vidspotai-shared 1.0.87 → 1.0.89

package/lib/services/agent/resnapVo.d.ts

@@ -0,0 +1,51 @@
+import { VideoPlan } from "../../schemas/videoPlan.schema";
+/**
+ * Post-VO re-snap (Issues A + B from the duration/VO audit, 2026-06-17).
+ *
+ * Beat-snap (`snapPlanToBeats`) runs ONCE at plan time against a loose 3-wps VO
+ * *estimate*, because the real VO doesn't exist yet. By finalize the real audio
+ * has been probed (ffprobe → `voiceoverActualMs`), so two residual quality gaps
+ * are now fixable against the truth:
+ *
+ *   A. Trailing silence — VO shorter than its scene leaves dead air over a
+ *      continuing visual (benign with music, reads as a hang without it).
+ *   B. Beat drift — a VO longer than planned fires the `max(planned, vo)` stretch
+ *      backstop in planToProject, pushing every later cut off the onset it was
+ *      snapped to. Cumulative across overrunning scenes.
+ *
+ * This pure pass recomputes each scene boundary against the REAL per-scene VO
+ * length. The onsets the plan was snapped against persist on `plan.music.onsets`,
+ * so we re-anchor every boundary to an ABSOLUTE onset — drift cannot accumulate
+ * (scene N+1's cut lands on an onset regardless of what N did).
+ *
+ * Three desiderata are over-constrained (a VO almost never ends exactly on an
+ * onset, so beat-aligned and zero-silence conflict), so the guarantee is a
+ * deterministic, bounded outcome with a fixed priority order:
+ *
+ *   (I)   VO-safe   — `out.durationMs >= actualVoMs` for every scene. HARD, always.
+ *   (II)  on-beat   — boundaries land on onsets / bar grid where music exists.
+ *   (III) bounded silence — trailing silence ≤ {one onset gap | one bar | TAIL_MS}.
+ *
+ * Mode is picked automatically (same precedence as beat-snap): onsets → bpm grid
+ * → no-music floor. `opts.skip` returns the plan untouched (regen/frozen safety —
+ * re-snapping non-frozen neighbours would move offsets and desync a locked clip).
+ */
+/** Breathing room appended after the spoken line before the scene cuts. */
+export declare const TAIL_MS = 300;
+/** Floor for a scene in the no-music mode (prevents sub-second flashes). */
+export declare const MIN_SCENE_MS = 1500;
+export interface ResnapOptions {
+    /**
+     * When true the plan is returned verbatim. Set on the regen / frozen-clip
+     * path (`preserveClips.length > 0`): frozen clips keep their prior display
+     * window, and re-snapping their non-frozen neighbours would shift offsets and
+     * desync the locked clip. v1 guarantee — strictly avoid the interaction.
+     */
+    skip?: boolean;
+    /** Breathing room after the VO (default {@link TAIL_MS}). */
+    tailMs?: number;
+    /** No-music scene floor (default {@link MIN_SCENE_MS}). */
+    minSceneMs?: number;
+}
+export declare function resnapPlanToActualVo(plan: VideoPlan, actualVoMsByScene: Record<number, number>, opts?: ResnapOptions): VideoPlan;
+//# sourceMappingURL=resnapVo.d.ts.map

package/lib/services/agent/resnapVo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resnapVo.d.ts","sourceRoot":"","sources":["../../../src/services/agent/resnapVo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAGzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,OAAO,MAAM,CAAC;AAC3B,4EAA4E;AAC5E,eAAO,MAAM,YAAY,OAAO,CAAC;AAIjC,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,IAAI,GAAE,aAAkB,GACvB,SAAS,CAwBX"}

package/lib/services/agent/resnapVo.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_SCENE_MS = exports.TAIL_MS = void 0;
+exports.resnapPlanToActualVo = resnapPlanToActualVo;
+const beatSnap_1 = require("./beatSnap");
+/**
+ * Post-VO re-snap (Issues A + B from the duration/VO audit, 2026-06-17).
+ *
+ * Beat-snap (`snapPlanToBeats`) runs ONCE at plan time against a loose 3-wps VO
+ * *estimate*, because the real VO doesn't exist yet. By finalize the real audio
+ * has been probed (ffprobe → `voiceoverActualMs`), so two residual quality gaps
+ * are now fixable against the truth:
+ *
+ *   A. Trailing silence — VO shorter than its scene leaves dead air over a
+ *      continuing visual (benign with music, reads as a hang without it).
+ *   B. Beat drift — a VO longer than planned fires the `max(planned, vo)` stretch
+ *      backstop in planToProject, pushing every later cut off the onset it was
+ *      snapped to. Cumulative across overrunning scenes.
+ *
+ * This pure pass recomputes each scene boundary against the REAL per-scene VO
+ * length. The onsets the plan was snapped against persist on `plan.music.onsets`,
+ * so we re-anchor every boundary to an ABSOLUTE onset — drift cannot accumulate
+ * (scene N+1's cut lands on an onset regardless of what N did).
+ *
+ * Three desiderata are over-constrained (a VO almost never ends exactly on an
+ * onset, so beat-aligned and zero-silence conflict), so the guarantee is a
+ * deterministic, bounded outcome with a fixed priority order:
+ *
+ *   (I)   VO-safe   — `out.durationMs >= actualVoMs` for every scene. HARD, always.
+ *   (II)  on-beat   — boundaries land on onsets / bar grid where music exists.
+ *   (III) bounded silence — trailing silence ≤ {one onset gap | one bar | TAIL_MS}.
+ *
+ * Mode is picked automatically (same precedence as beat-snap): onsets → bpm grid
+ * → no-music floor. `opts.skip` returns the plan untouched (regen/frozen safety —
+ * re-snapping non-frozen neighbours would move offsets and desync a locked clip).
+ */
+/** Breathing room appended after the spoken line before the scene cuts. */
+exports.TAIL_MS = 300;
+/** Floor for a scene in the no-music mode (prevents sub-second flashes). */
+exports.MIN_SCENE_MS = 1500;
+const BEATS_PER_BAR = 4;
+function resnapPlanToActualVo(plan, actualVoMsByScene, opts = {}) {
+    if (opts.skip)
+        return plan;
+    const tailMs = opts.tailMs ?? exports.TAIL_MS;
+    const minSceneMs = opts.minSceneMs ?? exports.MIN_SCENE_MS;
+    // Per-scene minimum (the binding floor that makes the output VO-safe). A scene
+    // that actually speaks must outlast its real VO plus a tail; a scene with no
+    // VO (silent B-roll) keeps its deliberately-planned duration as the floor so
+    // the re-snap never collapses it to zero.
+    const floorMs = (scene) => {
+        const vo = actualVoMsByScene[scene.sceneIndex] ?? 0;
+        return vo > 0 ? vo + tailMs : scene.durationMs;
+    };
+    const onsets = plan.music?.onsets;
+    if (onsets && onsets.length >= plan.scenes.length) {
+        return resnapToOnsets(plan, onsets, floorMs);
+    }
+    const bpm = (0, beatSnap_1.resolveBpm)(plan);
+    if (bpm) {
+        return resnapToBpmGrid(plan, bpm, floorMs);
+    }
+    return resnapNoMusic(plan, floorMs, minSceneMs);
+}
+/** Mode 1 — snap each cumulative boundary to the nearest onset ≥ (start + floor). */
+function resnapToOnsets(plan, onsets, floorMs) {
+    const sortedOnsets = [...onsets].sort((a, b) => a - b);
+    const snappedScenes = [];
+    let cumulativeMs = 0;
+    for (const scene of plan.scenes) {
+        const minDurMs = floorMs(scene);
+        // Target the floor itself (not the planned duration): we want the FIRST
+        // onset at or past where the VO actually ends, which both trims trailing
+        // silence (A) and re-anchors the cut to an absolute onset (B).
+        const targetEndMs = cumulativeMs + minDurMs;
+        const snappedEndMs = Math.max(cumulativeMs + minDurMs, (0, beatSnap_1.nearestOnsetMs)(targetEndMs, sortedOnsets, cumulativeMs + minDurMs));
+        const newDurationMs = snappedEndMs - cumulativeMs;
+        snappedScenes.push(newDurationMs === scene.durationMs ? scene : { ...scene, durationMs: newDurationMs });
+        cumulativeMs = snappedEndMs;
+    }
+    return { ...plan, scenes: snappedScenes, totalDurationMs: cumulativeMs };
+}
+/** Mode 2 — round each scene to the bar grid, never below the VO floor. */
+function resnapToBpmGrid(plan, bpm, floorMs) {
+    const barMs = (60000 / bpm) * BEATS_PER_BAR;
+    const snappedScenes = plan.scenes.map((scene) => {
+        const minMs = Math.max(barMs, (0, beatSnap_1.ceilToBar)(floorMs(scene), barMs));
+        const snapped = Math.max(minMs, (0, beatSnap_1.roundToBar)(floorMs(scene), barMs));
+        return snapped === scene.durationMs ? scene : { ...scene, durationMs: snapped };
+    });
+    const totalDurationMs = snappedScenes.reduce((sum, s) => sum + s.durationMs, 0);
+    return { ...plan, scenes: snappedScenes, totalDurationMs };
+}
+/** Mode 3 — no music: scene = max(VO + tail, MIN_SCENE_MS). Silence == tail. */
+function resnapNoMusic(plan, floorMs, minSceneMs) {
+    const snappedScenes = plan.scenes.map((scene) => {
+        const snapped = Math.max(floorMs(scene), minSceneMs);
+        return snapped === scene.durationMs ? scene : { ...scene, durationMs: snapped };
+    });
+    const totalDurationMs = snappedScenes.reduce((sum, s) => sum + s.durationMs, 0);
+    return { ...plan, scenes: snappedScenes, totalDurationMs };
+}

package/lib/services/aiGen/providers/alibaba/alibaba.d.ts

@@ -45,6 +45,6 @@ export declare class AlibabaService extends BaseAiGenProviderService {
      * and text2image/image-synthesis (legacy Qwen).
      */
     private generateImageAsync;
-    getCreditUsed({ modelKey, resolution, aspectRatio, duration, multiClip, numImages, }: CreditUsageParams): number;
+    getCreditUsed({ modelKey, resolution, aspectRatio, duration, multiClip, numImages, creditFloor, }: CreditUsageParams): number;
 }
 //# sourceMappingURL=alibaba.d.ts.map

package/lib/services/aiGen/providers/alibaba/alibaba.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alibaba.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/alibaba/alibaba.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AA2DlB,qBAAa,cAAe,SAAQ,wBAAwB;IAE1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;;IAiBjC;;;;OAIG;YACW,OAAO;IAwBf,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAiE3B,gBAAgB,CAAC,EACrB,IAAI,EACJ,cAAc,EACd,cAAyB,EACzB,QAAQ,GACT,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0EjD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IA4EjC;;;OAGG;YACW,iBAAiB;IAuC/B;;;OAGG;YACW,kBAAkB;IAuDhC,aAAa,CAAC,EACZ,QAAQ,EACR,UAAU,EACV,WAAW,EACX,QAAQ,EACR,SAAiB,EACjB,SAAa,GACd,EAAE,iBAAiB,GAAG,MAAM;CAmB9B"}
+{"version":3,"file":"alibaba.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/alibaba/alibaba.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AA2DlB,qBAAa,cAAe,SAAQ,wBAAwB;IAE1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;;IAiBjC;;;;OAIG;YACW,OAAO;IAwBf,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAiE3B,gBAAgB,CAAC,EACrB,IAAI,EACJ,cAAc,EACd,cAAyB,EACzB,QAAQ,GACT,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0EjD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IA4EjC;;;OAGG;YACW,iBAAiB;IAuC/B;;;OAGG;YACW,kBAAkB;IAuDhC,aAAa,CAAC,EACZ,QAAQ,EACR,UAAU,EACV,WAAW,EACX,QAAQ,EACR,SAAiB,EACjB,SAAa,EACb,WAAW,GACZ,EAAE,iBAAiB,GAAG,MAAM;CAoB9B"}

package/lib/services/aiGen/providers/alibaba/alibaba.js

@@ -368,11 +368,11 @@ class AlibabaService extends baseAiGenProvider_service_1.BaseAiGenProviderServic
         const urls = results.map((r) => r.url).filter((u) => !!u);
         return { urls, taskId };
     }
-    getCreditUsed({ modelKey, resolution, aspectRatio, duration, multiClip = false, numImages = 1, }) {
+    getCreditUsed({ modelKey, resolution, aspectRatio, duration, multiClip = false, numImages = 1, creditFloor, }) {
         const modelConfig = aiModels_1.aiModelConfigs[modelKey];
         // Image-gen — flat per-image cost (Kolors / Qwen-Image).
         if (modelConfig?.cost?.fixed !== undefined) {
-            return (0, utils_1.getCreditsFromCost)(modelConfig.cost.fixed * Math.max(1, numImages), !multiClip);
+            return (0, utils_1.getCreditsFromCost)(modelConfig.cost.fixed * Math.max(1, numImages), !multiClip, creditFloor);
         }
         const dimensions = (0, helpers_1.getAlibabaDimensions)(resolution, aspectRatio);
         const cost = modelConfig.cost?.table?.[dimensions]?.[duration];

package/lib/services/aiGen/providers/bytedance/bytedance.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bytedance.service.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/bytedance/bytedance.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AAUlB,qBAAa,gBAAiB,SAAQ,wBAAwB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CACsD;IAI9E,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,WAAW;IAIb,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAoL3B,gBAAgB,CAAC,EACrB,IAAI,EACJ,cAAc,EACd,cAAyB,GAC1B,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA4HjD,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM;CA0DjD"}
+{"version":3,"file":"bytedance.service.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/bytedance/bytedance.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AAUlB,qBAAa,gBAAiB,SAAQ,wBAAwB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CACsD;IAI9E,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,WAAW;IAIb,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAoL3B,gBAAgB,CAAC,EACrB,IAAI,EACJ,cAAc,EACd,cAAyB,GAC1B,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA4HjD,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM;CAyEjD"}

package/lib/services/aiGen/providers/bytedance/bytedance.service.js

@@ -270,6 +270,14 @@ class ByteDanceService extends baseAiGenProvider_service_1.BaseAiGenProviderServ
     }
     getCreditUsed(params) {
         const modelConfig = aiModels_1.aiModelConfigs[params.modelKey];
+        // Image-gen — flat per-image cost (Seedream). Must be handled before the
+        // token-based video logic below: image models carry no duration/resolution,
+        // so they'd otherwise fall through to the `return 10` fallback. Honors the
+        // image credit floor passed by the image controller.
+        if (modelConfig?.cost?.fixed !== undefined &&
+            modelConfig.type?.some((t) => t.endsWith("-to-image"))) {
+            return (0, helpers_2.getCreditsFromCost)(modelConfig.cost.fixed * Math.max(1, params.numImages ?? 1), !params.multiClip, params.creditFloor);
+        }
         // Seedance 2.0 prices on (resolution × whether the request includes a
         // video input), not on (audio toggle). Pick the matching per-1K rate.
         let per1KTokens;

package/lib/services/aiGen/providers/google/google.service.d.ts

@@ -46,6 +46,6 @@ export declare class GoogleService extends BaseAiGenProviderService {
      * ./googleMusic.
      */
     generateMusic(params: MusicGenerationParams): Promise<MusicGenerationResult>;
-    getCreditUsed({ modelKey, duration, resolution, multiClip, numImages, imageSize }: CreditUsageParams): number;
+    getCreditUsed({ modelKey, duration, resolution, multiClip, numImages, imageSize, creditFloor }: CreditUsageParams): number;
 }
 //# sourceMappingURL=google.service.d.ts.map

package/lib/services/aiGen/providers/google/google.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.service.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/google/google.service.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AAelB,qBAAa,aAAc,SAAQ,wBAAwB;IAKzD,OAAO,CAAC,EAAE,CAAc;IACxB,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAK;;IAQ/C;;;;;;;;;OASG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;IAoChC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAoCvB;;;;OAIG;YACW,kBAAkB;IA+B1B,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAiJ3B,gBAAgB,CAAC,EACrB,IAAI,EACJ,cAAc,EACd,cAAyB,GAC1B,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiH3C,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;YAiBnB,cAAc;IAwG5B;;;;;;OAMG;IACH;;;;OAIG;IACG,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAIjC,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAY,EAAE,UAAmB,EAAE,SAAiB,EAAE,SAAa,EAAE,SAAS,EAAE,EAAE,iBAAiB,GAAG,MAAM;CA8BvI"}
+{"version":3,"file":"google.service.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/google/google.service.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AAelB,qBAAa,aAAc,SAAQ,wBAAwB;IAKzD,OAAO,CAAC,EAAE,CAAc;IACxB,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAK;;IAQ/C;;;;;;;;;OASG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;IAoChC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAoCvB;;;;OAIG;YACW,kBAAkB;IA+B1B,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IA0M3B,gBAAgB,CAAC,EACrB,IAAI,EACJ,cAAc,EACd,cAAyB,GAC1B,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiH3C,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;YAiBnB,cAAc;IAwG5B;;;;;;OAMG;IACH;;;;OAIG;IACG,aAAa,CACjB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAIjC,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAY,EAAE,UAAmB,EAAE,SAAiB,EAAE,SAAa,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,iBAAiB,GAAG,MAAM;CA8BpJ"}

package/lib/services/aiGen/providers/google/google.service.js

@@ -236,20 +236,75 @@ class GoogleService extends baseAiGenProvider_service_1.BaseAiGenProviderService
                 }));
             }
         }
-        // Route this submit to a key with budget (priority order). The per-key
-        // caps are the single-key Tier-2 numbers in the model config; the
-        // model-level limiter already gated the aggregate (per-key × key count).
-        const keyEntry = await this.keyPool.pickForSubmit(modelId, modelConfig.requestPerMin ?? 0, modelConfig.requestPerDay ?? 0);
-        const operation = await this.withTransientRetry("generateVideos", () => keyEntry.client.models.generateVideos(request));
-        if (!operation || !operation.name) {
-            throw new Error("Failed to initiate video generation task");
+        // Submit with billing/auth failover across the key pool. Each key is a
+        // separate GCP project + billing account; if the highest-priority key's
+        // account is depleted (or its auth is revoked), retry the SAME submit on
+        // the next key and circuit-break the failed one so the rest of the pipeline
+        // routes around it (see googleKeyPool.markDepleted).
+        //
+        // Cost safety: failover only fires when generateVideos THREW — i.e. no
+        // operation name came back, so that account was NOT billed for this scene.
+        // A scene is therefore charged on at most ONE account; we never pay twice.
+        const tried = new Set();
+        let lastErr;
+        // Bounded by the number of keys: one submit attempt per account, worst case.
+        for (let attempt = 0; attempt < this.keyPool.size; attempt++) {
+            const keyEntry = await this.keyPool.pickForSubmit(modelId, modelConfig.requestPerMin ?? 0, modelConfig.requestPerDay ?? 0, tried);
+            // Same key came back (single key, or all others already tried) → no point
+            // looping further; do the attempt and let any error propagate normally.
+            const isLastUsableKey = tried.has(keyEntry.id);
+            tried.add(keyEntry.id);
+            try {
+                const operation = await this.withTransientRetry("generateVideos", () => keyEntry.client.models.generateVideos(request));
+                if (!operation || !operation.name) {
+                    throw new Error("Failed to initiate video generation task");
+                }
+                // Tag the task with the issuing key so poll + download re-select the
+                // same (project-scoped) client. Single-key pool → bare name (legacy).
+                return {
+                    task: (0, googleApiKeys_1.encodeVeoTask)(keyEntry.id, operation.name, this.keyPool.size),
+                    status: types_1.EVideoSceneStatus.TRIGGERED,
+                };
+            }
+            catch (err) {
+                lastErr = err;
+                const keyFailure = (0, googleErrors_1.classifyGoogleKeyHealth)(err);
+                // Not an account-level failure (e.g. content rejection, bad params,
+                // transient RPM 429) → don't burn other accounts on it; surface as-is.
+                if (!keyFailure)
+                    throw err;
+                // Account-level failure: circuit-break this key and try the next one.
+                // (No operation was created above, so this account wasn't charged.)
+                await this.keyPool.markDepleted(keyEntry.id, keyFailure.ttlSeconds, keyFailure.reason);
+                logger_1.logger.warn("Google Veo: key account failure — failing over", {
+                    modelKey: params.modelKey,
+                    keyId: keyEntry.id,
+                    kind: keyFailure.kind,
+                    attempt: attempt + 1,
+                    poolSize: this.keyPool.size,
+                });
+                if (isLastUsableKey || tried.size >= this.keyPool.size) {
+                    // No untried key left — EVERY Google billing account is down. This is
+                    // a platform-wide outage (the 2026-06-18 Veo-depletion class), not a
+                    // per-job blip: page Slack at the source with full context so on-call
+                    // sees it immediately rather than relying on downstream classification.
+                    logger_1.logger.error("Google Veo: ALL keys exhausted — every account failing over", {
+                        modelKey: params.modelKey,
+                        kind: keyFailure.kind,
+                        reason: keyFailure.reason,
+                        triedKeys: [...tried],
+                        poolSize: this.keyPool.size,
+                    });
+                    // Propagate so the job surfaces a friendly error + refunds, and the
+                    // job-level provider fallback can spill to another provider.
+                    throw err;
+                }
+                // else: loop and pickForSubmit will skip `tried` + circuit-broken keys.
+            }
         }
-        // Tag the task with the issuing key so poll + download re-select the same
-        // (project-scoped) client. Single-key pool → bare name (legacy format).
-        return {
-            task: (0, googleApiKeys_1.encodeVeoTask)(keyEntry.id, operation.name, this.keyPool.size),
-            status: types_1.EVideoSceneStatus.TRIGGERED,
-        };
+        // Loop exhausted without returning (shouldn't happen — the throw above
+        // covers the no-key-left case) — surface the last error.
+        throw lastErr ?? new Error("Failed to initiate video generation task");
     }
     async checkVideoStatus({ task, outputFilename, outputFilePath = "videos", }) {
         // Re-select the key that submitted this task (Veo operations are
@@ -472,7 +527,7 @@ class GoogleService extends baseAiGenProvider_service_1.BaseAiGenProviderService
     async generateMusic(params) {
         return (0, googleMusic_1.generateGoogleMusic)(params);
     }
-    getCreditUsed({ modelKey, duration = 8, resolution = "720p", multiClip = false, numImages = 1, imageSize }) {
+    getCreditUsed({ modelKey, duration = 8, resolution = "720p", multiClip = false, numImages = 1, imageSize, creditFloor }) {
         const modelConfig = aiModels_1.aiModelConfigs[modelKey];
         const cost = modelConfig.cost;
         const applyFloor = !multiClip;
@@ -481,11 +536,11 @@ class GoogleService extends baseAiGenProvider_service_1.BaseAiGenProviderService
         if (cost?.perImageSize) {
             const key = imageSize ?? "2K";
             const perImage = cost.perImageSize[key] ?? cost.fixed ?? 0;
-            return (0, helpers_1.getCreditsFromCost)(perImage * Math.max(1, numImages), applyFloor);
+            return (0, helpers_1.getCreditsFromCost)(perImage * Math.max(1, numImages), applyFloor, creditFloor);
         }
         // Image-gen flat per-image cost (Imagen / Nano Banana).
         if (cost?.fixed !== undefined) {
-            return (0, helpers_1.getCreditsFromCost)(cost.fixed * Math.max(1, numImages), applyFloor);
+            return (0, helpers_1.getCreditsFromCost)(cost.fixed * Math.max(1, numImages), applyFloor, creditFloor);
         }
         if (cost?.perResolution) {
             const ratePerSecond = cost.perResolution[resolution] ?? cost.perResolution["720p"];

package/lib/services/aiGen/providers/google/googleErrors.d.ts

@@ -10,4 +10,32 @@ import { UserFacingError } from "../../../../utils/errors";
  * error instead of raw provider JSON that pages Slack as a platform bug.
  */
 export declare function classifyGoogleApiError(err: any): UserFacingError | null;
+/** A key-level (billing / auth) failure that warrants failing over to the next
+ *  key in the pool and circuit-breaking the failed one for `ttlSeconds`. */
+export interface GoogleKeyHealthFailure {
+    /** "billing" | "auth" — the class of account problem, for logs + TTL choice. */
+    kind: "billing" | "auth";
+    /** Short human reason, persisted as the circuit-breaker value (Loki/debug). */
+    reason: string;
+    /** How long to skip this key before re-probing it. */
+    ttlSeconds: number;
+}
+/**
+ * Classifies whether a Veo *submit* failure is an ACCOUNT-LEVEL problem with
+ * THIS key (billing exhausted / auth revoked) — distinct from a transient
+ * per-minute rate limit or a content/validation error.
+ *
+ * Returns a failure descriptor when the pool should fail over to the next key
+ * and circuit-break this one; null otherwise (caller handles normally).
+ *
+ * IMPORTANT (cost safety): this is only consulted on a THROWN submit — i.e. no
+ * Veo operation was created, so the account was NOT billed. Failing over to a
+ * second billing account therefore cannot double-charge for the same job.
+ *
+ * Deliberately does NOT match a bare per-minute 429 / RESOURCE_EXHAUSTED with
+ * no billing signal: that's our own RPM cap, not an account outage, and the
+ * existing quota router + provider-fallback chain already handle it. Failing
+ * over on every RPM blip would needlessly drain the reserve account.
+ */
+export declare function classifyGoogleKeyHealth(err: any): GoogleKeyHealthFailure | null;
 //# sourceMappingURL=googleErrors.d.ts.map

package/lib/services/aiGen/providers/google/googleErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"googleErrors.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/google/googleErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2B,MAAM,0BAA0B,CAAC;AAEpF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,GAAG,IAAI,CAmHvE"}
+{"version":3,"file":"googleErrors.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/google/googleErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAGhB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,GAAG,IAAI,CA4IvE;AAED;4EAC4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,sBAAsB,GAAG,IAAI,CA4C/E"}

package/lib/services/aiGen/providers/google/googleErrors.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifyGoogleApiError = classifyGoogleApiError;
+exports.classifyGoogleKeyHealth = classifyGoogleKeyHealth;
 const errors_1 = require("../../../../utils/errors");
 /**
  * Maps `@google/genai` `ApiError` failures (whose message is a JSON string)
@@ -20,12 +21,25 @@ function classifyGoogleApiError(err) {
         const httpCode = inner.code;
         const status = inner.status;
         const msg = inner.message ?? raw;
+        // Billing depletion / billing-not-enabled. Veo surfaces this as
+        // RESOURCE_EXHAUSTED / 429 but with a billing-specific message ("Your
+        // prepayment credits are depleted… manage your project and billing") or as
+        // FAILED_PRECONDITION. This is an ACCOUNT problem, NOT a per-minute rate
+        // limit — give it the distinct ACCOUNT_QUOTA_EXCEEDED code (which DOES page
+        // Slack) and a SAFE message. Never echo the raw provider text: it tells the
+        // end user to go manage OUR Google AI Studio billing (the bug we're fixing).
+        const billingSignal = /prepayment credits? (?:are|is) depleted|credits? (?:are|is) depleted|\bbilling\b|free tier is not available|check your plan and billing/i.test(msg) || status === "FAILED_PRECONDITION";
+        if (billingSignal) {
+            return new errors_1.UserFacingError((0, errors_1.friendlyMessageForCode)(errors_1.USER_FACING_ERROR_CODES.ACCOUNT_QUOTA_EXCEEDED), errors_1.USER_FACING_ERROR_CODES.ACCOUNT_QUOTA_EXCEEDED);
+        }
         if (status === "RESOURCE_EXHAUSTED" || httpCode === 429) {
-            return new errors_1.UserFacingError(msg, errors_1.USER_FACING_ERROR_CODES.VIDEO_PROVIDER_RATE_LIMITED);
+            // Transient per-minute / per-day rate limit. Safe canned message — the raw
+            // provider text can still carry billing/console URLs we must not show.
+            return new errors_1.UserFacingError((0, errors_1.friendlyMessageForCode)(errors_1.USER_FACING_ERROR_CODES.VIDEO_PROVIDER_RATE_LIMITED), errors_1.USER_FACING_ERROR_CODES.VIDEO_PROVIDER_RATE_LIMITED);
         }
         // gRPC code 14 = UNAVAILABLE; Veo surfaces "high demand" failures with this.
         if (httpCode === 14 || /high demand/i.test(msg)) {
-            return new errors_1.UserFacingError(msg, errors_1.USER_FACING_ERROR_CODES.VIDEO_PROVIDER_HIGH_DEMAND);
+            return new errors_1.UserFacingError((0, errors_1.friendlyMessageForCode)(errors_1.USER_FACING_ERROR_CODES.VIDEO_PROVIDER_HIGH_DEMAND), errors_1.USER_FACING_ERROR_CODES.VIDEO_PROVIDER_HIGH_DEMAND);
         }
         // INVALID_ARGUMENT 400 — narrow match: only the specific "use case is
         // currently not supported" string, which Veo returns when our request
@@ -100,3 +114,62 @@ function classifyGoogleApiError(err) {
     }
     return null;
 }
+// Re-probe a billing-depleted key every 30 min: long enough to stop hammering a
+// dead account (and to route the whole pipeline onto the healthy key), short
+// enough that a top-up recovers within half an hour. Auth/permission problems
+// (revoked / not-yet-propagated key, disabled API) re-probe faster — they're
+// often a transient config rollout — at 15 min.
+const BILLING_CIRCUIT_TTL_S = 30 * 60;
+const AUTH_CIRCUIT_TTL_S = 15 * 60;
+/**
+ * Classifies whether a Veo *submit* failure is an ACCOUNT-LEVEL problem with
+ * THIS key (billing exhausted / auth revoked) — distinct from a transient
+ * per-minute rate limit or a content/validation error.
+ *
+ * Returns a failure descriptor when the pool should fail over to the next key
+ * and circuit-break this one; null otherwise (caller handles normally).
+ *
+ * IMPORTANT (cost safety): this is only consulted on a THROWN submit — i.e. no
+ * Veo operation was created, so the account was NOT billed. Failing over to a
+ * second billing account therefore cannot double-charge for the same job.
+ *
+ * Deliberately does NOT match a bare per-minute 429 / RESOURCE_EXHAUSTED with
+ * no billing signal: that's our own RPM cap, not an account outage, and the
+ * existing quota router + provider-fallback chain already handle it. Failing
+ * over on every RPM blip would needlessly drain the reserve account.
+ */
+function classifyGoogleKeyHealth(err) {
+    const raw = err?.message ?? "";
+    let httpCode;
+    let status;
+    let msg = raw;
+    try {
+        const parsed = JSON.parse(raw);
+        const inner = parsed.error ?? parsed;
+        httpCode = inner.code;
+        status = inner.status;
+        msg = inner.message ?? raw;
+    }
+    catch {
+        // Non-JSON message — match against the raw string below.
+    }
+    // Billing depletion. Veo surfaces this as RESOURCE_EXHAUSTED / 429 but with a
+    // billing-specific message ("Your prepayment credits are depleted… manage
+    // your project and billing"), OR as FAILED_PRECONDITION (free-tier/billing
+    // not enabled). Match the billing signal, NOT a bare 429.
+    if (/prepayment credits? (?:are|is) depleted|credits? (?:are|is) depleted|billing|free tier is not available|check your plan and billing|FAILED_PRECONDITION/i.test(msg) ||
+        status === "FAILED_PRECONDITION") {
+        return { kind: "billing", reason: `billing: ${msg.slice(0, 120)}`, ttlSeconds: BILLING_CIRCUIT_TTL_S };
+    }
+    // Auth / permission: key revoked, not yet propagated, API disabled, or the
+    // billing account suspended. These make every call on this key fail until
+    // fixed, so circuit-break + fail over rather than burn the whole job on it.
+    if (httpCode === 401 ||
+        httpCode === 403 ||
+        status === "PERMISSION_DENIED" ||
+        status === "UNAUTHENTICATED" ||
+        /API[_ ]key not valid|API_KEY_INVALID|permission denied|SERVICE_DISABLED|has not been used in project|consumer .* (?:suspended|disabled)/i.test(msg)) {
+        return { kind: "auth", reason: `auth: ${msg.slice(0, 120)}`, ttlSeconds: AUTH_CIRCUIT_TTL_S };
+    }
+    return null;
+}

package/lib/services/aiGen/providers/google/googleKeyPool.d.ts

@@ -28,6 +28,13 @@ declare class GoogleKeyPool {
     private readonly entries;
     constructor();
     get size(): number;
+    /** All key ids in priority order (for failover bookkeeping by the caller). */
+    get keyIds(): string[];
+    private depletedKey;
+    /** Circuit-break a key for `ttlSeconds` after an account-level submit failure. */
+    markDepleted(id: string, ttlSeconds: number, reason: string): Promise<void>;
+    /** Ids currently circuit-broken. Best-effort; empty on Redis trouble (fail-open). */
+    private depletedIds;
     /** The highest-priority key's client (index 0). */
     get primaryClient(): GoogleGenAI;
     /** Resolve a tagged task's key id back to its client (undefined if unknown). */
@@ -41,7 +48,7 @@ declare class GoogleKeyPool {
      * if Redis is down or all are at cap (the aggregate model-level gate should
      * have prevented the latter).
      */
-    pickForSubmit(modelId: string, baselineMin: number, baselineDay: number): Promise<KeyEntry>;
+    pickForSubmit(modelId: string, baselineMin: number, baselineDay: number, skip?: Set<string>): Promise<KeyEntry>;
     /** Best-effort increment of a key's per-day + per-minute routing counters. */
     private consume;
 }

package/lib/services/aiGen/providers/google/googleKeyPool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"googleKeyPool.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/google/googleKeyPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EACL,iBAAiB,EAKlB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;CACd;AAcD,cAAM,aAAa;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;;IA4BrC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,mDAAmD;IACnD,IAAI,aAAa,IAAI,WAAW,CAE/B;IAED,gFAAgF;IAChF,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS;IAK3D;;;;;;;;OAQG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IA2CpB,8EAA8E;YAChE,OAAO;CAUtB;AAID,sCAAsC;AACtC,wBAAgB,gBAAgB,IAAI,aAAa,CAGhD;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"googleKeyPool.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/google/googleKeyPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EACL,iBAAiB,EAKlB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;CACd;AAcD,cAAM,aAAa;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;;IA4BrC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,8EAA8E;IAC9E,IAAI,MAAM,IAAI,MAAM,EAAE,CAErB;IAUD,OAAO,CAAC,WAAW;IAInB,kFAAkF;IAC5E,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjF,qFAAqF;YACvE,WAAW;IAiBzB,mDAAmD;IACnD,IAAI,aAAa,IAAI,WAAW,CAE/B;IAED,gFAAgF;IAChF,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS;IAK3D;;;;;;;;OAQG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACjB,OAAO,CAAC,QAAQ,CAAC;IA2DpB,8EAA8E;YAChE,OAAO;CAUtB;AAID,sCAAsC;AACtC,wBAAgB,gBAAgB,IAAI,aAAa,CAGhD;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/lib/services/aiGen/providers/google/googleKeyPool.js

@@ -44,6 +44,59 @@ class GoogleKeyPool {
     get size() {
         return this.entries.length;
     }
+    /** All key ids in priority order (for failover bookkeeping by the caller). */
+    get keyIds() {
+        return this.entries.map((e) => e.id);
+    }
+    // ── Circuit breaker ────────────────────────────────────────────────────────
+    // A key whose BILLING is depleted (or whose auth is revoked) keeps returning
+    // the same error on every submit, but our quota counters (which only track
+    // OUR request rate) have no way to know that — so routing would keep sending
+    // jobs into the dead key. When generateVideo's submit fails with an account-
+    // level error it calls markDepleted(); pickForSubmit then skips the key until
+    // the TTL lapses and we re-probe it. The flag lives in Redis so every worker
+    // shares one view (and it auto-clears if Redis is wiped — fail-open).
+    depletedKey(id) {
+        return `gkpool:${id}:depleted`;
+    }
+    /** Circuit-break a key for `ttlSeconds` after an account-level submit failure. */
+    async markDepleted(id, ttlSeconds, reason) {
+        const client = redis_service_1.redis.getClient();
+        if (!client)
+            return; // no Redis → fail-open (caller still fails over in-loop)
+        try {
+            await client.set(this.depletedKey(id), reason, "EX", Math.max(60, ttlSeconds));
+            logger_1.logger.warn("googleKeyPool: key circuit-broken (skipping until re-probe)", {
+                keyId: id,
+                ttlSeconds,
+                reason,
+            });
+        }
+        catch (err) {
+            logger_1.logger.warn("googleKeyPool: markDepleted failed", {
+                keyId: id,
+                err: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    /** Ids currently circuit-broken. Best-effort; empty on Redis trouble (fail-open). */
+    async depletedIds() {
+        const out = new Set();
+        const client = redis_service_1.redis.getClient();
+        if (!client || this.entries.length <= 1)
+            return out;
+        try {
+            const flags = await Promise.all(this.entries.map((e) => client.get(this.depletedKey(e.id))));
+            this.entries.forEach((e, i) => {
+                if (flags[i])
+                    out.add(e.id);
+            });
+        }
+        catch {
+            // fail-open: treat all as healthy
+        }
+        return out;
+    }
     /** The highest-priority key's client (index 0). */
     get primaryClient() {
         return this.entries[0].client;
@@ -63,14 +116,25 @@ class GoogleKeyPool {
      * if Redis is down or all are at cap (the aggregate model-level gate should
      * have prevented the latter).
      */
-    async pickForSubmit(modelId, baselineMin, baselineDay) {
+    async pickForSubmit(modelId, baselineMin, baselineDay, skip) {
         if (this.entries.length === 1)
             return this.entries[0];
         const client = redis_service_1.redis.getClient();
-        if (!client)
-            return this.entries[0];
+        if (!client) {
+            // No Redis routing — honor the caller's failover skip set if possible.
+            return this.entries.find((e) => !skip?.has(e.id)) ?? this.entries[0];
+        }
+        // Exclude keys the caller already tried this job (failover) AND keys that
+        // are circuit-broken (depleted billing / revoked auth). If that leaves
+        // nothing, fall back to the full list so we always return *some* key.
+        const depleted = await this.depletedIds();
+        const excluded = new Set([...(skip ?? []), ...depleted]);
+        const pool = this.entries.filter((e) => !excluded.has(e.id));
+        const candidates = pool.length ? pool : this.entries;
+        if (candidates.length === 1)
+            return candidates[0];
         const date = utcDateKey();
-        for (const entry of this.entries) {
+        for (const entry of candidates) {
             try {
                 const perKeyMinLimit = (0, googleApiKeys_1.scaleLimitForTier)(baselineMin, entry.tier, "rpm");
                 const perKeyDayLimit = (0, googleApiKeys_1.scaleLimitForTier)(baselineDay, entry.tier, "rpd");
@@ -96,14 +160,18 @@ class GoogleKeyPool {
                 });
             }
         }
-        // All at cap / errored — use the primary and let Google's own 429 + the
-        // provider-fallback chain handle it.
-        logger_1.logger.warn("googleKeyPool: no key with headroom — using primary", {
+        // All at cap / errored — use the highest-priority *candidate* (already
+        // excludes failover-tried + circuit-broken keys) and let Google's own 429 +
+        // the provider-fallback chain handle it.
+        const fallback = candidates[0];
+        logger_1.logger.warn("googleKeyPool: no key with headroom — using best candidate", {
             modelId,
             poolSize: this.entries.length,
+            candidates: candidates.length,
+            keyId: fallback.id,
         });
-        await this.consume(this.entries[0], modelId, date).catch(() => undefined);
-        return this.entries[0];
+        await this.consume(fallback, modelId, date).catch(() => undefined);
+        return fallback;
     }
     /** Best-effort increment of a key's per-day + per-minute routing counters. */
     async consume(entry, modelId, date) {