cartethyia 2.4.6 → 2.5.0

package/scripts/cli/gateway/spawn.ts

@@ -1,101 +1,173 @@
-import { openSync } from "node:fs";
-import { join } from "node:path";
-import { PACKAGE_ROOT, resolvePackagePath } from "../../../src/config/package-paths";
-
-/**
- * Starts the gateway and resolves once it answers its own health probe.
- *
- * The child is attached by default. A detached child cannot be killed from an
- * `exit` handler on Windows (measured: `kill()` runs, the gateway keeps
- * serving), and a terminal's Ctrl-C only reaches children in the same process
- * group. Staying attached means Ctrl-C and the `exit` backstop both stop the
- * gateway. "Hide to tray" passes `detached: true` because that gateway must
- * outlive this process.
- */
-export async function startGateway(
-  port: number,
-  drainToken: string,
-  options: { readonly detached?: boolean } = {},
-): Promise<Bun.Subprocess> {
-  // Starting a second gateway on the same port used to fail with "stopped
-  // before becoming ready (exit code 1)", which says nothing about the real
-  // cause. Probe the port first and say what is actually there.
-  const existing = await fetch(`http://127.0.0.1:${port}/health`, {
-    signal: AbortSignal.timeout(1_000),
-  }).catch(() => null);
-  if (existing !== null) {
-    throw new Error(
-      `Cartethyia is already running on port ${port}. Open http://127.0.0.1:${port}/console, or stop the terminal that started it.`,
-    );
-  }
-  // The gateway logs a startup phase line per stage. In menu mode those lines
-  // would scroll through the same terminal the menu is drawing on, so they go
-  // to a file instead and the operator sees only the menu.
-  const configDir = process.env.CARTETHYIA_CONFIG_DIR;
-  let logFd: number | null = null;
-  if (configDir) {
-    try {
-      logFd = openSync(join(configDir, "gateway.log"), "a");
-    } catch {
-      // A read-only config directory costs only the log, not startup.
-    }
-  }
-  const child = Bun.spawn(
-    [process.execPath, "run", resolvePackagePath("src", "main.ts")],
-    {
-      cwd: PACKAGE_ROOT,
-      env: { ...process.env, CARTETHYIA_DRAIN_TOKEN: drainToken },
-      // "ignore", not "inherit": the gateway does not read stdin, and in menu
-      // mode the menu is the only stdin consumer. With "inherit" the gateway
-      // held the fd and swallowed every keypress after the first, so the menu
-      // rendered but never received Enter.
-      stdin: "ignore",
-      stdout: logFd ?? "ignore",
-      // stderr goes to the same file: "inherit" ties the gateway to the
-      // terminal, so closing that terminal took the gateway down with it and
-      // "Hide to tray" left nothing running.
-      stderr: logFd ?? "ignore",
-      detached: options.detached === true,
-    },
-  );
-  const startupController = new AbortController();
-  const ready = (async (): Promise<void> => {
-    const deadline = Date.now() + 30_000;
-    while (!startupController.signal.aborted && Date.now() < deadline) {
-      try {
-        const response = await fetch(`http://127.0.0.1:${port}/health`, {
-          signal: AbortSignal.timeout(500),
-        });
-        if (response.ok) {
-          const body: unknown = await response.json();
-          if (body !== null && typeof body === "object" && "status" in body && body.status === "ok") return;
-        }
-      } catch {
-        // The gateway is not accepting health requests yet.
-      }
-      await Bun.sleep(250);
-    }
-    if (startupController.signal.aborted) throw new Error("Cartethyia exited before becoming ready");
-    throw new Error("Cartethyia did not open its configured port within 30 seconds");
-  })();
-  const exitedEarly = child.exited.then((code) => {
-    startupController.abort();
-    return { status: "exit" as const, code };
-  });
-  const readyResult = ready.then(
-    () => ({ status: "ready" as const }),
-    (error: unknown) => ({ status: "failure" as const, error }),
-  );
-  try {
-    const result = await Promise.race([readyResult, exitedEarly]);
-    if (result.status === "exit") {
-      throw new Error(`Cartethyia stopped before becoming ready (exit code ${result.code})`);
-    }
-    if (result.status === "failure") throw result.error;
-    return child;
-  } catch (error) {
-    child.kill();
-    await child.exited;
-    throw error;
-  }
-}
+import { openSync } from "node:fs";
+import {
+  clearInstanceLock,
+  fingerprint,
+  pidAlive,
+  readInstanceLock,
+  writeInstanceLock,
+} from "./instance-lock";
+import { join } from "node:path";
+import { PACKAGE_ROOT, resolvePackagePath } from "../../../src/config/package-paths";
+
+/**
+ * Frees the port when what holds it is this install's own gateway.
+ *
+ * Returns `null` when the port is free (or was successfully taken), and a
+ * message to fail with otherwise. It never kills a process it cannot identify:
+ * a stranger's service on this port is reported, not drained.
+ *
+ * The probe is two-step on purpose. `/health` alone is answered by anything, so
+ * it only says "something is there"; the drain request is what distinguishes
+ * ours from someone else's, because it is token-gated — and a 401 means another
+ * Cartethyia install, which this one must not stop.
+ */
+async function claimPort(port: number, drainToken: string): Promise<string | null> {
+  // A lock naming this install's own gateway is the strongest evidence
+  // available, so prefer it over the network probe when it is live.
+  const lock = readInstanceLock();
+  const ours = lock !== null && lock.port === port && lock.tokenFingerprint === fingerprint(drainToken);
+
+  const response = await fetch(`http://127.0.0.1:${port}/admin/drain`, {
+    method: "POST",
+    headers: { "x-drain-token": drainToken },
+    signal: AbortSignal.timeout(3_000),
+  }).catch(() => null);
+
+  if (response === null) {
+    // Nothing answered a drain request. If our own lock names a dead pid, the
+    // marker is stale and nothing is holding the port — clear it and continue.
+    if (ours && !pidAlive(lock.pid)) {
+      clearInstanceLock();
+      return null;
+    }
+    return `Port ${port} is busy and nothing there answers a drain request. Stop whatever holds it, or set a different PORT.`;
+  }
+  if (response.status === 401) {
+    return `Another Cartethyia gateway is already running on port ${port} under a different install. Stop it from its own terminal or tray — this install will not stop a gateway it does not own.`;
+  }
+  if (response.status === 403) {
+    return `Port ${port} refused a drain from loopback. Stop what holds it, then start again.`;
+  }
+  if (response.status !== 202) {
+    return `Port ${port} is busy and refused to drain (HTTP ${response.status}). Stop it manually, then start again.`;
+  }
+  // Drain accepted. Wait for the port to actually free: the gateway flushes its
+  // 202 before closing sockets, so acceptance is not release.
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    const stillUp = await fetch(`http://127.0.0.1:${port}/health`, {
+      signal: AbortSignal.timeout(500),
+    }).catch(() => null);
+    if (stillUp === null) {
+      clearInstanceLock();
+      return null;
+    }
+    await Bun.sleep(200);
+  }
+  return `The gateway on port ${port} accepted a drain but did not release the port within 30 seconds. Stop it manually, then start again.`;
+}
+
+/**
+ * Starts the gateway and resolves once it answers its own health probe.
+ *
+ * The child is attached by default. A detached child cannot be killed from an
+ * `exit` handler on Windows (measured: `kill()` runs, the gateway keeps
+ * serving), and a terminal's Ctrl-C only reaches children in the same process
+ * group. Staying attached means Ctrl-C and the `exit` backstop both stop the
+ * gateway. "Hide to tray" passes `detached: true` because that gateway must
+ * outlive this process.
+ */
+export async function startGateway(
+  port: number,
+  drainToken: string,
+  options: { readonly detached?: boolean } = {},
+): Promise<Bun.Subprocess> {
+  // Starting a second gateway on the same port used to fail with "stopped
+  // before becoming ready (exit code 1)", which says nothing about the real
+  // cause. Probe the port first and say what is actually there.
+  const existing = await fetch(`http://127.0.0.1:${port}/health`, {
+    signal: AbortSignal.timeout(1_000),
+  }).catch(() => null);
+  if (existing !== null) {
+    // Something already owns the port. Replace it only when it proves to be our
+    // own gateway — otherwise stop and say what is there. A gateway left behind
+    // by a closed terminal used to make every later start fail until the
+    // operator found and killed it by hand.
+    const claimed = await claimPort(port, drainToken);
+    if (claimed !== null) throw new Error(claimed);
+  }
+  // The gateway logs a startup phase line per stage. In menu mode those lines
+  // would scroll through the same terminal the menu is drawing on, so they go
+  // to a file instead and the operator sees only the menu.
+  const configDir = process.env.CARTETHYIA_CONFIG_DIR;
+  let logFd: number | null = null;
+  if (configDir) {
+    try {
+      logFd = openSync(join(configDir, "gateway.log"), "a");
+    } catch {
+      // A read-only config directory costs only the log, not startup.
+    }
+  }
+  const child = Bun.spawn(
+    [process.execPath, "run", resolvePackagePath("src", "main.ts")],
+    {
+      cwd: PACKAGE_ROOT,
+      env: { ...process.env, CARTETHYIA_DRAIN_TOKEN: drainToken },
+      // "ignore", not "inherit": the gateway does not read stdin, and in menu
+      // mode the menu is the only stdin consumer. With "inherit" the gateway
+      // held the fd and swallowed every keypress after the first, so the menu
+      // rendered but never received Enter.
+      stdin: "ignore",
+      stdout: logFd ?? "ignore",
+      // stderr goes to the same file: "inherit" ties the gateway to the
+      // terminal, so closing that terminal took the gateway down with it and
+      // "Hide to tray" left nothing running.
+      stderr: logFd ?? "ignore",
+      detached: options.detached === true,
+    },
+  );
+  const startupController = new AbortController();
+  const ready = (async (): Promise<void> => {
+    const deadline = Date.now() + 30_000;
+    while (!startupController.signal.aborted && Date.now() < deadline) {
+      try {
+        const response = await fetch(`http://127.0.0.1:${port}/health`, {
+          signal: AbortSignal.timeout(500),
+        });
+        if (response.ok) {
+          const body: unknown = await response.json();
+          if (body !== null && typeof body === "object" && "status" in body && body.status === "ok") return;
+        }
+      } catch {
+        // The gateway is not accepting health requests yet.
+      }
+      await Bun.sleep(250);
+    }
+    if (startupController.signal.aborted) throw new Error("Cartethyia exited before becoming ready");
+    throw new Error("Cartethyia did not open its configured port within 30 seconds");
+  })();
+  const exitedEarly = child.exited.then((code) => {
+    startupController.abort();
+    return { status: "exit" as const, code };
+  });
+  const readyResult = ready.then(
+    () => ({ status: "ready" as const }),
+    (error: unknown) => ({ status: "failure" as const, error }),
+  );
+  try {
+    const result = await Promise.race([readyResult, exitedEarly]);
+    if (result.status === "exit") {
+      throw new Error(`Cartethyia stopped before becoming ready (exit code ${result.code})`);
+    }
+    if (result.status === "failure") throw result.error;
+    // Recorded only once the child is actually serving: a marker written before
+    // readiness would name a gateway that never came up, and the next start
+    // would treat a live port as ours when it is not.
+    writeInstanceLock(port, child.pid, drainToken);
+    return child;
+  } catch (error) {
+    child.kill();
+    await child.exited;
+    throw error;
+  }
+}

package/scripts/cli/ui/background.ts

@@ -1,49 +1,110 @@
-import { spawn } from "node:child_process";
-import { PACKAGE_ROOT, resolvePackagePath } from "../../../src/config/package-paths";
-
-/** Opens a URL in the operator's default browser, ignoring a missing handler. */
-export function openUrl(url: string): Promise<void> {
-  const command = process.platform === "win32"
-    ? "explorer.exe"
-    : process.platform === "darwin"
-      ? "open"
-      : "xdg-open";
-  const child = Bun.spawn([command, url], {
-    stdin: "ignore",
-    stdout: "ignore",
-    stderr: "ignore",
-  });
-  return child.exited.then(() => undefined);
-}
-
-/**
- * Starts a Bun process that owns no console window.
- *
- * On Windows, spawning the child directly is not enough: a console-subsystem
- * child of a window-less parent allocates a new console, and when the parent is
- * inside Windows Terminal the tab is already on screen before any flag can take
- * effect — measured: `detached: true` plus `windowsHide: true` still produced a
- * Windows Terminal window titled with the bun path. `wscript.exe` is a
- * GUI-subsystem host, so it never allocates a console, and a child launched
- * from it with window style 0 inherits that. The VBS is that launcher.
- *
- * Elsewhere `detached` is enough and the helper is not used.
- */
-export function launchBackground(args: readonly string[]): void {
-  if (process.platform !== "win32") {
-    const child = spawn(process.execPath, [...args], {
-      cwd: PACKAGE_ROOT,
-      detached: true,
-      stdio: "ignore",
-    });
-    child.unref();
-    return;
-  }
-  const launcher = resolvePackagePath("scripts", "cli", "tray", "hidden-window.vbs");
-  const child = spawn(
-    "wscript.exe",
-    ["//nologo", launcher, process.execPath, ...args],
-    { cwd: PACKAGE_ROOT, detached: true, stdio: "ignore", windowsHide: true },
-  );
-  child.unref();
-}
+import { spawn } from "node:child_process";
+import { readFileSync, unlinkSync } from "node:fs";
+import { PACKAGE_ROOT, resolvePackagePath } from "../../../src/config/package-paths";
+
+/** Opens a URL in the operator's default browser, ignoring a missing handler. */
+export function openUrl(url: string): Promise<void> {
+  const command = process.platform === "win32"
+    ? "explorer.exe"
+    : process.platform === "darwin"
+      ? "open"
+      : "xdg-open";
+  const child = Bun.spawn([command, url], {
+    stdin: "ignore",
+    stdout: "ignore",
+    stderr: "ignore",
+  });
+  return child.exited.then(() => undefined);
+}
+
+/**
+ * Starts a detached process and resolves once it reports readiness.
+ *
+ * The child owns no stdio, so a signal file is the only channel that survives
+ * the parent. Without it the caller prints "running in the background" for a
+ * child that may already have died — which is exactly what a port clash looks
+ * like, because the child's own startup probe fails while the parent's gateway
+ * still holds the port.
+ *
+ * Resolves with the URL the child reported. Rejects with the child's message
+ * when it reports failure, or with a timeout if it never reports at all.
+ */
+export function launchBackgroundWithStatus(
+  args: readonly string[],
+  options: { readonly signalPath: string; readonly timeoutMs?: number } = { signalPath: "" },
+): Promise<string> {
+  return new Promise<string>((resolve, reject) => {
+    const signalPath = options.signalPath;
+    const deadline = Date.now() + (options.timeoutMs ?? 60_000);
+    let settled = false;
+    const finish = (error: Error | null, url?: string): void => {
+      if (settled) return;
+      settled = true;
+      clearInterval(timer);
+      try {
+        unlinkSync(signalPath);
+      } catch {}
+      if (error) reject(error);
+      else resolve(url ?? "");
+    };
+
+    const env = { ...process.env, CARTETHYIA_TRAY_STARTUP_SIGNAL: signalPath };
+    spawnBackground(args, env);
+
+    const timer = setInterval(() => {
+      if (settled) return;
+      let raw: string;
+      try {
+        raw = readFileSync(signalPath, "utf8");
+      } catch {
+        if (Date.now() >= deadline) finish(new Error("the background process did not report startup within the deadline"));
+        return;
+      }
+      try {
+        const signal = JSON.parse(raw) as { status?: string; url?: string; message?: string };
+        if (signal.status === "ready" && typeof signal.url === "string") finish(null, signal.url);
+        else if (signal.status === "failed") finish(new Error(signal.message ?? "the background process failed to start"));
+      } catch {
+        // A partially written file is read again on the next tick.
+      }
+    }, 150);
+    timer.unref?.();
+  });
+}
+
+/**
+ * Starts a Bun process that owns no console window.
+ *
+ * On Windows, spawning the child directly is not enough: a console-subsystem
+ * child of a window-less parent allocates a new console, and when the parent is
+ * inside Windows Terminal the tab is already on screen before any flag can take
+ * effect — measured: `detached: true` plus `windowsHide: true` still produced a
+ * Windows Terminal window titled with the bun path. `wscript.exe` is a
+ * GUI-subsystem host, so it never allocates a console, and a child launched
+ * from it with window style 0 inherits that. The VBS is that launcher.
+ *
+ * Elsewhere `detached` is enough and the helper is not used.
+ */
+export function launchBackground(args: readonly string[]): void {
+  spawnBackground(args, process.env);
+}
+
+function spawnBackground(args: readonly string[], env: NodeJS.ProcessEnv): void {
+  if (process.platform !== "win32") {
+    const child = spawn(process.execPath, [...args], {
+      cwd: PACKAGE_ROOT,
+      detached: true,
+      stdio: "ignore",
+      env,
+    });
+    child.unref();
+    return;
+  }
+  const launcher = resolvePackagePath("scripts", "cli", "tray", "hidden-window.vbs");
+  const child = spawn(
+    "wscript.exe",
+    ["//nologo", launcher, process.execPath, ...args],
+    { cwd: PACKAGE_ROOT, detached: true, stdio: "ignore", windowsHide: true, env },
+  );
+  child.unref();
+}

package/src/boot/app.ts

@@ -34,14 +34,21 @@ import {
 import { createResponsesCompactHandler } from "../transport/dispatch/responses-compact";
 import { createSystemoneHandler } from "../transport/dispatch/systemone";
 import { createWebsearchHandler } from "../transport/dispatch/websearch";
-import { createImageGenerationHandler, createVideoGenerationHandler } from "../transport/dispatch/generation";
+import {
+  createAudioSpeechHandler,
+  createAudioTranscriptionHandler,
+  createEmbeddingHandler,
+  createImageGenerationHandler,
+  createVideoGenerationHandler,
+} from "../transport/dispatch/generation";
 import { createTokenCountHandler } from "../transport/dispatch/token-count";
 
 import { createTransportPipeline } from "../transport/guards/pipeline";
 import { createDrainHandler, isLoopbackPeer, tokenMatches } from "../transport/drain-endpoint";
 import { createConsoleAccountResetHandler } from "../console/auth/account-reset";
+import { resetConsoleAuthState } from "../console/auth/account-reset-store";
 import { createBackupExportHandler } from "../console/backup/export-endpoint";
-import { consoleUsers, tenants } from "../persistence/schema";
+import { tenants } from "../persistence/schema";
 import { PublicModelCatalogStore, type AllowedModelEntry } from "../console/providers/catalog/public-model-store";
 import type { IpAbuseProtectionService } from "../security/abuse";
 import type { ReadinessCheckResult } from "../persistence/readiness";
@@ -514,6 +521,13 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     // Mounted with no model behind it on purpose: the surface exists so it can
     // be finished when an upstream is known, rather than 404ing like a typo.
     const handleVideoGeneration = createVideoGenerationHandler(generationDeps);
+    // Passthrough surfaces: routed and accounted for, but never interpreted.
+    // No bundled adapter implements embeddings or audio, and inventing a wire
+    // for them would be a guess; what these need to be useful is the route, the
+    // pipeline, and a compatible upstream behind it.
+    const handleEmbedding = createEmbeddingHandler(generationDeps);
+    const handleAudioTranscription = createAudioTranscriptionHandler(generationDeps);
+    const handleAudioSpeech = createAudioSpeechHandler(generationDeps);
     // Shares the generation dependency bundle: same pipeline, and a count is
     // neither chat-shaped nor generation-shaped, so it needs exactly the same
     // routing, leasing, and accounting surface.
@@ -535,6 +549,9 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         routes.post("/search", handleWebsearch);
         routes.post("/images/generations", handleImageGeneration);
         routes.post("/videos/generations", handleVideoGeneration);
+        routes.post("/embeddings", handleEmbedding);
+        routes.post("/audio/transcriptions", handleAudioTranscription);
+        routes.post("/audio/speech", handleAudioSpeech);
         routes.get("/models", handleModelsList);
         routes.get("/models/info", handleModelsDetail);
         routes.get("/models/*", handleModelsDetail);
@@ -582,10 +599,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         createConsoleAccountResetHandler({
           token: deps.drainToken,
           resolvePeerAddress: (request) => peerAddresses.get(request) ?? null,
-          resetConsoleAccount: async () => {
-            const users = await deps.db.delete(consoleUsers);
-            return users.rowCount ?? 0;
-          },
+          resetConsoleAccount: () => resetConsoleAuthState(deps.db),
         }),
       );
     }

package/src/boot/dependencies.ts

@@ -32,6 +32,9 @@ import { RedisAdmissionCounterStore } from "../security/admission/redis-store";
 import { sweepLeases } from "../security/admission/lease-sweep";
 import { DrizzleApiKeyStore } from "../persistence/stores/api-key-store";
 import { UsageFlushBuffer } from "../persistence/usage-flush";
+import { setPendingUsageSource } from "../security/api-key-auth";
+import { HealthEventFlushBuffer, setHealthEventBuffer } from "../persistence/health-event-flush";
+import { subscribePeerSettingsRevisions } from "../persistence/settings-revision";
 import { deleteExpiredSessions } from "../console/auth/session-service";
 import { InMemoryIpAbuseStore, IpAbuseProtectionService, RedisIpAbuseStore } from "../security/abuse";
 import {
@@ -111,6 +114,7 @@ export interface ProductionDeps {
   poolSelector: NetworkPoolSelector;
   telemetryBuffer: TelemetryBatchBuffer;
   usageFlush: UsageFlushBuffer;
+  healthEventFlush: HealthEventFlushBuffer;
   trustedProxyBoundary: TrustedProxyBoundary;
   providerRegistry: ProviderRegistry;
   resolveOAuthRefresher: (providerId: string) => Promise<OAuthTokenRefresher | undefined>;
@@ -204,7 +208,21 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
     }
     return [...totals].map(([accountId, inflight]) => ({ accountId, inflight }));
   };
+  // Peer processes' settings mutations arrive here. Subscribed once for the
+  // process: the revision counter is process-global, and the handler only
+  // moves it forward.
+  subscribePeerSettingsRevisions();
   const usageFlush = new UsageFlushBuffer(db);
+  // Auth reads lifetime usage to seed the admission counter. The persisted
+  // value lags by up to one flush interval, so hand it the in-flight deltas
+  // too — otherwise the seed is systematically under what has actually been
+  // spent, worst exactly when the key is busiest.
+  setPendingUsageSource((apiKeyId) => usageFlush.pendingFor(apiKeyId));
+  // Health audit rows are append-only and read by nobody in dispatch, so they
+  // no longer land inside the request. The status write they accompany stays
+  // synchronous — routing reads it.
+  const healthEventFlush = new HealthEventFlushBuffer(db);
+  setHealthEventBuffer(healthEventFlush);
   const admissionStore = redis
     ? new RedisAdmissionCounterStore(redis)
     : new InMemoryAdmissionCounterStore();
@@ -548,6 +566,7 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
     poolAgentResolver,
     telemetryBuffer,
     usageFlush,
+    healthEventFlush,
     poolSelector,
     admissionService,
     trustedProxyBoundary: resolveTrustedProxyBoundary(),

package/src/boot/elysia-typebox-bridge.ts

@@ -0,0 +1,37 @@
+/**
+ * Wires Elysia's TypeBox bridge statically, for a source-run process.
+ *
+ * Elysia reaches TypeBox through a lazy `require("typebox/schema")` that
+ * resolves to a partial namespace outside a bundler. The bridge supplies all
+ * five namespaces explicitly so the lookup never has to happen.
+ *
+ * This is necessary but **not sufficient** for `NODE_ENV=production`: it does
+ * not stop the eager validator branch from reading
+ * `this.tb.buildResult.external`, which is still absent on a source run. That
+ * half is owned by `resolveElysiaPrecompile()`, which turns precompilation off
+ * for a source run. Keep both — wiring the bridge without the precompile guard
+ * still crashes, and the guard without the bridge leaves the lazy require in
+ * place for anything else that needs it.
+ *
+ * Keep this import first in `main.ts` so it runs before any module builds a
+ * route.
+ */
+import { setupTypebox } from "elysia";
+import * as typeboxType from "typebox";
+import * as typeboxCompile from "typebox/compile";
+import * as typeboxSchema from "typebox/schema";
+import * as typeboxSystem from "typebox/system";
+import * as typeboxValue from "typebox/value";
+
+setupTypebox({
+  typebox: {
+    // The type side (`type` + `system`) and the value side (`value` + `schema`
+    // + `compile`) must both be complete; Elysia rejects a partial set because
+    // a half-wired bridge fails later with a less obvious error.
+    type: typeboxType,
+    system: typeboxSystem,
+    value: typeboxValue,
+    schema: typeboxSchema,
+    compile: typeboxCompile,
+  },
+});

package/src/boot/lifecycle.ts

@@ -220,12 +220,14 @@ export async function bootstrap(): Promise<CartethyiaBoot> {
         flushTelemetry: async () => {
           await deps.telemetryBuffer.flush();
           await deps.usageFlush.flush();
+          await deps.healthEventFlush.flush();
         },
         closePools: async () => {
           await boot.server?.stop();
           await deps.scheduledTasks.stop();
           await deps.telemetryBuffer.stop({ flush: true });
           await deps.usageFlush.stop({ flush: true });
+          await deps.healthEventFlush.stop();
           await Promise.allSettled([
             closeDb(),
             closeRedis(),