@askalf/dario 6.7.1 → 6.8.0

package/dist/keys.js

@@ -0,0 +1,346 @@
+/**
+ * Named keys — one credential per developer on a shared dario (dario#1318).
+ *
+ * A team runs one proxy for several people. `DARIO_API_KEY` is one secret for
+ * all of them, so nothing says whose traffic is whose except an
+ * `x-dario-consumer` header any client can set to anything. A named key ties
+ * attribution to the credential: the request authenticated with alice's key
+ * IS alice's, in `/analytics`, in the ledger, on every log line.
+ *
+ * What a key can carry, all optional:
+ *   seat     the pool account this key's traffic prefers. Honoured when that
+ *            seat is eligible; otherwise the request routes like any other,
+ *            and failover mid-request is unchanged. A developer's key can
+ *            ride the developer's own subscription without anyone else's
+ *            requests landing on it.
+ *   models   an allowlist; a request for any other model is refused (403)
+ *            before anything goes upstream.
+ *   expires  after which the key is refused like a revoked one.
+ *
+ * Storage is one file, `~/.dario/keys.json`, mode 0600, holding hashes and
+ * never secrets: the secret is printed once at creation and is not
+ * recoverable. The running proxy re-reads the file when its mtime moves, so
+ * `dario keys create` and the admin API's `/admin/keys` both take effect on
+ * the next request with no restart.
+ *
+ * The wire is untouched. dario already replaces the inbound key with the
+ * seat's own bearer before upstream, so a named key changes what dario
+ * knows, not what Anthropic sees — passthrough stays byte-identical.
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+export const KEYS_VERSION = 1;
+export const KEY_PREFIX = 'dk_';
+/** Same charset as a pool alias — a key name is printed next to one. */
+export const KEY_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_\-.]{0,63}$/;
+export const KEYS_FLUSH_DELAY_MS = 3_000;
+const SECRET_BYTES = 24;
+export function keysPathFor(home = homedir()) {
+    return join(home, '.dario', 'keys.json');
+}
+export function resolveKeysPath(env = process.env) {
+    const p = env['DARIO_KEYS_PATH'];
+    return typeof p === 'string' && p.trim().length > 0 ? p.trim() : keysPathFor();
+}
+/**
+ * sha256, not a slow KDF, on purpose: a key is 24 bytes from `randomBytes`
+ * (192 bits of entropy), never a human-chosen password, so a guess is not
+ * a threat a KDF could slow down, and this hash runs once per request on the
+ * hot path. This is how GitHub and Stripe store their API tokens.
+ * (CodeQL's js/insufficient-password-hash fires on the x-api-key source and
+ * is dismissed as a false positive for exactly this reason.)
+ */
+export function hashKey(secret) {
+    return createHash('sha256').update(secret).digest('hex');
+}
+/** `dk_` + 48 hex characters. The prefix lets a reject log say "a named key" without the value. */
+export function mintSecret() {
+    return KEY_PREFIX + randomBytes(SECRET_BYTES).toString('hex');
+}
+export function looksLikeNamedKey(value) {
+    return typeof value === 'string' && value.startsWith(KEY_PREFIX);
+}
+export function emptyKeysFile() {
+    return { version: KEYS_VERSION, keys: [] };
+}
+const isIso = (v) => typeof v === 'string' && !Number.isNaN(Date.parse(v));
+/**
+ * Parse a keys file's text, keeping only well-formed records. A file that is
+ * not a keys file at all throws; the caller decides whether to move it aside.
+ */
+export function parseKeysFile(text) {
+    const raw = JSON.parse(text);
+    if (!raw || typeof raw !== 'object' || raw.version !== KEYS_VERSION || !Array.isArray(raw.keys)) {
+        throw new Error('not a dario keys file');
+    }
+    const keys = [];
+    const seen = new Set();
+    for (const k of raw.keys) {
+        if (!k || typeof k !== 'object')
+            continue;
+        if (typeof k.name !== 'string' || !KEY_NAME_RE.test(k.name) || seen.has(k.name))
+            continue;
+        if (typeof k.hash !== 'string' || !/^[0-9a-f]{64}$/.test(k.hash))
+            continue;
+        if (typeof k.id !== 'string' || !/^[0-9a-f]{8}$/.test(k.id))
+            continue;
+        const rec = { id: k.id, name: k.name, hash: k.hash, created: isIso(k.created) ? k.created : new Date(0).toISOString() };
+        if (isIso(k.lastUsed))
+            rec.lastUsed = k.lastUsed;
+        if (k.disabled === true)
+            rec.disabled = true;
+        if (isIso(k.expires))
+            rec.expires = k.expires;
+        if (typeof k.seat === 'string' && KEY_NAME_RE.test(k.seat))
+            rec.seat = k.seat;
+        if (Array.isArray(k.models)) {
+            const models = k.models.filter((m) => typeof m === 'string' && m.trim().length > 0).map((m) => m.trim());
+            if (models.length > 0)
+                rec.models = models;
+        }
+        seen.add(rec.name);
+        keys.push(rec);
+    }
+    return { version: KEYS_VERSION, keys };
+}
+/** Missing file → empty. Unreadable or malformed → throws (never silently empty: that would "revoke" everyone). */
+export function readKeysFile(path) {
+    if (!existsSync(path))
+        return emptyKeysFile();
+    return parseKeysFile(readFileSync(path, 'utf8'));
+}
+/** Atomic, 0600, parent 0700 — the same primitive config.json uses. */
+export function writeKeysFile(path, file) {
+    const parent = dirname(path);
+    if (!existsSync(parent))
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const json = JSON.stringify({ version: KEYS_VERSION, keys: file.keys }, null, 2) + '\n';
+    const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+    try {
+        writeFileSync(tmp, json, { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+}
+function newId(existing) {
+    for (;;) {
+        const id = randomBytes(4).toString('hex');
+        if (!existing.keys.some((k) => k.id === id))
+            return id;
+    }
+}
+/** Mint a key. Returns the record (stored) and the secret (shown once). Mutates `file`. */
+export function createKey(file, name, opts = {}) {
+    const trimmed = name.trim();
+    if (!KEY_NAME_RE.test(trimmed))
+        throw new Error(`invalid key name "${name}": letters, digits, _ - . only, up to 64, starting with a letter or digit`);
+    if (file.keys.some((k) => k.name === trimmed))
+        throw new Error(`a key named "${trimmed}" already exists (rotate it, or pick another name)`);
+    if (opts.seat !== undefined && !KEY_NAME_RE.test(opts.seat))
+        throw new Error(`invalid seat alias "${opts.seat}"`);
+    const secret = mintSecret();
+    const record = { id: newId(file), name: trimmed, hash: hashKey(secret), created: new Date(opts.now ?? Date.now()).toISOString() };
+    if (opts.seat)
+        record.seat = opts.seat;
+    if (opts.models && opts.models.length > 0)
+        record.models = opts.models.map((m) => m.trim()).filter(Boolean);
+    if (opts.expiresAt !== undefined) {
+        if (!Number.isFinite(opts.expiresAt) || opts.expiresAt <= (opts.now ?? Date.now()))
+            throw new Error('expiry must be in the future');
+        record.expires = new Date(opts.expiresAt).toISOString();
+    }
+    file.keys.push(record);
+    return { record, secret };
+}
+/** Mark a key refused. Returns false when there is no such key. The record stays, for the list. */
+export function revokeKey(file, name) {
+    const k = file.keys.find((x) => x.name === name);
+    if (!k)
+        return false;
+    k.disabled = true;
+    return true;
+}
+/** Forget a key entirely (list no longer shows it). */
+export function deleteKey(file, name) {
+    const i = file.keys.findIndex((x) => x.name === name);
+    if (i < 0)
+        return false;
+    file.keys.splice(i, 1);
+    return true;
+}
+/** New secret, same name, seat, models and expiry; the old secret stops working at once. */
+export function rotateKey(file, name, now = Date.now()) {
+    const k = file.keys.find((x) => x.name === name);
+    if (!k)
+        return null;
+    const secret = mintSecret();
+    k.hash = hashKey(secret);
+    k.created = new Date(now).toISOString();
+    delete k.lastUsed;
+    delete k.disabled;
+    return { record: k, secret };
+}
+export function keyIsUsable(k, now = Date.now()) {
+    if (k.disabled)
+        return false;
+    if (k.expires && Date.parse(k.expires) <= now)
+        return false;
+    return true;
+}
+/**
+ * The record a presented secret belongs to, or null. Compares hashes in
+ * constant time, every record every time, so a miss takes as long as a hit
+ * and neither the count of keys nor which one matched leaks through timing.
+ * A disabled or expired key matches nothing — the caller cannot tell it from
+ * a wrong secret, on purpose.
+ */
+export function matchKey(file, provided, now = Date.now()) {
+    if (typeof provided !== 'string' || provided.length === 0)
+        return null;
+    const h = Buffer.from(hashKey(provided), 'hex');
+    let found = null;
+    for (const k of file.keys) {
+        const stored = Buffer.from(k.hash, 'hex');
+        if (stored.length === h.length && timingSafeEqual(stored, h) && keyIsUsable(k, now))
+            found = k;
+    }
+    return found;
+}
+/** `models` entries are exact ids, or `prefix*`; case-insensitive. Absent list = any model. */
+export function keyAllowsModel(k, model) {
+    if (!k.models || k.models.length === 0)
+        return true;
+    const m = (model ?? '').toLowerCase();
+    for (const entry of k.models) {
+        const e = entry.toLowerCase();
+        if (e.endsWith('*') ? m.startsWith(e.slice(0, -1)) : m === e)
+            return true;
+    }
+    return false;
+}
+export function publicKey(k, now = Date.now()) {
+    const status = k.disabled ? 'revoked' : k.expires && Date.parse(k.expires) <= now ? 'expired' : 'active';
+    return { id: k.id, name: k.name, created: k.created, last_used: k.lastUsed ?? null, status, expires: k.expires ?? null, seat: k.seat ?? null, models: k.models ?? [] };
+}
+/** `--expires=30d` / `12h` / `2026-12-31` → epoch ms, or null when unparseable. */
+export function parseExpiry(value, now = Date.now()) {
+    const v = value.trim();
+    const rel = /^(\d+)([hdw])$/i.exec(v);
+    if (rel) {
+        const n = Number(rel[1]);
+        const unit = rel[2].toLowerCase();
+        const ms = unit === 'h' ? 3_600_000 : unit === 'd' ? 86_400_000 : 7 * 86_400_000;
+        return n > 0 ? now + n * ms : null;
+    }
+    const abs = Date.parse(v);
+    return Number.isNaN(abs) ? null : abs;
+}
+/**
+ * The proxy's live view of the file. Reloads when the file's mtime moves (a
+ * stat per auth — the cost of "no restart"), records last-used with a
+ * debounced write that re-reads first so it never clobbers an edit the CLI
+ * made in between.
+ */
+export class KeyStore {
+    path;
+    file = emptyKeysFile();
+    mtimeMs = -1;
+    loadError = null;
+    dirtyLastUsed = new Map();
+    flushTimer = null;
+    constructor(path) {
+        this.path = path;
+    }
+    /** Read the file now. A malformed file is reported and leaves the last good state in place. */
+    load() {
+        let mtime = -1;
+        try {
+            mtime = statSync(this.path).mtimeMs;
+        }
+        catch {
+            mtime = -1;
+        }
+        if (mtime === this.mtimeMs)
+            return;
+        try {
+            this.file = readKeysFile(this.path);
+            this.loadError = null;
+        }
+        catch (err) {
+            this.loadError = err instanceof Error ? err.message : String(err);
+        }
+        this.mtimeMs = mtime;
+    }
+    get error() { return this.loadError; }
+    size() { return this.file.keys.length; }
+    list(now = Date.now()) {
+        this.load();
+        return this.file.keys.map((k) => publicKey(k, now));
+    }
+    /** The record a request's credential names, or null. Reloads first when the file moved. */
+    match(provided, now = Date.now()) {
+        this.load();
+        if (!provided || this.file.keys.length === 0)
+            return null;
+        return matchKey(this.file, provided, now);
+    }
+    /** Note a use; written to disk after a quiet moment. */
+    touch(k, now = Date.now()) {
+        const iso = new Date(now).toISOString();
+        k.lastUsed = iso;
+        this.dirtyLastUsed.set(k.id, iso);
+        if (!this.flushTimer) {
+            this.flushTimer = setTimeout(() => { this.flushTimer = null; this.flush(); }, KEYS_FLUSH_DELAY_MS);
+            this.flushTimer.unref?.();
+        }
+    }
+    /** Apply a mutation to the file on disk (re-read first), then adopt it. */
+    mutate(fn) {
+        const current = readKeysFile(this.path);
+        const out = fn(current);
+        writeKeysFile(this.path, current);
+        this.file = current;
+        try {
+            this.mtimeMs = statSync(this.path).mtimeMs;
+        }
+        catch {
+            this.mtimeMs = -1;
+        }
+        return out;
+    }
+    /** Persist pending last-used stamps. Safe to call at any time; a no-op when nothing is pending. */
+    flush() {
+        if (this.dirtyLastUsed.size === 0)
+            return;
+        const pending = new Map(this.dirtyLastUsed);
+        this.dirtyLastUsed.clear();
+        try {
+            this.mutate((file) => {
+                for (const k of file.keys) {
+                    const iso = pending.get(k.id);
+                    if (iso && (!k.lastUsed || Date.parse(iso) > Date.parse(k.lastUsed)))
+                        k.lastUsed = iso;
+                }
+            });
+        }
+        catch (err) {
+            // The stamp is a convenience; losing it is not worth failing a request over.
+            console.error(`[dario] keys: could not record last-used: ${err instanceof Error ? err.message : err}`);
+        }
+    }
+    close() {
+        if (this.flushTimer) {
+            clearTimeout(this.flushTimer);
+            this.flushTimer = null;
+        }
+        this.flush();
+    }
+}

package/dist/ledger.d.ts

@@ -48,6 +48,29 @@ export interface LedgerFile {
     updated: string;
     /** `YYYY-MM-DD` (UTC) → model id → per-bucket totals. */
     days: Record<string, Record<string, LedgerRow>>;
+    /**
+     * The same rows split by consumer (dario#1318): `YYYY-MM-DD` → consumer →
+     * model id → per-bucket totals. Only requests that named a consumer land
+     * here (a named key, the `x-dario-consumer` header, or the hashed user
+     * id), so the split never claims to sum to `days`. Absent on files from
+     * before 6.8 and read as empty.
+     */
+    consumers?: Record<string, Record<string, Record<string, LedgerRow>>>;
+}
+/** One consumer's share of the lifetime number. */
+export interface LedgerConsumerSummary {
+    requests: number;
+    apiEquivalentCost: number;
+    meteredCost: number;
+    recent: {
+        today: number;
+        last7d: number;
+        last30d: number;
+    };
+    /** `YYYY-MM-DD` of the consumer's most recent counted request. */
+    lastDay: string;
+    /** Models this consumer used, most requests first. */
+    models: string[];
 }
 export interface LedgerModelSummary {
     provider: PricingProvider;
@@ -64,6 +87,8 @@ export interface LedgerModelSummary {
 export interface LedgerSummary {
     /** Where the file lives — so `dario usage` can say what it read. */
     path: string;
+    /** The lifetime number split by consumer (named key, header, or hashed user id); empty when nothing named one. */
+    perConsumer: Record<string, LedgerConsumerSummary>;
     since: string;
     /** Distinct UTC days with traffic. */
     days: number;
@@ -121,8 +146,10 @@ export declare function ledgerBucketFor(record: Pick<RequestRecord, 'status' | '
 export declare function parseLedger(text: string): LedgerFile;
 /** Add one record's tokens to the file in place. Returns false when it was not counted. */
 export declare function addToLedger(file: LedgerFile, record: RequestRecord): boolean;
-/** Drop the oldest days past LEDGER_MAX_DAYS. */
+/** Drop the oldest days past LEDGER_MAX_DAYS, from the per-consumer split too. */
 export declare function pruneLedger(file: LedgerFile, maxDays?: number): void;
+/** The per-consumer split of a file, priced the same way as the headline. */
+export declare function summarizeLedgerConsumers(file: LedgerFile, now?: number): Record<string, LedgerConsumerSummary>;
 export declare function summarizeLedger(file: LedgerFile, path: string, now?: number): LedgerSummary;
 /**
  * Read a ledger file for display without a running proxy (`dario usage`
@@ -167,6 +194,12 @@ export declare function shortModelName(model: string): string;
  * to match the rest of that command's output.
  */
 export declare function formatLedgerSummary(s: LedgerSummary): string[];
+/**
+ * `dario usage --by-key`: the lifetime number per consumer, biggest first.
+ * A consumer is a named key's name, an `x-dario-consumer` header, or the
+ * `u_…` hash of a client's user id — whichever named the request.
+ */
+export declare function formatLedgerConsumers(s: LedgerSummary, limit?: number): string[];
 /**
  * A share card: one SVG, 640×320, dark, the number in the middle. Plain
  * system monospace so it renders the same in a README, a tweet screenshot

package/dist/ledger.js

@@ -115,7 +115,46 @@ export function parseLedger(text) {
     }
     const since = typeof raw.since === 'string' && !Number.isNaN(Date.parse(raw.since)) ? raw.since : new Date().toISOString();
     const updated = typeof raw.updated === 'string' && !Number.isNaN(Date.parse(raw.updated)) ? raw.updated : since;
-    return { version: LEDGER_VERSION, since, updated, days };
+    const file = { version: LEDGER_VERSION, since, updated, days };
+    if (raw.consumers && typeof raw.consumers === 'object') {
+        const consumers = {};
+        for (const [day, byConsumer] of Object.entries(raw.consumers)) {
+            if (!/^\d{4}-\d{2}-\d{2}$/.test(day) || !byConsumer || typeof byConsumer !== 'object')
+                continue;
+            const cleanDay = {};
+            for (const [consumer, models] of Object.entries(byConsumer)) {
+                if (!consumer || !models || typeof models !== 'object')
+                    continue;
+                const clean = {};
+                for (const [model, row] of Object.entries(models)) {
+                    if (!row || typeof row !== 'object')
+                        continue;
+                    const r = {};
+                    if (isCell(row.covered))
+                        r.covered = { ...row.covered };
+                    if (isCell(row.metered))
+                        r.metered = { ...row.metered };
+                    if (r.covered || r.metered)
+                        clean[model] = r;
+                }
+                if (Object.keys(clean).length > 0)
+                    cleanDay[consumer] = clean;
+            }
+            if (Object.keys(cleanDay).length > 0)
+                consumers[day] = cleanDay;
+        }
+        if (Object.keys(consumers).length > 0)
+            file.consumers = consumers;
+    }
+    return file;
+}
+function addCell(row, bucket, record) {
+    const cell = (row[bucket] ??= emptyCell());
+    cell.requests += 1;
+    cell.inputTokens += record.inputTokens;
+    cell.outputTokens += record.outputTokens;
+    cell.cacheReadTokens += record.cacheReadTokens;
+    cell.cacheCreateTokens += record.cacheCreateTokens;
 }
 /** Add one record's tokens to the file in place. Returns false when it was not counted. */
 export function addToLedger(file, record) {
@@ -125,23 +164,76 @@ export function addToLedger(file, record) {
     const day = dayKey(record.timestamp);
     const model = record.model || 'unknown';
     const models = (file.days[day] ??= {});
-    const row = (models[model] ??= {});
-    const cell = (row[bucket] ??= emptyCell());
-    cell.requests += 1;
-    cell.inputTokens += record.inputTokens;
-    cell.outputTokens += record.outputTokens;
-    cell.cacheReadTokens += record.cacheReadTokens;
-    cell.cacheCreateTokens += record.cacheCreateTokens;
+    addCell((models[model] ??= {}), bucket, record);
+    if (record.consumer) {
+        const byConsumer = ((file.consumers ??= {})[day] ??= {});
+        const rows = (byConsumer[record.consumer] ??= {});
+        addCell((rows[model] ??= {}), bucket, record);
+    }
     if (Date.parse(file.since) > record.timestamp)
         file.since = new Date(record.timestamp).toISOString();
     pruneLedger(file);
     return true;
 }
-/** Drop the oldest days past LEDGER_MAX_DAYS. */
+/** Drop the oldest days past LEDGER_MAX_DAYS, from the per-consumer split too. */
 export function pruneLedger(file, maxDays = LEDGER_MAX_DAYS) {
     const days = Object.keys(file.days).sort();
     for (const day of days.slice(0, Math.max(0, days.length - maxDays)))
         delete file.days[day];
+    if (file.consumers) {
+        const keep = new Set(Object.keys(file.days));
+        for (const day of Object.keys(file.consumers))
+            if (!keep.has(day))
+                delete file.consumers[day];
+        if (Object.keys(file.consumers).length === 0)
+            delete file.consumers;
+    }
+}
+/** The per-consumer split of a file, priced the same way as the headline. */
+export function summarizeLedgerConsumers(file, now = Date.now()) {
+    const today = dayKey(now);
+    const cutoff7 = dayKey(now - 6 * 86_400_000);
+    const cutoff30 = dayKey(now - 29 * 86_400_000);
+    const out = {};
+    for (const [day, byConsumer] of Object.entries(file.consumers ?? {})) {
+        const at = dayMs(day);
+        for (const [consumer, models] of Object.entries(byConsumer)) {
+            const c = (out[consumer] ??= { requests: 0, apiEquivalentCost: 0, meteredCost: 0, recent: { today: 0, last7d: 0, last30d: 0 }, lastDay: day, models: [], _models: {} });
+            if (day > c.lastDay)
+                c.lastDay = day;
+            for (const [model, row] of Object.entries(models)) {
+                if (row.covered) {
+                    const cost = costOfTokens(model, at, row.covered);
+                    c.apiEquivalentCost += cost;
+                    c.requests += row.covered.requests;
+                    c._models[model] = (c._models[model] ?? 0) + row.covered.requests;
+                    if (day === today)
+                        c.recent.today += cost;
+                    if (day >= cutoff7)
+                        c.recent.last7d += cost;
+                    if (day >= cutoff30)
+                        c.recent.last30d += cost;
+                }
+                if (row.metered) {
+                    c.meteredCost += costOfTokens(model, at, row.metered);
+                    c.requests += row.metered.requests;
+                    c._models[model] = (c._models[model] ?? 0) + row.metered.requests;
+                }
+            }
+        }
+    }
+    const result = {};
+    for (const [consumer, c] of Object.entries(out)) {
+        result[consumer] = {
+            requests: c.requests,
+            apiEquivalentCost: round(c.apiEquivalentCost),
+            meteredCost: round(c.meteredCost),
+            recent: { today: round(c.recent.today), last7d: round(c.recent.last7d), last30d: round(c.recent.last30d) },
+            lastDay: c.lastDay,
+            models: Object.entries(c._models).sort((a, b) => b[1] - a[1]).map(([m]) => m),
+        };
+    }
+    return result;
 }
 // Six places, not the window's four: a handful of gpt-5.6-luna requests is
 // real money in the millionths and "$0 for 2 requests" reads as free.
@@ -217,6 +309,7 @@ export function summarizeLedger(file, path, now = Date.now()) {
         perProvider,
         perModel,
         recent: { today: round(recent.today), last7d: round(recent.last7d), last30d: round(recent.last30d) },
+        perConsumer: summarizeLedgerConsumers(file, now),
     };
 }
 /**
@@ -372,6 +465,26 @@ export function formatLedgerSummary(s) {
         lines.push(`    Paid per token on top (API key / extra usage): ${formatUsd(s.meteredCost)}`);
     return lines;
 }
+/**
+ * `dario usage --by-key`: the lifetime number per consumer, biggest first.
+ * A consumer is a named key's name, an `x-dario-consumer` header, or the
+ * `u_…` hash of a client's user id — whichever named the request.
+ */
+export function formatLedgerConsumers(s, limit = 20) {
+    const entries = Object.entries(s.perConsumer).sort((a, b) => b[1].apiEquivalentCost - a[1].apiEquivalentCost);
+    if (entries.length === 0)
+        return ['  By key: no request named a consumer yet (create keys with `dario keys create <name>`).'];
+    const lines = [];
+    lines.push(`  By key (${entries.length} consumer${entries.length === 1 ? '' : 's'}; API-equivalent, lifetime · today · 7d · 30d):`);
+    const width = Math.min(24, Math.max(...entries.map(([c]) => c.length)));
+    for (const [consumer, c] of entries.slice(0, limit)) {
+        const models = c.models.slice(0, 2).map(shortModelName).join(', ');
+        lines.push(`    ${consumer.slice(0, width).padEnd(width)} ${formatUsd(c.apiEquivalentCost).padStart(9)} · ${formatUsd(c.recent.today).padStart(8)} · ${formatUsd(c.recent.last7d).padStart(8)} · ${formatUsd(c.recent.last30d).padStart(8)}   ${c.requests.toLocaleString('en-US')} req${c.requests === 1 ? '' : 's'}${models ? `, ${models}` : ''}${c.meteredCost > 0 ? `, ${formatUsd(c.meteredCost)} metered` : ''}`);
+    }
+    if (entries.length > limit)
+        lines.push(`    … and ${entries.length - limit} more`);
+    return lines;
+}
 const escapeXml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
 /**
  * A share card: one SVG, 640×320, dark, the number in the middle. Plain

package/dist/proxy.d.ts

@@ -334,6 +334,16 @@ interface ProxyOptions {
      * `DARIO_LEDGER=0` turns it off, `DARIO_LEDGER_PATH` moves the file.
      */
     ledger?: boolean;
+    /**
+     * Named keys (v6.8, src/keys.ts, dario#1318): per-developer credentials
+     * in `~/.dario/keys.json`, hashes only, re-read when the file moves. A
+     * request that authenticates with one is attributed to it in /analytics,
+     * the ledger and the log, may prefer a seat, and may be held to a model
+     * allowlist. On by default; `--no-keys` / `DARIO_KEYS=0` ignores the file,
+     * `--keys-path` / `DARIO_KEYS_PATH` moves it.
+     */
+    keys?: boolean;
+    keysPath?: string;
     sessionIdleRotateMs?: number;
     sessionRotateJitterMs?: number;
     sessionMaxAgeMs?: number;
@@ -583,6 +593,7 @@ export interface ProxyLogEntry {
     bucket?: string;
     account?: string;
     consumer?: string;
+    key?: string;
     client?: string;
     preserve_tools?: boolean;
     stream?: boolean;