = Promise.resolve();
+    const mark = (row) => {
+        changed.add(row);
+    };
+    const report = (error) => {
+        try {
+            options.onError?.(error);
+        }
+        catch {
+            // A diagnostic callback cannot change what was written.
+        }
+    };
+    const writeRow = async (row) => {
+        const attribution = attributions.get(row);
+        if (attribution === undefined)
+            return;
+        changed.delete(row);
+        const selection = durableSelectionOf(row);
+        try {
+            await options.source.commitState(attribution, (current) => ({
+                metadata: {
+                    ...(current?.metadata ?? { addedAt: now() }),
+                    ...selection,
+                },
+                ...(current?.quota !== undefined ? { quota: current.quota } : {}),
+                ...(current?.extensions !== undefined
+                    ? { extensions: current.extensions }
+                    : {}),
+            }));
+        }
+        catch (error) {
+            report(error);
+        }
+    };
+    const flush = () => {
+        writing = writing.then(async () => {
+            for (const row of [...changed])
+                await writeRow(row);
+        });
+        return writing;
+    };
+    return {
+        sink: {
+            rateLimit: mark,
+            cooldown: mark,
+            switched: mark,
+            lastUsed: mark,
+            usage: mark,
+            accessVerdict: mark,
+            fingerprint: mark,
+            requestSave: () => {
+                void flush();
+            },
+        },
+        admitted(row, attribution) {
+            attributions.set(row, attribution);
+        },
+        async hydrate(rows) {
+            const file = await options.readState();
+            for (const row of rows) {
+                const identity = row.route.accountIdentity;
+                if (!Object.hasOwn(file.accounts, identity))
+                    continue;
+                const state = file.accounts[identity];
+                if (state === undefined || !stateBelongsTo(state, row))
+                    continue;
+                if (state.metadata !== undefined)
+                    applyDurableSelection(row, state.metadata);
+                if (state.quota !== undefined) {
+                    const cached = cachedQuotaOf(state.quota);
+                    if (cached !== undefined)
+                        row.cachedQuota = cached;
+                    const updatedAt = present(state.quota.cachedQuotaUpdatedAt);
+                    if (updatedAt !== undefined)
+                        row.cachedQuotaUpdatedAt = updatedAt;
+                }
+            }
+        },
+        flush,
+        recordQuota(attribution, quota) {
+            return options.source.commitState(attribution, (current) => ({
+                ...(current?.metadata !== undefined
+                    ? { metadata: current.metadata }
+                    : {}),
+                quota,
+                ...(current?.extensions !== undefined
+                    ? { extensions: current.extensions }
+                    : {}),
+            }));
+        },
+    };
+}
+export function createVaultAccountPool(options) {
+    const { source, durable } = options;
+    const state = durable
+        ? createVaultSelectionState({
+            source: durable.source,
+            readState: durable.readState,
+            ...(options.now ? { now: options.now } : {}),
+            ...(durable.onError ? { onError: durable.onError } : {}),
+        })
+        : undefined;
+    const selector = new AccountSelector({
+        ...(options.now ? { now: options.now } : {}),
+        ...(state ? { sink: state.sink } : {}),
+    });
+    const credentials = createVaultRequestCredentials(source, state && durable
+        ? {
+            source: durable.source,
+            admitted: (row, attribution) => state.admitted(row, attribution),
+        }
+        : undefined);
+    /** Fresh rows for the source's routes, with stored state on new ones. */
+    const rowsFromSource = async () => {
+        const rows = vaultAccountRows(source.routes());
+        if (state) {
+            const kept = new Set(selector.rows.map(vaultAccountRowKey));
+            const added = rows.filter((row) => !kept.has(vaultAccountRowKey(row)));
+            if (added.length > 0)
+                await state.hydrate(added);
+        }
+        return rows;
+    };
+    const replace = async () => {
+        selector.replaceAccounts(await rowsFromSource(), {
+            keyOf: vaultAccountRowKey,
+            refresh: refreshVaultAccountRow,
+        });
+    };
+    let firstRead = null;
+    const readOnce = () => {
+        firstRead ??= (async () => {
+            await source.refresh();
+            selector.resetAccounts(await rowsFromSource());
+        })().catch((error) => {
+            firstRead = null;
+            throw error;
+        });
+        return firstRead;
+    };
+    return {
+        selector,
+        credentials,
+        state,
+        async sync() {
+            const pending = firstRead;
+            await readOnce();
+            // The first read just installed the rows; later calls re-sync.
+            if (pending !== null)
+                await replace();
+        },
+        async refresh() {
+            await readOnce();
+            await source.refresh();
+            await replace();
+        },
+        flush: async () => {
+            await state?.flush();
+        },
+    };
+}
+/** The stored quota reading for a summary taken at `at`. */
+export function vaultQuotaState(quota, at) {
+    const cachedQuota = {};
+    for (const [name, group] of Object.entries(quota.groups)) {
+        if (group === undefined)
+            continue;
+        cachedQuota[name] = {
+            modelCount: group.modelCount,
+            ...(group.remainingFraction !== undefined
+                ? { remainingFraction: group.remainingFraction }
+                : {}),
+            ...(group.resetTime !== undefined ? { resetTime: group.resetTime } : {}),
+            ...(group.windows !== undefined
+                ? { windows: group.windows.map((window) => ({ ...window })) }
+                : {}),
+        };
+    }
+    return { schemaVersion: 1, cachedQuota, cachedQuotaUpdatedAt: at };
+}
+/**
+ * Checks quota for every row of a durable vault pool and records each
+ * reading through the source's provider-state commit, attributed to the
+ * admission that produced it. A row counts as checked only when its reading
+ * was written; a reading with an error, without an attribution, or whose
+ * write the source refuses (another credential, account or a newer record
+ * version) is not checked and is not shown. A written reading is also put
+ * on the row that is still at that route, credential and account. An
+ * aborted `signal` stops the check; the remaining rows are not checked.
+ */
+export async function checkVaultQuota(input) {
+    const state = input.pool.state;
+    const rows = [...input.pool.selector.rows];
+    const now = input.now ?? (() => Date.now());
+    let checked = 0;
+    for (const row of rows) {
+        if (input.signal.aborted || state === undefined)
+            break;
+        try {
+            const answer = await input.fetchReading(row.route, input.signal);
+            const attribution = answer.quotaAttribution;
+            if (attribution === undefined || answer.quota.error !== undefined)
+                continue;
+            const reading = vaultQuotaState(answer.quota, now());
+            const result = await state.recordQuota(attribution, reading);
+            if (result.status !== 'written')
+                continue;
+            checked += 1;
+            const live = input.pool.selector.rows.find((candidate) => candidate.route.routeId === attribution.routeId &&
+                candidate.route.credentialId === attribution.credentialId &&
+                candidate.route.accountIdentity === attribution.accountIdentity);
+            if (live !== undefined) {
+                const cached = cachedQuotaOf(reading);
+                if (cached !== undefined)
+                    live.cachedQuota = cached;
+                live.cachedQuotaUpdatedAt = reading.cachedQuotaUpdatedAt ?? undefined;
+            }
+        }
+        catch (error) {
+            try {
+                input.onError?.(error);
+            }
+            catch {
+                // A diagnostic callback cannot change the report.
+            }
+        }
+    }
+    return { checked, notChecked: rows.length - checked };
+}
+//# sourceMappingURL=vault-request-credentials.js.map