@askalf/dario 6.15.0 → 6.17.0

package/dist/credits-rung.js

@@ -0,0 +1,133 @@
+/**
+ * The credits rung of the failover chain.
+ *
+ * Since October 2026 a Max plan includes monthly Claude API credits ($100 on
+ * Max 5x, $200 on Max 20x). They are spent through a Console API key of the
+ * organization the plan is linked to, not through the seat's own five-hour
+ * and weekly windows, so until now the only ways to spend them through dario
+ * were ANTHROPIC_UPSTREAM_API_KEY (the whole Claude backend on the key, pool
+ * bypassed) or an OpenAI-compat backend pointed at Anthropic's compatibility
+ * layer, which Anthropic describes as a layer for testing models.
+ *
+ * A chain entry written `credits:<model>` names the key as a rung. When every
+ * seat is drained or cooling and no subscription rung can serve, the request
+ * goes to api.anthropic.com on the Messages path as a plain API request: the
+ * client's own body with the model swapped, `x-api-key`, no Claude Code
+ * template and no OAuth beta. Both wire shapes work, because the Claude path
+ * already translates OpenAI-shape requests and responses. The response says
+ * `x-dario-pool-fallback: credits:<model>`; the rolling window, `/metrics`
+ * and the dashboard file the request under its own billing bucket, `credits`,
+ * next to extra usage and API key; the persistent ledger counts it in its
+ * metered total, as spent; and the overage guard does not halt on it: a rung
+ * the operator configured is not a surprise bill.
+ *
+ * The key comes from DARIO_CREDITS_API_KEY only, never a flag, so it never
+ * lands in argv. The rung is opt-in twice: the entry must be in the chain AND
+ * the key must be set. Without the key the entry is inert, the proxy says so
+ * at startup and `dario doctor` says so in its Failover line.
+ *
+ * Where it sits: a subscription rung (a Codex account that lists an entry)
+ * always goes first, because the plan is the thing dario exists to spend.
+ * Among the metered rungs, this one and the openai-compat backend, the
+ * chain's own left-to-right order decides.
+ */
+import { resolveClaudeTarget } from './claude-model.js';
+export const CREDITS_PREFIX = 'credits:';
+/** The analytics `account` of a request the credits rung served. */
+export const ACCOUNT_KEY_CREDITS = '__credits__';
+/** The OAuth-enablement beta a plain API request must not carry. */
+const OAUTH_BETA = 'oauth-2025-04-20';
+/** The value of `x-dario-pool-fallback` on a response the rung served. */
+export function creditsFallbackMarker(model) {
+    return `${CREDITS_PREFIX}${model}`;
+}
+export function isCreditsEntry(entry) {
+    return entry.trim().toLowerCase().startsWith(CREDITS_PREFIX);
+}
+/** The model half of a `credits:<model>` entry as written; null for any other entry. */
+export function creditsEntryModel(entry) {
+    const e = entry.trim();
+    if (!e.toLowerCase().startsWith(CREDITS_PREFIX))
+        return null;
+    const model = e.slice(CREDITS_PREFIX.length).trim();
+    return model || null;
+}
+/** Every credits entry's model as written, in chain order. */
+export function creditsEntries(chain) {
+    const out = [];
+    for (const entry of chain) {
+        const model = creditsEntryModel(entry);
+        if (model)
+            out.push(model);
+    }
+    return out;
+}
+/** The chain without its credits entries: what the subscription and openai-compat rungs read. */
+export function withoutCreditsEntries(chain) {
+    return chain.filter((entry) => !isCreditsEntry(entry));
+}
+/**
+ * True when the credits rung is asked before the openai-compat backend: the
+ * first credits entry precedes every plain entry, or there is no plain entry.
+ * False when the chain has no credits entry at all.
+ */
+export function creditsBeforePlain(chain) {
+    const credits = chain.findIndex((entry) => isCreditsEntry(entry));
+    if (credits < 0)
+        return false;
+    const plain = chain.findIndex((entry) => !isCreditsEntry(entry));
+    return plain < 0 || credits < plain;
+}
+/**
+ * The first credits entry the Claude catalog can serve, resolved exactly like
+ * a Claude chain entry: aliases (`credits:sonnet`), a provider prefix
+ * (`credits:anthropic:claude-opus-5`) and an effort suffix spelled the way a
+ * Claude entry spells it (`credits:claude:opus:high`, `credits:claude-opus-5-high`)
+ * all work, and a name the catalog does not list is skipped rather than sent, so
+ * a typo cannot trade a recoverable 429 for a 404 billed to the key.
+ */
+export function pickCreditsTarget(chain, bases, resolve) {
+    for (const entry of chain) {
+        const model = creditsEntryModel(entry);
+        if (!model)
+            continue;
+        const target = resolveClaudeTarget(model, bases, resolve);
+        if (target)
+            return target;
+    }
+    return null;
+}
+/**
+ * Outbound headers for a credits request: the headers a plain API client
+ * sends and nothing of Claude Code's identity. The client's own betas go
+ * through minus the OAuth flag, which an API key request must not carry.
+ */
+export function creditsHeaders(key, clientBeta, anthropicVersion = '2023-06-01') {
+    const headers = {
+        'accept': 'application/json',
+        'Content-Type': 'application/json',
+        'x-api-key': key,
+        'anthropic-version': anthropicVersion,
+    };
+    const beta = (clientBeta ?? '')
+        .split(',')
+        .map((b) => b.trim())
+        .filter((b) => b.length > 0 && b !== OAUTH_BETA)
+        .join(',');
+    if (beta)
+        headers['anthropic-beta'] = beta;
+    return headers;
+}
+/**
+ * One phrase for the startup line and `dario doctor`, or null when the chain
+ * names no credits entry.
+ */
+export function describeCreditsRung(chain, hasKey) {
+    const credits = creditsEntries(chain);
+    if (credits.length === 0)
+        return null;
+    const model = credits[0];
+    return hasKey
+        ? `API credits as ${model} (x-api-key on the Messages path, both wire shapes, billing bucket credits, metered in the ledger)`
+        : `credits:${model} named but DARIO_CREDITS_API_KEY is not set, so that rung is inert`;
+}

package/dist/doctor-core.d.ts

@@ -83,6 +83,8 @@ export declare function failoverReadiness(input: {
     chain: readonly string[];
     codexAccounts: number;
     backends: readonly string[];
+    /** DARIO_CREDITS_API_KEY is set (the credits rung, credits-rung.ts). */
+    creditsKey?: boolean;
 }): {
     status: CheckStatus;
     detail: string;

package/dist/doctor-core.js

@@ -12,6 +12,7 @@
  */
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
 import { maskEmail } from './pool.js';
+import { creditsEntries, withoutCreditsEntries } from './credits-rung.js';
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -111,36 +112,71 @@ function describeAge(ms) {
 }
 export function failoverReadiness(input) {
     const { chain, codexAccounts, backends } = input;
+    const creditsKey = input.creditsKey === true;
     const hasCodex = codexAccounts > 0;
     const hasBackend = backends.length > 0;
+    // The subscription and openai-compat rungs read the chain without its
+    // credits entries; the credits rung is reported on the end of whichever
+    // verdict those earn.
+    const plain = withoutCreditsEntries(chain);
+    const credits = creditsEntries(chain);
+    const creditsArmed = credits.length > 0 && creditsKey;
+    const creditsNote = credits.length > 0
+        ? (creditsKey
+            ? ` Then API credits as ${credits[0]} on DARIO_CREDITS_API_KEY (billing bucket credits, metered in the ledger).`
+            : ` credits:${credits[0]} is in the chain but DARIO_CREDITS_API_KEY is not set, so that rung is inert.`)
+        : (creditsKey ? ' DARIO_CREDITS_API_KEY is set but no chain entry names credits:<model>, so nothing spends it.' : '');
     if (chain.length === 0) {
-        return { status: 'info', detail: 'off — a drained Claude pool returns 429/503 (--pool-fallback to arm)' };
+        return { status: 'info', detail: 'off: a drained Claude pool returns 429/503 (--pool-fallback to arm)' + creditsNote };
+    }
+    if (plain.length === 0) {
+        // Nothing but credits entries: the rung is the whole chain.
+        if (creditsArmed) {
+            return {
+                status: 'ok',
+                detail: `claude → API credits as ${credits[0]} (x-api-key on the Messages path, both wire shapes, billing bucket credits, metered in the ledger). `
+                    + 'Metered: add a Codex account (`dario add altman`) to the chain to spend a subscription first.',
+            };
+        }
+        return {
+            status: 'warn',
+            detail: `armed (${chain.join(' → ')}) but INERT: DARIO_CREDITS_API_KEY is not set. Set it (env only, never a flag) `
+                + 'to arm the credits rung, or add a subscription rung: `dario add altman`.',
+        };
     }
     if (!hasCodex && !hasBackend) {
+        if (creditsArmed) {
+            return {
+                status: 'ok',
+                detail: `claude → API credits as ${credits[0]} (both wire shapes, billing bucket credits, metered in the ledger). `
+                    + `${plain.join(' → ')} has no Codex account and no backend to serve it; add one `
+                    + '(`dario add altman` for a subscription, `dario backend add …` for an api key) to spend it before the key.',
+            };
+        }
         return {
             status: 'warn',
-            detail: `armed (${chain.join(' → ')}) but INERT — no Codex account and no backend to fall back to. `
-                + 'Add one: `dario add altman` (subscription) or `dario backend add …` (api key).',
+            detail: `armed (${chain.join(' → ')}) but INERT: no Codex account and no backend to fall back to. `
+                + 'Add one: `dario add altman` (subscription) or `dario backend add …` (api key).' + creditsNote,
         };
     }
-    if (hasCodex && chain.length > 1) {
+    if (hasCodex && plain.length > 1) {
         return {
             status: 'ok',
-            detail: `symmetric: ${chain.join(' → ')}, across ${codexAccounts} Codex account`
-                + `${codexAccounts === 1 ? '' : 's'}${hasBackend ? ` + ${backends.length} backend(s)` : ''}`,
+            detail: `symmetric: ${plain.join(' → ')}, across ${codexAccounts} Codex account`
+                + `${codexAccounts === 1 ? '' : 's'}${hasBackend ? ` + ${backends.length} backend(s)` : ''}.` + creditsNote,
         };
     }
     if (hasCodex) {
         return {
             status: 'ok',
-            detail: `claude → codex as ${chain[0]} (both wire shapes). One-way — add a Claude model to `
-                + 'the chain (--pool-fallback=a,b) to cover a rate-limited ChatGPT plan too.',
+            detail: `claude → codex as ${plain[0]} (both wire shapes). One-way: add a Claude model to `
+                + 'the chain (--pool-fallback=a,b) to cover a rate-limited ChatGPT plan too.' + creditsNote,
         };
     }
     return {
         status: 'ok',
-        detail: `claude → ${backends[0]} as ${chain[0]} — OpenAI path only. A Codex account would `
-            + 'extend it to Anthropic-shape clients (Claude Code, agent runtimes).',
+        detail: `claude → ${backends[0]} as ${plain[0]}, OpenAI path only. A Codex account would `
+            + 'extend it to Anthropic-shape clients (Claude Code, agent runtimes).' + creditsNote,
     };
 }
 /**
@@ -1252,6 +1288,7 @@ export async function runChecks(opts = {}) {
             chain,
             codexAccounts: codexAliases.length,
             backends: backends.map((b) => b.name),
+            creditsKey: (process.env.DARIO_CREDITS_API_KEY ?? '').trim().length > 0,
         });
         checks.push({ status: verdict.status, label: 'Failover', detail: verdict.detail });
         const midstreamEnabled = !['0', 'false', 'no', 'off'].includes((process.env.DARIO_MIDSTREAM_CONTINUE ?? '').toLowerCase());

package/dist/donuts.d.ts

@@ -1,15 +1,3 @@
-/**
- * Spend donuts — where the API-equivalent number comes from, as shares.
- *
- * Three rings from the ledger, no new data: by model, by consumer (named
- * key / `x-dario-consumer`), and covered-vs-metered. Rendered as one SVG
- * (`dario usage --donut`, `GET /analytics/donuts.svg`) and inside the
- * server-rendered `/analytics/view` fragment that the `/analytics/ui` shell
- * page loads. Same palette and frame as the share card in ledger.ts.
- *
- * Pure over a LedgerSummary / AnalyticsSummary so the geometry is testable
- * without a proxy.
- */
 import type { LedgerSummary } from './ledger.js';
 import type { AnalyticsSummary } from './analytics.js';
 import type { QueueSnapshot } from './request-queue.js';
@@ -35,12 +23,25 @@ export declare function renderSpendDonuts(s: LedgerSummary): string;
 /**
  * The server-rendered fragment behind `/analytics/ui`: headline, the three
  * rings, the rolling window, and a per-model table. Same gate as
- * `/analytics`; the shell page fetches it with the token the viewer typed.
+ * `/analytics`; the page before 6.17 fetched it with the token the viewer typed; it is still served.
  */
 export declare function renderAnalyticsView(summary: AnalyticsView, lifetime: LedgerSummary | null, version: string): string;
 /**
- * The static shell for `/analytics/ui`. Carries NO data — it is safe to
- * serve without auth — and asks the viewer for the token once (kept in
- * sessionStorage), then fetches `/analytics/view` every 60 s with it.
+ * A reader of the dashboard page that reads it once: the first read that succeeds is kept for
+ * every call after it. A failed read answers with the missing-file page and keeps nothing, so
+ * copying the file in takes effect on the next request without a restart. The reader is a
+ * parameter so the test can count the reads.
+ */
+export declare function analyticsUiLoader(read: () => string): () => string;
+/**
+ * The dashboard behind `/analytics/ui`: `dist/analytics-ui.html`, copied from `src/` by the
+ * build and read once, on the first request. It carries no data and no credential. It asks for
+ * the analytics token or an API key once (kept in sessionStorage) and reads `/analytics`,
+ * `/accounts`, `/codex`, `/health`, `/analytics/ledger` and `/admin/keys` with it, and tails
+ * `/analytics/stream`; it loads nothing from outside the proxy. The
+ * `window.DARIO_COCKPIT = "served"` line in its head tells the page a proxy is serving it, so it
+ * goes live at once; the same file opened from disk runs on sample data, because the page checks
+ * the protocol before the marker. `/analytics/view` and the rings above are unchanged for the CLI
+ * and for anything that embedded them.
  */
-export declare const ANALYTICS_UI_SHELL = "<!doctype html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>dario analytics</title>\n<style>\n  :root{color-scheme:dark}\n  body{margin:0;background:#0a0a0f;color:#e5e7eb;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,\"Liberation Mono\",monospace;font-size:14px}\n  header{display:flex;gap:12px;align-items:center;padding:14px 20px;border-bottom:1px solid #1f2937;background:linear-gradient(90deg,#7c3aed,#db2777) top/100% 4px no-repeat,#0a0a0f}\n  header h1{font-size:14px;letter-spacing:2px;margin:0;color:#9ca3af;font-weight:600}\n  header input{background:#111827;color:#e5e7eb;border:1px solid #374151;border-radius:6px;padding:6px 10px;font:inherit;width:22em}\n  header button{background:#7c3aed;color:#fff;border:0;border-radius:6px;padding:6px 12px;font:inherit;cursor:pointer}\n  #status{color:#9ca3af;margin-left:auto}\n  main{padding:20px;max-width:1100px;margin:0 auto}\n  .headline{font-size:34px;font-weight:700;color:#fff;margin:6px 0 16px}\n  .headline span{display:block;font-size:13px;font-weight:400;color:#9ca3af;margin-top:4px}\n  .headline.muted{color:#6b7280}\n  .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-bottom:18px}\n  .stat{background:#111827;border:1px solid #1f2937;border-radius:12px;padding:12px 14px}\n  .stat .v{font-size:20px;font-weight:700;color:#fff}.stat .l{font-size:11px;color:#9ca3af;margin-top:2px}\n  .rings svg{width:100%;max-width:640px;height:auto;display:block;margin:0 auto 18px}\n  table{width:100%;border-collapse:collapse;margin:0 0 18px;font-size:12px}\n  th,td{text-align:right;padding:6px 8px;border-bottom:1px solid #1f2937}th:first-child,td:first-child{text-align:left}\n  th{color:#9ca3af;font-weight:500}\n  .foot{color:#6b7280;font-size:11px}\n  .err{color:#fca5a5;padding:20px;background:#1f1115;border:1px solid #7f1d1d;border-radius:12px}\n</style></head>\n<body>\n<header><h1>DARIO ANALYTICS</h1>\n  <input id=\"tok\" type=\"password\" placeholder=\"analytics token or API key (blank on an unkeyed proxy)\" autocomplete=\"off\">\n  <button id=\"go\">connect</button><span id=\"status\"></span></header>\n<main id=\"view\"></main>\n<script>\n(function(){\n  var tok=document.getElementById('tok'),view=document.getElementById('view'),status=document.getElementById('status'),timer=null;\n  try{tok.value=sessionStorage.getItem('dario.analytics.token')||''}catch(e){}\n  function headers(){var h={};if(tok.value)h['Authorization']='Bearer '+tok.value;return h}\n  function load(){\n    fetch('/analytics/view',{headers:headers(),cache:'no-store'}).then(function(r){\n      if(r.status===401){view.innerHTML='<div class=\"err\">401 \u2014 this proxy is keyed. Paste its analytics token (DARIO_ANALYTICS_TOKEN) or API key above.</div>';status.textContent='';return}\n      if(!r.ok){view.innerHTML='<div class=\"err\">'+r.status+' from /analytics/view</div>';return}\n      return r.text().then(function(html){view.innerHTML=html;status.textContent='live \u00B7 refreshes every 60 s';try{sessionStorage.setItem('dario.analytics.token',tok.value)}catch(e){}})\n    }).catch(function(e){view.innerHTML='<div class=\"err\">'+String(e)+'</div>'});\n  }\n  function start(){if(timer)clearInterval(timer);load();timer=setInterval(load,60000)}\n  document.getElementById('go').addEventListener('click',start);\n  tok.addEventListener('keydown',function(e){if(e.key==='Enter')start()});\n  start();\n})();\n</script>\n</body></html>\n";
+export declare const analyticsUiPage: () => string;

package/dist/donuts.js

@@ -1,3 +1,16 @@
+/**
+ * Spend donuts — where the API-equivalent number comes from, as shares.
+ *
+ * Three rings from the ledger, no new data: by model, by consumer (named
+ * key / `x-dario-consumer`), and covered-vs-metered. Rendered as one SVG
+ * (`dario usage --donut`, `GET /analytics/donuts.svg`) and inside the
+ * server-rendered `/analytics/view` fragment that the `/analytics/ui` page
+ * loaded before 6.17 (still served). Same palette and frame as the share card in ledger.ts.
+ *
+ * Pure over a LedgerSummary / AnalyticsSummary so the geometry is testable
+ * without a proxy.
+ */
+import { readFileSync } from 'node:fs';
 import { formatUsd } from './ledger.js';
 const PALETTE = ['#7c3aed', '#db2777', '#2563eb', '#059669', '#d97706', '#0891b2'];
 const OTHER = '#6b7280';
@@ -90,7 +103,7 @@ export function renderSpendDonuts(s) {
 /**
  * The server-rendered fragment behind `/analytics/ui`: headline, the three
  * rings, the rolling window, and a per-model table. Same gate as
- * `/analytics`; the shell page fetches it with the token the viewer typed.
+ * `/analytics`; the page before 6.17 fetched it with the token the viewer typed; it is still served.
  */
 export function renderAnalyticsView(summary, lifetime, version) {
     const w = summary.window;
@@ -119,58 +132,37 @@ ${table}
 ${accounts ? `<table><thead><tr><th>seat</th><th>requests</th><th>5h</th><th>7d</th><th>last claim</th></tr></thead><tbody>${accounts}</tbody></table>` : ''}
 <div class="foot">dario ${escapeHtml(version)} · rendered ${escapeHtml(new Date().toISOString().slice(0, 19).replace('T', ' '))} UTC</div>`;
 }
+/** The page served when the build ran tsc without the copy step: say so instead of a 500. */
+const ANALYTICS_UI_MISSING = '<!doctype html><html lang="en"><head><meta charset="utf-8"><title>dario</title></head><body><p>This build is missing <code>analytics-ui.html</code> next to <code>donuts.js</code>; run <code>npm run build</code>.</p></body></html>';
 /**
- * The static shell for `/analytics/ui`. Carries NO data — it is safe to
- * serve without auth — and asks the viewer for the token once (kept in
- * sessionStorage), then fetches `/analytics/view` every 60 s with it.
+ * A reader of the dashboard page that reads it once: the first read that succeeds is kept for
+ * every call after it. A failed read answers with the missing-file page and keeps nothing, so
+ * copying the file in takes effect on the next request without a restart. The reader is a
+ * parameter so the test can count the reads.
  */
-export const ANALYTICS_UI_SHELL = `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>dario analytics</title>
-<style>
-  :root{color-scheme:dark}
-  body{margin:0;background:#0a0a0f;color:#e5e7eb;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace;font-size:14px}
-  header{display:flex;gap:12px;align-items:center;padding:14px 20px;border-bottom:1px solid #1f2937;background:linear-gradient(90deg,#7c3aed,#db2777) top/100% 4px no-repeat,#0a0a0f}
-  header h1{font-size:14px;letter-spacing:2px;margin:0;color:#9ca3af;font-weight:600}
-  header input{background:#111827;color:#e5e7eb;border:1px solid #374151;border-radius:6px;padding:6px 10px;font:inherit;width:22em}
-  header button{background:#7c3aed;color:#fff;border:0;border-radius:6px;padding:6px 12px;font:inherit;cursor:pointer}
-  #status{color:#9ca3af;margin-left:auto}
-  main{padding:20px;max-width:1100px;margin:0 auto}
-  .headline{font-size:34px;font-weight:700;color:#fff;margin:6px 0 16px}
-  .headline span{display:block;font-size:13px;font-weight:400;color:#9ca3af;margin-top:4px}
-  .headline.muted{color:#6b7280}
-  .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-bottom:18px}
-  .stat{background:#111827;border:1px solid #1f2937;border-radius:12px;padding:12px 14px}
-  .stat .v{font-size:20px;font-weight:700;color:#fff}.stat .l{font-size:11px;color:#9ca3af;margin-top:2px}
-  .rings svg{width:100%;max-width:640px;height:auto;display:block;margin:0 auto 18px}
-  table{width:100%;border-collapse:collapse;margin:0 0 18px;font-size:12px}
-  th,td{text-align:right;padding:6px 8px;border-bottom:1px solid #1f2937}th:first-child,td:first-child{text-align:left}
-  th{color:#9ca3af;font-weight:500}
-  .foot{color:#6b7280;font-size:11px}
-  .err{color:#fca5a5;padding:20px;background:#1f1115;border:1px solid #7f1d1d;border-radius:12px}
-</style></head>
-<body>
-<header><h1>DARIO ANALYTICS</h1>
-  <input id="tok" type="password" placeholder="analytics token or API key (blank on an unkeyed proxy)" autocomplete="off">
-  <button id="go">connect</button><span id="status"></span></header>
-<main id="view"></main>
-<script>
-(function(){
-  var tok=document.getElementById('tok'),view=document.getElementById('view'),status=document.getElementById('status'),timer=null;
-  try{tok.value=sessionStorage.getItem('dario.analytics.token')||''}catch(e){}
-  function headers(){var h={};if(tok.value)h['Authorization']='Bearer '+tok.value;return h}
-  function load(){
-    fetch('/analytics/view',{headers:headers(),cache:'no-store'}).then(function(r){
-      if(r.status===401){view.innerHTML='<div class="err">401 — this proxy is keyed. Paste its analytics token (DARIO_ANALYTICS_TOKEN) or API key above.</div>';status.textContent='';return}
-      if(!r.ok){view.innerHTML='<div class="err">'+r.status+' from /analytics/view</div>';return}
-      return r.text().then(function(html){view.innerHTML=html;status.textContent='live · refreshes every 60 s';try{sessionStorage.setItem('dario.analytics.token',tok.value)}catch(e){}})
-    }).catch(function(e){view.innerHTML='<div class="err">'+String(e)+'</div>'});
-  }
-  function start(){if(timer)clearInterval(timer);load();timer=setInterval(load,60000)}
-  document.getElementById('go').addEventListener('click',start);
-  tok.addEventListener('keydown',function(e){if(e.key==='Enter')start()});
-  start();
-})();
-</script>
-</body></html>
-`;
+export function analyticsUiLoader(read) {
+    let page = null;
+    return () => {
+        if (page !== null)
+            return page;
+        try {
+            page = read();
+            return page;
+        }
+        catch {
+            return ANALYTICS_UI_MISSING;
+        }
+    };
+}
+/**
+ * The dashboard behind `/analytics/ui`: `dist/analytics-ui.html`, copied from `src/` by the
+ * build and read once, on the first request. It carries no data and no credential. It asks for
+ * the analytics token or an API key once (kept in sessionStorage) and reads `/analytics`,
+ * `/accounts`, `/codex`, `/health`, `/analytics/ledger` and `/admin/keys` with it, and tails
+ * `/analytics/stream`; it loads nothing from outside the proxy. The
+ * `window.DARIO_COCKPIT = "served"` line in its head tells the page a proxy is serving it, so it
+ * goes live at once; the same file opened from disk runs on sample data, because the page checks
+ * the protocol before the marker. `/analytics/view` and the rings above are unchanged for the CLI
+ * and for anything that embedded them.
+ */
+export const analyticsUiPage = analyticsUiLoader(() => readFileSync(new URL('./analytics-ui.html', import.meta.url), 'utf8'));

package/dist/ledger.d.ts

@@ -142,6 +142,11 @@ export declare function dayKey(atMs: number): string;
  * claim, and an absent claim on a 2xx (stream aborts, api-key mode without
  * the header) are covered — the request was served, and nothing says it was
  * billed per token.
+ *
+ * `credits` is metered too: the credits rung spends the monthly API credits
+ * a Max plan includes, at API rates, from a balance with an end. That is
+ * money the plan handed over and the request used up, not a bill that never
+ * arrived, so it is reported as spent and never counted as saved.
  */
 export declare function ledgerBucketFor(record: Pick<RequestRecord, 'status' | 'claim'>): LedgerBucket | null;
 /**
@@ -169,6 +174,19 @@ export declare function consumerDayUsage(file: LedgerFile, consumer: string, now
 /** `1234` → `1.2k`, `1234567` → `1.2M`; below a thousand, the number itself. */
 export declare function formatTokenCount(n: number): string;
 export declare function summarizeLedger(file: LedgerFile, path: string, now?: number): LedgerSummary;
+/** One row of the table as money: the bucket's USD at that day's rate, present where the bucket is. */
+export type PricedLedgerRow = Partial<Record<LedgerBucket, number>>;
+/**
+ * The table priced row for row, the way summarizeLedger prices it: what
+ * /analytics/ledger sends next to the raw cells, so a reader charting them
+ * (the dashboard, a script) needs no price list of its own and a pricing
+ * correction here reaches every reader at once.
+ */
+export interface PricedLedger {
+    days: Record<string, Record<string, PricedLedgerRow>>;
+    consumers: Record<string, Record<string, Record<string, PricedLedgerRow>>>;
+}
+export declare function priceLedger(file: LedgerFile): PricedLedger;
 /**
  * Read a ledger file for display without a running proxy (`dario usage`
  * when the proxy is down). Missing file → null; unreadable → null with the
@@ -204,6 +222,8 @@ export declare class Ledger {
     };
     /** The raw per-day table, for /analytics/ledger. */
     snapshot(): LedgerFile;
+    /** The same table as money, sent next to it on /analytics/ledger. */
+    priced(): PricedLedger;
     private scheduleFlush;
     /** Write now if anything changed. Serialized; a failure is logged, not thrown. */
     flush(): Promise<void>;

package/dist/ledger.js

@@ -71,12 +71,17 @@ function dayMs(day) {
  * claim, and an absent claim on a 2xx (stream aborts, api-key mode without
  * the header) are covered — the request was served, and nothing says it was
  * billed per token.
+ *
+ * `credits` is metered too: the credits rung spends the monthly API credits
+ * a Max plan includes, at API rates, from a balance with an end. That is
+ * money the plan handed over and the request used up, not a bill that never
+ * arrived, so it is reported as spent and never counted as saved.
  */
 export function ledgerBucketFor(record) {
     if (record.status < 200 || record.status >= 300)
         return null;
     const bucket = billingBucketFromClaim(record.claim);
-    return bucket === 'api' || bucket === 'extra_usage' ? 'metered' : 'covered';
+    return bucket === 'api' || bucket === 'extra_usage' || bucket === 'credits' ? 'metered' : 'covered';
 }
 function isCell(v) {
     if (!v || typeof v !== 'object')
@@ -365,6 +370,36 @@ export function summarizeLedger(file, path, now = Date.now()) {
         perConsumer: summarizeLedgerConsumers(file, now),
     };
 }
+export function priceLedger(file) {
+    const priceRow = (day, model, row) => {
+        const at = dayMs(day);
+        const out = {};
+        if (row.covered)
+            out.covered = round(costOfTokens(model, at, row.covered));
+        if (row.metered)
+            out.metered = round(costOfTokens(model, at, row.metered));
+        return out;
+    };
+    const days = {};
+    for (const [day, models] of Object.entries(file.days)) {
+        const priced = {};
+        for (const [model, row] of Object.entries(models))
+            priced[model] = priceRow(day, model, row);
+        days[day] = priced;
+    }
+    const consumers = {};
+    for (const [day, byConsumer] of Object.entries(file.consumers ?? {})) {
+        const priced = {};
+        for (const [consumer, models] of Object.entries(byConsumer)) {
+            const rows = {};
+            for (const [model, row] of Object.entries(models))
+                rows[model] = priceRow(day, model, row);
+            priced[consumer] = rows;
+        }
+        consumers[day] = priced;
+    }
+    return { days, consumers };
+}
 /**
  * Read a ledger file for display without a running proxy (`dario usage`
  * when the proxy is down). Missing file → null; unreadable → null with the
@@ -438,6 +473,10 @@ export class Ledger {
     snapshot() {
         return JSON.parse(JSON.stringify(this.file));
     }
+    /** The same table as money, sent next to it on /analytics/ledger. */
+    priced() {
+        return priceLedger(this.file);
+    }
     scheduleFlush() {
         this.dirty = true;
         if (this.timer)

package/dist/metrics.js

@@ -130,7 +130,8 @@ export function renderPrometheus(input) {
     if (p.estimatedExhaustionMinutes !== null) {
         metric('dario_predicted_exhaustion_minutes', 'Minutes until the current seat window is predicted to exhaust at the present burn rate.', [[{}, p.estimatedExhaustionMinutes]]);
     }
-    metric('dario_burn_tokens_per_minute', 'Token burn rate over the rolling window.', [[{}, p.tokenBurnRate]]);
+    metric('dario_burn_tokens_per_minute', 'Input and output token burn rate over the rolling window; cache reads and writes are not in it.', [[{}, p.tokenBurnRate]]);
+    metric('dario_burn_total_tokens_per_minute', 'Token burn rate over the rolling window, every kind: input, output, cache reads and cache writes.', [[{}, p.totalTokenBurnRate]]);
     metric('dario_burn_cost_usd_per_minute', 'API-equivalent cost burn rate over the rolling window, USD/min.', [[{}, p.costBurnRate]]);
     // ---- ledger (survives restarts) ----------------------------------------
     if (lifetime) {

package/dist/midstream.js

@@ -47,6 +47,7 @@
  * the existing pre-byte failover covers them), and the api-key OpenAI backend.
  * A stream that cannot be continued ends exactly as it did before this module.
  */
+import { upstreamDeadline } from './upstream-deadline.js';
 /**
  * Marks a loopback request as a continuation and carries its DEPTH: `1` for
  * the resume of a client request, `2` for the resume of that resume. A
@@ -836,7 +837,8 @@ export class MidstreamGuard {
         const body = buildResumeBody(this.o.shape, clientBody, target.model, partial);
         const splicer = new Splicer(this.o.shape, s, partial);
         const abort = new AbortController();
-        const timer = setTimeout(() => abort.abort(), r.timeoutMs);
+        // Caps the wait until headers, then the gap between chunks of the resume.
+        const timer = upstreamDeadline(r.timeoutMs, () => abort.abort());
         const startedAt = Date.now();
         try {
             r.onBeforeResume?.();
@@ -854,6 +856,7 @@ export class MidstreamGuard {
             // An SSE comment, ignored by every parser, so a raw capture shows where
             // the second provider took over.
             this.o.write(`${SEAM_COMMENT_PREFIX} ${target.label} after ${partial.length} chars\n\n`);
+            timer.streaming();
             const reader = res.body.getReader();
             const split = new SseFrameSplitter();
             let sawContent = false;
@@ -861,6 +864,7 @@ export class MidstreamGuard {
             try {
                 outer: while (true) {
                     const { done, value } = await reader.read();
+                    timer.touch();
                     if (done)
                         break;
                     if (this.o.isClientGone()) {
@@ -919,7 +923,7 @@ export class MidstreamGuard {
             return 'failed';
         }
         finally {
-            clearTimeout(timer);
+            timer.clear();
         }
     }
     log(line) {

package/dist/openai-backend.js

@@ -15,6 +15,7 @@
 import { readFile, writeFile, mkdir, unlink, readdir } from 'node:fs/promises';
 import { join, basename } from 'node:path';
 import { homedir } from 'node:os';
+import { upstreamDeadline } from './upstream-deadline.js';
 const DARIO_DIR = join(homedir(), '.dario');
 const BACKENDS_DIR = join(DARIO_DIR, 'backends');
 export const MINIMAX_MODELS = ['MiniMax-M3.1-Flash', 'MiniMax-M3'];
@@ -138,7 +139,8 @@ export async function forwardToOpenAI(req, res, body, backend, corsOrigin, secur
     // Drop Anthropic-specific headers entirely
     void clientBeta;
     const abort = new AbortController();
-    const timeout = setTimeout(() => abort.abort(), upstreamTimeoutMs);
+    // Caps the wait until headers, then the gap between chunks of a 2xx body.
+    const timeout = upstreamDeadline(upstreamTimeoutMs, () => abort.abort());
     try {
         if (verbose) {
             console.log(`[dario] → openai backend: ${target}`);
@@ -165,10 +167,13 @@ export async function forwardToOpenAI(req, res, body, backend, corsOrigin, secur
         }
         res.writeHead(upstream.status, respHeaders);
         if (upstream.body) {
+            if (upstream.ok)
+                timeout.streaming();
             const reader = upstream.body.getReader();
             try {
                 while (true) {
                     const { done, value } = await reader.read();
+                    timeout.touch();
                     if (done)
                         break;
                     if (value)
@@ -182,7 +187,7 @@ export async function forwardToOpenAI(req, res, body, backend, corsOrigin, secur
         res.end();
     }
     catch (err) {
-        clearTimeout(timeout);
+        timeout.clear();
         // Log error details server-side only. Responding with err.message
         // exposes internal stack / path / module information (CodeQL
         // js/stack-trace-exposure). The client gets a generic 502.
@@ -205,6 +210,6 @@ export async function forwardToOpenAI(req, res, body, backend, corsOrigin, secur
         return;
     }
     finally {
-        clearTimeout(timeout);
+        timeout.clear();
     }
 }