@askalf/dario 6.16.0 → 6.17.0

package/dist/proxy.js

@@ -19,10 +19,10 @@ import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion }
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, parsePoolHeadroomFloor, describePoolStrategy, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail } from './pool.js';
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
-import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
+import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM, CREDITS_CLAIM } from './analytics.js';
 import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { renderPrometheus } from './metrics.js';
-import { renderSpendDonuts, renderAnalyticsView, ANALYTICS_UI_SHELL } from './donuts.js';
+import { renderSpendDonuts, renderAnalyticsView, analyticsUiPage } from './donuts.js';
 import { KeyStore, keyAllowsModel, resolveKeysPath, looksLikeNamedKey, budgetVerdict, budgetHeaders, requestBudgetReservation, addReservation, subtractReservation, EMPTY_RESERVATION } from './keys.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
@@ -56,6 +56,7 @@ import { codexUsageView, resolveCodexUsagePollMs } from './codex-usage.js';
 import { seedStaleCodexUsage } from './codex-backend.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
+import { ACCOUNT_KEY_CREDITS, creditsBeforePlain, creditsEntries, creditsFallbackMarker, creditsHeaders, describeCreditsRung, pickCreditsTarget, withoutCreditsEntries } from './credits-rung.js';
 import { parseFamilyFallback, familyFallbackModel, describeFamilyFallback } from './family-fallback.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS, resolveMaxConcurrent } from './request-queue.js';
 import { waitForIdle, drainThenClose, shutdownTimers, DEFAULT_SHUTDOWN_GRACE_MS } from './shutdown-drain.js';
@@ -1349,6 +1350,9 @@ export async function startProxy(opts = {}) {
     const upstreamFetch = chaosCut && chaosState ? chaosCutFetch(opts.fetchImpl ?? fetch, chaosCut, chaosState) : (opts.fetchImpl ?? fetch);
     const codexFetch = chaosCut && chaosState ? chaosCutFetch(fetch, chaosCut, chaosState) : fetch;
     const upstreamApiKey = (opts.upstreamApiKey ?? process.env.ANTHROPIC_UPSTREAM_API_KEY ?? '').trim();
+    // The credits rung's key (credits-rung.ts). Read once here; whether it is
+    // ever used depends on the chain naming a `credits:<model>` entry.
+    const creditsApiKey = (opts.creditsApiKey ?? process.env.DARIO_CREDITS_API_KEY ?? '').trim();
     if (upstreamApiKey)
         console.error('[dario] upstream auth: per-token API key (x-api-key) — OAuth/Max + account pool bypassed');
     else if (ignoreCcCredentials())
@@ -1555,17 +1559,37 @@ export async function startProxy(opts = {}) {
         }
     };
     if (poolFallbackModel) {
+        // The rungs in the order they are asked: the subscription first, then the
+        // metered rungs (the credits key and the openai-compat backend) in the
+        // chain's own order. A `credits:` entry is not a model the other rungs
+        // can serve, so their model is the first plain entry.
+        const plainFallbackModel = withoutCreditsEntries(poolFallbackModels)[0] ?? null;
+        const creditsLine = describeCreditsRung(poolFallbackModels, creditsApiKey.length > 0);
+        const creditsArmed = creditsLine !== null && creditsApiKey.length > 0;
         const targets = [];
-        if (startupCodexAliases.length > 0)
-            targets.push(`codex subscription (${startupCodexAliases.join(', ')}) — both wire shapes`);
-        if (openaiBackend)
-            targets.push(`${openaiBackend.name} — OpenAI shape only`);
+        if (startupCodexAliases.length > 0 && plainFallbackModel)
+            targets.push(`codex subscription (${startupCodexAliases.join(', ')}) as ${plainFallbackModel}, both wire shapes`);
+        const metered = [];
+        if (openaiBackend && plainFallbackModel)
+            metered.push(`${openaiBackend.name} as ${plainFallbackModel}, OpenAI shape only`);
+        if (creditsArmed) {
+            if (creditsBeforePlain(poolFallbackModels))
+                metered.unshift(creditsLine);
+            else
+                metered.push(creditsLine);
+        }
+        targets.push(...metered);
         if (targets.length > 0) {
-            console.log(`  Pool fallback: exhausted-pool requests → ${targets.join(', then ')} as ${poolFallbackModel} (marked x-dario-pool-fallback)`);
+            console.log(`  Pool fallback: exhausted-pool requests → ${targets.join(', then ')} (marked x-dario-pool-fallback)`);
         }
         else {
-            console.warn('[dario] --pool-fallback is set but there is nothing to fall back TO — add a Codex account (`dario codex add …`) or an OpenAI-compat backend (`dario backend add …`). Fallback is inert.');
+            console.warn('[dario] --pool-fallback is set but there is nothing to fall back TO: add a Codex account (`dario codex add …`), an OpenAI-compat backend (`dario backend add …`), or a credits:<model> entry with DARIO_CREDITS_API_KEY set. Fallback is inert.');
         }
+        if (creditsLine && !creditsArmed)
+            console.warn(`[dario] --pool-fallback ${creditsLine}`);
+    }
+    else if (creditsApiKey) {
+        console.warn('[dario] DARIO_CREDITS_API_KEY is set but no --pool-fallback entry names credits:<model>, so nothing spends it');
     }
     // Family fallback (strictly opt-in, family-fallback.ts). Bad entries are
     // dropped with a warning; the rest still apply.
@@ -2479,7 +2503,9 @@ export async function startProxy(opts = {}) {
         //
         // With NO next option and no peer, do not defer: the real upstream error is
         // more useful to the client than replacing it with a generic 503.
-        const hasNextOption = openaiBackend !== null && shape === 'openai';
+        // An armed credits rung is a next option on both wire shapes.
+        const hasNextOption = (openaiBackend !== null && shape === 'openai')
+            || (creditsApiKey.length > 0 && creditsEntries(fallbackModels).length > 0);
         // The next seat that could serve one of these fallback models, excluding
         // everything already tried. `peek` is the cached read, so the scan costs no
         // upstream call; a seat whose model list is unknown is still worth a try.
@@ -2577,21 +2603,37 @@ export async function startProxy(opts = {}) {
      * bug structurally impossible to reintroduce: a future third call site gets
      * this by construction, not by remembering to copy six lines correctly.
      */
-    const attemptPoolFallbackOn429 = async (req, res, body, isOpenAI, attempted, timing) => {
-        if (await tryCodexPoolFallback(req, res, body, selectPoolFallbackForBody(body), isOpenAI ? 'openai' : 'anthropic', 'pool exhausted mid-flight (429, no peer)', attempted, timing)) {
-            return true;
+    const attemptPoolFallbackOn429 = async (req, res, body, isOpenAI, attempted, timing, 
+    /**
+     * Re-arm THIS request on the credits rung (credits-rung.ts): returns true
+     * once the request is re-pointed at the key, and the caller re-enters its
+     * dispatch loop. Absent on a site that cannot re-dispatch.
+     */
+    armCredits) => {
+        const chain = selectPoolFallbackForBody(body);
+        if (await tryCodexPoolFallback(req, res, body, chain, isOpenAI ? 'openai' : 'anthropic', 'pool exhausted mid-flight (429, no peer)', attempted, timing)) {
+            return 'served';
         }
-        const fallbackModel = selectPoolFallbackForBody(body)[0] ?? null;
-        if (isOpenAI && fallbackModel && openaiBackend) {
-            const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
+        // The metered rungs, in the chain's own order. The credits rung is never
+        // asked twice in one request: a 429 from the key falls through to the
+        // openai-compat backend or to the honest 429.
+        const plainModel = withoutCreditsEntries(chain)[0] ?? null;
+        const creditsFirst = creditsBeforePlain(chain);
+        const tryCredits = () => armCredits !== undefined && !attempted.has('credits') && armCredits();
+        if (creditsFirst && tryCredits())
+            return 'credits';
+        if (isOpenAI && plainModel && openaiBackend) {
+            const fallbackBody = buildPoolFallbackBody(body, plainModel);
             if (fallbackBody) {
-                console.log(`[dario] #${requestCount} pool exhausted mid-flight (429, no peer) → ${openaiBackend.name} as ${fallbackModel}`);
+                console.log(`[dario] #${requestCount} pool exhausted mid-flight (429, no peer) → ${openaiBackend.name} as ${plainModel}`);
                 requestCount++;
-                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose);
-                return true;
+                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': plainModel }, upstreamTimeoutMs, verbose);
+                return 'served';
             }
         }
-        return false;
+        if (!creditsFirst && tryCredits())
+            return 'credits';
+        return 'none';
     };
     const server = createServer(async (req, res) => {
         // The request's first stamp (src/timing.ts): every split below is
@@ -2829,11 +2871,12 @@ export async function startProxy(opts = {}) {
             if (handled)
                 return;
         }
-        // The dashboard shell carries no data, so it needs no credential: it is
-        // the page that ASKS for the token and then fetches /analytics/view.
+        // The dashboard page carries no data, so it needs no credential: it asks
+        // for the token, then reads /analytics, /accounts, /codex, /health, the
+        // ledger and the keys with it and tails /analytics/stream (donuts.ts).
         if (urlPath === '/analytics/ui' && req.method === 'GET') {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', ...SECURITY_HEADERS });
-            res.end(ANALYTICS_UI_SHELL);
+            res.end(analyticsUiPage());
             return;
         }
         // Read-only analytics token: accepted on the read-only surfaces only, and
@@ -3013,7 +3056,11 @@ export async function startProxy(opts = {}) {
             // `queue` rides along the summary (dario#905): request-queue.ts always
             // documented snapshot() as "exposed for /analytics", but it was never
             // actually wired in, so slot exhaustion was invisible from outside.
-            res.end(JSON.stringify({ ...analytics.summary(), queue: queue.snapshot(), lifetime: ledger ? ledger.summary() : null, budgets: keyBudgetsSnapshot() }));
+            // `overage` is the halt state for every reader of this route (the
+            // dashboard, dario#1734): the stream replays a halt only while one is
+            // in force and the analytics token cannot read /admin/resume, so a
+            // viewer that saw the halt and missed the resume resyncs from here.
+            res.end(JSON.stringify({ ...analytics.summary(), queue: queue.snapshot(), overage: { halted: overageGuard.isHalted(), state: overageGuard.state() }, lifetime: ledger ? ledger.summary() : null, budgets: keyBudgetsSnapshot() }));
             return;
         }
         // Prometheus text exposition of the same state (dario#1341). A view, not
@@ -3052,7 +3099,9 @@ export async function startProxy(opts = {}) {
             return;
         }
         // The ledger's per-day table, for anyone charting it. `lifetime` on
-        // /analytics is the summary; this is the data behind it.
+        // /analytics is the summary; this is the data behind it. `priced` is the
+        // same rows as USD at each day's rate (ledger.ts), so a reader, the
+        // dashboard first, never needs a price list of its own.
         if (urlPath === '/analytics/ledger' && req.method === 'GET') {
             if (!ledger) {
                 res.writeHead(404, JSON_HEADERS);
@@ -3060,7 +3109,7 @@ export async function startProxy(opts = {}) {
                 return;
             }
             res.writeHead(200, JSON_HEADERS);
-            res.end(JSON.stringify({ path: ledger.path, ...ledger.snapshot() }));
+            res.end(JSON.stringify({ path: ledger.path, ...ledger.snapshot(), priced: ledger.priced() }));
             return;
         }
         // Analytics live stream — SSE of new RequestRecord JSON, one event
@@ -3372,6 +3421,17 @@ export async function startProxy(opts = {}) {
             // form gives the declared type without seeding a narrowing.
             let poolAccount = null;
             let accessToken = '';
+            // Set when the credits rung (credits-rung.ts) is serving this request:
+            // the Claude path then runs on the key instead of a seat. The same `as`
+            // form as poolAccount, for the same narrowing reason.
+            let creditsRung = null;
+            // The account an analytics record names: the seat, the credits rung, or
+            // the api-key slot. A function because a mid-flight 429 can move the
+            // request from a seat to the credits rung after the first attempt.
+            const accountKeyNow = () => creditsRung ? ACCOUNT_KEY_CREDITS : (poolAccount?.alias ?? ACCOUNT_KEY_APIKEY);
+            // The claim a record carries: Anthropic sends none on an API key
+            // request, so the credits rung stamps its own, as the codex engine does.
+            const claimNow = (rl) => creditsRung ? CREDITS_CLAIM : rl.claim;
             // Providers this ONE request has already asked. Paired with the
             // process-wide cool-downs: the set stops a revisit inside the request,
             // the cool-downs stop the next request repeating the discovery.
@@ -3575,7 +3635,11 @@ export async function startProxy(opts = {}) {
                     //
                     // An EMPTY pool still 503s: that's a setup error the operator needs to
                     // see, not traffic to quietly re-bill somewhere else.
-                    const fallbackViable = poolFallbackModels.length > 0 && pool.size > 0;
+                    // A chain whose only entries are credits rungs without the key is
+                    // inert and defers nothing: the honest 429/503 stands.
+                    const chainCanServe = withoutCreditsEntries(poolFallbackModels).length > 0
+                        || (creditsApiKey.length > 0 && creditsEntries(poolFallbackModels).length > 0);
+                    const fallbackViable = chainCanServe && pool.size > 0;
                     if (!fallbackViable) {
                         if (parkedUntil !== null)
                             writePoolParked(parkedUntil);
@@ -4556,6 +4620,30 @@ export async function startProxy(opts = {}) {
             }
             if (!selectPoolAccount())
                 return;
+            // The credits rung (credits-rung.ts): re-point THIS request at the key
+            // as the first `credits:<model>` entry the catalog can serve. False when
+            // the chain names no such entry, the key is unset, the request is pinned
+            // to a seat, or the rung already answered this request. The response is
+            // marked here, before any byte of the answer, and the Claude path below
+            // then runs on the key: `x-api-key`, the client's own body, no template.
+            const armCreditsRung = (why) => {
+                if (!creditsApiKey || creditsRung || pinnedAccount || attemptedProviders.has('credits'))
+                    return false;
+                const target = pickCreditsTarget(selectPoolFallbackForBody(body), getCachedBases(), (m) => resolveClaudeAlias(applyModelAlias(m, modelAliases) ?? m));
+                if (!target)
+                    return false;
+                attemptedProviders.add('credits');
+                creditsRung = target;
+                poolAccount = null;
+                accessToken = '';
+                requestModel = target.model;
+                requestFamily = modelFamily(target.model);
+                if (target.effort)
+                    requestEffort = target.effort;
+                res.setHeader('x-dario-pool-fallback', creditsFallbackMarker(target.model));
+                console.log(`[dario] #${requestCount} ${why} → API credits as ${target.model}${target.effort ? ` (effort: ${target.effort})` : ''} (x-api-key)`);
+                return true;
+            };
             // Pool-exhausted fallback dispatch. In OAuth mode poolAccount can only
             // be null here when the selection above deferred to this path (armed
             // fallback + drained pool + OpenAI-shape request): swap the model and
@@ -4583,19 +4671,34 @@ export async function startProxy(opts = {}) {
             // that was ~2% of dario's own CPU on every request that never took the
             // branch (scripts/bench-overhead.mjs profile, v6.9.2). Resolved only
             // when the branch can be taken.
-            const fallbackModel = (!upstreamApiKey && !poolAccount && openaiBackend && isOpenAI)
-                ? (selectPoolFallbackForBody(body)[0] ?? null)
-                : null;
-            if (!upstreamApiKey && !poolAccount && fallbackModel && openaiBackend && isOpenAI) {
-                const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
-                if (!fallbackBody) {
-                    writePoolUnavailable();
+            //
+            // The metered rungs come after the subscription, in the chain's own
+            // order: the credits rung (both wire shapes, since it rides the Claude
+            // path) and the openai-compat backend (OpenAI shape only). A `credits:`
+            // entry is no model for that backend, so its model is the first plain
+            // entry.
+            if (!upstreamApiKey && !poolAccount && !pinnedAccount) {
+                const chainForBody = selectPoolFallbackForBody(body);
+                const plainModel = withoutCreditsEntries(chainForBody)[0] ?? null;
+                const openaiCanServe = openaiBackend !== null && isOpenAI && plainModel !== null;
+                const creditsFirst = creditsBeforePlain(chainForBody);
+                if (creditsFirst && armCreditsRung('pool exhausted')) {
+                    // Served below, on the key.
+                }
+                else if (openaiCanServe) {
+                    const fallbackBody = buildPoolFallbackBody(body, plainModel);
+                    if (!fallbackBody) {
+                        writePoolUnavailable();
+                        return;
+                    }
+                    console.log(`[dario] #${requestCount} pool exhausted, /v1/chat/completions → ${openaiBackend.name} as ${plainModel}`);
+                    requestCount++;
+                    await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': plainModel }, upstreamTimeoutMs, verbose);
                     return;
                 }
-                console.log(`[dario] #${requestCount} pool exhausted — /v1/chat/completions → ${openaiBackend.name} as ${fallbackModel}`);
-                requestCount++;
-                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose);
-                return;
+                else if (!creditsFirst) {
+                    armCreditsRung('pool exhausted');
+                }
             }
             // Deferred at selection because a fallback was armed, but nothing could
             // actually serve it — no Codex account lists the model, and either there
@@ -4603,7 +4706,7 @@ export async function startProxy(opts = {}) {
             // with the truth the selector used to give. Without this the request
             // would fall through to the Claude path with no account and an empty
             // bearer token, turning a clean 503 into a confusing upstream 401.
-            if (!upstreamApiKey && !poolAccount) {
+            if (!upstreamApiKey && !poolAccount && !creditsRung) {
                 // A fallback was armed but nothing could serve, and the pool itself is
                 // parked: the exact reset beats a cool-down estimate (dario#1244).
                 const parkedNow = pool.parkedUntil(Date.now(), requestFamily);
@@ -4658,7 +4761,49 @@ export async function startProxy(opts = {}) {
                 userId: req.headers['x-user-id'],
                 timestamp: new Date().toISOString(),
             } : undefined;
-            if (body.length > 0) {
+            // The credits rung sends the client's own body as a plain API request:
+            // sanitized, translated when OpenAI-shaped, the model swapped for the
+            // rung's, the effort the entry named applied when the client set none.
+            // No Claude Code template, identity or cch stamp: those make a request
+            // look like Claude Code's for the OAuth gate, and an API key request
+            // would be billed for every byte of them for nothing.
+            const thinCreditsBody = (target) => {
+                try {
+                    const parsed = JSON.parse(body.toString());
+                    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                        return null;
+                    const client = parsed;
+                    sanitizeMessages(client, opts.preserveOrchestrationTags);
+                    const r = (isOpenAI ? openaiToAnthropic(client, target.model) : { ...client, model: target.model });
+                    r.model = stripContext1mTag(typeof r.model === 'string' ? r.model : target.model);
+                    const effort = requestEffort ?? opts.effort;
+                    if (effort) {
+                        const oc = (r.output_config && typeof r.output_config === 'object' && !Array.isArray(r.output_config))
+                            ? { ...r.output_config }
+                            : {};
+                        if (typeof oc.effort !== 'string') {
+                            oc.effort = effort;
+                            r.output_config = oc;
+                        }
+                    }
+                    return Buffer.from(JSON.stringify(r));
+                }
+                catch {
+                    return null;
+                }
+            };
+            if (creditsRung) {
+                const thin = thinCreditsBody(creditsRung);
+                if (!thin) {
+                    console.log(`[dario] #${requestCount} credits rung: the request body could not be re-pointed at ${creditsRung.model}`);
+                    writePoolUnavailable();
+                    return;
+                }
+                finalBody = thin;
+                // The client's own tool names go out and come back untouched.
+                preserveToolsEffective = true;
+            }
+            else if (body.length > 0) {
                 try {
                     // Reuse the object parsed for provider-prefix detection above — the same
                     // bytes, so re-parsing is wasted work on large bodies (#642-audit). Falls
@@ -4978,7 +5123,12 @@ export async function startProxy(opts = {}) {
             // Beta headers
             const clientBeta = req.headers['anthropic-beta'];
             let beta;
-            if (passthrough || isCountTokens) {
+            if (creditsRung) {
+                // A plain API request: the client's betas minus the OAuth flag go out
+                // in creditsHeaders below; nothing of the template's set applies.
+                beta = '';
+            }
+            else if (passthrough || isCountTokens) {
                 // Passthrough (and thin count_tokens): only add oauth beta,
                 // forward client betas as-is — no template beta set.
                 beta = 'oauth-2025-04-20';
@@ -4992,7 +5142,7 @@ export async function startProxy(opts = {}) {
                 // context-1m requires Extra Usage — if it 400s, we auto-retry without
                 // it, and cache the rejection so subsequent requests on this account
                 // skip context-1m entirely (dario#36).
-                const acctKey = poolAccount?.alias ?? ACCOUNT_KEY_APIKEY;
+                const acctKey = accountKeyNow();
                 const skipContext1m = context1mUnavailable.has(acctKey);
                 // Model-conditional betas (fable fallback-credit; [1m] context-1m),
                 // mirroring real CC — see betaForModel. betaWithoutContext1m still
@@ -5050,7 +5200,7 @@ export async function startProxy(opts = {}) {
             // (below) does not re-pace on the peer: the retry is the rare path, and
             // holding it for a floor would stack a second wait on a request that
             // has already been refused once.
-            const seatClock = pacingClocks.seat(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY);
+            const seatClock = pacingClocks.seat(accountKeyNow());
             const nowForPacing = Date.now();
             const pacingDelay = computePacingDelay(nowForPacing, seatClock.lastRequestTime, pacingCfg);
             const thinkDelay = thinkTimeEnabled
@@ -5096,12 +5246,16 @@ export async function startProxy(opts = {}) {
             const forwardedIdentity = (passthrough || genuineCCRequest)
                 ? forwardClientCCIdentityHeaders(req.headers)
                 : {};
-            const headers = {
+            const clientAnthropicVersion = passthrough ? (req.headers['anthropic-version'] || '2023-06-01') : '2023-06-01';
+            // On the credits rung the outbound set is a plain API client's
+            // (credits-rung.ts): the key, the version, the client's betas minus the
+            // OAuth flag. Nothing of Claude Code's identity or session.
+            const headers = creditsRung ? creditsHeaders(creditsApiKey, clientBeta, clientAnthropicVersion) : {
                 ...staticHeaders,
                 ...forwardedIdentity,
                 ...upstreamAuthHeaders(upstreamApiKey, accessToken),
                 'x-claude-code-session-id': outboundSessionId,
-                'anthropic-version': passthrough ? (req.headers['anthropic-version'] || '2023-06-01') : '2023-06-01',
+                'anthropic-version': clientAnthropicVersion,
                 'anthropic-beta': beta,
                 // Prefer the client's own when passthrough forwarded one: a genuine CC
                 // request already carries a real request id, and synthesising over it
@@ -5192,12 +5346,37 @@ export async function startProxy(opts = {}) {
                 pool.rebindSticky(stickyKey, next.alias);
                 poolSync?.bindSticky(stickyKey, next.alias);
             };
+            // Mid-flight move to the credits rung (credits-rung.ts): a 429 with no
+            // peer seat left, and the chain names a credits entry the key can serve.
+            // The request is rebuilt as a plain API request and the headers are
+            // replaced in place, because the loop head re-derives the outbound set
+            // from `headers` on every pass; the caller then re-enters the loop.
+            const rearmOnCredits = () => {
+                if (!armCreditsRung('pool exhausted mid-flight (429, no peer)'))
+                    return false;
+                const thin = thinCreditsBody(creditsRung);
+                if (!thin) {
+                    console.log(`[dario] #${requestCount} credits rung: the request body could not be re-pointed at ${creditsRung.model}`);
+                    creditsRung = null;
+                    res.removeHeader('x-dario-pool-fallback');
+                    return false;
+                }
+                finalBody = thin;
+                ccToolMap = null;
+                preserveToolsEffective = true;
+                bodyIdentityOwned = false;
+                for (const k of Object.keys(headers))
+                    delete headers[k];
+                Object.assign(headers, creditsHeaders(creditsApiKey, clientBeta, clientAnthropicVersion));
+                return true;
+            };
             dispatchLoop: while (true) {
                 // Reorder outbound headers to match CC's captured header sequence
                 // when the live template recorded one. No-op on bundled-only installs.
                 // Skipped in passthrough mode — passthrough means "don't shape the
                 // request to look like CC," and reordering is a form of shaping.
-                const outboundHeaders = passthrough ? headers : orderHeadersForOutbound(headers);
+                // Skipped on the credits rung too: a plain API request has no CC order.
+                const outboundHeaders = (passthrough || creditsRung) ? headers : orderHeadersForOutbound(headers);
                 fetchStartedAt ??= Date.now();
                 upstream = await upstreamFetch(targetBase, {
                     method: req.method ?? 'POST',
@@ -5287,7 +5466,7 @@ export async function startProxy(opts = {}) {
                         }
                     }
                     if (betaRejectedFlags.length > 0 && recoveryPasses < MAX_RECOVERY_PASSES) {
-                        const acctKey = poolAccount?.alias ?? ACCOUNT_KEY_APIKEY;
+                        const acctKey = accountKeyNow();
                         let set = unavailableBetas.get(acctKey);
                         if (!set) {
                             set = new Set();
@@ -5500,7 +5679,7 @@ export async function startProxy(opts = {}) {
                     else if (isLongContextError && recoveryPasses < MAX_RECOVERY_PASSES) {
                         // Cache the rejection so future requests on this account skip
                         // context-1m up front instead of re-paying the 400/429 round-trip.
-                        const acctKey = poolAccount?.alias ?? ACCOUNT_KEY_APIKEY;
+                        const acctKey = accountKeyNow();
                         const firstRejection = !context1mUnavailable.has(acctKey);
                         context1mUnavailable.add(acctKey);
                         if (verbose && firstRejection)
@@ -5549,12 +5728,20 @@ export async function startProxy(opts = {}) {
                         // The Claude half is out of quota for this request AND for the next
                         // one — cool it here, honouring the upstream `retry-after` when it
                         // sent one, so the following request does not re-walk the chain.
-                        if (await familyFallbackOn429(upstream))
+                        if (!creditsRung && await familyFallbackOn429(upstream))
                             return;
                         attemptedProviders.add('claude');
-                        providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
-                        if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt })) {
-                            return;
+                        // A 429 from the credits key is the key's limit, not the pool's.
+                        if (!creditsRung)
+                            providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
+                        if (!pinnedAccount) {
+                            const outcome = await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt }, rearmOnCredits);
+                            if (outcome === 'served')
+                                return;
+                            if (outcome === 'credits') {
+                                peekedBody = null;
+                                continue dispatchLoop;
+                            }
                         }
                         if (allProvidersCooled(['codex', 'claude'], providerCooldowns)) {
                             writeAllProvidersRateLimited(['codex', 'claude']);
@@ -5582,10 +5769,10 @@ export async function startProxy(opts = {}) {
                             analytics.record({
                                 timestamp: Date.now(),
                                 consumer,
-                                account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                                account: accountKeyNow(),
                                 model: requestModel,
                                 inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
-                                claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                                claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                                 latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI, timing: timingNow(),
                             });
                         }
@@ -5609,6 +5796,9 @@ export async function startProxy(opts = {}) {
                         }
                         const rejection = classifyUpstreamRejection(upstream.status, peekedBody);
                         responseHeaders['x-dario-upstream-rejection'] = rejection.marker;
+                        if (creditsRung) {
+                            console.error(`[dario] #${requestCount} credits rung refused (${upstream.status}, ${rejection.marker}) as ${creditsRung.model}: the key may be out of credits or not linked to the plan's organization; the upstream error is forwarded`);
+                        }
                         requestCount++;
                         res.writeHead(upstream.status, responseHeaders);
                         res.end(peekedBody);
@@ -5622,6 +5812,12 @@ export async function startProxy(opts = {}) {
                 // headers, so headroom math sees a healthy idle account. Mark the
                 // cool-down here, try the next-best account, fall through to the
                 // normal forwarding only if no peer is available.
+                // On the credits rung there is no seat to cool and no peer to try: a
+                // 401/403 from the key is the key's own answer and is forwarded as is
+                // (the forwarder below reuses the body the classifier read).
+                if (creditsRung && (upstream.status === 401 || upstream.status === 403)) {
+                    console.error(`[dario] #${requestCount} credits rung refused (${upstream.status}) as ${creditsRung.model}: the key was not accepted (invalid, revoked, or without permission for the model); the upstream error is forwarded`);
+                }
                 if (poolAccount && (upstream.status === 401 || upstream.status === 403)) {
                     pool.markAuthFailure(poolAccount.alias);
                     if (verbose) {
@@ -5667,12 +5863,21 @@ export async function startProxy(opts = {}) {
                     // into body. See attemptPoolFallbackOn429's doc comment for why this
                     // is one shared function rather than an inline copy.
                     // Same bookkeeping as the other mid-flight site — see there.
-                    if (await familyFallbackOn429(upstream))
+                    if (!creditsRung && await familyFallbackOn429(upstream))
                         return;
                     attemptedProviders.add('claude');
-                    providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
-                    if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt })) {
-                        return;
+                    // A 429 from the credits key is the key's limit, not the pool's.
+                    if (!creditsRung)
+                        providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
+                    if (!pinnedAccount) {
+                        const outcome = await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt }, rearmOnCredits);
+                        if (outcome === 'served')
+                            return;
+                        if (outcome === 'credits') {
+                            // This site has not read the 429's body; release it before the retry.
+                            void upstream.body?.cancel().catch(() => { });
+                            continue dispatchLoop;
+                        }
                     }
                     if (allProvidersCooled(['codex', 'claude'], providerCooldowns)) {
                         writeAllProvidersRateLimited(['codex', 'claude']);
@@ -5696,10 +5901,10 @@ export async function startProxy(opts = {}) {
                         analytics.record({
                             timestamp: Date.now(),
                             consumer,
-                            account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                            account: accountKeyNow(),
                             model: requestModel,
                             inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
-                            claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                            claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                             latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI, timing: timingNow(),
                         });
                     }
@@ -5733,6 +5938,11 @@ export async function startProxy(opts = {}) {
                     responseHeaders[key] = value;
                 }
             }
+            // A classified rejection that reached the plain forwarder (no seat to
+            // fail over from) is marked the way the seat branches mark theirs.
+            if (peekedBody !== null && upstream.status >= 400) {
+                responseHeaders['x-dario-upstream-rejection'] = classifyUpstreamRejection(upstream.status, peekedBody).marker;
+            }
             requestCount++;
             // Log billing classification on first request or in verbose mode.
             //
@@ -5749,7 +5959,10 @@ export async function startProxy(opts = {}) {
             const billingClaim = upstream.headers.get('anthropic-ratelimit-unified-representative-claim');
             const overageUtil = upstream.headers.get('anthropic-ratelimit-unified-overage-utilization');
             if (requestCount === 1 || verbose) {
-                if (billingClaim) {
+                if (creditsRung) {
+                    console.log(`[dario] #${requestCount} billing: credits (${CREDITS_CLAIM}, x-api-key as ${creditsRung.model})`);
+                }
+                else if (billingClaim) {
                     let overagePct;
                     if (overageUtil !== null) {
                         overagePct = `${Math.round(parseFloat(overageUtil) * 100)}%`;
@@ -5996,19 +6209,19 @@ export async function startProxy(opts = {}) {
                 // would read, and using their (often zero) output_tokens would
                 // pin think time to baseMs+jitter on the next request needlessly.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), streamOutputTokens);
+                    pacingClocks.noteResponse(accountKeyNow(), Date.now(), streamOutputTokens);
                 }
                 {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                     analytics.record({
                         timestamp: Date.now(),
                         consumer,
-                        account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                        account: accountKeyNow(),
                         model: requestModel,
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
                         cacheReadTokens: streamCacheReadTokens, cacheCreateTokens: streamCacheCreateTokens,
                         thinkingTokens: Math.round(streamThinkingChars / 4),
-                        claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                        claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                         latencyMs: Date.now() - startTime, status: upstream.status, isStream: true, isOpenAI, timing: timingNow(),
                         continuation: continuationOf(guard, requestDepth),
                     });
@@ -6020,9 +6233,9 @@ export async function startProxy(opts = {}) {
                     status: upstream.status, latency_ms: Date.now() - startTime, ...timingLogFields(timingNow()),
                     in_tokens: streamInputTokens, out_tokens: streamOutputTokens,
                     cache_read: streamCacheReadTokens, cache_create: streamCacheCreateTokens,
-                    claim: poolAccount?.rateLimit.claim,
-                    bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
-                    account: poolAccount?.alias,
+                    claim: creditsRung ? CREDITS_CLAIM : poolAccount?.rateLimit.claim,
+                    bucket: creditsRung ? 'credits' : (poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined),
+                    account: creditsRung ? ACCOUNT_KEY_CREDITS : poolAccount?.alias,
                     consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
@@ -6037,8 +6250,13 @@ export async function startProxy(opts = {}) {
                     }, consumer));
             }
             else {
-                // Buffer and forward
-                let responseBody = await upstream.text();
+                // Buffer and forward. A 400/402/403 body the rejection classifier
+                // already read is in peekedBody and the stream is consumed; reading
+                // it again would hand the client an empty body with the right
+                // status. Only responses no branch above handled reach here: a
+                // non-billing 403 with no seat to fail over from (the credits rung,
+                // ANTHROPIC_UPSTREAM_API_KEY), a generic 400 or 402.
+                let responseBody = peekedBody ?? await upstream.text();
                 upstreamDoneAt = Date.now();
                 // Reverse tool name mapping so client sees original names
                 if (ccToolMap)
@@ -6066,7 +6284,7 @@ export async function startProxy(opts = {}) {
                 // tokens when the body wasn't JSON or had no usage block — base +
                 // jitter still apply but the per-token component is 0.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), bufferedUsage?.outputTokens ?? 0);
+                    pacingClocks.noteResponse(accountKeyNow(), Date.now(), bufferedUsage?.outputTokens ?? 0);
                 }
                 if (bufferedUsage) {
                     try {
@@ -6074,12 +6292,12 @@ export async function startProxy(opts = {}) {
                         analytics.record({
                             timestamp: Date.now(),
                             consumer,
-                            account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                            account: accountKeyNow(),
                             model: bufferedUsage.model || requestModel,
                             inputTokens: bufferedUsage.inputTokens, outputTokens: bufferedUsage.outputTokens,
                             cacheReadTokens: bufferedUsage.cacheReadTokens, cacheCreateTokens: bufferedUsage.cacheCreateTokens,
                             thinkingTokens: bufferedUsage.thinkingTokens,
-                            claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                            claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                             latencyMs: Date.now() - startTime, status: upstream.status, isStream: false, isOpenAI, timing: timingNow(),
                         });
                     }
@@ -6092,9 +6310,9 @@ export async function startProxy(opts = {}) {
                     status: upstream.status, latency_ms: Date.now() - startTime, ...timingLogFields(timingNow()),
                     in_tokens: bufferedUsage?.inputTokens, out_tokens: bufferedUsage?.outputTokens,
                     cache_read: bufferedUsage?.cacheReadTokens, cache_create: bufferedUsage?.cacheCreateTokens,
-                    claim: poolAccount?.rateLimit.claim,
-                    bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
-                    account: poolAccount?.alias,
+                    claim: creditsRung ? CREDITS_CLAIM : poolAccount?.rateLimit.claim,
+                    bucket: creditsRung ? 'credits' : (poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined),
+                    account: creditsRung ? ACCOUNT_KEY_CREDITS : poolAccount?.alias,
                     consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,