@timo972/cc-router 0.11.0 → 0.12.0-rc.1

package/dist/providers/xai/device-oauth.js

@@ -0,0 +1,116 @@
+import { createXaiAccountRecord, XAI_DEFAULT_SCOPES } from "./account-record.js";
+const DEFAULT_ISSUER = "https://auth.x.ai";
+const DEFAULT_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+function issuerOf(opts) {
+    return (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+}
+function clientIdOf(opts) {
+    return opts.clientId ?? DEFAULT_CLIENT_ID;
+}
+function fetchOf(opts) {
+    return opts.fetchImpl ?? fetch;
+}
+async function readError(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return "";
+    }
+}
+function parseAccessTokenExpiry(accessToken, expiresIn, now = Date.now()) {
+    const parts = accessToken.split(".");
+    if (parts[1]) {
+        try {
+            const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+            if (typeof claims.exp === "number" && Number.isFinite(claims.exp) && claims.exp > 0) {
+                return claims.exp * 1000;
+            }
+        }
+        catch { /* fall through */ }
+    }
+    if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0) {
+        return now + expiresIn * 1000;
+    }
+    throw new Error("xAI access token has no usable expiry");
+}
+export async function requestXaiDeviceCode(opts = {}) {
+    const issuer = issuerOf(opts);
+    const form = new URLSearchParams({
+        client_id: clientIdOf(opts),
+        scope: XAI_DEFAULT_SCOPES.join(" "),
+    });
+    const res = await fetchOf(opts)(`${issuer}/oauth2/device/code`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: form.toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`xAI device code request failed (${res.status}): ${await readError(res)}`);
+    }
+    const body = await res.json();
+    if (!body.device_code || !body.user_code || !body.verification_uri) {
+        throw new Error("xAI device code response is missing device_code, user_code, or verification_uri");
+    }
+    return {
+        verificationUrl: body.verification_uri_complete ?? body.verification_uri,
+        userCode: body.user_code,
+        deviceCode: body.device_code,
+        intervalSeconds: Number(body.interval ?? 5),
+    };
+}
+export async function exchangeXaiDeviceCodeForTokens(opts) {
+    const issuer = issuerOf(opts);
+    const sleep = opts.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const now = opts.now ?? Date.now;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const started = now();
+    while (now() - started <= timeoutMs) {
+        const form = new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            device_code: opts.deviceCode.deviceCode,
+            client_id: clientIdOf(opts),
+        });
+        const res = await fetchOf(opts)(`${issuer}/oauth2/token`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body: form.toString(),
+        });
+        const body = await res.json().catch(() => ({}));
+        if (res.ok && body.access_token && body.refresh_token) {
+            return {
+                accessToken: body.access_token,
+                refreshToken: body.refresh_token,
+                expiresAt: parseAccessTokenExpiry(body.access_token, body.expires_in, now()),
+            };
+        }
+        const error = body.error ?? "";
+        if (error === "authorization_pending" || error === "slow_down" || res.status === 400 && !error) {
+            const wait = error === "slow_down"
+                ? Math.max(1, opts.deviceCode.intervalSeconds) + 5
+                : Math.max(1, opts.deviceCode.intervalSeconds);
+            await sleep(wait * 1000);
+            continue;
+        }
+        throw new Error(`xAI device authorization failed (${res.status}): ${body.error_description ?? (error || await readError(res))}`);
+    }
+    throw new Error("xAI device authorization timed out");
+}
+export async function loginXaiWithDeviceCode(opts) {
+    const deviceCode = await requestXaiDeviceCode(opts);
+    opts.onDeviceCode?.(deviceCode);
+    const tokens = await exchangeXaiDeviceCodeForTokens({ ...opts, deviceCode });
+    return createXaiAccountRecord({
+        id: opts.accountId,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt,
+    });
+}

package/dist/providers/xai/import-auth.js

@@ -0,0 +1,70 @@
+import { existsSync, readFileSync } from "fs";
+import path from "path";
+import { grokHomeDir } from "./overview.js";
+import { createXaiAccountRecord } from "./account-record.js";
+/**
+ * Copy the Grok CLI OIDC login (~/.grok/auth.json) into an accounts.json record.
+ * Does not write the file itself — the caller persists via upsert.
+ */
+export function importGrokCliAuth(opts = {}) {
+    const grokHome = opts.grokHome ?? grokHomeDir();
+    const fileExists = opts.fileExists ?? existsSync;
+    const readFile = opts.readFile ?? ((filePath) => readFileSync(filePath, "utf-8"));
+    const authPath = path.join(grokHome, "auth.json");
+    if (!fileExists(authPath)) {
+        throw new Error(`No Grok CLI login at ${authPath}. Run: grok login`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFile(authPath));
+    }
+    catch {
+        throw new Error(`Could not parse ${authPath}`);
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error(`${authPath} is not a Grok auth map`);
+    }
+    const entry = firstOidcEntry(raw);
+    if (!entry) {
+        throw new Error("No OIDC Grok login found in auth.json. Run: grok login");
+    }
+    const accessToken = typeof entry.key === "string" ? entry.key.trim() : "";
+    const refreshToken = typeof entry.refresh_token === "string" ? entry.refresh_token.trim() : "";
+    const expiresAt = parseExpiresAt(entry.expires_at, accessToken);
+    const id = opts.accountId?.trim() || "grok";
+    return createXaiAccountRecord({
+        id,
+        accessToken,
+        refreshToken,
+        expiresAt,
+    });
+}
+function firstOidcEntry(raw) {
+    for (const value of Object.values(raw)) {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            continue;
+        const entry = value;
+        if (entry.auth_mode === "oidc" && typeof entry.key === "string" && typeof entry.refresh_token === "string") {
+            return entry;
+        }
+    }
+    return undefined;
+}
+function parseExpiresAt(value, accessToken) {
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Date.parse(value);
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    const parts = accessToken.split(".");
+    if (parts[1]) {
+        try {
+            const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+            if (typeof claims.exp === "number" && Number.isFinite(claims.exp) && claims.exp > 0) {
+                return claims.exp * 1000;
+            }
+        }
+        catch { /* fall through */ }
+    }
+    throw new Error("Grok login is missing a usable expiry");
+}

package/dist/providers/xai/overview.js

@@ -0,0 +1,279 @@
+import { existsSync, readFileSync } from "fs";
+import os from "os";
+import path from "path";
+import { loadXaiAccounts } from "../../config/manager.js";
+import { fetchGrokSubscription } from "./subscription-fetch.js";
+function loadConfiguredXaiAccounts() {
+    // Read the override at call time. This keeps the overview aligned with the
+    // manager's documented ACCOUNTS_PATH override even when the environment is
+    // installed after this module has been imported (as in embedded callers and
+    // tests); without it the paths module's import-time snapshot can hide stored
+    // xAI accounts from the dashboard.
+    return loadXaiAccounts(process.env["ACCOUNTS_PATH"] || undefined);
+}
+export function grokHomeDir(homeDir = os.homedir()) {
+    const fromEnv = process.env["GROK_HOME"]?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return path.join(homeDir, ".grok");
+}
+export function loadGrokAccountSnapshots(opts = {}) {
+    const grokHome = opts.grokHome ?? grokHomeDir();
+    const now = opts.now ?? Date.now;
+    const isProcessAlive = opts.isProcessAlive ?? defaultIsProcessAlive;
+    const readFile = opts.readFile ?? ((filePath) => readFileSync(filePath, "utf-8"));
+    const fileExists = opts.fileExists ?? existsSync;
+    const authPath = path.join(grokHome, "auth.json");
+    if (!fileExists(authPath))
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(readFile(authPath));
+    }
+    catch {
+        return [];
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return [];
+    const liveSessions = readLiveSessions(path.join(grokHome, "active_sessions.json"), { readFile, fileExists, isProcessAlive });
+    const nowMs = now();
+    const usedIds = new Set();
+    const snapshots = [];
+    for (const entry of Object.values(raw)) {
+        const snapshot = snapshotFromAuthEntry(entry, liveSessions.length, nowMs, usedIds);
+        if (snapshot)
+            snapshots.push(snapshot);
+    }
+    return snapshots;
+}
+/** Stored xAI accounts if any, otherwise the live Grok CLI login. */
+export function loadGrokHealthSnapshots(opts = {}) {
+    const overlay = loadGrokAccountSnapshots(opts);
+    const liveSessions = overlay.reduce((sum, account) => Math.max(sum, account.activeSessions), 0);
+    const stored = loadConfiguredXaiAccounts();
+    if (stored.length === 0)
+        return overlay;
+    const now = (opts.now ?? Date.now)();
+    return stored.map(account => {
+        const tier = grokTierFromAccessToken(account.accessToken);
+        return {
+            id: account.id,
+            provider: "xai_subscription",
+            enabled: true,
+            healthy: account.enabled !== false && account.expiresAt > now,
+            busy: liveSessions > 0,
+            inFlightRequests: 0,
+            activeSessions: liveSessions,
+            requestCount: 0,
+            errorCount: 0,
+            expiresInMs: account.expiresAt - now,
+            lastUsedMs: 0,
+            lastRefreshMs: 0,
+            ...(tier !== undefined ? { tier } : {}),
+        };
+    });
+}
+/**
+ * Sync snapshots enriched with the live plan name + code-access flag. Each
+ * stored xAI account gets one `/v1/user` lookup (matched by id); a failed or
+ * missing lookup leaves the snapshot on its access-token `tier` fallback, so an
+ * offline dashboard degrades to the coarse tier instead of dropping the row.
+ */
+export async function loadGrokHealthSnapshotsWithSubscription(opts = {}) {
+    const base = loadGrokHealthSnapshots(opts);
+    if (base.length === 0)
+        return base;
+    const accounts = opts.accounts ?? loadConfiguredXaiAccounts();
+    const fetchSubscription = opts.fetchSubscription
+        ?? ((accessToken) => fetchGrokSubscription({ accessToken }));
+    return Promise.all(base.map(async (snapshot) => {
+        const account = accounts.find(candidate => candidate.id === snapshot.id);
+        if (!account)
+            return snapshot;
+        const result = await fetchSubscription(account.accessToken);
+        if (!result.ok)
+            return snapshot;
+        return {
+            ...snapshot,
+            ...(result.subscriptionTier !== undefined ? { subscriptionTier: result.subscriptionTier } : {}),
+            ...(result.hasCodeAccess !== undefined ? { hasCodeAccess: result.hasCodeAccess } : {}),
+        };
+    }));
+}
+export function grokSnapshotAsHealthAccount(snapshot) {
+    const xai = {
+        ...(snapshot.tier !== undefined ? { tier: snapshot.tier } : {}),
+        ...(snapshot.subscriptionTier !== undefined ? { subscriptionTier: snapshot.subscriptionTier } : {}),
+        ...(snapshot.hasCodeAccess !== undefined ? { hasCodeAccess: snapshot.hasCodeAccess } : {}),
+    };
+    return {
+        id: snapshot.id,
+        provider: "xai_subscription",
+        enabled: true,
+        healthy: snapshot.healthy,
+        busy: snapshot.busy,
+        inFlightRequests: 0,
+        activeSessions: snapshot.activeSessions,
+        requestCount: snapshot.requestCount,
+        errorCount: snapshot.errorCount,
+        expiresInMs: snapshot.expiresInMs,
+        lastUsedMs: snapshot.lastUsedMs,
+        lastRefreshMs: snapshot.lastRefreshMs,
+        ...(Object.keys(xai).length > 0 ? { xai } : {}),
+    };
+}
+export function mergeGrokIntoHealth(health, snapshots = loadGrokHealthSnapshots()) {
+    // The proxy daemon already emits the Grok row from the sync (network-free)
+    // path, so it carries only the coarse `tier`. Rather than skip enrichment,
+    // overlay the live plan name / code-access flag from the async snapshots the
+    // caller polled — otherwise the daemon-served row would stay stuck on "tier N".
+    if (health.accounts.some(account => account.provider === "xai_subscription")) {
+        return enrichExistingGrokAccounts(health, snapshots);
+    }
+    const grokAccounts = snapshots.map(grokSnapshotAsHealthAccount);
+    if (grokAccounts.length === 0)
+        return health;
+    const healthy = grokAccounts.filter(account => account.healthy).length;
+    const xai = {
+        configured: true,
+        accounts: grokAccounts.length,
+        healthy,
+        enabled: grokAccounts.length,
+    };
+    return {
+        ...health,
+        accounts: [...health.accounts, ...grokAccounts],
+        ...(health.operational
+            ? { operational: { ...health.operational, providers: { ...health.operational.providers, xai } } }
+            : {}),
+    };
+}
+/**
+ * Overlay the live plan name / code-access flag from freshly-polled snapshots
+ * onto the tier-only Grok rows the proxy daemon serves. Matches by account id,
+ * with a single-account fallback (the common one-Grok-login case). Returns the
+ * same object untouched when nothing changed, so the fast poll path stays cheap.
+ */
+function enrichExistingGrokAccounts(health, snapshots) {
+    if (snapshots.length === 0)
+        return health;
+    const byId = new Map(snapshots.map(snapshot => [snapshot.id, snapshot]));
+    let changed = false;
+    const accounts = health.accounts.map(account => {
+        if (account.provider !== "xai_subscription")
+            return account;
+        const snapshot = (account.id !== undefined ? byId.get(account.id) : undefined)
+            ?? (snapshots.length === 1 ? snapshots[0] : undefined);
+        if (!snapshot)
+            return account;
+        const enrichment = {
+            ...(snapshot.tier !== undefined ? { tier: snapshot.tier } : {}),
+            ...(snapshot.subscriptionTier !== undefined ? { subscriptionTier: snapshot.subscriptionTier } : {}),
+            ...(snapshot.hasCodeAccess !== undefined ? { hasCodeAccess: snapshot.hasCodeAccess } : {}),
+        };
+        if (Object.keys(enrichment).length === 0)
+            return account;
+        changed = true;
+        return { ...account, xai: { ...account.xai, ...enrichment } };
+    });
+    return changed ? { ...health, accounts } : health;
+}
+function snapshotFromAuthEntry(value, liveSessionCount, nowMs, usedIds) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entry = value;
+    if (entry.auth_mode !== "oidc" && typeof entry.key !== "string")
+        return undefined;
+    const claims = typeof entry.key === "string" ? decodeJwtPayload(entry.key) : null;
+    const id = uniqueAccountId("grok", usedIds);
+    const expiresAt = parseExpiresAt(entry.expires_at, claims);
+    const expiresInMs = expiresAt > 0 ? expiresAt - nowMs : 0;
+    const healthy = expiresInMs > 0;
+    const tier = numberClaim(claims, "tier");
+    return {
+        id,
+        provider: "xai_subscription",
+        enabled: true,
+        healthy,
+        busy: liveSessionCount > 0,
+        inFlightRequests: 0,
+        activeSessions: liveSessionCount,
+        requestCount: 0,
+        errorCount: 0,
+        expiresInMs,
+        lastUsedMs: 0,
+        lastRefreshMs: 0,
+        ...(tier !== undefined ? { tier } : {}),
+    };
+}
+function readLiveSessions(sessionsPath, opts) {
+    if (!opts.fileExists(sessionsPath))
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(opts.readFile(sessionsPath));
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((row) => {
+        if (row === null || typeof row !== "object")
+            return false;
+        const pid = row.pid;
+        return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && opts.isProcessAlive(pid);
+    });
+}
+function uniqueAccountId(base, used) {
+    if (!used.has(base)) {
+        used.add(base);
+        return base;
+    }
+    let n = 2;
+    while (used.has(`${base}-${n}`))
+        n += 1;
+    const id = `${base}-${n}`;
+    used.add(id);
+    return id;
+}
+function parseExpiresAt(value, claims) {
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Date.parse(value);
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    const exp = numberClaim(claims, "exp");
+    return exp !== undefined && exp > 0 ? exp * 1000 : 0;
+}
+export function grokTierFromAccessToken(accessToken) {
+    return numberClaim(decodeJwtPayload(accessToken), "tier");
+}
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length < 2 || !parts[1])
+        return null;
+    try {
+        const json = Buffer.from(parts[1], "base64url").toString("utf-8");
+        const parsed = JSON.parse(json);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function numberClaim(claims, key) {
+    const value = claims?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function defaultIsProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/providers/xai/subscription-fetch.js

@@ -0,0 +1,56 @@
+/**
+ * Live subscription lookup for the Grok dashboard row.
+ *
+ * The Grok CLI's own backend is `https://cli-chat-proxy.grok.com/v1`. A
+ * bearer-only GET on `/v1/user?include=subscription` answers with the account
+ * identity plus `subscriptionTier` ("GrokPro", …) and `hasGrokCodeAccess` — the
+ * only quota-relevant signals xAI exposes to the OIDC CLI token. The
+ * `?include=subscription` query is REQUIRED: the bare `/v1/user` omits
+ * `subscriptionTier` entirely (verified live 2026-08-21).
+ *
+ * Probed 2026-08-21 against the live endpoint: there is NO usage/limit/reset
+ * data here. `/v1/usage`, `/v1/rate-limits`, `/v1/quota` and friends all 404;
+ * no `x-ratelimit-*` response headers. xAI's weekly usage pool lives only in the
+ * web app's Settings → Usage surface behind a different auth context, so the
+ * dashboard shows the plan, not a percentage. This is why the Grok row has no
+ * Claude-style 5h/7d windows — they do not exist.
+ */
+export const GROK_USER_ENDPOINT = "https://cli-chat-proxy.grok.com/v1/user?include=subscription";
+export async function fetchGrokSubscription(account, options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetchImpl(GROK_USER_ENDPOINT, {
+            headers: { authorization: `Bearer ${account.accessToken}`, accept: "application/json" },
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        return { ok: false, reason: "network" };
+    }
+    if (response.status === 401 || response.status === 403)
+        return { ok: false, reason: "auth" };
+    if (!response.ok)
+        return { ok: false, reason: "http" };
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { ok: false, reason: "malformed" };
+    }
+    return parseGrokUserPayload(body);
+}
+export function parseGrokUserPayload(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return { ok: false, reason: "malformed" };
+    }
+    const record = body;
+    const tier = record["subscriptionTier"];
+    const codeAccess = record["hasGrokCodeAccess"];
+    return {
+        ok: true,
+        ...(typeof tier === "string" && tier.trim() ? { subscriptionTier: tier.trim() } : {}),
+        ...(typeof codeAccess === "boolean" ? { hasCodeAccess: codeAccess } : {}),
+    };
+}

package/dist/proxy/allowance.js

@@ -0,0 +1,142 @@
+// The 7-day (weekly) window is the headline constraint for both providers —
+// it is the one that actually forces a provider switch. The 5-hour window
+// resets hourly-scale and is only a secondary, tie-breaking signal. This
+// module is a PURE function over the already-in-memory HealthAccountView[]
+// (no upstream fetch, no I/O) so polling it can never itself rate-limit an
+// account.
+const CONSTRAINED_THRESHOLD = 0.85;
+const NO_WINDOWS = { sevenDayUtil: null, sevenDayResetMs: null, fiveHourUtil: null };
+export function createAllowanceView(views, now) {
+    return {
+        ts: now,
+        providers: {
+            anthropic: computeProviderAllowance(views.filter(v => v.provider === "anthropic_subscription"), now, anthropicWindows, isAnthropicRateLimited),
+            openai: computeProviderAllowance(views.filter(v => v.provider === "openai_subscription"), now, openAIWindows, isOpenAIRateLimited),
+        },
+    };
+}
+function isCandidate(view) {
+    return view.enabled !== false;
+}
+function isCooling(view, now) {
+    return Math.max(view.cooldownUntilMs ?? 0, view.globalCooldownUntilMs ?? 0) > now;
+}
+function isAnthropicRateLimited(view) {
+    return view.rateLimits?.status === "rate_limited";
+}
+function isOpenAIRateLimited(view) {
+    return view.codexRateLimits?.status === "rate_limited";
+}
+function anthropicWindows(view) {
+    const rl = view.rateLimits;
+    if (!rl)
+        return NO_WINDOWS;
+    return {
+        sevenDayUtil: typeof rl.sevenDayUtil === "number" ? rl.sevenDayUtil : null,
+        sevenDayResetMs: rl.sevenDayReset > 0 ? rl.sevenDayReset * 1000 : null,
+        fiveHourUtil: typeof rl.fiveHourUtil === "number" ? rl.fiveHourUtil : null,
+    };
+}
+// The default Codex bucket carries two windows: a short one (primary,
+// typically the 5h window) and a long one (secondary, typically the 7d /
+// weekly window). We identify the weekly window by whichever has the LARGER
+// windowMinutes rather than by name, since primary/secondary are positional,
+// not semantic. If only one window is present it is treated as the weekly
+// (7d-primary) signal and there is no secondary 5h reading.
+function openAIWindows(view) {
+    const bucket = view.codexRateLimits?.buckets?.[0];
+    if (!bucket)
+        return NO_WINDOWS;
+    const windows = [bucket.primary, bucket.secondary]
+        .filter((w) => w != null);
+    if (windows.length === 0)
+        return NO_WINDOWS;
+    const weekly = windows.reduce((best, w) => (w.windowMinutes > best.windowMinutes ? w : best));
+    const short = windows.length > 1 ? windows.find(w => w !== weekly) ?? null : null;
+    return {
+        sevenDayUtil: weekly.utilization,
+        sevenDayResetMs: weekly.resetAt > 0 ? weekly.resetAt * 1000 : null,
+        fiveHourUtil: short ? short.utilization : null,
+    };
+}
+function computeProviderAllowance(views, now, windowsOf, isRateLimited) {
+    const candidates = views.filter(isCandidate);
+    const available = candidates.filter(v => !isCooling(v, now) && !isRateLimited(v));
+    const availableWindows = available.map(windowsOf);
+    const sevenDayUtils = availableWindows
+        .map(w => w.sevenDayUtil)
+        .filter((u) => u != null);
+    const fiveHourUtils = availableWindows
+        .map(w => w.fiveHourUtil)
+        .filter((u) => u != null);
+    const worstSevenDayUtil = sevenDayUtils.length > 0 ? Math.max(...sevenDayUtils) : null;
+    const bestSevenDayUtil = sevenDayUtils.length > 0 ? Math.min(...sevenDayUtils) : null;
+    const sevenDayHeadroom = bestSevenDayUtil != null ? 1 - bestSevenDayUtil : null;
+    const sevenDaySpread = worstSevenDayUtil != null && bestSevenDayUtil != null
+        ? worstSevenDayUtil - bestSevenDayUtil
+        : null;
+    const fiveHourUtil = fiveHourUtils.length > 0 ? Math.min(...fiveHourUtils) : null;
+    const accountsTotal = candidates.length;
+    const accountsAvailable = available.length;
+    let status;
+    if (accountsAvailable === 0) {
+        status = "exhausted";
+    }
+    else if ((bestSevenDayUtil != null && bestSevenDayUtil >= CONSTRAINED_THRESHOLD)
+        || (fiveHourUtil != null && fiveHourUtil >= CONSTRAINED_THRESHOLD)) {
+        status = "constrained";
+    }
+    else {
+        status = "ok";
+    }
+    const earliestResetAt = computeEarliestResetAt({
+        status,
+        accountsAvailable,
+        available,
+        candidates,
+        windowsOf,
+        now,
+    });
+    const coolingModelFamilies = Array.from(new Set(candidates.flatMap(v => (v.modelCooldowns ?? [])
+        .filter(c => c.untilMs > now)
+        .map(c => c.modelFamily)))).sort();
+    return {
+        status,
+        accountsTotal,
+        accountsAvailable,
+        sevenDayUtil: worstSevenDayUtil,
+        sevenDayHeadroom,
+        sevenDaySpread,
+        fiveHourUtil,
+        earliestResetAt,
+        coolingModelFamilies,
+    };
+}
+function computeEarliestResetAt(args) {
+    const { status, accountsAvailable, available, candidates, windowsOf, now } = args;
+    if (accountsAvailable > 0) {
+        if (status !== "constrained")
+            return null;
+        const resets = available
+            .map(windowsOf)
+            .map(w => w.sevenDayResetMs)
+            .filter((r) => r != null);
+        return resets.length > 0 ? Math.min(...resets) : null;
+    }
+    // Exhausted: the earliest moment capacity could plausibly return, per
+    // candidate — whichever cooldown (account or global) is currently
+    // enforced, or otherwise its weekly reset if that lies in the future.
+    const candidateResets = [];
+    for (const view of candidates) {
+        const cooldownUntil = Math.max(view.cooldownUntilMs ?? 0, view.globalCooldownUntilMs ?? 0);
+        if (cooldownUntil > now) {
+            candidateResets.push(cooldownUntil);
+            continue;
+        }
+        const sevenDayResetMs = windowsOf(view).sevenDayResetMs;
+        if (sevenDayResetMs != null && sevenDayResetMs > now) {
+            candidateResets.push(sevenDayResetMs);
+        }
+    }
+    return candidateResets.length > 0 ? Math.min(...candidateResets) : null;
+}

package/dist/proxy/logger.js

@@ -1,12 +1,13 @@
 import chalk from "chalk";
 function ts() {
-    return new Date().toISOString().slice(11, 19); // HH:MM:SS
+    return new Date().toISOString().slice(0, 19).replace("T", " "); // YYYY-MM-DD HH:MM:SS
 }
-export function logRoute(accountId, requestCount, expiresInMin) {
+export function logRoute(accountId, requestCount, expiresInMin, reason) {
     console.log(chalk.gray(`[${ts()}]`) +
         chalk.green(` → ${accountId}`) +
         chalk.gray(` req#${requestCount}`) +
-        chalk.yellow(` exp=${expiresInMin}min`));
+        chalk.yellow(` exp=${expiresInMin}min`) +
+        (reason ? chalk.cyan(` ${reason}`) : ""));
 }
 export function logRefresh(accountId, ok, expiresInMin) {
     if (ok) {