@goodandready/dsh-key-rotation 0.8.66 → 0.8.68

package/lib/ops-analytics.js

@@ -0,0 +1,162 @@
+// lib/ops-analytics.js — 24h error breakdown, load distribution, and health index analytics (#505).
+// Pure helpers with zero dependencies.
+
+const DAY_MS = 86400000;
+const MAX_RING_BUFFER = 200;
+
+/**
+ * Classifies an error code or message into canonical categories:
+ * 'rateLimit' | 'server' | 'timeout' | 'quota' | 'auth' | 'other'
+ */
+export function classifyErrorCategory(code, message = '') {
+  const c = String(code ?? '').toUpperCase();
+  const m = String(message ?? '').toLowerCase();
+
+  if (c === '429' || c.includes('RATE_LIMIT') || m.includes('rate limit') || m.includes('too many requests')) {
+    return 'rateLimit';
+  }
+  if (/^5\d\d$/.test(c) || c === 'SERVER' || c === 'BAD_GATEWAY' || c === 'SERVICE_UNAVAILABLE' || m.includes('internal server error')) {
+    return 'server';
+  }
+  if (c.includes('TIMEOUT') || c === 'ETIMEDOUT' || c === 'ESOCKETTIMEDOUT' || m.includes('timeout') || m.includes('timed out')) {
+    return 'timeout';
+  }
+  if (c === 'QUOTA' || c === '402' || c.includes('QUOTA') || m.includes('quota') || m.includes('credit') || m.includes('insufficient_quota')) {
+    return 'quota';
+  }
+  if (c === 'AUTH' || c === '401' || c === '403' || m.includes('unauthorized') || m.includes('invalid_api_key') || m.includes('forbidden')) {
+    return 'auth';
+  }
+  return 'other';
+}
+
+function initPoolAnalytics(pool) {
+  if (!pool.state.analytics24h) {
+    pool.state.analytics24h = {
+      requests: [], // Ring buffer of { at, ref, success, attempts, failovers, cascaded }
+      errorEvents: [], // Ring buffer of { at, category, code, ref }
+    };
+  }
+  return pool.state.analytics24h;
+}
+
+/**
+ * Records a failover error encountered during key rotation.
+ */
+export function recordFailureCategory(pool, code, message = '', ref = '', now = Date.now()) {
+  if (!pool?.state) return;
+  const a = initPoolAnalytics(pool);
+  const category = classifyErrorCategory(code, message);
+  a.errorEvents.push({
+    at: now,
+    category,
+    code: String(code ?? 'UNKNOWN'),
+    ref: ref || pool.state.lastUsed || '',
+  });
+  if (a.errorEvents.length > MAX_RING_BUFFER) {
+    a.errorEvents.shift();
+  }
+}
+
+/**
+ * Records a completed request outcome in the pool's 24h analytics buffer.
+ */
+export function recordRequestOutcome(pool, outcome, now = Date.now()) {
+  if (!pool?.state) return;
+  const a = initPoolAnalytics(pool);
+
+  const entry = {
+    at: now,
+    ref: outcome.ref || pool.state.lastUsed || '',
+    success: outcome.success !== false,
+    attempts: Number(outcome.attempts) || 1,
+    failovers: Number(outcome.failovers) || 0,
+    cascaded: Boolean(outcome.cascaded),
+  };
+
+  a.requests.push(entry);
+  if (a.requests.length > MAX_RING_BUFFER) {
+    a.requests.shift();
+  }
+}
+
+/**
+ * Computes 24h analytics snapshot for the pool.
+ */
+export function compute24hAnalytics(pool, now = Date.now()) {
+  const cutoff = now - DAY_MS;
+  const a = pool?.state?.analytics24h;
+  const requests = a?.requests?.filter(r => r.at >= cutoff) ?? [];
+  const errorEvents = a?.errorEvents?.filter(e => e.at >= cutoff) ?? [];
+
+  const totalRequests = requests.length;
+  let firstAttemptSuccesses = 0;
+  let cascades = 0;
+  const keyCounts = new Map();
+  const errors = {
+    rateLimit: 0,
+    server: 0,
+    timeout: 0,
+    quota: 0,
+    auth: 0,
+    other: 0,
+  };
+
+  for (const r of requests) {
+    if (r.ref) {
+      keyCounts.set(r.ref, (keyCounts.get(r.ref) ?? 0) + 1);
+    }
+    if (r.success && r.attempts <= 1 && r.failovers === 0) {
+      firstAttemptSuccesses++;
+    }
+    if (r.cascaded) {
+      cascades++;
+    }
+  }
+
+  for (const ev of errorEvents) {
+    if (ev.category && errors[ev.category] != null) {
+      errors[ev.category]++;
+    }
+  }
+
+  // Calculate load distribution across pool refs
+  const refs = pool?.refs ?? [...keyCounts.keys()];
+  const loadDistribution = refs.map(ref => {
+    const count = keyCounts.get(ref) ?? 0;
+    const pct = totalRequests > 0 ? Math.round((count / totalRequests) * 100) : 0;
+    return { ref, count, pct };
+  });
+
+  const totalErrors = Object.values(errors).reduce((sum, n) => sum + n, 0);
+
+  // Compute average cooldown recovery time from pool.state.events
+  let cooldownTotalMs = 0;
+  let cooldownCount = 0;
+  const events = pool?.state?.events ?? [];
+  for (const ev of events) {
+    if (ev.at >= cutoff && ev.type === 'fail' && Number.isFinite(ev.cooldownMs) && ev.cooldownMs > 0) {
+      cooldownTotalMs += ev.cooldownMs;
+      cooldownCount++;
+    }
+  }
+  const avgCooldownRecoveryMs = cooldownCount > 0 ? Math.round(cooldownTotalMs / cooldownCount) : 0;
+
+  // Health index: % of requests handled without retries or failover
+  const healthIndexPct = totalRequests > 0
+    ? Math.round((firstAttemptSuccesses / totalRequests) * 100)
+    : 100;
+
+  return {
+    totalRequests,
+    firstAttemptSuccesses,
+    healthIndexPct,
+    loadDistribution,
+    errorBreakdown: {
+      ...errors,
+      total: totalErrors,
+    },
+    cascades: Math.max(cascades, pool?.state?.cascadeCount ?? 0),
+    avgCooldownRecoveryMs,
+  };
+}

package/lib/ops-config-io.js

@@ -0,0 +1,325 @@
+// lib/ops-config-io.js — full configuration export and import (#504).
+import crypto from 'node:crypto';
+import { json, readJson, isTrustedBridgeRequest, NS } from './http-bridge.js';
+import { CONFIG_EXPORT_PATH, CONFIG_IMPORT_PATH, IMPORT_PATH } from './ops-paths.js';
+import { keyTail } from './pool.js';
+import { plainConfig } from './index.js';
+
+export function encryptConfig(plainText, passphrase) {
+  const salt = crypto.randomBytes(16);
+  const key = crypto.pbkdf2Sync(passphrase, salt, 100000, 32, 'sha256');
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(plainText, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    encrypted: true,
+    algorithm: 'aes-256-gcm',
+    kdf: 'pbkdf2',
+    iterations: 100000,
+    salt: salt.toString('hex'),
+    iv: iv.toString('hex'),
+    tag: tag.toString('hex'),
+    ciphertext: encrypted.toString('hex'),
+  };
+}
+
+export function decryptConfig(payload, passphrase) {
+  if (!payload || !payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
+    throw new Error('Invalid encrypted config payload structure');
+  }
+  const salt = Buffer.from(payload.salt, 'hex');
+  const iv = Buffer.from(payload.iv, 'hex');
+  const tag = Buffer.from(payload.tag, 'hex');
+  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
+  const key = crypto.pbkdf2Sync(passphrase, salt, payload.iterations || 100000, 32, 'sha256');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString('utf8');
+}
+
+export function maskConfig(config) {
+  if (!config || typeof config !== 'object') return config;
+  const clone = JSON.parse(JSON.stringify(config));
+  if (Array.isArray(clone.providers)) {
+    for (const prov of clone.providers) {
+      if (Array.isArray(prov.keys)) {
+        prov.keys = prov.keys.map((k) => {
+          if (typeof k === 'string') return k.length > 8 ? `sk-...${k.slice(-4)}` : '***';
+          if (k && typeof k === 'object') {
+            return {
+              ...k,
+              value: typeof k.value === 'string' ? (k.value.length > 8 ? `sk-...${k.value.slice(-4)}` : '***') : '***',
+            };
+          }
+          return '***';
+        });
+      }
+    }
+  }
+  if (clone.webhookUrl && typeof clone.webhookUrl === 'string') {
+    try {
+      const u = new URL(clone.webhookUrl);
+      const parts = u.pathname.split('/');
+      if (parts.length > 2) {
+        parts[parts.length - 1] = '***';
+        u.pathname = parts.join('/');
+      }
+      clone.webhookUrl = u.toString();
+    } catch (_) {
+      clone.webhookUrl = '***';
+    }
+  }
+  if (clone.webhookActionToken) clone.webhookActionToken = '***';
+  return clone;
+}
+
+export function diffConfigs(currentConfig, incomingConfig, mode = 'merge') {
+  const currentProviders = Array.isArray(currentConfig?.providers) ? currentConfig.providers : [];
+  const incomingProviders = Array.isArray(incomingConfig?.providers) ? incomingConfig.providers : [];
+
+  const currentMap = new Map();
+  for (const p of currentProviders) {
+    const name = p.provider || p.name || p.id;
+    if (name) currentMap.set(name, p);
+  }
+
+  const createdProviders = [];
+  const updatedProviders = [];
+  let keysAdded = 0;
+  let keysUpdated = 0;
+
+  for (const p of incomingProviders) {
+    const name = p.provider || p.name || p.id;
+    if (!name) continue;
+    const inKeys = Array.isArray(p.keys) ? p.keys : [];
+    if (!currentMap.has(name)) {
+      createdProviders.push(name);
+      keysAdded += inKeys.length;
+    } else {
+      updatedProviders.push(name);
+      const curP = currentMap.get(name);
+      const curKeys = new Set(Array.isArray(curP.keys) ? curP.keys.map((k) => (typeof k === 'string' ? k : k?.value)) : []);
+      for (const k of inKeys) {
+        const val = typeof k === 'string' ? k : k?.value;
+        if (!curKeys.has(val)) keysAdded++;
+        else keysUpdated++;
+      }
+    }
+  }
+
+  const removedProviders = [];
+  if (mode === 'replace') {
+    const incomingNames = new Set(incomingProviders.map((p) => p.provider || p.name || p.id).filter(Boolean));
+    for (const [name] of currentMap.entries()) {
+      if (!incomingNames.has(name)) removedProviders.push(name);
+    }
+  }
+
+  const totalKeys = incomingProviders.reduce((acc, p) => acc + (Array.isArray(p.keys) ? p.keys.length : 0), 0);
+
+  return {
+    mode,
+    createdProviders,
+    updatedProviders,
+    removedProviders,
+    keysAdded,
+    keysUpdated,
+    totalKeys,
+  };
+}
+
+export function registerConfigIoRoutes(ctx, deps) {
+  // ── GET /dsh-key-rotation/export ──
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: CONFIG_EXPORT_PATH,
+    handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        json(res, 405, { error: { code: 'method', message: 'GET only' } });
+        return;
+      }
+      if (!isTrustedBridgeRequest(req)) {
+        json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: export is local-only' } });
+        return;
+      }
+
+      const urlObj = new URL(req.url, 'http://127.0.0.1');
+      const maskedParam = urlObj.searchParams.get('masked');
+      const masked = maskedParam === null ? true : maskedParam !== 'false';
+      const passphrase = urlObj.searchParams.get('passphrase') || null;
+
+      const settings = ctx.get('settings');
+      let currentConfig = {};
+      try {
+        if (settings && typeof settings.get === 'function') {
+          currentConfig = settings.get(NS) || {};
+        } else if (settings && typeof settings.describe === 'function') {
+          const desc = settings.describe({ redactSecrets: false })?.find((c) => c.ns === NS);
+          currentConfig = desc?.value || {};
+        } else {
+          currentConfig = deps.buildRuntime().cfg0 || {};
+        }
+      } catch (_) {
+        currentConfig = deps.buildRuntime().cfg0 || {};
+      }
+
+      const rawConfig = plainConfig(currentConfig);
+      const exportData = masked ? maskConfig(rawConfig) : rawConfig;
+
+      if (passphrase) {
+        const encryptedPayload = encryptConfig(JSON.stringify(exportData), passphrase);
+        json(res, 200, {
+          ok: true,
+          version: '0.8.67',
+          exportedAt: new Date().toISOString(),
+          masked,
+          encrypted: true,
+          ...encryptedPayload,
+        });
+        return;
+      }
+
+      json(res, 200, {
+        ok: true,
+        version: '0.8.67',
+        exportedAt: new Date().toISOString(),
+        masked,
+        encrypted: false,
+        config: exportData,
+      });
+    },
+  }));
+
+  // ── POST /dsh-key-rotation/config-import ──
+  const handleImport = async (req, res) => {
+    if (req.method !== 'POST') {
+      json(res, 405, { error: { code: 'method', message: 'POST only' } });
+      return;
+    }
+    if (!isTrustedBridgeRequest(req)) {
+      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: import is local-only' } });
+      return;
+    }
+
+    let body;
+    try {
+      body = await readJson(req);
+    } catch (e) {
+      json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } });
+      return;
+    }
+
+    let incomingConfig = null;
+    const passphrase = body.passphrase || null;
+
+    if (body.encrypted && body.ciphertext) {
+      if (!passphrase) {
+        json(res, 400, { error: { code: 'passphrase-required', message: 'Passphrase is required for encrypted configuration' } });
+        return;
+      }
+      try {
+        const decryptedStr = decryptConfig(body, passphrase);
+        incomingConfig = JSON.parse(decryptedStr);
+      } catch (err) {
+        json(res, 400, { error: { code: 'decryption-failed', message: `Decryption failed: ${err.message}` } });
+        return;
+      }
+    } else if (body.config) {
+      incomingConfig = body.config;
+    } else if (body.providers) {
+      incomingConfig = body;
+    } else {
+      json(res, 400, { error: { code: 'invalid-payload', message: 'Missing config or providers in request' } });
+      return;
+    }
+
+    if (!incomingConfig || typeof incomingConfig !== 'object') {
+      json(res, 400, { error: { code: 'invalid-config', message: 'Imported configuration must be an object' } });
+      return;
+    }
+
+    const mode = body.mode === 'replace' ? 'replace' : 'merge';
+    const dryRun = Boolean(body.dryRun);
+
+    const settings = ctx.get('settings');
+    let currentConfig = {};
+    try {
+      if (settings && typeof settings.get === 'function') {
+        currentConfig = settings.get(NS) || {};
+      } else if (settings && typeof settings.describe === 'function') {
+        const desc = settings.describe({ redactSecrets: false })?.find((c) => c.ns === NS);
+        currentConfig = desc?.value || {};
+      } else {
+        currentConfig = deps.buildRuntime().cfg0 || {};
+      }
+    } catch (_) {
+      currentConfig = deps.buildRuntime().cfg0 || {};
+    }
+    const rawCurrent = plainConfig(currentConfig);
+
+    const preview = diffConfigs(rawCurrent, incomingConfig, mode);
+
+    if (dryRun) {
+      json(res, 200, {
+        ok: true,
+        dryRun: true,
+        preview,
+      });
+      return;
+    }
+
+    // Apply configuration
+    let mergedConfig;
+    if (mode === 'replace') {
+      mergedConfig = { ...rawCurrent, ...incomingConfig };
+      if (Array.isArray(incomingConfig.providers)) {
+        mergedConfig.providers = incomingConfig.providers;
+      }
+    } else {
+      // Merge mode
+      mergedConfig = { ...rawCurrent, ...incomingConfig };
+      const curProviders = Array.isArray(rawCurrent.providers) ? [...rawCurrent.providers] : [];
+      const curMap = new Map();
+      for (let i = 0; i < curProviders.length; i++) {
+        const name = curProviders[i].provider || curProviders[i].name || curProviders[i].id;
+        if (name) curMap.set(name, i);
+      }
+      const inProviders = Array.isArray(incomingConfig.providers) ? incomingConfig.providers : [];
+      for (const p of inProviders) {
+        const name = p.provider || p.name || p.id;
+        if (!name) continue;
+        if (curMap.has(name)) {
+          const idx = curMap.get(name);
+          curProviders[idx] = { ...curProviders[idx], ...p };
+        } else {
+          curProviders.push(p);
+        }
+      }
+      mergedConfig.providers = curProviders;
+    }
+
+    if (settings && typeof settings.replace === 'function') {
+      try {
+        await settings.replace(NS, mergedConfig);
+      } catch (err) {
+        json(res, 500, { error: { code: 'settings-write-failed', message: err.message } });
+        return;
+      }
+    }
+
+    json(res, 200, {
+      ok: true,
+      applied: true,
+      mode,
+      preview,
+    });
+  };
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: CONFIG_IMPORT_PATH,
+    handler: handleImport,
+  }));
+}

package/lib/ops-paths.js

@@ -19,3 +19,6 @@ export const DISCOVER_PATH = '/dsh-key-rotation/discover';
 export const AUTO_IMPORT_PATH = '/dsh-key-rotation/auto-import';
 export const PRESET_LIMITS_PATH = '/dsh-key-rotation/preset-limits';
 export const BALANCE_PATH = '/dsh-key-rotation/balance';
+export const CONFIG_EXPORT_PATH = '/dsh-key-rotation/export';
+export const CONFIG_IMPORT_PATH = '/dsh-key-rotation/config-import';
+export const QUICK_ACTION_PATH = '/dsh-key-rotation/quick-action';

package/lib/ops-quick-action.js

@@ -0,0 +1,167 @@
+import { json, readJson, isTrustedBridgeRequest } from './http-bridge.js';
+import { QUICK_ACTION_PATH } from './ops-paths.js';
+import { keyTail, isKeyPaused } from './pool.js';
+
+/**
+ * @param {object} ctx cordis context
+ * @param {object} deps live dependencies from apply()
+ */
+export function registerQuickActionRoutes(ctx, deps) {
+  const { buildRuntime, pushEvent, circuitBreaker } = deps;
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: QUICK_ACTION_PATH,
+    handler: async (req, res) => {
+      if (req.method !== 'POST') {
+        json(res, 405, { error: { code: 'method', message: 'POST only' } });
+        return;
+      }
+      if (!isTrustedBridgeRequest(req)) {
+        json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: quick-action is local-only' } });
+        return;
+      }
+
+      let body;
+      try {
+        body = await readJson(req);
+      } catch (e) {
+        json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } });
+        return;
+      }
+
+      const action = typeof body?.action === 'string' ? body.action.trim().toLowerCase() : '';
+      const provider = typeof body?.provider === 'string' ? body.provider.trim() : '';
+      const ref = typeof body?.ref === 'string' ? body.ref.trim() : null;
+
+      if (!action || !['skip', 'reset', 'pause'].includes(action)) {
+        json(res, 400, { error: { code: 'invalid-action', message: 'action must be skip, reset, or pause' } });
+        return;
+      }
+
+      if (!provider) {
+        json(res, 400, { error: { code: 'missing-provider', message: 'provider is required' } });
+        return;
+      }
+
+      const runtime = buildRuntime();
+      let targetPool = null;
+
+      const pools = runtime.pools ?? Array.from(runtime.poolByRef?.values() || []);
+      for (const pool of pools) {
+        if (pool.provider === provider || pool.base === provider) {
+          targetPool = pool;
+          break;
+        }
+      }
+
+      if (!targetPool) {
+        json(res, 404, { error: { code: 'pool-not-found', message: `Pool not found for provider: ${provider}` } });
+        return;
+      }
+
+      if (action === 'skip') {
+        const total = targetPool.refs?.length || 0;
+        if (total === 0) {
+          json(res, 400, { error: { code: 'no-keys', message: 'Pool has no keys to rotate' } });
+          return;
+        }
+        const currentCursor = targetPool.state.cursor ?? 0;
+        const nextCursor = (currentCursor + 1) % total;
+        targetPool.state.cursor = nextCursor;
+        const nextRef = targetPool.refs[nextCursor];
+        targetPool.state.lastUsed = nextRef;
+
+        if (typeof pushEvent === 'function') {
+          pushEvent(targetPool, nextRef, 'QUICK_ACTION_SKIP', 0);
+        }
+
+        json(res, 200, {
+          ok: true,
+          action: 'skip',
+          provider,
+          cursor: nextCursor,
+          activeRef: nextRef,
+          activeTail: keyTail(nextRef),
+        });
+        return;
+      }
+
+      if (action === 'reset') {
+        targetPool.state.failedUntil?.clear();
+        targetPool.state.failCounts?.clear();
+        targetPool.state.resetReasons?.clear();
+        targetPool.state.headerResetTimes?.clear();
+        targetPool.state.switches = 0;
+        targetPool.state.lastReason = null;
+
+        const breaker = circuitBreaker ?? runtime.breaker;
+        if (breaker) {
+          if (typeof breaker.reset === 'function') breaker.reset(provider);
+          else if (typeof breaker.onSuccess === 'function') breaker.onSuccess(provider);
+        }
+
+        if (typeof pushEvent === 'function') {
+          pushEvent(targetPool, '*', 'QUICK_ACTION_RESET', 0);
+        }
+
+        json(res, 200, {
+          ok: true,
+          action: 'reset',
+          provider,
+          healthyKeys: targetPool.refs?.length || 0,
+        });
+        return;
+      }
+
+      if (action === 'pause') {
+        const targetRef = ref || targetPool.state.lastUsed || targetPool.refs?.[0];
+        if (!targetRef) {
+          json(res, 400, { error: { code: 'no-ref', message: 'No key specified or active in pool' } });
+          return;
+        }
+
+        let isPaused = false;
+        if (!targetPool.state.pausedRefs) targetPool.state.pausedRefs = new Set();
+
+        if (targetPool.state.pausedRefs instanceof Set) {
+          if (targetPool.state.pausedRefs.has(targetRef)) {
+            targetPool.state.pausedRefs.delete(targetRef);
+            targetPool.state.pauseReasons?.delete(targetRef);
+            isPaused = false;
+          } else {
+            targetPool.state.pausedRefs.add(targetRef);
+            if (!targetPool.state.pauseReasons) targetPool.state.pauseReasons = new Map();
+            targetPool.state.pauseReasons.set(targetRef, 'MANUAL_QUICK_PAUSED');
+            isPaused = true;
+          }
+        } else if (Array.isArray(targetPool.state.pausedRefs)) {
+          const idx = targetPool.state.pausedRefs.indexOf(targetRef);
+          if (idx >= 0) {
+            targetPool.state.pausedRefs.splice(idx, 1);
+            targetPool.state.pauseReasons?.delete(targetRef);
+            isPaused = false;
+          } else {
+            targetPool.state.pausedRefs.push(targetRef);
+            if (!targetPool.state.pauseReasons) targetPool.state.pauseReasons = new Map();
+            targetPool.state.pauseReasons.set(targetRef, 'MANUAL_QUICK_PAUSED');
+            isPaused = true;
+          }
+        }
+
+        if (typeof pushEvent === 'function') {
+          pushEvent(targetPool, targetRef, isPaused ? 'KEY_PAUSED' : 'KEY_RESUMED', 0);
+        }
+
+        json(res, 200, {
+          ok: true,
+          action: 'pause',
+          provider,
+          ref: targetRef,
+          paused: isPaused,
+        });
+        return;
+      }
+    },
+  }));
+}

package/lib/ops-status.js

@@ -17,6 +17,8 @@ import {
 import { bucketInfo, tpmInfo } from './bucket.js';
 import { isBlockedUntilReset } from './quota-window.js';
 import { sanitizeSnapshot } from './sanitize-snapshot.js';
+import { compute24hAnalytics } from './ops-analytics.js';
+import { getPromptCacheSummary } from './prompt-cache.js';
 import {
   STATUS_PATH,
   HEALTH_PATH,
@@ -177,6 +179,8 @@ ctx.effect(() => ctx.webServer.register({
         routingStrategy: pool.routingStrategy ?? runtime.routingStrategy ?? 'round-robin',
         proactiveRateLimitGuard: pool.proactiveRateLimitGuard ?? runtime.proactiveRateLimitGuard ?? true,
         smoothedRequests: pool.state.smoothedRequests ?? 0,
+        promptCache: getPromptCacheSummary(pool, now),
+        analytics24h: compute24hAnalytics(pool, now),
       });
       } catch (e) {
         (ctx?.logger ? ctx.logger('dsh-key-rotation') : null)?.warn?.(`[dsh-key-rotation] status: pool ${pool.base} failed: ${String(e?.message ?? e)} ${e?.stack ?? ''}`);
@@ -242,6 +246,8 @@ ctx.effect(() => ctx.webServer.register({
         providerName: pool.provider ?? providerOfBase(pool.base),
         basePool: basePoolH?.base ?? null,
         modelQuota: quotaAware ? { configured: true, exhaustedKeys: quotaExhausted } : null,
+        lastUsed: pool.state.lastUsed ?? null,
+        lastUsedTail: pool.state.lastUsed ? keyTail(pool.state.lastUsed) : null,
       };
     }
     let circuitOpenAny = false;