@askalf/dario 6.0.32 → 6.0.34

package/dist/pool.d.ts

@@ -65,6 +65,54 @@ export interface UtilFreshness {
  * null rather than as an age of ~56 years since epoch.
  */
 export declare function utilFreshness(rl: RateLimitSnapshot, now: number): UtilFreshness;
+/** When an account's rate-limit window rolls over — see `rateLimitWindow`. */
+export interface RateLimitWindow {
+    /**
+     * Epoch ms the window resets at, from `anthropic-ratelimit-unified-reset`;
+     * null when no response on this account has stated one.
+     */
+    resetAt: number | null;
+    /** Ms until that reset, floored at 0 once it has passed; null when unknown. */
+    resetInMs: number | null;
+}
+/**
+ * The reset moment of the window an account's last reading was measured
+ * against (dario#1244). The snapshot has carried `reset` since the header was
+ * first parsed and routing has expired rejections on it since #1232, but no
+ * operator surface showed it: a seat read `status: rejected` with nothing
+ * saying until when, and `requestCount: 0` beside it (a 429 serves nothing,
+ * so the attempt was never counted) made the rejection look like one dario
+ * had made up. For a `rejected` seat this is when the rejection lifts; for
+ * an `allowed` one, when its representative window rolls. The header is
+ * epoch SECONDS; both fields here are milliseconds, like `expiresInMs` and
+ * `utilAgeMs`.
+ */
+export declare function rateLimitWindow(rl: RateLimitSnapshot, now: number): RateLimitWindow;
+/**
+ * One line for a log or a doctor row:
+ * `5h 104%, 7d 25%, claim five_hour, resets in 37m`.
+ */
+export declare function describeRateLimitSnapshot(rl: RateLimitSnapshot, now?: number): string;
+/**
+ * The identity of the rate-limit window a reading was measured against:
+ * its representative claim plus its reset second, or null when the reading
+ * states no live window (no reset, a reset that has passed, or no claim).
+ *
+ * Two seats that report the same key are one subscription under two aliases
+ * (dario#1244, "a few have the same issue"): two independent windows all but
+ * never share a reset second, and two readings of one window always do. The
+ * organization id is deliberately NOT part of the key — several seats can
+ * share an organization and still have their own windows — the window itself
+ * is the fact that matters for headroom.
+ */
+export declare function windowKey(rl: RateLimitSnapshot, now: number): string | null;
+/** For every seat, the other aliases whose last reading names the same live window. */
+export declare function windowPeers(accounts: readonly PoolAccount[], now: number): Map<string, string[]>;
+/**
+ * How many windows the pool really has: each measured live window once, and
+ * each seat without a live reading as its own (nothing says otherwise yet).
+ */
+export declare function distinctWindows(accounts: readonly PoolAccount[], now: number): number;
 export interface PoolAccount {
     alias: string;
     accessToken: string;
@@ -73,6 +121,32 @@ export interface PoolAccount {
     identity: AccountIdentity;
     rateLimit: RateLimitSnapshot;
     requestCount: number;
+    /**
+     * Upstream 429s this account has answered. `requestCount` counts requests
+     * the account SERVED, and a 429 served nothing — so a seat parked on its
+     * first attempt read `requestCount: 0` next to `status: rejected`, as if
+     * dario had rejected a seat it never called (dario#1244). This is the field
+     * that says it was tried.
+     */
+    rejectedCount: number;
+    /** Epoch ms of the most recent 429 on this account; undefined if never. */
+    lastRejectedAt?: number;
+    /**
+     * The Anthropic organization behind this seat's token, from the
+     * `anthropic-organization-id` response header: learned on the first
+     * response the seat serves, written to its record with the next token
+     * refresh (dario#1244 — a reading that surprises you is usually a token on
+     * an organization other than the one whose usage page you are looking at).
+     * Undefined until seen.
+     */
+    organizationId?: string;
+    /**
+     * Set when the current reading came from a peer instance (pool-sync.ts):
+     * that instance's id. Cleared by the next reading this instance takes
+     * itself. A seat parked on a peer's 429 shows `rejected` with
+     * `rejectedCount` unchanged — the 429 was the peer's — and this says so.
+     */
+    adoptedFrom?: string;
     /** Epoch ms of the OAuth grant (refresh-grant.ts); undefined when unknown. */
     grantedAt?: number;
     /**
@@ -236,6 +310,7 @@ export declare class AccountPool {
         deviceId: string;
         accountUuid: string;
         grantedAt?: number;
+        organizationId?: string;
     }): void;
     remove(alias: string): boolean;
     get size(): number;
@@ -304,7 +379,27 @@ export declare class AccountPool {
     /** Select the next-best account, excluding the given set of aliases. */
     selectExcluding(excluded: Set<string>, family?: string | null): PoolAccount | null;
     updateRateLimits(alias: string, snapshot: RateLimitSnapshot): void;
-    markRejected(alias: string, snapshot: RateLimitSnapshot): void;
+    /**
+     * Park `alias` on an upstream 429. Returns true when this takes a seat OUT
+     * of rotation — the first 429 of a window — and false when the seat was
+     * already parked inside a live window: the all-exhausted fallback in
+     * `select()` re-probes parked seats, so a pool with nothing left can 429
+     * the same seat many times, and only the transition is worth a log line.
+     */
+    markRejected(alias: string, snapshot: RateLimitSnapshot): boolean;
+    /**
+     * Record the organization a response said this seat belongs to. Returns
+     * true when it is news — the first observation, or a change (an alias
+     * re-granted on another organization) — so the caller persists it once.
+     */
+    noteOrganization(alias: string, organizationId: string): boolean;
+    /**
+     * Take a peer instance's reading of `alias` (pool-sync.ts): its snapshot
+     * replaces ours, `rejected` parks the seat on it. Counters are left alone
+     * — a request the peer served or a 429 it took are the peer's facts — and
+     * `adoptedFrom` records whose reading this is. False for an unknown alias.
+     */
+    adoptSnapshot(alias: string, snapshot: RateLimitSnapshot, rejected: boolean, from: string): boolean;
     updateTokens(alias: string, accessToken: string, refreshToken: string, expiresAt: number): void;
     get(alias: string): PoolAccount | undefined;
     all(): PoolAccount[];
@@ -327,6 +422,7 @@ export interface ReconcilableAccount {
     deviceId: string;
     accountUuid: string;
     grantedAt?: number;
+    organizationId?: string;
 }
 /**
  * Reconcile a live pool against the current on-disk account set: add or refresh

package/dist/pool.js

@@ -58,6 +58,97 @@ export function utilFreshness(rl, now) {
         utilAgeMs: lastObservedAt === null ? null : Math.max(0, now - lastObservedAt),
     };
 }
+/**
+ * The reset moment of the window an account's last reading was measured
+ * against (dario#1244). The snapshot has carried `reset` since the header was
+ * first parsed and routing has expired rejections on it since #1232, but no
+ * operator surface showed it: a seat read `status: rejected` with nothing
+ * saying until when, and `requestCount: 0` beside it (a 429 serves nothing,
+ * so the attempt was never counted) made the rejection look like one dario
+ * had made up. For a `rejected` seat this is when the rejection lifts; for
+ * an `allowed` one, when its representative window rolls. The header is
+ * epoch SECONDS; both fields here are milliseconds, like `expiresInMs` and
+ * `utilAgeMs`.
+ */
+export function rateLimitWindow(rl, now) {
+    if (!(rl.reset > 0))
+        return { resetAt: null, resetInMs: null };
+    const resetAt = rl.reset * 1000;
+    return { resetAt, resetInMs: Math.max(0, resetAt - now) };
+}
+/**
+ * One line for a log or a doctor row:
+ * `5h 104%, 7d 25%, claim five_hour, resets in 37m`.
+ */
+export function describeRateLimitSnapshot(rl, now = Date.now()) {
+    const pct = (n) => `${Math.round(n * 100)}%`;
+    const { resetInMs } = rateLimitWindow(rl, now);
+    const reset = resetInMs === null ? 'no reset stated'
+        : resetInMs === 0 ? 'window already rolled'
+            : `resets in ${formatDurationMs(resetInMs)}`;
+    return `5h ${pct(rl.util5h)}, 7d ${pct(rl.util7d)}, claim ${rl.claim}, ${reset}`;
+}
+function formatDurationMs(ms) {
+    const totalMins = Math.max(1, Math.round(ms / 60_000));
+    const h = Math.floor(totalMins / 60);
+    const m = totalMins % 60;
+    return h > 0 ? `${h}h ${m}m` : `${m}m`;
+}
+/**
+ * The identity of the rate-limit window a reading was measured against:
+ * its representative claim plus its reset second, or null when the reading
+ * states no live window (no reset, a reset that has passed, or no claim).
+ *
+ * Two seats that report the same key are one subscription under two aliases
+ * (dario#1244, "a few have the same issue"): two independent windows all but
+ * never share a reset second, and two readings of one window always do. The
+ * organization id is deliberately NOT part of the key — several seats can
+ * share an organization and still have their own windows — the window itself
+ * is the fact that matters for headroom.
+ */
+export function windowKey(rl, now) {
+    if (!(rl.reset > 0) || rl.reset * 1000 <= now)
+        return null;
+    if (!rl.claim || rl.claim === 'unknown')
+        return null;
+    return `${rl.claim}@${rl.reset}`;
+}
+/** For every seat, the other aliases whose last reading names the same live window. */
+export function windowPeers(accounts, now) {
+    const byKey = new Map();
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        if (!k)
+            continue;
+        const list = byKey.get(k);
+        if (list)
+            list.push(a.alias);
+        else
+            byKey.set(k, [a.alias]);
+    }
+    const out = new Map();
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        out.set(a.alias, k ? (byKey.get(k) ?? []).filter((alias) => alias !== a.alias) : []);
+    }
+    return out;
+}
+/**
+ * How many windows the pool really has: each measured live window once, and
+ * each seat without a live reading as its own (nothing says otherwise yet).
+ */
+export function distinctWindows(accounts, now) {
+    const keys = new Set();
+    let unmeasured = 0;
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        if (k)
+            keys.add(k);
+        else
+            unmeasured++;
+    }
+    return keys.size + unmeasured;
+}
 /**
  * Cool-down schedule after auth failures. First failure: 60s. Each
  * consecutive failure doubles the window up to 30 minutes. Cleared
@@ -318,21 +409,38 @@ export class AccountPool {
     }
     add(alias, opts) {
         const existing = this.accounts.get(alias);
+        // A record whose grantedAt differs from the live entry's is a NEW grant
+        // under this alias — a re-login, possibly on a different organization
+        // with its own windows. The live state describes the old credential (its
+        // rejection and reading, its auth streak, its identity), so it starts
+        // fresh (dario#1244): before this, a seat re-granted to clear
+        // `auth-cooldown` stayed cooling until the old streak's timer ran out,
+        // and one re-granted on another organization stayed parked on the old
+        // organization's window. A reconcile carrying the same grant — a token
+        // refresh, an admin change to another seat, a peer instance's rotation in
+        // HA — keeps the live state as before. So does a record with no grantedAt
+        // at all: it cannot be told apart from the same grant.
+        const regranted = existing !== undefined && opts.grantedAt !== undefined && opts.grantedAt !== existing.grantedAt;
+        const keep = regranted ? undefined : existing;
         this.accounts.set(alias, {
             alias,
             accessToken: opts.accessToken,
             refreshToken: opts.refreshToken,
             expiresAt: opts.expiresAt,
-            grantedAt: opts.grantedAt ?? existing?.grantedAt,
-            identity: existing?.identity ?? {
+            grantedAt: opts.grantedAt ?? keep?.grantedAt,
+            organizationId: opts.organizationId ?? keep?.organizationId,
+            adoptedFrom: keep?.adoptedFrom,
+            identity: keep?.identity ?? {
                 deviceId: opts.deviceId,
                 accountUuid: opts.accountUuid,
                 sessionId: randomUUID(),
             },
-            rateLimit: existing?.rateLimit ?? { ...EMPTY_SNAPSHOT },
-            requestCount: existing?.requestCount ?? 0,
-            lastAuthFailureAt: existing?.lastAuthFailureAt,
-            consecutiveAuthFailures: existing?.consecutiveAuthFailures ?? 0,
+            rateLimit: keep?.rateLimit ?? { ...EMPTY_SNAPSHOT },
+            requestCount: keep?.requestCount ?? 0,
+            rejectedCount: keep?.rejectedCount ?? 0,
+            lastRejectedAt: keep?.lastRejectedAt,
+            lastAuthFailureAt: keep?.lastAuthFailureAt,
+            consecutiveAuthFailures: keep?.consecutiveAuthFailures ?? 0,
         });
     }
     remove(alias) {
@@ -547,13 +655,53 @@ export class AccountPool {
         if (!account)
             return;
         account.rateLimit = snapshot;
+        account.adoptedFrom = undefined;
         account.requestCount++;
     }
+    /**
+     * Park `alias` on an upstream 429. Returns true when this takes a seat OUT
+     * of rotation — the first 429 of a window — and false when the seat was
+     * already parked inside a live window: the all-exhausted fallback in
+     * `select()` re-probes parked seats, so a pool with nothing left can 429
+     * the same seat many times, and only the transition is worth a log line.
+     */
     markRejected(alias, snapshot) {
         const account = this.accounts.get(alias);
         if (!account)
-            return;
+            return false;
+        const now = snapshot.updatedAt || Date.now();
+        const wasParked = account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now);
         account.rateLimit = { ...snapshot, status: 'rejected' };
+        account.adoptedFrom = undefined;
+        account.rejectedCount++;
+        account.lastRejectedAt = now;
+        return !wasParked;
+    }
+    /**
+     * Record the organization a response said this seat belongs to. Returns
+     * true when it is news — the first observation, or a change (an alias
+     * re-granted on another organization) — so the caller persists it once.
+     */
+    noteOrganization(alias, organizationId) {
+        const account = this.accounts.get(alias);
+        if (!account || !organizationId || account.organizationId === organizationId)
+            return false;
+        account.organizationId = organizationId;
+        return true;
+    }
+    /**
+     * Take a peer instance's reading of `alias` (pool-sync.ts): its snapshot
+     * replaces ours, `rejected` parks the seat on it. Counters are left alone
+     * — a request the peer served or a 429 it took are the peer's facts — and
+     * `adoptedFrom` records whose reading this is. False for an unknown alias.
+     */
+    adoptSnapshot(alias, snapshot, rejected, from) {
+        const account = this.accounts.get(alias);
+        if (!account)
+            return false;
+        account.rateLimit = rejected ? { ...snapshot, status: 'rejected' } : { ...snapshot };
+        account.adoptedFrom = from;
+        return true;
     }
     updateTokens(alias, accessToken, refreshToken, expiresAt) {
         const account = this.accounts.get(alias);
@@ -674,6 +822,7 @@ export function reconcilePoolAccounts(pool, accounts) {
             deviceId: a.deviceId,
             accountUuid: a.accountUuid,
             grantedAt: a.grantedAt,
+            organizationId: a.organizationId,
         });
     }
     for (const existing of pool.all()) {

package/dist/proxy.d.ts

@@ -345,12 +345,25 @@ interface ProxyOptions {
      * `--pool-strategy` / `DARIO_POOL_STRATEGY` / config `pool.strategy`.
      */
     poolStrategy?: string;
+    /**
+     * Share rate-limit readings and sticky bindings with other instances
+     * through the refresh-lock service (pool-sync.ts). Needs
+     * `DARIO_REFRESH_LOCK_URL` / `DARIO_REFRESH_LOCK_TOKEN`. Off by default.
+     */
+    poolSharedState?: boolean;
+    /** How often to pull peers' readings, ms. Default 2000. */
+    poolSharedStateIntervalMs?: number;
     /** Max concurrent in-flight requests. Default 10. dario#80. */
     maxConcurrent?: number;
     /** Max requests buffered waiting for a concurrency slot. Default 128. dario#80. */
     maxQueued?: number;
     /** Max ms a queued request waits before it times out with 504. Default 60000. dario#80. */
     queueTimeoutMs?: number;
+    /**
+     * Max in-flight requests per consumer (`x-dario-consumer` header). A
+     * consumer at its cap waits while others keep flowing. 0 / unset = off.
+     */
+    maxConcurrentPerConsumer?: number;
     /**
      * Max ms before the upstream fetch is aborted. Default 300000 (5 min,
      * matching the Anthropic SDK). Injectable so tests can exercise the
@@ -545,6 +558,7 @@ export interface ProxyLogEntry {
     claim?: string;
     bucket?: string;
     account?: string;
+    consumer?: string;
     client?: string;
     preserve_tools?: boolean;
     stream?: boolean;