@askalf/dario 6.0.33 → 6.0.35

package/dist/pool.d.ts

@@ -93,6 +93,26 @@ export declare function rateLimitWindow(rl: RateLimitSnapshot, now: number): Rat
  * `5h 104%, 7d 25%, claim five_hour, resets in 37m`.
  */
 export declare function describeRateLimitSnapshot(rl: RateLimitSnapshot, now?: number): string;
+/**
+ * The identity of the rate-limit window a reading was measured against:
+ * its representative claim plus its reset second, or null when the reading
+ * states no live window (no reset, a reset that has passed, or no claim).
+ *
+ * Two seats that report the same key are one subscription under two aliases
+ * (dario#1244, "a few have the same issue"): two independent windows all but
+ * never share a reset second, and two readings of one window always do. The
+ * organization id is deliberately NOT part of the key — several seats can
+ * share an organization and still have their own windows — the window itself
+ * is the fact that matters for headroom.
+ */
+export declare function windowKey(rl: RateLimitSnapshot, now: number): string | null;
+/** For every seat, the other aliases whose last reading names the same live window. */
+export declare function windowPeers(accounts: readonly PoolAccount[], now: number): Map<string, string[]>;
+/**
+ * How many windows the pool really has: each measured live window once, and
+ * each seat without a live reading as its own (nothing says otherwise yet).
+ */
+export declare function distinctWindows(accounts: readonly PoolAccount[], now: number): number;
 export interface PoolAccount {
     alias: string;
     accessToken: string;
@@ -111,6 +131,22 @@ export interface PoolAccount {
     rejectedCount: number;
     /** Epoch ms of the most recent 429 on this account; undefined if never. */
     lastRejectedAt?: number;
+    /**
+     * The Anthropic organization behind this seat's token, from the
+     * `anthropic-organization-id` response header: learned on the first
+     * response the seat serves, written to its record with the next token
+     * refresh (dario#1244 — a reading that surprises you is usually a token on
+     * an organization other than the one whose usage page you are looking at).
+     * Undefined until seen.
+     */
+    organizationId?: string;
+    /**
+     * Set when the current reading came from a peer instance (pool-sync.ts):
+     * that instance's id. Cleared by the next reading this instance takes
+     * itself. A seat parked on a peer's 429 shows `rejected` with
+     * `rejectedCount` unchanged — the 429 was the peer's — and this says so.
+     */
+    adoptedFrom?: string;
     /** Epoch ms of the OAuth grant (refresh-grant.ts); undefined when unknown. */
     grantedAt?: number;
     /**
@@ -194,6 +230,22 @@ export declare function reportedAccountStatus(account: PoolAccount, now?: number
 export declare function accountIneligibility(account: PoolAccount, now?: number): AccountIneligibility | null;
 /** Boolean form of `accountIneligibility` — the router's eligibility filter. */
 export declare function isAccountEligible(account: PoolAccount, now?: number): boolean;
+/**
+ * A seat parked on a 429 whose stated window has not rolled yet — the one
+ * state the router must never re-probe: the 429 named the reset, the clock
+ * has not reached it, and a probe can only 429 again. A rejection with no
+ * stated reset is NOT this: with nothing to expire, asking is the only way
+ * back, so it stays probeable (dario#1244).
+ */
+export declare function isParkedInLiveWindow(account: PoolAccount, now?: number): boolean;
+/**
+ * The operator's next step for one seat, next to `status` on both listings
+ * (dario#1244 — "do I have to re-login?" should not need the docs table).
+ * `wait`: the seat comes back on its own (a live rate-limit window, or a
+ * single auth blip cooling down). `regrant`: an auth-failure streak, which is
+ * a dead refresh token. `none`: nothing to do.
+ */
+export declare function accountAction(account: PoolAccount, now?: number): 'none' | 'wait' | 'regrant';
 export interface PoolStatus {
     accounts: number;
     healthy: number;
@@ -274,6 +326,7 @@ export declare class AccountPool {
         deviceId: string;
         accountUuid: string;
         grantedAt?: number;
+        organizationId?: string;
     }): void;
     remove(alias: string): boolean;
     get size(): number;
@@ -304,6 +357,18 @@ export declare class AccountPool {
      * unified-buckets-only headroom — same behavior as before this PR.
      */
     select(family?: string | null): PoolAccount | null;
+    /**
+     * When EVERY seat is parked inside a live rate-limit window: the epoch ms
+     * the earliest window rolls, i.e. the moment the pool can serve again
+     * without a probe. Null otherwise — including a pool mixing parked seats
+     * with an auth-cooling or token-expired one, which is not "all seats over
+     * their windows" and must not be reported (or cooled) as if it were; those
+     * pools stay on the existing unavailable handling (dario#1244, and the
+     * review on dario#1254 that caught the mixed case).
+     */
+    parkedUntil(now?: number): number | null;
+    /** Seats currently parked inside a live window (dario#1244). */
+    parkedCount(now?: number): number;
     /**
      * Select with session stickiness. If `stickyKey` is already bound to a
      * healthy account (not rejected, token not near expiry, headroom > 2%),
@@ -350,6 +415,19 @@ export declare class AccountPool {
      * the same seat many times, and only the transition is worth a log line.
      */
     markRejected(alias: string, snapshot: RateLimitSnapshot): boolean;
+    /**
+     * Record the organization a response said this seat belongs to. Returns
+     * true when it is news — the first observation, or a change (an alias
+     * re-granted on another organization) — so the caller persists it once.
+     */
+    noteOrganization(alias: string, organizationId: string): boolean;
+    /**
+     * Take a peer instance's reading of `alias` (pool-sync.ts): its snapshot
+     * replaces ours, `rejected` parks the seat on it. Counters are left alone
+     * — a request the peer served or a 429 it took are the peer's facts — and
+     * `adoptedFrom` records whose reading this is. False for an unknown alias.
+     */
+    adoptSnapshot(alias: string, snapshot: RateLimitSnapshot, rejected: boolean, from: string): boolean;
     updateTokens(alias: string, accessToken: string, refreshToken: string, expiresAt: number): void;
     get(alias: string): PoolAccount | undefined;
     all(): PoolAccount[];
@@ -372,6 +450,7 @@ export interface ReconcilableAccount {
     deviceId: string;
     accountUuid: string;
     grantedAt?: number;
+    organizationId?: string;
 }
 /**
  * Reconcile a live pool against the current on-disk account set: add or refresh

package/dist/pool.js

@@ -94,6 +94,61 @@ function formatDurationMs(ms) {
     const m = totalMins % 60;
     return h > 0 ? `${h}h ${m}m` : `${m}m`;
 }
+/**
+ * The identity of the rate-limit window a reading was measured against:
+ * its representative claim plus its reset second, or null when the reading
+ * states no live window (no reset, a reset that has passed, or no claim).
+ *
+ * Two seats that report the same key are one subscription under two aliases
+ * (dario#1244, "a few have the same issue"): two independent windows all but
+ * never share a reset second, and two readings of one window always do. The
+ * organization id is deliberately NOT part of the key — several seats can
+ * share an organization and still have their own windows — the window itself
+ * is the fact that matters for headroom.
+ */
+export function windowKey(rl, now) {
+    if (!(rl.reset > 0) || rl.reset * 1000 <= now)
+        return null;
+    if (!rl.claim || rl.claim === 'unknown')
+        return null;
+    return `${rl.claim}@${rl.reset}`;
+}
+/** For every seat, the other aliases whose last reading names the same live window. */
+export function windowPeers(accounts, now) {
+    const byKey = new Map();
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        if (!k)
+            continue;
+        const list = byKey.get(k);
+        if (list)
+            list.push(a.alias);
+        else
+            byKey.set(k, [a.alias]);
+    }
+    const out = new Map();
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        out.set(a.alias, k ? (byKey.get(k) ?? []).filter((alias) => alias !== a.alias) : []);
+    }
+    return out;
+}
+/**
+ * How many windows the pool really has: each measured live window once, and
+ * each seat without a live reading as its own (nothing says otherwise yet).
+ */
+export function distinctWindows(accounts, now) {
+    const keys = new Set();
+    let unmeasured = 0;
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        if (k)
+            keys.add(k);
+        else
+            unmeasured++;
+    }
+    return keys.size + unmeasured;
+}
 /**
  * Cool-down schedule after auth failures. First failure: 60s. Each
  * consecutive failure doubles the window up to 30 minutes. Cleared
@@ -195,6 +250,31 @@ export function accountIneligibility(account, now = Date.now()) {
 export function isAccountEligible(account, now = Date.now()) {
     return accountIneligibility(account, now) === null;
 }
+/**
+ * A seat parked on a 429 whose stated window has not rolled yet — the one
+ * state the router must never re-probe: the 429 named the reset, the clock
+ * has not reached it, and a probe can only 429 again. A rejection with no
+ * stated reset is NOT this: with nothing to expire, asking is the only way
+ * back, so it stays probeable (dario#1244).
+ */
+export function isParkedInLiveWindow(account, now = Date.now()) {
+    const rl = account.rateLimit;
+    return rl.status === 'rejected' && rl.reset > 0 && rl.reset * 1000 > now;
+}
+/**
+ * The operator's next step for one seat, next to `status` on both listings
+ * (dario#1244 — "do I have to re-login?" should not need the docs table).
+ * `wait`: the seat comes back on its own (a live rate-limit window, or a
+ * single auth blip cooling down). `regrant`: an auth-failure streak, which is
+ * a dead refresh token. `none`: nothing to do.
+ */
+export function accountAction(account, now = Date.now()) {
+    if (isInAuthCooldown(account, now))
+        return account.consecutiveAuthFailures >= 2 ? 'regrant' : 'wait';
+    if (isParkedInLiveWindow(account, now))
+        return 'wait';
+    return 'none';
+}
 /**
  * Resolve the pool strategy from an explicit value (CLI flag / config file,
  * already precedence-merged by the caller) with `DARIO_POOL_STRATEGY` as
@@ -373,6 +453,8 @@ export class AccountPool {
             refreshToken: opts.refreshToken,
             expiresAt: opts.expiresAt,
             grantedAt: opts.grantedAt ?? keep?.grantedAt,
+            organizationId: opts.organizationId ?? keep?.organizationId,
+            adoptedFrom: keep?.adoptedFrom,
             identity: keep?.identity ?? {
                 deviceId: opts.deviceId,
                 accountUuid: opts.accountUuid,
@@ -458,20 +540,45 @@ export class AccountPool {
             }
             return pickMaxHeadroom(eligible, family);
         }
-        // All accounts exhausted — return the one with the earliest reset.
-        // Auth-cooldown'd accounts are excluded from this fallback too: we
-        // know upstream rejected their tokens, so picking them on rate-limit
-        // grounds wouldn't help. Better to return null and let the caller
-        // surface "no account available" than to hand back a dead account.
-        const withReset = all.filter(a => a.rateLimit.reset > 0 && !isInAuthCooldown(a, now));
-        if (withReset.length > 0) {
-            return withReset.reduce((a, b) => a.rateLimit.reset < b.rateLimit.reset ? a : b);
-        }
-        // No rate-limit data at all — least-used first, still skipping cool-downs.
-        const usable = all.filter(a => !isInAuthCooldown(a, now));
-        if (usable.length === 0)
+        // No seat is eligible. A seat parked inside a live window is not
+        // re-probed: its 429 named the reset, the clock has not reached it, and a
+        // probe there is one upstream round trip that can only 429 again — on the
+        // dario#1244 gateway that was 500 probes of one seat inside a single
+        // window, `rejectedCount` climbing by one each time and the operator
+        // reading it as a seat that needed a re-login. The caller reads
+        // `parkedUntil()` and answers the client itself; the seat returns on its
+        // own when the window rolls (`rateLimitWindowPassed` makes it eligible
+        // again). Auth-cooldown seats are skipped for the same reason: upstream
+        // already rejected their tokens.
+        //
+        // What is left — a rejection with no stated reset (nothing to expire, so
+        // asking is the only way back) or an expiring token — is tried least-used
+        // first, as before.
+        const probeable = all.filter(a => !isInAuthCooldown(a, now) && !isParkedInLiveWindow(a, now));
+        if (probeable.length === 0)
             return null;
-        return usable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
+        return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
+    }
+    /**
+     * When EVERY seat is parked inside a live rate-limit window: the epoch ms
+     * the earliest window rolls, i.e. the moment the pool can serve again
+     * without a probe. Null otherwise — including a pool mixing parked seats
+     * with an auth-cooling or token-expired one, which is not "all seats over
+     * their windows" and must not be reported (or cooled) as if it were; those
+     * pools stay on the existing unavailable handling (dario#1244, and the
+     * review on dario#1254 that caught the mixed case).
+     */
+    parkedUntil(now = Date.now()) {
+        if (this.accounts.size === 0)
+            return null;
+        const all = [...this.accounts.values()];
+        if (!all.every(a => isParkedInLiveWindow(a, now)))
+            return null;
+        return Math.min(...all.map(a => a.rateLimit.reset * 1000));
+    }
+    /** Seats currently parked inside a live window (dario#1244). */
+    parkedCount(now = Date.now()) {
+        return [...this.accounts.values()].filter(a => isParkedInLiveWindow(a, now)).length;
     }
     /**
      * Select with session stickiness. If `stickyKey` is already bound to a
@@ -588,8 +695,13 @@ export class AccountPool {
             }
             return pickMaxHeadroom(eligible, family);
         }
-        if (candidates.length > 0) {
-            return candidates.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
+        // Mid-flight: the seats a 429 could still hand this request to. A seat
+        // parked inside a live window is not one of them — on the dario#1244
+        // gateway every request walked all six parked seats, six guaranteed 429s
+        // a request. Cool-downs are skipped for the same reason.
+        const probeable = candidates.filter(a => !isInAuthCooldown(a, now) && !isParkedInLiveWindow(a, now));
+        if (probeable.length > 0) {
+            return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
         }
         return null;
     }
@@ -598,6 +710,7 @@ export class AccountPool {
         if (!account)
             return;
         account.rateLimit = snapshot;
+        account.adoptedFrom = undefined;
         account.requestCount++;
     }
     /**
@@ -614,10 +727,37 @@ export class AccountPool {
         const now = snapshot.updatedAt || Date.now();
         const wasParked = account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now);
         account.rateLimit = { ...snapshot, status: 'rejected' };
+        account.adoptedFrom = undefined;
         account.rejectedCount++;
         account.lastRejectedAt = now;
         return !wasParked;
     }
+    /**
+     * Record the organization a response said this seat belongs to. Returns
+     * true when it is news — the first observation, or a change (an alias
+     * re-granted on another organization) — so the caller persists it once.
+     */
+    noteOrganization(alias, organizationId) {
+        const account = this.accounts.get(alias);
+        if (!account || !organizationId || account.organizationId === organizationId)
+            return false;
+        account.organizationId = organizationId;
+        return true;
+    }
+    /**
+     * Take a peer instance's reading of `alias` (pool-sync.ts): its snapshot
+     * replaces ours, `rejected` parks the seat on it. Counters are left alone
+     * — a request the peer served or a 429 it took are the peer's facts — and
+     * `adoptedFrom` records whose reading this is. False for an unknown alias.
+     */
+    adoptSnapshot(alias, snapshot, rejected, from) {
+        const account = this.accounts.get(alias);
+        if (!account)
+            return false;
+        account.rateLimit = rejected ? { ...snapshot, status: 'rejected' } : { ...snapshot };
+        account.adoptedFrom = from;
+        return true;
+    }
     updateTokens(alias, accessToken, refreshToken, expiresAt) {
         const account = this.accounts.get(alias);
         if (!account)
@@ -737,6 +877,7 @@ export function reconcilePoolAccounts(pool, accounts) {
             deviceId: a.deviceId,
             accountUuid: a.accountUuid,
             grantedAt: a.grantedAt,
+            organizationId: a.organizationId,
         });
     }
     for (const existing of pool.all()) {

package/dist/proxy.d.ts

@@ -345,12 +345,25 @@ interface ProxyOptions {
      * `--pool-strategy` / `DARIO_POOL_STRATEGY` / config `pool.strategy`.
      */
     poolStrategy?: string;
+    /**
+     * Share rate-limit readings and sticky bindings with other instances
+     * through the refresh-lock service (pool-sync.ts). Needs
+     * `DARIO_REFRESH_LOCK_URL` / `DARIO_REFRESH_LOCK_TOKEN`. Off by default.
+     */
+    poolSharedState?: boolean;
+    /** How often to pull peers' readings, ms. Default 2000. */
+    poolSharedStateIntervalMs?: number;
     /** Max concurrent in-flight requests. Default 10. dario#80. */
     maxConcurrent?: number;
     /** Max requests buffered waiting for a concurrency slot. Default 128. dario#80. */
     maxQueued?: number;
     /** Max ms a queued request waits before it times out with 504. Default 60000. dario#80. */
     queueTimeoutMs?: number;
+    /**
+     * Max in-flight requests per consumer (`x-dario-consumer` header). A
+     * consumer at its cap waits while others keep flowing. 0 / unset = off.
+     */
+    maxConcurrentPerConsumer?: number;
     /**
      * Max ms before the upstream fetch is aborted. Default 300000 (5 min,
      * matching the Anthropic SDK). Injectable so tests can exercise the
@@ -545,6 +558,7 @@ export interface ProxyLogEntry {
     claim?: string;
     bucket?: string;
     account?: string;
+    consumer?: string;
     client?: string;
     preserve_tools?: boolean;
     stream?: boolean;