@askalf/dario 6.0.37 → 6.0.39

package/dist/codex-backend.js

@@ -24,6 +24,7 @@
 import { createHash } from 'node:crypto';
 import { anthropicToResponsesRequest, anthropicUsageFromResponses, createResponsesSSEParser, formatResponsesAnthropicSSE, createAnthropicMessageAssembler, responsesStreamToAnthropicSSE, } from './anthropic-responses-translate.js';
 import { resolveClaudeTarget } from './claude-model.js';
+import { parseEffortSuffix } from './effort.js';
 import { BAKED_BASE_MODELS } from './model-catalog.js';
 import { parseRetryAfterMs } from './provider-cooldown.js';
 export const CODEX_BACKEND_BASE_URL = process.env.DARIO_CODEX_BASE_URL || 'https://chatgpt.com/backend-api/codex';
@@ -121,20 +122,28 @@ export function isCodexModel(model, slugs) {
     const m = model.toLowerCase();
     return slugs.some(s => s.toLowerCase() === m);
 }
-/**
- * A pool-fallback value may name a CHAIN — `gpt-5.6-sol,claude-sonnet-5` — and
- * each provider takes the first entry it can actually serve. These two pickers
- * are the whole selection rule, kept pure so it is testable without a socket.
- *
- * Reading the chain from both ends is what makes failover SYMMETRIC in v6.0.0:
- * `pickCodexFallback` catches a drained Claude pool, `pickClaudeFallback`
- * catches a ChatGPT subscription that is rate-limited or down. Neither
- * subscription hitting its ceiling can take the whole deployment dark on its
- * own. A single-entry chain keeps the pre-6.0 meaning exactly, so configs
- * written before this release behave identically.
- */
 export function pickCodexFallback(models, slugs) {
-    return models.find(m => isCodexModel(m, slugs)) ?? null;
+    for (const m of models) {
+        // The name AS WRITTEN wins, and only a name that matches no slug at all is
+        // re-read as `model:effort` — the same two-pass rule resolveClaudeTarget
+        // uses for chain entries (dario#1161), so a slug that genuinely ends in an
+        // effort word keeps priority over the suffix reading.
+        //
+        // Without the second pass a codex chain entry carrying the very suffix the
+        // Claude half accepts (`gpt-5.6-terra:high`) matched nothing and was
+        // silently SKIPPED: no error, no log, just a failover the operator
+        // configured that never fired (dario#1260).
+        //
+        // Per entry rather than two passes over the whole list, because the chain is
+        // priority-ordered and a full as-written sweep would let a later entry
+        // overtake an earlier one purely for being spelled without a suffix.
+        if (isCodexModel(m, slugs))
+            return { model: m };
+        const eff = parseEffortSuffix(m);
+        if (eff.effort && isCodexModel(eff.model, slugs))
+            return { model: eff.model, effort: eff.effort };
+    }
+    return null;
 }
 export function pickClaudeFallback(models, slugs, bases = BAKED_BASE_MODELS, resolve) {
     // "Not a codex slug" is NOT the same as "the Claude pool can serve it". A
@@ -746,7 +755,13 @@ export function buildCodexHeaders(creds) {
  * testable without network (test/codex-backend.mjs), matching the pattern
  * test/codex-oauth.mjs already uses.
  */
-export async function forwardToCodex(req, res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, shape = 'openai', fetchImpl = fetch, deferOnUnavailable = false, onDone, onDecline) {
+export async function forwardToCodex(req, res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, shape = 'openai', fetchImpl = fetch, deferOnUnavailable = false, onDone, onDecline, 
+/**
+ * Effort named by a model-name suffix (dario#1260). Anthropic-shape only:
+ * a chat/completions caller sets `reasoning_effort` itself and that already
+ * translates. Undefined leaves the request exactly as it was.
+ */
+effort) {
     void req;
     const isAnthropic = shape === 'anthropic';
     // Reported exactly once, on every exit that answered the client. Without
@@ -789,7 +804,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
     const model = String(parsed.model ?? '');
     // stream is forced: the backend is always streamed and collapsed here.
     const upstreamBody = isAnthropic
-        ? { ...anthropicToResponsesRequest(parsed, model), stream: true }
+        ? { ...anthropicToResponsesRequest(parsed, model, effort ? { effort } : {}), stream: true }
         : chatCompletionsToResponses(parsed);
     const scrubbed = toCodexSupportedBody({
         ...upstreamBody,

package/dist/doctor-core.d.ts

@@ -156,6 +156,40 @@ export interface OrganizationsInput {
  * until at least two seats have been observed.
  */
 export declare function checkOrganizations(input: OrganizationsInput): Check[];
+export interface AccountIdentityInput {
+    accounts: Array<{
+        alias: string;
+        accountId?: string;
+        accountEmail?: string;
+    }>;
+}
+/**
+ * The Accounts doctor row (dario#1244, #1263): how many distinct Anthropic
+ * accounts the pool's seats are, from the OAuth account uuid each record
+ * carries — the fact, not an inference from reset seconds. Two seats with one
+ * uuid ARE one subscription under two aliases; a seat without one is not yet
+ * identified (its next token refresh fills it in) and is never guessed at.
+ */
+export declare function checkAccountIdentity(input: AccountIdentityInput): Check[];
+export interface SharedClientIdentityInput {
+    accounts: Array<{
+        alias: string;
+        deviceId: string;
+        accountUuid: string;
+        accountId?: string;
+        identityFrom?: string;
+    }>;
+}
+/**
+ * The Client identity doctor row (dario#1244, 2026-09-08). Every `accounts add`
+ * used to copy the machine's Claude Code identity into the new alias, so a
+ * pool of colleagues' tokens on one machine presented ONE `device_id` /
+ * `account_uuid` in `metadata.user_id` across every OAuth account it held.
+ * Anthropic ties what it sees to that identity (see checkIdentityDrift).
+ * Seats that are genuinely the same account may share it; seats that are
+ * different accounts, or not yet identified, must not.
+ */
+export declare function checkSharedClientIdentity(input: SharedClientIdentityInput): Check[];
 export declare function checkIdentityDrift(input: IdentityDriftInput): Check[];
 export declare function probeNpmLatestCC(): string | null;
 /**

package/dist/doctor-core.js

@@ -11,6 +11,7 @@
  * system surfaces as `fail` instead of crashing the CLI.
  */
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
+import { maskEmail } from './pool.js';
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -221,7 +222,89 @@ export function checkOrganizations(input) {
     return [{
             status: 'info',
             label: 'Organizations',
-            detail: `${head} — ${pairs}. Seats on one organization may be one subscription counted twice: \`sharesWindowWith\` on GET /accounts says so when they report the same window`,
+            detail: `${head} — ${pairs}. Seats on one organization are not one subscription: the Accounts row says which seats are the same account, from each token's OAuth profile.`,
+        }];
+}
+/**
+ * The Accounts doctor row (dario#1244, #1263): how many distinct Anthropic
+ * accounts the pool's seats are, from the OAuth account uuid each record
+ * carries — the fact, not an inference from reset seconds. Two seats with one
+ * uuid ARE one subscription under two aliases; a seat without one is not yet
+ * identified (its next token refresh fills it in) and is never guessed at.
+ */
+export function checkAccountIdentity(input) {
+    if (input.accounts.length < 2)
+        return [];
+    const byId = new Map();
+    let unidentified = 0;
+    for (const a of input.accounts) {
+        if (!a.accountId) {
+            unidentified++;
+            continue;
+        }
+        const g = byId.get(a.accountId);
+        if (g) {
+            g.aliases.push(a.alias);
+            if (!g.email && a.accountEmail)
+                g.email = a.accountEmail;
+        }
+        else
+            byId.set(a.accountId, { aliases: [a.alias], email: a.accountEmail });
+    }
+    const distinct = byId.size + unidentified;
+    const head = `${input.accounts.length} seats, ${distinct} distinct account${distinct === 1 ? '' : 's'}`
+        + (unidentified > 0 ? ` (${unidentified} not yet identified — filled in by the next token refresh)` : '');
+    const dups = [...byId.values()].filter((g) => g.aliases.length > 1);
+    if (dups.length === 0) {
+        return [{ status: 'ok', label: 'Accounts', detail: `${head} — no alias is a duplicate of another` }];
+    }
+    const named = dups.map((g) => `${g.aliases.join(' + ')} are the same account${g.email ? ` (${maskEmail(g.email)})` : ''}`).join('; ');
+    return [{
+            status: 'info',
+            label: 'Accounts',
+            detail: `${head} — ${named}. Duplicates share one window and one set of limits; the pool counts them once.`,
+        }];
+}
+/**
+ * The Client identity doctor row (dario#1244, 2026-09-08). Every `accounts add`
+ * used to copy the machine's Claude Code identity into the new alias, so a
+ * pool of colleagues' tokens on one machine presented ONE `device_id` /
+ * `account_uuid` in `metadata.user_id` across every OAuth account it held.
+ * Anthropic ties what it sees to that identity (see checkIdentityDrift).
+ * Seats that are genuinely the same account may share it; seats that are
+ * different accounts, or not yet identified, must not.
+ */
+export function checkSharedClientIdentity(input) {
+    if (input.accounts.length < 2)
+        return [];
+    const byIdentity = new Map();
+    for (const a of input.accounts) {
+        if (!a.deviceId && !a.accountUuid)
+            continue;
+        const k = `${a.deviceId}|${a.accountUuid}`;
+        const list = byIdentity.get(k);
+        if (list)
+            list.push(a);
+        else
+            byIdentity.set(k, [a]);
+    }
+    const offending = [...byIdentity.entries()].filter(([, seats]) => {
+        if (seats.length < 2)
+            return false;
+        const ids = new Set(seats.map((s) => s.accountId));
+        return ids.size > 1 || ids.has(undefined);
+    });
+    if (offending.length === 0) {
+        return [{ status: 'ok', label: 'Client identity', detail: 'every seat presents its own client identity (or shares one only with the same account)' }];
+    }
+    const parts = offending.map(([k, seats]) => {
+        const accounts = new Set(seats.map((s) => s.accountId ?? `?${s.alias}`)).size;
+        return `${seats.length} seats present ONE client identity (device ${(k.split('|')[0] || '(empty)').slice(0, 8)}…) across ${accounts} account${accounts === 1 ? '' : 's'}: ${seats.map((s) => s.alias).join(', ')}`;
+    });
+    return [{
+            status: 'warn',
+            label: 'Client identity',
+            detail: `${parts.join('; ')}. Every alias added on a machine with Claude Code installed copied its identity, and Anthropic ties usage and limits to the identity it sees. Give each seat its own: \`dario accounts identity --fresh <alias>\` (or \`--all\`); the running proxy presents the new one on the seat's next request.`,
         }];
 }
 const REGRANT_FIX = " — re-grant with `dario accounts add <alias>` (or `dario login --force-reauth` for the login seat); the new grant restarts the clock";
@@ -811,8 +894,8 @@ export async function runChecks(opts = {}) {
                     : '';
                 checks.push({
                     status: util >= 0.90 ? 'warn' : 'ok',
-                    label: `Usage 7d (${family} only)`,
-                    detail: `${pct(util)} used${marker}`,
+                    label: family === 'oi' ? 'Included overage credit (7d, oi)' : `Usage 7d (${family} only)`,
+                    detail: `${pct(util)} used${marker}${family === 'oi' ? " — the plan's included-overage credit; binds Fable's weekly allowance (#1262)" : ''}`,
                 });
             }
             if (firstOk.overageUtil > 0) {
@@ -969,6 +1052,7 @@ export async function runChecks(opts = {}) {
             });
             checks.push(...checkRefreshGrant({ accounts: loaded.map((a) => ({ alias: a.alias, grantedAt: a.grantedAt })), now }));
             checks.push(...checkOrganizations({ accounts: loaded.map((a) => ({ alias: a.alias, organizationId: a.organizationId })) }));
+            checks.push(...checkAccountIdentity({ accounts: loaded.map((a) => ({ alias: a.alias, accountId: a.accountId, accountEmail: a.accountEmail })) }));
             // Next-account-in-rotation surfacing. The proxy's per-request
             // selector picks by max headroom (with 7d_<family> per-model
             // bucket considered when a request's model family is known);
@@ -1047,6 +1131,10 @@ export async function runChecks(opts = {}) {
         });
         for (const c of driftChecks)
             checks.push(c);
+        for (const c of checkSharedClientIdentity({
+            accounts: loaded.map((a) => ({ alias: a.alias, deviceId: a.deviceId, accountUuid: a.accountUuid, accountId: a.accountId, identityFrom: a.identityFrom })),
+        }))
+            checks.push(c);
     }
     catch (err) {
         checks.push({ status: 'warn', label: 'Identity', detail: `check failed: ${err.message}` });

package/dist/effort.d.ts

@@ -18,6 +18,20 @@
 /** Valid values for the `--effort` flag. Mirrors CC's effort set (`low|medium|high|xhigh|max`) plus CC's `ultracode` mode and dario's pseudo-value `'client'` for passthrough. `'ultracode'` is CC's xhigh-plus-dynamic-workflow-orchestration mode (CC 2.1.154); the Messages API accepts only low|medium|high|xhigh|max, so dario normalizes ultracode → 'xhigh' on the wire (see normalizeEffortForWire). `'client'` passes through the client's own `output_config.effort` (falling back to `'xhigh'`). dario#87, `'max'` added in dario#190, `'ultracode'` added 2026-05-28. */
 export type EffortValue = 'low' | 'medium' | 'high' | 'xhigh' | 'ultracode' | 'max' | 'client';
 export declare const VALID_EFFORT_VALUES: ReadonlyArray<EffortValue>;
+/**
+ * dario's effort tiers onto the levels the Codex Responses backend accepts
+ * (dario#1260). Probed 2026-08-29: `none, minimal, low, medium, high, xhigh,
+ * max` are valid upstream; `ultra` 400s.
+ *
+ *   - low/medium/high/xhigh/max pass through — same name on both sides.
+ *   - `ultracode` is dario's own tier with no upstream equivalent. It maps to
+ *     `max`, the nearest thing the backend has, rather than being dropped:
+ *     a caller who asked for the most effort available should not silently
+ *     get the default.
+ *   - `client` means "whatever the client asked for", so it forces nothing
+ *     and the request's own thinking budget decides, as before.
+ */
+export declare function effortForCodex(effort: EffortValue | undefined): 'low' | 'medium' | 'high' | 'xhigh' | 'max' | undefined;
 export declare function parseEffortSuffix(model: string): {
     model: string;
     effort?: EffortValue;

package/dist/effort.js

@@ -26,6 +26,32 @@ export const VALID_EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'ultracode
  * suffix removed plus the parsed effort (undefined when none). Exported for tests.
  */
 const SUFFIX_EFFORTS = ['ultracode', 'medium', 'xhigh', 'high', 'low', 'max'];
+/**
+ * dario's effort tiers onto the levels the Codex Responses backend accepts
+ * (dario#1260). Probed 2026-08-29: `none, minimal, low, medium, high, xhigh,
+ * max` are valid upstream; `ultra` 400s.
+ *
+ *   - low/medium/high/xhigh/max pass through — same name on both sides.
+ *   - `ultracode` is dario's own tier with no upstream equivalent. It maps to
+ *     `max`, the nearest thing the backend has, rather than being dropped:
+ *     a caller who asked for the most effort available should not silently
+ *     get the default.
+ *   - `client` means "whatever the client asked for", so it forces nothing
+ *     and the request's own thinking budget decides, as before.
+ */
+export function effortForCodex(effort) {
+    switch (effort) {
+        case 'low':
+        case 'medium':
+        case 'high':
+        case 'xhigh':
+        case 'max': return effort;
+        case 'ultracode': return 'max';
+        case 'client':
+        case undefined: return undefined;
+        default: return undefined;
+    }
+}
 export function parseEffortSuffix(model) {
     for (const e of SUFFIX_EFFORTS) {
         for (const sep of [':', '-']) {

package/dist/pool.d.ts

@@ -38,6 +38,34 @@ export interface RateLimitSnapshot {
     reset: number;
     fallbackPct: number;
     updatedAt: number;
+    /**
+     * `retry-after` on the response, in ms, or null/undefined when absent. Read
+     * for a 429 that names no exhausted window (see `exhausted`): it is the only
+     * duration the upstream actually stated for that case.
+     */
+    retryAfterMs?: number | null;
+    /**
+     * Set by `markRejected`. True when the 429 itself showed a window was over —
+     * a utilization at or past the 1.0 threshold on some window or bucket — so the
+     * seat is parked until `reset`. False when the 429 said no such thing
+     * (dario#1244 follow-up, 2026-09-08): a seat on the fleet box was parked for
+     * 546 HOURS on a 429 reading `5h 0%, 7d 0%, claim unknown`, because the
+     * status code alone used to decide and the stated reset was honoured
+     * blindly. Such a rejection cools for `retryAfterMs` (or a minute) and stays
+     * probeable. Undefined on snapshots that predate the field, which behave as
+     * before (exhausted).
+     */
+    exhausted?: boolean;
+    /** Epoch ms a non-exhausted rejection stops being ineligible. */
+    cooldownUntil?: number;
+    /**
+     * Which per-model buckets the upstream has shown to bind which model
+     * family on THIS account, learned from responses: `{ fable: ['oi'] }`. Merged
+     * across readings by the pool, so a binding learned on one response holds
+     * for the seat's later headroom decisions. See `WIRE_BUCKET_BINDINGS` for the
+     * static seed and the evidence.
+     */
+    boundBuckets?: Record<string, string[]>;
 }
 export declare const EMPTY_SNAPSHOT: RateLimitSnapshot;
 /** Freshness of an account's utilisation reading — see `utilFreshness`. */
@@ -94,25 +122,35 @@ export declare function rateLimitWindow(rl: RateLimitSnapshot, now: number): Rat
  */
 export declare function describeRateLimitSnapshot(rl: RateLimitSnapshot, now?: number): string;
 /**
- * The identity of the rate-limit window a reading was measured against:
- * its representative claim plus its reset second, or null when the reading
- * states no live window (no reset, a reset that has passed, or no claim).
+ * The log line for a 429 as `markRejected` classified it: an exhausted window
+ * parks the seat until its reset; anything else cools briefly and says which
+ * stated reset was NOT honoured, so the operator can see the reading dario
+ * declined to act on.
+ */
+/** `th***@example.com` — enough to recognise an account by eye, never the whole address on a listing or a log. */
+export declare function maskEmail(email: string | null | undefined): string | null;
+export declare function describeRejection(rl: RateLimitSnapshot, now?: number): string;
+/**
+ * For every seat, the other aliases that are the SAME Anthropic account —
+ * one subscription under several aliases (dario#1244).
  *
- * Two seats that report the same key are one subscription under two aliases
- * (dario#1244, "a few have the same issue"): two independent windows all but
- * never share a reset second, and two readings of one window always do. The
- * organization id is deliberately NOT part of the key — several seats can
- * share an organization and still have their own windows — the window itself
- * is the fact that matters for headroom.
+ * Identity, not inference. The first version of this keyed seats on
+ * `claim@reset` — "two independent windows all but never share a reset
+ * second". They do: Anthropic aligns the five-hour reset to a 20-minute grid
+ * (dario#1263 — two demonstrably different accounts, both resetting at
+ * exactly :40:00), so a five-hour window has 15 possible reset seconds and a
+ * pool of 18 seats is GUARANTEED collisions. That heuristic told an operator
+ * seven independent colleagues were one subscription. `accountId` is the
+ * account uuid the OAuth grant belongs to (accounts.ts, `fetchOAuthProfile`);
+ * two seats with the same one are the same account, full stop, and two
+ * seats without one are simply not yet identified — never guessed.
  */
-export declare function windowKey(rl: RateLimitSnapshot, now: number): string | null;
-/** For every seat, the other aliases whose last reading names the same live window. */
-export declare function windowPeers(accounts: readonly PoolAccount[], now: number): Map<string, string[]>;
+export declare function accountPeers(accounts: readonly PoolAccount[]): Map<string, string[]>;
 /**
- * How many windows the pool really has: each measured live window once, and
- * each seat without a live reading as its own (nothing says otherwise yet).
+ * How many accounts the pool really has: each identified account once, and
+ * each seat not yet identified as its own (nothing says otherwise).
  */
-export declare function distinctWindows(accounts: readonly PoolAccount[], now: number): number;
+export declare function distinctAccounts(accounts: readonly PoolAccount[]): number;
 export interface PoolAccount {
     alias: string;
     accessToken: string;
@@ -131,6 +169,19 @@ export interface PoolAccount {
     rejectedCount: number;
     /** Epoch ms of the most recent 429 on this account; undefined if never. */
     lastRejectedAt?: number;
+    /**
+     * The Anthropic account uuid behind this seat's token, from the OAuth
+     * profile at grant time (accounts.ts). The one fact that says whether two
+     * aliases are one subscription (dario#1244, #1263). Undefined until the
+     * seat's record carries it — a record from before this field is filled in
+     * by its next token refresh.
+     */
+    accountId?: string;
+    /** Email on that account, for the operator's eye; masked on every listing. */
+    accountEmail?: string;
+    /** `organization.rate_limit_tier` / `seat_tier` from the same profile, when stated. */
+    rateLimitTier?: string;
+    seatTier?: string;
     /**
      * The Anthropic organization behind this seat's token, from the
      * `anthropic-organization-id` response header: learned on the first
@@ -238,6 +289,32 @@ export declare function isAccountEligible(account: PoolAccount, now?: number): b
  * back, so it stays probeable (dario#1244).
  */
 export declare function isParkedInLiveWindow(account: PoolAccount, now?: number): boolean;
+/**
+ * A seat rejected by a 429 that named no exhausted window, still inside the
+ * cool-down that rejection earned (see `RateLimitSnapshot.exhausted`). It is
+ * deliberately NOT "parked in a live window" — the reset it stated was never
+ * this seat's window — but it is equally not askable yet: the upstream said
+ * retry after N, and asking sooner is the retry storm the cool-down exists to
+ * prevent (dario#1264 review).
+ */
+export declare function isCoolingAfterRejection(account: PoolAccount, now?: number): boolean;
+/**
+ * Whether the router may send this seat a request RIGHT NOW, for reasons that
+ * expire on their own: an auth cool-down, a live rate-limit window, or the
+ * cool-down a non-window 429 earned.
+ *
+ * ONE predicate, filtered on by both fallback paths (the all-exhausted branch
+ * in `select()` and the mid-flight `selectExcluding()`). They carried the
+ * condition inline and independently, so `isCoolingAfterRejection` was added to
+ * neither — a seat that had just answered `retry-after: 17` could be retried
+ * inside the same client request. Caught in review on #1264; the shape of the
+ * bug is why this is a named predicate rather than two copies of a filter.
+ *
+ * Note this is NOT `isAccountEligible`: eligibility also refuses an expired
+ * token, which no amount of waiting fixes and which these paths handle
+ * separately.
+ */
+export declare function isProbeable(account: PoolAccount, now?: number): boolean;
 /**
  * The operator's next step for one seat, next to `status` on both listings
  * (dario#1244 — "do I have to re-login?" should not need the docs table).
@@ -280,8 +357,50 @@ export type PoolStrategy = 'headroom' | 'fill-first';
  * in this codebase (see resolveSessionRotationConfig).
  */
 export declare function resolvePoolStrategy(explicit?: string | null, env?: NodeJS.ProcessEnv): PoolStrategy;
+/**
+ * Which wire buckets bind which model family, when the wire does not say it
+ * by name. `7d_sonnet` names its family; `7d_oi` does not — it is the plan's
+ * INCLUDED-OVERAGE credit, and it is what Fable's weekly allowance is metered
+ * on (dario#1262):
+ *
+ *   - 2026-07-05, live Max account: Fable drew `representative-claim:
+ *     seven_day_overage_included` at 7d 82% with `7d_oi` at 99%, served at $0;
+ *     at `7d_oi` ≥ 1.0 Fable answered a hard 429 (`7d_oi-status: rejected`,
+ *     `7d_oi-surpassed-threshold: 1.0`) while Opus kept serving.
+ *   - 2026-09-08 (#1262): a Fable response at `7d 0.63, 7d_oi 0.98` — headroom
+ *     read 0.37 against a seat two points from refusal.
+ *
+ * So for Fable, `oi` IS the binding weekly bucket, under a name that is not
+ * "fable". This seed makes that true from the first response. Bindings for
+ * other families are LEARNED per account from the wire (see
+ * `parseRateLimits`): a response whose claim is `*_overage_included`, or a 429
+ * whose `7d_<bucket>-status` is `rejected`, proves that bucket binds the family
+ * that request was for. Nothing here maps a family to `oi` by assumption:
+ * a seat drawing on included overage for Opus is bound by `oi` for Opus
+ * exactly when its responses say so.
+ */
+export declare const WIRE_BUCKET_BINDINGS: Readonly<Record<string, readonly string[]>>;
+/** Parse `retry-after`: delta-seconds or an HTTP date; null when absent or unreadable. */
+export declare function parseRetryAfterMs(value: string | null, now?: number): number | null;
+/** Union of two readings' learned bindings, per family, order-preserving. */
+export declare function mergeBoundBuckets(prev: Record<string, string[]> | undefined, next: Record<string, string[]> | undefined): Record<string, string[]> | undefined;
+/** `next` with everything the account had already learned carried forward. */
+export declare function withBoundBuckets(prev: RateLimitSnapshot, next: RateLimitSnapshot): RateLimitSnapshot;
 /** Parse an Anthropic response's rate-limit headers into a snapshot. */
-export declare function parseRateLimits(headers: Headers): RateLimitSnapshot;
+export declare function parseRateLimits(headers: Headers, family?: string | null): RateLimitSnapshot;
+/**
+ * Does this 429 say a rate-limit WINDOW is over? True only when the reading
+ * itself shows one: a utilization at or past the 1.0 threshold on any window
+ * or bucket (the unified headers are a ratio against
+ * `surpassed-threshold: 1.0`, so `1.02` is 102%; every live rejection observed
+ * has read 1.00–1.06). A 429 with a claim but 30% used, or with no claim and
+ * 0% used, is a refusal of some other kind — concurrency, an account-level
+ * lock, a monthly credit — and its stated `reset` is not the moment this
+ * seat's window rolls. 0.99 rather than 1 absorbs float formatting.
+ */
+export declare function isWindowRejection(rl: RateLimitSnapshot): boolean;
+/** Cool-down for a 429 that named no exhausted window, when it stated no `retry-after`. */
+export declare const NON_WINDOW_REJECTION_COOLDOWN_MS = 60000;
 /**
  * Extract the model family (`opus` / `sonnet` / `haiku` / `fable`) from a
  * request's model id. Used to look up the per-model 7d bucket in
@@ -307,8 +426,14 @@ export declare function modelFamily(modelId: string | null | undefined): string
  * isn't represented in the snapshot (e.g. account hasn't seen a Sonnet
  * request yet so `7d_sonnet` is unknown), headroom is computed from the
  * unified buckets only — best-effort, populated on the next response.
+ *
+ * A bucket counts for a family when it names the family (`7d_sonnet`), when
+ * `WIRE_BUCKET_BINDINGS` says it binds the family (`7d_oi` → fable, dario#1262),
+ * or when this account's responses have shown it does (`boundBuckets`).
  */
 export declare function computeHeadroom(snapshot: RateLimitSnapshot, family?: string | null): number;
+/** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
+export declare function bucketsBindingFamily(snapshot: RateLimitSnapshot, family: string): string[];
 export declare class AccountPool {
     private readonly strategy;
     private accounts;
@@ -327,6 +452,10 @@ export declare class AccountPool {
         accountUuid: string;
         grantedAt?: number;
         organizationId?: string;
+        accountId?: string;
+        accountEmail?: string;
+        rateLimitTier?: string;
+        seatTier?: string;
     }): void;
     remove(alias: string): boolean;
     get size(): number;
@@ -367,7 +496,7 @@ export declare class AccountPool {
      * review on dario#1254 that caught the mixed case).
      */
     parkedUntil(now?: number): number | null;
-    /** Seats currently parked inside a live window (dario#1244). */
+    /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
     parkedCount(now?: number): number;
     /**
      * Select with session stickiness. If `stickyKey` is already bound to a