+ iHjRt^RIHt^RIt^RIHtHtHtHtH t ] 'd^RI H t Rt Rt RRltRR ltR R lt!R R 4tR#)aModel-scoped rate-limit cooldowns for pooled credentials. Anthropic enforces its API rate limits (requests / tokens per minute) per model, so a generic 429 for one Claude model says nothing about the same credential's standing for its sibling models. Such a 429 is recorded as a cooldown on the requested model only, beside the credential-wide status that auth, billing and payment failures keep benching the whole credential with. ) annotationsN)AnyDictIterableOptional TYPE_CHECKING)PooledCredential usage_windowc(V^8dQhRRRRRRRR/#) reasonr error_contextOptional[dict[str, Any]]billing_unverifiedboolreturnstr)formats"J/home/ubuntu/.hermes/hermes-agent/agent/credential_pool_model_cooldowns.py __annotate__rs+   4L bf kn c^RIHpWP8Xd(T;'g/PR4'd\#WP8XdV'd ^RIHpV#VP#)zThe pool's failure reason for a rotation (*reason* is a ``FailoverReason``). A usage-window 402 benches only the refused model; an ambiguous billing body is sized as transient, not a 1-hour bench.)FailoverReasonr )!FAILURE_REASON_BILLING_UNVERIFIED)agent.error_classifierrbillinggetFAILURE_REASON_USAGE_WINDOWagent.credential_poolrvalue)r r rrrs&&& rpool_failure_reasonr!sS6 ''']-@-@b,E,En,U,U** ''',>K00 <<rc$V^8dQhRRRRRR/#)r entryrmodel Optional[str]rzOptional[float]r)rs"rrr%s" + + 0 + +? +rc`VP;'g/pV'gVP4MVPV43p\P!4pVUu.uF4p\ V\ \ 34'gK!WT8gK)\ V4NK6 ppV'd \V4#R#uupi)zActive cooldown blocking *entry* for *model*, or ``None``. Callers that do not know the model stay conservative: any active model cooldown blocks them, so an unscoped route cannot reuse the credential. N)model_cooldownsvaluesrtime isinstanceintfloatmax)r#r$ cooldownsr(nowuntilactives&& rmodel_cooldown_untilr2%s %%++I',Y   9==3G2IF ))+C(. bu*US%L2QlV[ValeElF b 3v;*d*csB+=B+B+c V^8dQhRRRR/#)r mapsrrzdict[str, float]r)rs"rrr2s   )9 rc /pVFyp\V\4'gKVP4FJwr4\V\\34'gK#\ \ V4VP VR44W&KL K{ V#)uTLatest reset per model across snapshots — each writer only observed its own model.g)r*dictitemsr+r,r-r)r4mergedr.r$r0s* rmerge_model_cooldownsr92si!F )T** %OO-LE%#u.. #E%L&**UC2H I . MrcR]tRt^>tRR/RRlltRRltR RRlltR R ltR tR#) CredentialPoolModelCooldownMixinr$Nc$V^8dQhRRRRRR/#)r tokenrr$r%rrr)rs"rr-CredentialPoolModelCooldownMixin.__annotate__?s!  c ] d rc aaVP;_uu_4\;QJd*VV3RlVP4F 'gK RM RM!VV3RlVP44uuRRR4# +'giR#;i)aWhether a pool cooldown blocks *token* for *model*. Closes the paths that hand out a native Anthropic token without selecting it from the pool (env / borrowed credentials). Tokens the pool does not know fail open: no row can attribute a cooldown to them. c3n<"TF*pVPS8H;'d\VS4RJxK, R#5iN)runtime_api_keyr2).0r#r$r=s& r DCredentialPoolModelCooldownMixin.token_is_blocked..Gs<*E%%.aa3Gu3U]a3aa*s55TFN)_lockany_entries)selfr=r$s&fdrtoken_is_blocked1CredentialPoolModelCooldownMixin.token_is_blocked?sLZZZ3!]]333!]]ZZZs+A2"A22 B c(V^8dQhRRRRRRRR/#)r status_codez Optional[int]r$r%failure_reasonrrr)rs"rrr>Ls,  ( 1> P]  rc ^RIHpHpV'gR#VR\39dR#VPR8H;'dVR8H;'dW4V39#)zAnthropic per-model 429s, and a Codex ChatGPT-account model entitlement 400: the account cannot use *model*, but the credential stays valid for every other model (#71970).)FAILURE_REASON_BILLINGrFmodel_entitlementT anthropic)rrPrrprovider)rIrMr$rNrPrs&&&& r_is_model_scoped_failure9CredentialPoolModelCooldownMixin._is_model_scoped_failureLs\ d 13NO O MM[ ( b b[C-? b b?`&aa rc ,V^8dQhRRRRRRRRR R /#) r r#rr$rr rrNr%rNoner)rs"rrr>\s6%.1BZ% rc :^RIHpHpVR8Xd"\P!4\,pMQV!V4P R4;'g3\P!4V!RVP 4R7,pVPp\VP4Fdp V PVP8wdV'dV PV8XgK9\V PW'/4p VPV RV R7Kf VP4R#) aRecord a cooldown for *model* on *entry* and every sibling sharing its key. Same TTL policy as a credential-wide 429 (provider ``reset_at`` wins, a sole credential keeps its short bench), except a ``model_entitlement`` rejection, which stays benched until the explicit reset path clears it. Siblings matter because a ``model_config`` twin seeded from the same key would otherwise be re-selected for the very model that just failed. Caller holds the lock. )_exhausted_ttl_normalize_error_contextrQreset_atrSsole_credentialF)persistr'N)rrZr[r)MODEL_ENTITLEMENT_BENCH_SECONDSr_is_sole_credentialrBlistrHidr9r'_adopt_persist) rIr#r$r rNrZr[r0 failed_keyscopedr.s &&&&& r_cool_down_model1CredentialPoolModelCooldownMixin._cool_down_model\s S 0 0IIK"AAE,];?? K nS$BZBZB\]] ** 4==)FyyEHH$jV=S=SWa=a-f.D.DunUI KKyK I * rc V^8dQhRRRR/#)r modelsz Iterable[str]rrr)rs"rrr>ysII-I4LIrc  ^RIHpHp\P!4pVP;_uu_4VP Uu.uFqUP V8wgKVNK pp\V4^8*pVUu/uF+pV!WWR7;p'gKW8gKVPVbK- p pV'dA\V 4\V48Xd(RRR\V P44/uuRRR4#VUu.uFqUPV 9gKVNK p p/p VFkp V Uu.uFp\W\4NK p pV 'gK'\V 4'gK:\V 4V, \^, 8gK^\V 4W&Km RRR4X 'dRRRV /#R#uupiuupiuupiuupi +'giL4;i)a What a picker should say about this pool's rate limits, or ``None`` when nothing is limited. ``{"scope": "account", "resets_at": epoch}`` when every live entry is benched credential-wide (the whole login is out; another model won't help), else ``{"scope": "models", "models": {model: epoch}}`` for the given *models* no usable entry can serve until a model cooldown ends. Entitlement benches (a year: the plan lacks the model) aren't windows that reset, so they're left out. Read-only: never clears or persists a cooldown. ) STATUS_DEAD_exhausted_untilr]scopeaccount resets_atNrk)rrmrnr)rFrH last_statuslenrcminr(r2allr`)rIrkrmrnr/r#livesoler0benchedusablecooledr$waitss&& r limit_state,CredentialPoolModelCooldownMixin.limit_stateysw Hiik ZZZ'+}}Y}e8I8I[8XEE}DYt9>D48dD5$4U$QQ5Q'W\Wb'uxxDGdG D 1KW^^=M9NO Z*.I1HeeFI')FIOP-e;P5SZZCJ,s$ T  :IIrr;i3)__doc__ __future__rr)typingrrrrrrrr`rr!r2r9r;rrrrsK# ??6#5-  + TITIr