model-eol 0.3.0 → 0.4.1

package/bot/lib/common.mjs

@@ -67,6 +67,8 @@ export const parseMetadata = body => {
     if (metadata.replacement !== undefined && metadata.replacement !== null && typeof metadata.replacement !== 'string') return null
     if (metadata.replacement_options !== undefined && (!Array.isArray(metadata.replacement_options) || metadata.replacement_options.some(option => typeof option !== 'string'))) return null
     if (metadata.replacement_note !== undefined && metadata.replacement_note !== null && typeof metadata.replacement_note !== 'string') return null
+    if (metadata.base_sha !== undefined && metadata.base_sha !== null && (typeof metadata.base_sha !== 'string' || !/^[0-9a-f]{40,64}$/.test(metadata.base_sha))) return null
+    if (metadata.stale_closed !== undefined && metadata.stale_closed !== true) return null
     if (typeof metadata.feed_digest !== 'string' || !metadata.feed_digest) return null
     if (!Object.hasOwn(metadata, 'head_sha') || (metadata.head_sha !== null && typeof metadata.head_sha !== 'string')) return null
     if (metadata.channel !== undefined && (typeof metadata.channel !== 'string' || !metadata.channel)) return null

package/bot/lib/eval.mjs

@@ -9,6 +9,12 @@ const truncateReport = (bytes, limit, truncated) => {
   return Buffer.concat([bytes.subarray(0, limit - marker.length), marker]).subarray(0, limit).toString('utf8')
 }
 
+export const capReport = (report, limit) => {
+  if (report === null || report === undefined) return null
+  const bytes = Buffer.from(String(report), 'utf8')
+  return truncateReport(bytes, Math.max(0, limit), bytes.length > limit)
+}
+
 export const readReportCapped = (file, limit) => {
   const cap = Math.max(0, limit)
   let lstat

package/bot/lib/git.mjs

@@ -105,23 +105,26 @@ export const verifyBotBranch = (cwd, branch, expectedHead, auth = null) => {
   }
 }
 
-export const pushBranch = (cwd, branch, expectedHead = null, auth = null) => {
+export const pushBranch = (cwd, branch, expectedHead = null, auth = null, { allowMissing = false } = {}) => {
   const destination = `HEAD:refs/heads/${branch}`
   if (expectedHead !== null) {
     const state = verifyBotBranch(cwd, branch, expectedHead, auth)
-    if (!state.safe) {
+    if (!state.safe && !(allowMissing && !state.error && state.head === null)) {
       const error = new Error(state.error || `refusing force-push: branch head ${state.head || 'missing'} or committer email ${state.committerEmail || 'missing'} failed bot lease checks`)
       error.code = 'MODEL_EOL_BRANCH_STAND_DOWN'
       error.currentHead = state.head
       error.committerEmail = state.committerEmail
       throw error
     }
-    run(cwd, [
-      'push',
-      `--force-with-lease=refs/heads/${branch}:${expectedHead}`,
-      'origin',
-      destination,
-    ], false, auth)
+    if (state.head === null) run(cwd, ['push', 'origin', destination], false, auth)
+    else {
+      run(cwd, [
+        'push',
+        `--force-with-lease=refs/heads/${branch}:${expectedHead}`,
+        'origin',
+        destination,
+      ], false, auth)
+    }
   } else {
     run(cwd, ['push', 'origin', destination], false, auth)
   }

package/bot/lib/github.mjs

@@ -81,7 +81,7 @@ export class GitHubClient {
     } catch (error) {
       if (error.status !== 404) {
         this.modelEolLabelAvailable = false
-        this.warn(`model-eol: warning: could not check the model-eol label; continuing without labels (${error.message})`)
+        this.warn(`model-eol: warning: could not check the model-eol label; refusing to publish untrusted work (${error.message})`)
         return false
       }
     }
@@ -97,11 +97,11 @@ export class GitHubClient {
           return true
         } catch {
           // Fall through to the warning below. Another writer may have raced us,
-          // but a failed confirmation should never block the migration itself.
+          // but ownership must be confirmed before publishing work.
         }
       }
       this.modelEolLabelAvailable = false
-      this.warn(`model-eol: warning: could not create the model-eol label; continuing without labels (${error.message})`)
+      this.warn(`model-eol: warning: could not create the model-eol label; refusing to publish untrusted work (${error.message})`)
       return false
     }
   }
@@ -113,7 +113,7 @@ export class GitHubClient {
       return true
     } catch (error) {
       this.modelEolLabelAvailable = false
-      this.warn(`model-eol: warning: could not label #${number}; the migration was still published (${error.message})`)
+      this.warn(`model-eol: warning: could not label #${number}; refusing to leave it open as trusted bot work (${error.message})`)
       return false
     }
   }
@@ -157,7 +157,10 @@ export class GitHubClient {
   async createPull(payload) {
     const { data } = await this.request('POST', `/repos/${this.repo}/pulls`, payload)
     if (data?.number === undefined) throw new Error('GitHub pull request response did not contain a number')
-    await this.addModelEolLabel(data.number)
+    if (!await this.addModelEolLabel(data.number)) {
+      try { await this.updatePull(data.number, { state: 'closed' }) } catch {}
+      throw new Error(`refusing unlabeled bot pull request #${data.number}; it was closed because ownership could not be established`)
+    }
     return data
   }
 
@@ -170,20 +173,8 @@ export class GitHubClient {
   }
 
   async createIssue(payload) {
-    const body = this.modelEolLabelAvailable
-      ? payload
-      : { ...payload, labels: (payload.labels ?? []).filter(label => label !== MODEL_EOL_LABEL.name) }
-    try {
-      return (await this.request('POST', `/repos/${this.repo}/issues`, body)).data
-    } catch (error) {
-      if (error.status !== 422 || !(body.labels ?? []).includes(MODEL_EOL_LABEL.name)) throw error
-      this.modelEolLabelAvailable = false
-      this.warn(`model-eol: warning: issue labels were rejected; retrying without the model-eol label (${error.message})`)
-      return (await this.request('POST', `/repos/${this.repo}/issues`, {
-        ...body,
-        labels: body.labels.filter(label => label !== MODEL_EOL_LABEL.name),
-      })).data
-    }
+    if (!this.modelEolLabelAvailable) throw new Error('refusing unlabeled bot issue; model-eol label is unavailable')
+    return (await this.request('POST', `/repos/${this.repo}/issues`, payload)).data
   }
 
   async updateIssue(number, payload) {

package/bot.yml.example

@@ -15,98 +15,134 @@ env:
 
 jobs:
   plan:
-    name: plan and evaluate
+    name: build trusted plan
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      # The eval job must never hold write tokens.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 22
+          package-manager-cache: false
       - name: Build the versioned plan
         run: |
+          mkdir -p "$RUNNER_TEMP/model-eol-plan"
+          MODEL_EOL_VERSION="$(npm view "$MODEL_EOL_PACKAGE" version --json | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{const v=JSON.parse(s);const r=Array.isArray(v)?v.at(-1):v;if(typeof r!=="string")process.exit(1);process.stdout.write(r)})')"
+          if [[ ! "$MODEL_EOL_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "refusing invalid resolved model-eol version: $MODEL_EOL_VERSION" >&2
+            exit 1
+          fi
+          printf '%s\n' "$MODEL_EOL_VERSION" > "$RUNNER_TEMP/model-eol-plan/model-eol-version"
           PLAN_ARGS=(plan .)
           if [ ! -f .model-eol.json ]; then PLAN_ARGS+=(--days 90 --scope direct); fi
-          npx --yes --package="$MODEL_EOL_PACKAGE" model-eol "${PLAN_ARGS[@]}" > model-eol-plan.json
-      - name: Run the configured eval harness
+          npx --yes --package="model-eol@$MODEL_EOL_VERSION" model-eol "${PLAN_ARGS[@]}" > "$RUNNER_TEMP/model-eol-plan/model-eol-plan.json"
+      - name: Upload plan
+        uses: actions/upload-artifact@v7
+        with:
+          name: model-eol-plan
+          path: |
+            ${{ runner.temp }}/model-eol-plan/model-eol-plan.json
+            ${{ runner.temp }}/model-eol-plan/model-eol-version
+          if-no-files-found: error
+
+  evaluate:
+    name: evaluate isolated migrations
+    needs: plan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      # Provider credentials exist only in this read-only job. The evaluator
+      # forwards only names explicitly allowed by eval.pass_env.
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - name: Download trusted plan
+        uses: actions/download-artifact@v8
+        with:
+          name: model-eol-plan
+          path: ${{ runner.temp }}/model-eol-plan
+      - name: Apply and evaluate each migration independently
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          # A non-empty repository variable overrides eval.command. Otherwise
+          # the strictly validated command in .model-eol.json is used.
           MODEL_EOL_EVAL_COMMAND: ${{ vars.MODEL_EOL_EVAL_COMMAND }}
-          MODEL_EOL_PLAN: ${{ github.workspace }}/model-eol-plan.json
-          MODEL_EOL_REPORT: ${{ github.workspace }}/model-eol-report.md
         run: |
-          # The workflow variable is an explicit override. Otherwise, use the
-          # eval.command already validated from .model-eol.json by the plan step.
-          if [ -z "${MODEL_EOL_EVAL_COMMAND:-}" ] && [ -f .model-eol.json ]; then
-            MODEL_EOL_EVAL_COMMAND="$(node --input-type=module -e '
-              import fs from "node:fs"
-              const config = JSON.parse(fs.readFileSync(".model-eol.json", "utf8"))
-              if (typeof config.eval?.command === "string") process.stdout.write(config.eval.command)
-            ')"
+          mkdir -p "$RUNNER_TEMP/model-eol-eval"
+          MODEL_EOL_VERSION="$(cat "$RUNNER_TEMP/model-eol-plan/model-eol-version")"
+          if [[ ! "$MODEL_EOL_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "refusing invalid resolved model-eol version: $MODEL_EOL_VERSION" >&2
+            exit 1
           fi
-          # Supply a provider-backed harness for this repository. It may read the
-          # plan and write Markdown to MODEL_EOL_REPORT, but this job has read-only
-          # contents permission and the publish job receives no provider keys.
-          if [ -n "${MODEL_EOL_EVAL_COMMAND:-}" ]; then
-            set +e
-            sh -c "$MODEL_EOL_EVAL_COMMAND"
-            eval_status=$?
-            set -e
-            printf '%s\n' "$eval_status" > model-eol-eval-exit-code
-          else
-            : > "$MODEL_EOL_REPORT"
-            printf '0\n' > model-eol-eval-exit-code
-          fi
-      - name: Upload plan and eval report
-        uses: actions/upload-artifact@v4
+          npx --yes --package="model-eol@$MODEL_EOL_VERSION" model-eol-bot evaluate \
+            --target-dir . \
+            --plan-file "$RUNNER_TEMP/model-eol-plan/model-eol-plan.json" \
+            --output-file "$RUNNER_TEMP/model-eol-eval/model-eol-eval-results.json"
+      - name: Upload bounded eval results
+        uses: actions/upload-artifact@v7
         with:
-          name: model-eol-plan-and-report
-          path: |
-            model-eol-plan.json
-            model-eol-report.md
-            model-eol-eval-exit-code
+          name: model-eol-eval-results
+          path: ${{ runner.temp }}/model-eol-eval/model-eol-eval-results.json
+          if-no-files-found: error
 
   publish:
-    name: publish migration work
-    needs: plan
+    name: reconcile migration work
+    needs: [plan, evaluate]
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # model-eol-bot authenticates its own temporary HTTPS clones and
           # pushes with GITHUB_TOKEN; no checkout credential is persisted.
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - name: Download trusted plan
+        uses: actions/download-artifact@v8
         with:
-          node-version: 20
-      - name: Download the plan and eval report
-        uses: actions/download-artifact@v4
+          name: model-eol-plan
+          path: ${{ runner.temp }}/model-eol-plan
+      - name: Download eval results
+        uses: actions/download-artifact@v8
         with:
-          name: model-eol-plan-and-report
-      - name: Publish model-eol PRs and issues
+          name: model-eol-eval-results
+          path: ${{ runner.temp }}/model-eol-eval
+      - name: Publish and reconcile model-eol work
         env:
           GITHUB_TOKEN: ${{ secrets.MODEL_EOL_BOT_TOKEN || secrets.GITHUB_TOKEN }}
-          MODEL_EOL_PLAN_FILE: ${{ github.workspace }}/model-eol-plan.json
-          MODEL_EOL_EVAL_REPORT_FILE: ${{ github.workspace }}/model-eol-report.md
-          MODEL_EOL_EVAL_STATUS_FILE: ${{ github.workspace }}/model-eol-eval-exit-code
+          MODEL_EOL_PLAN_FILE: ${{ runner.temp }}/model-eol-plan/model-eol-plan.json
+          MODEL_EOL_EVAL_RESULTS_FILE: ${{ runner.temp }}/model-eol-eval/model-eol-eval-results.json
+          # The write job receives the non-secret command text only so it can
+          # verify the eval configuration digest. It receives no provider keys.
+          MODEL_EOL_EVAL_COMMAND: ${{ vars.MODEL_EOL_EVAL_COMMAND }}
           MODEL_EOL_TOKEN_KIND: ${{ secrets.MODEL_EOL_BOT_TOKEN && 'external-token' || 'github-token' }}
-        run: npx --yes --package="$MODEL_EOL_PACKAGE" model-eol-bot --repo "${{ github.repository }}" --target-dir .
+        run: |
+          MODEL_EOL_VERSION="$(cat "$RUNNER_TEMP/model-eol-plan/model-eol-version")"
+          if [[ ! "$MODEL_EOL_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "refusing invalid resolved model-eol version: $MODEL_EOL_VERSION" >&2
+            exit 1
+          fi
+          npx --yes --package="model-eol@$MODEL_EOL_VERSION" model-eol-bot --repo "${{ github.repository }}" --target-dir .
 
-# Security and checks note:
-# A PR made with GITHUB_TOKEN does not trigger pull_request workflows, so checks
-# may be skipped even though this job has opened the PR. For required checks, use
-# a narrowly scoped fine-grained PAT or a GitHub App installation token in the
-# optional MODEL_EOL_BOT_TOKEN secret instead.
-# Keep provider API keys only in the read-only plan/eval job and never pass them to
-# the publish job.
-# Set feeds.allow_vendored_fallback: true in .model-eol.json only for degraded report-only runs; the default is false.
-# Independent concurrent invocations need external mutual exclusion; this tool does not lock.
+# A PR made with GITHUB_TOKEN does not trigger pull_request workflows. For
+# required checks, store a narrowly scoped fine-grained PAT or GitHub App token
+# as MODEL_EOL_BOT_TOKEN. Keep provider keys out of the publish job.
+# Set feeds.allow_vendored_fallback: true only for degraded report-only runs.
+# Independent concurrent invocations need external mutual exclusion.

package/check.mjs

@@ -19,8 +19,18 @@ import path from 'node:path'
 
 import { applyPlan } from './lib/apply.mjs'
 import { parseCliArgs } from './lib/cli.mjs'
-import { CLI_DEFAULT_CONFIG, DEFAULT_CONFIG, loadConfig, normalizeConfig } from './lib/config.mjs'
-import { findingFromRef, isBad, loadFeeds } from './lib/feeds.mjs'
+import {
+  CLI_DEFAULT_CONFIG,
+  DEFAULT_CONFIG,
+  configForRepoPath,
+  configuredVias,
+  loadConfig,
+  mappedRoutesForRepoPath,
+  normalizeConfig,
+  routeForRepoReference,
+} from './lib/config.mjs'
+import { BUILTIN_CHANNELS, findingFromRef, isBad, loadFeeds } from './lib/feeds.mjs'
+import { normalizeRepoPath } from './lib/glob.mjs'
 import { buildPlan } from './lib/plan.mjs'
 import {
   buildAlert,
@@ -73,6 +83,15 @@ const configForTargets = ({ targets, explicit }) => {
   return { file: files[0] ?? null, roots }
 }
 
+const repoPathForFile = (file, roots) => {
+  const absolute = path.resolve(file)
+  const candidates = roots
+    .map(root => ({ root, relative: path.relative(root, absolute) }))
+    .filter(({ relative }) => relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative))
+    .sort((a, b) => b.root.length - a.root.length)
+  return normalizeRepoPath(candidates[0]?.relative ?? absolute)
+}
+
 const main = () => {
 const COMMANDS = new Set(['check', 'inventory', 'schedule', 'alert', 'plan', 'apply', 'help'])
 const args = process.argv.slice(2)
@@ -222,6 +241,37 @@ if (feedData.entries.size === 0) {
   return 2
 }
 
+const allowedVias = new Set([...BUILTIN_CHANNELS, ...feedData.vias])
+const unknownVia = [values.via, ...configuredVias(repositoryConfig)]
+  .find(via => via && !allowedVias.has(via))
+if (unknownVia) {
+  console.error(`unknown lifecycle channel "${unknownVia}"; known values: ${[...allowedVias].sort().join(', ')}`)
+  return 2
+}
+const unresolvedRoute = repositoryConfig.routes.find(route => route.model && !feedData.entries.has(route.model))
+if (unresolvedRoute) {
+  console.error(`configured route model "${unresolvedRoute.model}" is not present in loaded feeds`)
+  return 2
+}
+
+const policyCache = new Map()
+const policyForFile = file => {
+  const absolute = path.resolve(file)
+  if (!policyCache.has(absolute)) {
+    const repoPath = repoPathForFile(absolute, configLocation.roots)
+    policyCache.set(absolute, { ...configForRepoPath(repositoryConfig, repoPath), repoPath })
+  }
+  return policyCache.get(absolute)
+}
+const routeForReference = ({ file, matched, id }) => {
+  const policy = policyForFile(file)
+  return routeForRepoReference(repositoryConfig, policy.repoPath, { matched, id })
+}
+const mappedRoutesForFile = file => {
+  const policy = policyForFile(file)
+  return mappedRoutesForRepoPath(repositoryConfig, policy.repoPath)
+}
+
 let scan
 try {
   scan = scanTargets({
@@ -229,10 +279,11 @@ try {
     entries: feedData.entries,
     keys: feedData.keys,
     includeDocs: INCLUDE_DOCS,
-    ignoreModels: repositoryConfig.ignore.models,
-    ignorePaths: repositoryConfig.ignore.paths,
     ignoreRoots: configLocation.roots,
     ignoredFiles: configLocation.file ? [configLocation.file] : [],
+    policyForFile,
+    routeForReference,
+    mappedRoutesForFile,
   })
 } catch (e) {
   console.error(`scan failed: ${e.message}`)
@@ -250,10 +301,32 @@ if (incompleteNotes.length && (command === 'check' || command === 'plan')) {
   if (!ALLOW_INCOMPLETE) return 2
 }
 
-const findings = scan.modelRefs.map(ref => findingFromRef(ref, { days: DAYS, via: VIA }))
-const checkFindings = SCOPE === 'direct'
-  ? findings.filter(f => f.usage === 'direct-api' || f.usage === 'model-reference')
-  : findings
+const findings = scan.modelRefs.map(ref => {
+  const policy = policyForFile(ref.file)
+  const route = routeForReference({ file: ref.file, matched: ref.matched, id: ref.id })
+  const days = values.days === undefined ? policy.days : DAYS
+  const scope = values.scope === undefined ? policy.scope : SCOPE
+  const via = values.via === undefined ? (route?.via ?? policy.via) : VIA
+  const finding = findingFromRef(ref, { days, via })
+  finding.effective_scope = scope
+  finding.requested_via = via
+  if (policy.override_indexes.length || route) {
+    finding.policy_provenance = {
+      override_indexes: policy.override_indexes,
+      route_index: route?.index ?? null,
+    }
+  }
+  return finding
+})
+for (const candidate of scan.candidateRefs) {
+  const policy = policyForFile(candidate.file)
+  candidate.effective_scope = values.scope === undefined ? policy.scope : SCOPE
+  if (policy.override_indexes.length) {
+    candidate.policy_provenance = { override_indexes: policy.override_indexes, route_index: null }
+  }
+}
+const checkFindings = findings.filter(finding =>
+  finding.effective_scope !== 'direct' || finding.usage === 'direct-api' || finding.usage === 'model-reference')
 let changedFindings = checkFindings
 if (CHANGED_BASE !== null) {
   try {

package/feeds/amazon.json

@@ -1,7 +1,7 @@
 {
   "spec": "model-eol/0.1",
   "publisher": "amazon",
-  "generated": "2026-08-03T21:43:59.800Z",
+  "generated": "2026-08-18T00:47:44.931Z",
   "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html",
   "models": [
     {

package/feeds/anthropic.json

@@ -1,7 +1,7 @@
 {
   "spec": "model-eol/0.1",
   "publisher": "anthropic",
-  "generated": "2026-08-03T21:43:59.800Z",
+  "generated": "2026-08-18T00:47:44.931Z",
   "source": "https://platform.claude.com/docs/en/about-claude/model-deprecations",
   "policy": {
     "min_notice_days": 60,

package/feeds/google.json

@@ -1,7 +1,7 @@
 {
   "spec": "model-eol/0.1",
   "publisher": "google",
-  "generated": "2026-08-03T21:43:59.800Z",
+  "generated": "2026-08-18T00:47:44.931Z",
   "source": "https://ai.google.dev/gemini-api/docs/deprecations",
   "models": [
     {
@@ -318,7 +318,13 @@
     },
     {
       "id": "gemini-embedding-2",
-      "source": "https://ai.google.dev/gemini-api/docs/deprecations"
+      "source": "https://ai.google.dev/gemini-api/docs/deprecations",
+      "distributions": [
+        {
+          "via": "vertex-ai",
+          "source": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/model-versions"
+        }
+      ]
     },
     {
       "id": "gemini-embedding-001",
@@ -518,9 +524,7 @@
       "source": "https://ai.google.dev/gemini-api/docs/deprecations",
       "shutdown": "2026-08-31",
       "date_precision": "earliest",
-      "replacement_options": [
-        "gemini-robotics-er-2-preview"
-      ]
+      "replacement": "gemini-robotics-er-2-preview"
     },
     {
       "id": "gemini-robotics-er-1.5-preview",
@@ -528,6 +532,85 @@
       "shutdown": "2026-04-30",
       "date_precision": "earliest",
       "replacement": "gemini-robotics-er-1.6-preview"
+    },
+    {
+      "id": "gemini-3.7-flash",
+      "source": "https://ai.google.dev/gemini-api/docs/deprecations",
+      "distributions": [
+        {
+          "via": "vertex-ai",
+          "source": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/model-versions"
+        }
+      ]
+    },
+    {
+      "id": "gemma-4-26b-a4b-it"
+    },
+    {
+      "id": "gemma-4-31b-it"
+    },
+    {
+      "id": "gemini-flash-latest"
+    },
+    {
+      "id": "gemini-flash-lite-latest"
+    },
+    {
+      "id": "gemini-pro-latest"
+    },
+    {
+      "id": "gemini-3.1-pro-preview-customtools"
+    },
+    {
+      "id": "nano-banana-pro-preview"
+    },
+    {
+      "id": "gemini-3.1-flash-lite-image",
+      "distributions": [
+        {
+          "via": "vertex-ai",
+          "source": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/model-versions"
+        }
+      ]
+    },
+    {
+      "id": "gemini-omni-flash-preview"
+    },
+    {
+      "id": "gemini-robotics-er-2-preview"
+    },
+    {
+      "id": "gemini-2.5-computer-use-preview-10-2025"
+    },
+    {
+      "id": "antigravity-preview-05-2026"
+    },
+    {
+      "id": "deep-research-max-preview-04-2026"
+    },
+    {
+      "id": "deep-research-preview-04-2026"
+    },
+    {
+      "id": "deep-research-pro-preview-12-2025"
+    },
+    {
+      "id": "gemini-embedding-2-preview"
+    },
+    {
+      "id": "aqa"
+    },
+    {
+      "id": "gemini-2.5-flash-native-audio-latest"
+    },
+    {
+      "id": "gemini-2.5-flash-native-audio-preview-09-2025"
+    },
+    {
+      "id": "gemini-robotics-er-2-streaming-preview"
+    },
+    {
+      "id": "gemini-3.5-live-translate-preview"
     }
   ]
 }