@askalf/dario 6.16.0 → 6.17.0

package/dist/analytics.d.ts

@@ -92,11 +92,17 @@ export declare function continuationStats(records: readonly RequestRecord[]): Co
  * - `api`                  — pure API key billing, no subscription involved
  * - `unknown`              — header absent or unparseable (non-200 responses, stream aborts)
  *
+ * A sixth, `credits`, is stamped by the proxy rather than read from a header:
+ * a request the credits rung of the failover chain served on the Console key
+ * in DARIO_CREDITS_API_KEY (credits-rung.ts). Anthropic sends no claim header
+ * on an API key request, and "the operator's own credits rung" is a different
+ * fact from "an unexpected API bill", so it gets its own bucket.
+ *
  * Exposed in `/analytics` summaries and in verbose per-request logs so
  * users can see at a glance which bucket their traffic is actually hitting.
  * See #34 for background.
  */
-export type BillingBucket = 'subscription' | 'subscription_fallback' | 'extra_usage' | 'api' | 'unknown';
+export type BillingBucket = 'subscription' | 'subscription_fallback' | 'extra_usage' | 'api' | 'credits' | 'unknown';
 /**
  * Map the raw `representative-claim` header value to a human-friendly
  * billing bucket. Pure function; no state; safe to call from any context.
@@ -112,6 +118,14 @@ export declare function billingBucketFromClaim(claim: string | null | undefined)
 export declare const SUBSCRIPTION_CLAIMS: ReadonlySet<string>;
 /** The claim the proxy stamps on codex-engine requests (see above). */
 export declare const CODEX_CLAIM = "chatgpt_subscription";
+/**
+ * The claim the proxy stamps on a request the credits rung served
+ * (credits-rung.ts). Not a subscription claim: the request was billed at API
+ * rates against the monthly credit balance, so it lands in its own bucket and
+ * the ledger files it as metered. The overage guard leaves it alone, because
+ * the rung is a chain entry the operator wrote, not a billing surprise.
+ */
+export declare const CREDITS_CLAIM = "anthropic_credits";
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *
@@ -282,6 +296,12 @@ export declare function costOfTokens(model: string, atMs: number, t: {
     cacheReadTokens: number;
     cacheCreateTokens: number;
 }): number;
+/**
+ * Request counts per five-minute bin over the window, oldest bin first; the
+ * newest bin is the one `now` falls in. Records outside the window are left
+ * out, so the bins sum to the window's request count.
+ */
+export declare function binByFiveMinutes(records: RequestRecord[], now: number, windowMinutes: number): number[];
 export declare class Analytics extends EventEmitter {
     private records;
     private maxRecords;
@@ -408,6 +428,8 @@ export interface AnalyticsSummary {
     window: WindowStats & {
         minutes: number;
         requests: number;
+        /** Requests per five-minute bin across the window, oldest first (twelve for the default hour). */
+        perFiveMinutes: number[];
     };
     allTime: WindowStats & {
         requests: number;
@@ -423,7 +445,10 @@ export interface AnalyticsSummary {
     };
     predictions: {
         estimatedExhaustionMinutes: number | null;
+        /** Input and output tokens per minute across the window; cache reads and writes are not in it. */
         tokenBurnRate: number;
+        /** Every kind per minute: input, output, cache reads and cache writes. */
+        totalTokenBurnRate: number;
         costBurnRate: number;
     };
 }

package/dist/analytics.js

@@ -69,6 +69,8 @@ export function billingBucketFromClaim(claim) {
             return 'extra_usage';
         case 'api':
             return 'api';
+        case CREDITS_CLAIM:
+            return 'credits';
         default:
             return 'unknown';
     }
@@ -96,6 +98,14 @@ export const SUBSCRIPTION_CLAIMS = new Set([
 ]);
 /** The claim the proxy stamps on codex-engine requests (see above). */
 export const CODEX_CLAIM = 'chatgpt_subscription';
+/**
+ * The claim the proxy stamps on a request the credits rung served
+ * (credits-rung.ts). Not a subscription claim: the request was billed at API
+ * rates against the monthly credit balance, so it lands in its own bucket and
+ * the ledger files it as metered. The overage guard leaves it alone, because
+ * the rung is a chain entry the operator wrote, not a billing surprise.
+ */
+export const CREDITS_CLAIM = 'anthropic_credits';
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *
@@ -189,6 +199,12 @@ export function consumerFromBody(body) {
 export function isNonSubscriptionBilling(claim) {
     if (!claim || claim === NO_BILLING_CLAIM)
         return false;
+    // The credits rung is metered billing the operator configured by name in
+    // the failover chain and armed with a key; the guard exists for billing
+    // nobody asked for. The claim is still not a subscription claim, so the
+    // bucket math and the ledger keep treating it as paid.
+    if (claim === CREDITS_CLAIM)
+        return false;
     return !SUBSCRIPTION_CLAIMS.has(claim);
 }
 /**
@@ -363,6 +379,22 @@ function estimateCost(record) {
     // estimates each side correctly rather than repricing history at today's rate.
     return costOfTokens(record.model, record.timestamp, record);
 }
+/**
+ * Request counts per five-minute bin over the window, oldest bin first; the
+ * newest bin is the one `now` falls in. Records outside the window are left
+ * out, so the bins sum to the window's request count.
+ */
+export function binByFiveMinutes(records, now, windowMinutes) {
+    const n = Math.max(1, Math.ceil(windowMinutes / 5));
+    const bins = new Array(n).fill(0);
+    for (const r of records) {
+        const age = now - r.timestamp;
+        if (age < 0 || age >= n * 300_000)
+            continue;
+        bins[n - 1 - Math.floor(age / 300_000)]++;
+    }
+    return bins;
+}
 export class Analytics extends EventEmitter {
     records = [];
     maxRecords;
@@ -426,13 +458,18 @@ export class Analytics extends EventEmitter {
         };
     }
     summary(windowMinutes = 60) {
-        const cutoff = Date.now() - windowMinutes * 60_000;
+        const now = Date.now();
+        const cutoff = now - windowMinutes * 60_000;
         const recent = this.records.filter(r => r.timestamp >= cutoff);
         const allTime = this.records;
         return {
             window: {
                 minutes: windowMinutes,
                 requests: recent.length,
+                // The dashboard's sparkline and its "vs prior 30 min" figure need the
+                // whole window; /analytics/stream replays only the last 50 records,
+                // which would show an hour of steady traffic as a late surge.
+                perFiveMinutes: binByFiveMinutes(recent, now, windowMinutes),
                 ...this.computeStats(recent),
             },
             allTime: {
@@ -459,6 +496,7 @@ export class Analytics extends EventEmitter {
                     subscription_fallback: 0,
                     extra_usage: 0,
                     api: 0,
+                    credits: 0,
                     unknown: 0,
                 },
                 subscriptionPercent: 0,
@@ -478,6 +516,7 @@ export class Analytics extends EventEmitter {
             subscription_fallback: 0,
             extra_usage: 0,
             api: 0,
+            credits: 0,
             unknown: 0,
         };
         for (const r of records) {
@@ -601,24 +640,31 @@ export class Analytics extends EventEmitter {
     }
     predict(records) {
         if (records.length < 3) {
-            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, costBurnRate: 0 };
+            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, totalTokenBurnRate: 0, costBurnRate: 0 };
         }
         const sorted = [...records].sort((a, b) => a.timestamp - b.timestamp);
         const first = sorted[0];
         const last = sorted[sorted.length - 1];
         const durationMin = (last.timestamp - first.timestamp) / 60_000;
         if (durationMin < 1) {
-            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, costBurnRate: 0 };
+            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, totalTokenBurnRate: 0, costBurnRate: 0 };
         }
         const totalTokens = sorted.reduce((s, r) => s + r.inputTokens + r.outputTokens, 0);
+        // Every kind the provider counts, for a reader asking "how many tokens a
+        // minute": on a cached prompt the cache reads dwarf input and output.
+        // thinkingTokens is an estimate carved out of outputTokens, not a kind of
+        // its own, so adding it would count that output twice.
+        const allTokens = sorted.reduce((s, r) => s + r.inputTokens + r.outputTokens + r.cacheReadTokens + r.cacheCreateTokens, 0);
         const totalCost = sorted.reduce((s, r) => s + estimateCost(r), 0);
         const tokenBurnRate = totalTokens / durationMin;
+        const totalTokenBurnRate = allTokens / durationMin;
         const costBurnRate = (totalCost / durationMin) * 60;
         const currentUtil = last.util5h;
         if (currentUtil >= 0.95) {
             return {
                 estimatedExhaustionMinutes: 0,
                 tokenBurnRate: Math.round(tokenBurnRate),
+                totalTokenBurnRate: Math.round(totalTokenBurnRate),
                 costBurnRate: Math.round(costBurnRate * 100) / 100,
             };
         }
@@ -627,6 +673,7 @@ export class Analytics extends EventEmitter {
             return {
                 estimatedExhaustionMinutes: null,
                 tokenBurnRate: Math.round(tokenBurnRate),
+                totalTokenBurnRate: Math.round(totalTokenBurnRate),
                 costBurnRate: Math.round(costBurnRate * 100) / 100,
             };
         }
@@ -634,6 +681,7 @@ export class Analytics extends EventEmitter {
         return {
             estimatedExhaustionMinutes: Math.round(minutesToExhaustion),
             tokenBurnRate: Math.round(tokenBurnRate),
+            totalTokenBurnRate: Math.round(totalTokenBurnRate),
             costBurnRate: Math.round(costBurnRate * 100) / 100,
         };
     }

package/dist/cli.js

@@ -2294,6 +2294,15 @@ async function help() {
                              Needs one of those configured. Empty value
                              disables. Env: DARIO_POOL_FALLBACK. Config:
                              poolFallback.model.
+                             An entry written credits:<model> is a rung on
+                             the API credits a Max plan includes: with
+                             DARIO_CREDITS_API_KEY set (env only, never a
+                             flag) the request goes to the Claude API on
+                             that key as <model>, both wire shapes, after
+                             every seat and subscription rung; /analytics
+                             and the dashboard file it under credits, the
+                             ledger counts it as metered. Without the key
+                             the entry is inert and dario doctor says so.
     --family-fallback=<family=model,...>
                              When every pool seat is parked for a model
                              family, serve its requests as <model> on the

package/dist/credits-rung.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The credits rung of the failover chain.
+ *
+ * Since October 2026 a Max plan includes monthly Claude API credits ($100 on
+ * Max 5x, $200 on Max 20x). They are spent through a Console API key of the
+ * organization the plan is linked to, not through the seat's own five-hour
+ * and weekly windows, so until now the only ways to spend them through dario
+ * were ANTHROPIC_UPSTREAM_API_KEY (the whole Claude backend on the key, pool
+ * bypassed) or an OpenAI-compat backend pointed at Anthropic's compatibility
+ * layer, which Anthropic describes as a layer for testing models.
+ *
+ * A chain entry written `credits:<model>` names the key as a rung. When every
+ * seat is drained or cooling and no subscription rung can serve, the request
+ * goes to api.anthropic.com on the Messages path as a plain API request: the
+ * client's own body with the model swapped, `x-api-key`, no Claude Code
+ * template and no OAuth beta. Both wire shapes work, because the Claude path
+ * already translates OpenAI-shape requests and responses. The response says
+ * `x-dario-pool-fallback: credits:<model>`; the rolling window, `/metrics`
+ * and the dashboard file the request under its own billing bucket, `credits`,
+ * next to extra usage and API key; the persistent ledger counts it in its
+ * metered total, as spent; and the overage guard does not halt on it: a rung
+ * the operator configured is not a surprise bill.
+ *
+ * The key comes from DARIO_CREDITS_API_KEY only, never a flag, so it never
+ * lands in argv. The rung is opt-in twice: the entry must be in the chain AND
+ * the key must be set. Without the key the entry is inert, the proxy says so
+ * at startup and `dario doctor` says so in its Failover line.
+ *
+ * Where it sits: a subscription rung (a Codex account that lists an entry)
+ * always goes first, because the plan is the thing dario exists to spend.
+ * Among the metered rungs, this one and the openai-compat backend, the
+ * chain's own left-to-right order decides.
+ */
+import { type ClaudeTarget, type ModelResolver } from './claude-model.js';
+export declare const CREDITS_PREFIX = "credits:";
+/** The analytics `account` of a request the credits rung served. */
+export declare const ACCOUNT_KEY_CREDITS = "__credits__";
+/** The value of `x-dario-pool-fallback` on a response the rung served. */
+export declare function creditsFallbackMarker(model: string): string;
+export declare function isCreditsEntry(entry: string): boolean;
+/** The model half of a `credits:<model>` entry as written; null for any other entry. */
+export declare function creditsEntryModel(entry: string): string | null;
+/** Every credits entry's model as written, in chain order. */
+export declare function creditsEntries(chain: readonly string[]): string[];
+/** The chain without its credits entries: what the subscription and openai-compat rungs read. */
+export declare function withoutCreditsEntries(chain: readonly string[]): string[];
+/**
+ * True when the credits rung is asked before the openai-compat backend: the
+ * first credits entry precedes every plain entry, or there is no plain entry.
+ * False when the chain has no credits entry at all.
+ */
+export declare function creditsBeforePlain(chain: readonly string[]): boolean;
+/**
+ * The first credits entry the Claude catalog can serve, resolved exactly like
+ * a Claude chain entry: aliases (`credits:sonnet`), a provider prefix
+ * (`credits:anthropic:claude-opus-5`) and an effort suffix spelled the way a
+ * Claude entry spells it (`credits:claude:opus:high`, `credits:claude-opus-5-high`)
+ * all work, and a name the catalog does not list is skipped rather than sent, so
+ * a typo cannot trade a recoverable 429 for a 404 billed to the key.
+ */
+export declare function pickCreditsTarget(chain: readonly string[], bases?: readonly string[], resolve?: ModelResolver): ClaudeTarget | null;
+/**
+ * Outbound headers for a credits request: the headers a plain API client
+ * sends and nothing of Claude Code's identity. The client's own betas go
+ * through minus the OAuth flag, which an API key request must not carry.
+ */
+export declare function creditsHeaders(key: string, clientBeta: string | undefined, anthropicVersion?: string): Record<string, string>;
+/**
+ * One phrase for the startup line and `dario doctor`, or null when the chain
+ * names no credits entry.
+ */
+export declare function describeCreditsRung(chain: readonly string[], hasKey: boolean): string | null;

package/dist/credits-rung.js

@@ -0,0 +1,133 @@
+/**
+ * The credits rung of the failover chain.
+ *
+ * Since October 2026 a Max plan includes monthly Claude API credits ($100 on
+ * Max 5x, $200 on Max 20x). They are spent through a Console API key of the
+ * organization the plan is linked to, not through the seat's own five-hour
+ * and weekly windows, so until now the only ways to spend them through dario
+ * were ANTHROPIC_UPSTREAM_API_KEY (the whole Claude backend on the key, pool
+ * bypassed) or an OpenAI-compat backend pointed at Anthropic's compatibility
+ * layer, which Anthropic describes as a layer for testing models.
+ *
+ * A chain entry written `credits:<model>` names the key as a rung. When every
+ * seat is drained or cooling and no subscription rung can serve, the request
+ * goes to api.anthropic.com on the Messages path as a plain API request: the
+ * client's own body with the model swapped, `x-api-key`, no Claude Code
+ * template and no OAuth beta. Both wire shapes work, because the Claude path
+ * already translates OpenAI-shape requests and responses. The response says
+ * `x-dario-pool-fallback: credits:<model>`; the rolling window, `/metrics`
+ * and the dashboard file the request under its own billing bucket, `credits`,
+ * next to extra usage and API key; the persistent ledger counts it in its
+ * metered total, as spent; and the overage guard does not halt on it: a rung
+ * the operator configured is not a surprise bill.
+ *
+ * The key comes from DARIO_CREDITS_API_KEY only, never a flag, so it never
+ * lands in argv. The rung is opt-in twice: the entry must be in the chain AND
+ * the key must be set. Without the key the entry is inert, the proxy says so
+ * at startup and `dario doctor` says so in its Failover line.
+ *
+ * Where it sits: a subscription rung (a Codex account that lists an entry)
+ * always goes first, because the plan is the thing dario exists to spend.
+ * Among the metered rungs, this one and the openai-compat backend, the
+ * chain's own left-to-right order decides.
+ */
+import { resolveClaudeTarget } from './claude-model.js';
+export const CREDITS_PREFIX = 'credits:';
+/** The analytics `account` of a request the credits rung served. */
+export const ACCOUNT_KEY_CREDITS = '__credits__';
+/** The OAuth-enablement beta a plain API request must not carry. */
+const OAUTH_BETA = 'oauth-2025-04-20';
+/** The value of `x-dario-pool-fallback` on a response the rung served. */
+export function creditsFallbackMarker(model) {
+    return `${CREDITS_PREFIX}${model}`;
+}
+export function isCreditsEntry(entry) {
+    return entry.trim().toLowerCase().startsWith(CREDITS_PREFIX);
+}
+/** The model half of a `credits:<model>` entry as written; null for any other entry. */
+export function creditsEntryModel(entry) {
+    const e = entry.trim();
+    if (!e.toLowerCase().startsWith(CREDITS_PREFIX))
+        return null;
+    const model = e.slice(CREDITS_PREFIX.length).trim();
+    return model || null;
+}
+/** Every credits entry's model as written, in chain order. */
+export function creditsEntries(chain) {
+    const out = [];
+    for (const entry of chain) {
+        const model = creditsEntryModel(entry);
+        if (model)
+            out.push(model);
+    }
+    return out;
+}
+/** The chain without its credits entries: what the subscription and openai-compat rungs read. */
+export function withoutCreditsEntries(chain) {
+    return chain.filter((entry) => !isCreditsEntry(entry));
+}
+/**
+ * True when the credits rung is asked before the openai-compat backend: the
+ * first credits entry precedes every plain entry, or there is no plain entry.
+ * False when the chain has no credits entry at all.
+ */
+export function creditsBeforePlain(chain) {
+    const credits = chain.findIndex((entry) => isCreditsEntry(entry));
+    if (credits < 0)
+        return false;
+    const plain = chain.findIndex((entry) => !isCreditsEntry(entry));
+    return plain < 0 || credits < plain;
+}
+/**
+ * The first credits entry the Claude catalog can serve, resolved exactly like
+ * a Claude chain entry: aliases (`credits:sonnet`), a provider prefix
+ * (`credits:anthropic:claude-opus-5`) and an effort suffix spelled the way a
+ * Claude entry spells it (`credits:claude:opus:high`, `credits:claude-opus-5-high`)
+ * all work, and a name the catalog does not list is skipped rather than sent, so
+ * a typo cannot trade a recoverable 429 for a 404 billed to the key.
+ */
+export function pickCreditsTarget(chain, bases, resolve) {
+    for (const entry of chain) {
+        const model = creditsEntryModel(entry);
+        if (!model)
+            continue;
+        const target = resolveClaudeTarget(model, bases, resolve);
+        if (target)
+            return target;
+    }
+    return null;
+}
+/**
+ * Outbound headers for a credits request: the headers a plain API client
+ * sends and nothing of Claude Code's identity. The client's own betas go
+ * through minus the OAuth flag, which an API key request must not carry.
+ */
+export function creditsHeaders(key, clientBeta, anthropicVersion = '2023-06-01') {
+    const headers = {
+        'accept': 'application/json',
+        'Content-Type': 'application/json',
+        'x-api-key': key,
+        'anthropic-version': anthropicVersion,
+    };
+    const beta = (clientBeta ?? '')
+        .split(',')
+        .map((b) => b.trim())
+        .filter((b) => b.length > 0 && b !== OAUTH_BETA)
+        .join(',');
+    if (beta)
+        headers['anthropic-beta'] = beta;
+    return headers;
+}
+/**
+ * One phrase for the startup line and `dario doctor`, or null when the chain
+ * names no credits entry.
+ */
+export function describeCreditsRung(chain, hasKey) {
+    const credits = creditsEntries(chain);
+    if (credits.length === 0)
+        return null;
+    const model = credits[0];
+    return hasKey
+        ? `API credits as ${model} (x-api-key on the Messages path, both wire shapes, billing bucket credits, metered in the ledger)`
+        : `credits:${model} named but DARIO_CREDITS_API_KEY is not set, so that rung is inert`;
+}

package/dist/doctor-core.d.ts

@@ -83,6 +83,8 @@ export declare function failoverReadiness(input: {
     chain: readonly string[];
     codexAccounts: number;
     backends: readonly string[];
+    /** DARIO_CREDITS_API_KEY is set (the credits rung, credits-rung.ts). */
+    creditsKey?: boolean;
 }): {
     status: CheckStatus;
     detail: string;

package/dist/doctor-core.js

@@ -12,6 +12,7 @@
  */
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
 import { maskEmail } from './pool.js';
+import { creditsEntries, withoutCreditsEntries } from './credits-rung.js';
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -111,36 +112,71 @@ function describeAge(ms) {
 }
 export function failoverReadiness(input) {
     const { chain, codexAccounts, backends } = input;
+    const creditsKey = input.creditsKey === true;
     const hasCodex = codexAccounts > 0;
     const hasBackend = backends.length > 0;
+    // The subscription and openai-compat rungs read the chain without its
+    // credits entries; the credits rung is reported on the end of whichever
+    // verdict those earn.
+    const plain = withoutCreditsEntries(chain);
+    const credits = creditsEntries(chain);
+    const creditsArmed = credits.length > 0 && creditsKey;
+    const creditsNote = credits.length > 0
+        ? (creditsKey
+            ? ` Then API credits as ${credits[0]} on DARIO_CREDITS_API_KEY (billing bucket credits, metered in the ledger).`
+            : ` credits:${credits[0]} is in the chain but DARIO_CREDITS_API_KEY is not set, so that rung is inert.`)
+        : (creditsKey ? ' DARIO_CREDITS_API_KEY is set but no chain entry names credits:<model>, so nothing spends it.' : '');
     if (chain.length === 0) {
-        return { status: 'info', detail: 'off — a drained Claude pool returns 429/503 (--pool-fallback to arm)' };
+        return { status: 'info', detail: 'off: a drained Claude pool returns 429/503 (--pool-fallback to arm)' + creditsNote };
+    }
+    if (plain.length === 0) {
+        // Nothing but credits entries: the rung is the whole chain.
+        if (creditsArmed) {
+            return {
+                status: 'ok',
+                detail: `claude → API credits as ${credits[0]} (x-api-key on the Messages path, both wire shapes, billing bucket credits, metered in the ledger). `
+                    + 'Metered: add a Codex account (`dario add altman`) to the chain to spend a subscription first.',
+            };
+        }
+        return {
+            status: 'warn',
+            detail: `armed (${chain.join(' → ')}) but INERT: DARIO_CREDITS_API_KEY is not set. Set it (env only, never a flag) `
+                + 'to arm the credits rung, or add a subscription rung: `dario add altman`.',
+        };
     }
     if (!hasCodex && !hasBackend) {
+        if (creditsArmed) {
+            return {
+                status: 'ok',
+                detail: `claude → API credits as ${credits[0]} (both wire shapes, billing bucket credits, metered in the ledger). `
+                    + `${plain.join(' → ')} has no Codex account and no backend to serve it; add one `
+                    + '(`dario add altman` for a subscription, `dario backend add …` for an api key) to spend it before the key.',
+            };
+        }
         return {
             status: 'warn',
-            detail: `armed (${chain.join(' → ')}) but INERT — no Codex account and no backend to fall back to. `
-                + 'Add one: `dario add altman` (subscription) or `dario backend add …` (api key).',
+            detail: `armed (${chain.join(' → ')}) but INERT: no Codex account and no backend to fall back to. `
+                + 'Add one: `dario add altman` (subscription) or `dario backend add …` (api key).' + creditsNote,
         };
     }
-    if (hasCodex && chain.length > 1) {
+    if (hasCodex && plain.length > 1) {
         return {
             status: 'ok',
-            detail: `symmetric: ${chain.join(' → ')}, across ${codexAccounts} Codex account`
-                + `${codexAccounts === 1 ? '' : 's'}${hasBackend ? ` + ${backends.length} backend(s)` : ''}`,
+            detail: `symmetric: ${plain.join(' → ')}, across ${codexAccounts} Codex account`
+                + `${codexAccounts === 1 ? '' : 's'}${hasBackend ? ` + ${backends.length} backend(s)` : ''}.` + creditsNote,
         };
     }
     if (hasCodex) {
         return {
             status: 'ok',
-            detail: `claude → codex as ${chain[0]} (both wire shapes). One-way — add a Claude model to `
-                + 'the chain (--pool-fallback=a,b) to cover a rate-limited ChatGPT plan too.',
+            detail: `claude → codex as ${plain[0]} (both wire shapes). One-way: add a Claude model to `
+                + 'the chain (--pool-fallback=a,b) to cover a rate-limited ChatGPT plan too.' + creditsNote,
         };
     }
     return {
         status: 'ok',
-        detail: `claude → ${backends[0]} as ${chain[0]} — OpenAI path only. A Codex account would `
-            + 'extend it to Anthropic-shape clients (Claude Code, agent runtimes).',
+        detail: `claude → ${backends[0]} as ${plain[0]}, OpenAI path only. A Codex account would `
+            + 'extend it to Anthropic-shape clients (Claude Code, agent runtimes).' + creditsNote,
     };
 }
 /**
@@ -1252,6 +1288,7 @@ export async function runChecks(opts = {}) {
             chain,
             codexAccounts: codexAliases.length,
             backends: backends.map((b) => b.name),
+            creditsKey: (process.env.DARIO_CREDITS_API_KEY ?? '').trim().length > 0,
         });
         checks.push({ status: verdict.status, label: 'Failover', detail: verdict.detail });
         const midstreamEnabled = !['0', 'false', 'no', 'off'].includes((process.env.DARIO_MIDSTREAM_CONTINUE ?? '').toLowerCase());

package/dist/donuts.d.ts

@@ -1,15 +1,3 @@
-/**
- * Spend donuts — where the API-equivalent number comes from, as shares.
- *
- * Three rings from the ledger, no new data: by model, by consumer (named
- * key / `x-dario-consumer`), and covered-vs-metered. Rendered as one SVG
- * (`dario usage --donut`, `GET /analytics/donuts.svg`) and inside the
- * server-rendered `/analytics/view` fragment that the `/analytics/ui` shell
- * page loads. Same palette and frame as the share card in ledger.ts.
- *
- * Pure over a LedgerSummary / AnalyticsSummary so the geometry is testable
- * without a proxy.
- */
 import type { LedgerSummary } from './ledger.js';
 import type { AnalyticsSummary } from './analytics.js';
 import type { QueueSnapshot } from './request-queue.js';
@@ -35,12 +23,25 @@ export declare function renderSpendDonuts(s: LedgerSummary): string;
 /**
  * The server-rendered fragment behind `/analytics/ui`: headline, the three
  * rings, the rolling window, and a per-model table. Same gate as
- * `/analytics`; the shell page fetches it with the token the viewer typed.
+ * `/analytics`; the page before 6.17 fetched it with the token the viewer typed; it is still served.
  */
 export declare function renderAnalyticsView(summary: AnalyticsView, lifetime: LedgerSummary | null, version: string): string;
 /**
- * The static shell for `/analytics/ui`. Carries NO data — it is safe to
- * serve without auth — and asks the viewer for the token once (kept in
- * sessionStorage), then fetches `/analytics/view` every 60 s with it.
+ * A reader of the dashboard page that reads it once: the first read that succeeds is kept for
+ * every call after it. A failed read answers with the missing-file page and keeps nothing, so
+ * copying the file in takes effect on the next request without a restart. The reader is a
+ * parameter so the test can count the reads.
+ */
+export declare function analyticsUiLoader(read: () => string): () => string;
+/**
+ * The dashboard behind `/analytics/ui`: `dist/analytics-ui.html`, copied from `src/` by the
+ * build and read once, on the first request. It carries no data and no credential. It asks for
+ * the analytics token or an API key once (kept in sessionStorage) and reads `/analytics`,
+ * `/accounts`, `/codex`, `/health`, `/analytics/ledger` and `/admin/keys` with it, and tails
+ * `/analytics/stream`; it loads nothing from outside the proxy. The
+ * `window.DARIO_COCKPIT = "served"` line in its head tells the page a proxy is serving it, so it
+ * goes live at once; the same file opened from disk runs on sample data, because the page checks
+ * the protocol before the marker. `/analytics/view` and the rings above are unchanged for the CLI
+ * and for anything that embedded them.
  */
-export declare const ANALYTICS_UI_SHELL = "<!doctype html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>dario analytics</title>\n<style>\n  :root{color-scheme:dark}\n  body{margin:0;background:#0a0a0f;color:#e5e7eb;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,\"Liberation Mono\",monospace;font-size:14px}\n  header{display:flex;gap:12px;align-items:center;padding:14px 20px;border-bottom:1px solid #1f2937;background:linear-gradient(90deg,#7c3aed,#db2777) top/100% 4px no-repeat,#0a0a0f}\n  header h1{font-size:14px;letter-spacing:2px;margin:0;color:#9ca3af;font-weight:600}\n  header input{background:#111827;color:#e5e7eb;border:1px solid #374151;border-radius:6px;padding:6px 10px;font:inherit;width:22em}\n  header button{background:#7c3aed;color:#fff;border:0;border-radius:6px;padding:6px 12px;font:inherit;cursor:pointer}\n  #status{color:#9ca3af;margin-left:auto}\n  main{padding:20px;max-width:1100px;margin:0 auto}\n  .headline{font-size:34px;font-weight:700;color:#fff;margin:6px 0 16px}\n  .headline span{display:block;font-size:13px;font-weight:400;color:#9ca3af;margin-top:4px}\n  .headline.muted{color:#6b7280}\n  .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-bottom:18px}\n  .stat{background:#111827;border:1px solid #1f2937;border-radius:12px;padding:12px 14px}\n  .stat .v{font-size:20px;font-weight:700;color:#fff}.stat .l{font-size:11px;color:#9ca3af;margin-top:2px}\n  .rings svg{width:100%;max-width:640px;height:auto;display:block;margin:0 auto 18px}\n  table{width:100%;border-collapse:collapse;margin:0 0 18px;font-size:12px}\n  th,td{text-align:right;padding:6px 8px;border-bottom:1px solid #1f2937}th:first-child,td:first-child{text-align:left}\n  th{color:#9ca3af;font-weight:500}\n  .foot{color:#6b7280;font-size:11px}\n  .err{color:#fca5a5;padding:20px;background:#1f1115;border:1px solid #7f1d1d;border-radius:12px}\n</style></head>\n<body>\n<header><h1>DARIO ANALYTICS</h1>\n  <input id=\"tok\" type=\"password\" placeholder=\"analytics token or API key (blank on an unkeyed proxy)\" autocomplete=\"off\">\n  <button id=\"go\">connect</button><span id=\"status\"></span></header>\n<main id=\"view\"></main>\n<script>\n(function(){\n  var tok=document.getElementById('tok'),view=document.getElementById('view'),status=document.getElementById('status'),timer=null;\n  try{tok.value=sessionStorage.getItem('dario.analytics.token')||''}catch(e){}\n  function headers(){var h={};if(tok.value)h['Authorization']='Bearer '+tok.value;return h}\n  function load(){\n    fetch('/analytics/view',{headers:headers(),cache:'no-store'}).then(function(r){\n      if(r.status===401){view.innerHTML='<div class=\"err\">401 \u2014 this proxy is keyed. Paste its analytics token (DARIO_ANALYTICS_TOKEN) or API key above.</div>';status.textContent='';return}\n      if(!r.ok){view.innerHTML='<div class=\"err\">'+r.status+' from /analytics/view</div>';return}\n      return r.text().then(function(html){view.innerHTML=html;status.textContent='live \u00B7 refreshes every 60 s';try{sessionStorage.setItem('dario.analytics.token',tok.value)}catch(e){}})\n    }).catch(function(e){view.innerHTML='<div class=\"err\">'+String(e)+'</div>'});\n  }\n  function start(){if(timer)clearInterval(timer);load();timer=setInterval(load,60000)}\n  document.getElementById('go').addEventListener('click',start);\n  tok.addEventListener('keydown',function(e){if(e.key==='Enter')start()});\n  start();\n})();\n</script>\n</body></html>\n";
+export declare const analyticsUiPage: () => string;