cartethyia 2.5.10 → 2.6.0

package/src/config/spec.ts

@@ -110,6 +110,28 @@ export const CONFIG_SPEC = {
     min: 0,
     max: 600_000,
   },
+  // Optional ceiling on in-flight requests per process. Left unset, the limit
+  // is derived from the memory limit and the body ceiling (see
+  // config/resources.ts): 2 GiB/4 MiB → 64, 512 MiB/4 MiB → 16, 256 MiB/16 MiB
+  // → 2. Set it to admit more than memory alone would allow — which is the
+  // operator's call, and is reported rather than corrected — or less, to keep
+  // a slow upstream from being handed more concurrency than it can serve.
+  // Optional-int, not int-with-a-zero-default: "unset" and "explicitly zero"
+  // must not be the same thing. Zero is not a valid ceiling, so a default of 0
+  // would need a second sentinel to mean "derive".
+  CARTETHYIA_PROCESS_CONCURRENCY_LIMIT: { kind: "optional-int", min: 1, max: 64 },
+  // Slack above each key's concurrency limit. Effective ceiling is
+  // limit + tolerance; only requests past it are refused.
+  CARTETHYIA_CONCURRENCY_TOLERANCE: { kind: "optional-int", min: 0, max: 1024 },
+  // How many gateway processes serve this deployment, and which one this is.
+  // Count > 1 requires Linux, CARTETHYIA_DB_MODE=full, and a REACHABLE Redis —
+  // checked at boot, because a half-configured multi-process deploy starts
+  // fine and then enforces every per-key limit N times over. Lite stays
+  // single-process: two processes on one SQLite file corrupt it.
+  CARTETHYIA_PROCESS_COUNT: { kind: "int", default: 1, min: 1, max: 16 },
+  // Which process this is (0 – count-1). Mandatory when count > 1: a process
+  // that does not know its index cannot own a shard of anything.
+  CARTETHYIA_PROCESS_INDEX: { kind: "int", default: 0, min: 0, max: 15 },
   // Optional secret for the operator drain endpoint (`POST /admin/drain`). When
   // set, a process can be stopped gracefully on platforms where a catchable
   // signal cannot be delivered to it (notably Windows, where `process.kill` of
@@ -130,9 +152,12 @@ export const CONFIG_SPEC = {
     min: 1,
     max: Number.MAX_SAFE_INTEGER,
   },
-  // Opt-in forced garbage collection. Off by default: see
-  // `observability/runtime-metrics.ts` — a forced collection is not
-  // reclamation, and the synchronous form stalls concurrent requests.
+  // Opt-in forced garbage collection under memory pressure. Off by default:
+  // see `observability/runtime-metrics.ts` — a forced collection is not
+  // reclamation, and a collection that runs while requests are in flight adds
+  // a latency spike. This gates the pressure path only; idle reclaim runs
+  // unconditionally, because reclaiming when nothing is in flight stalls
+  // nothing.
   CARTETHYIA_FORCED_GC: { kind: "flag" },
   // How often runtime gauges (memory + bounded-collection sizes) are sampled.
   CARTETHYIA_RUNTIME_METRICS_INTERVAL_MS: {
@@ -151,37 +176,13 @@ export const CONFIG_SPEC = {
   /**
    * How long a day's telemetry is kept, in days.
    *
-   * The retention unit is the whole day: a day's event file and its index are
-   * deleted together, and the current day is never touched. Past this age an
-   * individual request no longer exists anywhere, so its detail is gone —
-   * totals, breakdowns and spend are unaffected, because the index keeps
-   * running sums rather than the rows.
+   * Whole raw event files past this age are removed. No summary or compacted
+   * form replaces the individual requests.
    *
    * This is the knob that decides how long the request list, per-request
    * filters, and the detail drawer stay complete.
    */
   CARTETHYIA_TELEMETRY_RETENTION_DAYS: { kind: "int", default: 30, min: 3, max: 365 },
-  /**
-   * Age at which a request's detail is described as no longer stored.
-   *
-   * Retention itself is `CARTETHYIA_TELEMETRY_RETENTION_DAYS`; this only words
-   * the operator-facing message shown when a request that old is asked for.
-   */
-  CARTETHYIA_TELEMETRY_COMPACT_AFTER_DAYS: { kind: "int", default: 7, min: 1, max: 365 },
-  /**
-   * How often each day's index is brought up to date, in minutes.
-   *
-   * Bringing an index up to date means folding the bytes appended since the
-   * last pass — not re-reading the day. Reads fold before they answer too, so
-   * raising this does not make the numbers stale; it only leaves the on-disk
-   * index further behind, and the next read pays for the remainder.
-   */
-  CARTETHYIA_TELEMETRY_COMPACT_INTERVAL_MINUTES: {
-    kind: "int",
-    default: 60,
-    min: 5,
-    max: 1440,
-  },
   CARTETHYIA_TELEMETRY_PAYLOAD_MAX_BYTES: {
     kind: "int",
     default: 16 * 1024 * 1024,

package/src/config/telemetry.ts

@@ -20,28 +20,3 @@ export function resolveTelemetryPayloadMaxBytes(): number {
   );
 }
 
-/**
- * Age at which hourly telemetry files are compacted into a per-day summary.
- *
- * Clamped below the retention window: compacting at or past the delete age
- * would fold a file and throw it away in the same pass, spending the read for
- * totals that were about to be discarded.
- */
-export function resolveTelemetryCompactAfterDays(): number {
-  const compacted = readInt(
-    "CARTETHYIA_TELEMETRY_COMPACT_AFTER_DAYS",
-    CONFIG_SPEC.CARTETHYIA_TELEMETRY_COMPACT_AFTER_DAYS,
-  );
-  return Math.min(compacted, resolveTelemetryRetentionDays());
-}
-
-/** Minutes between compaction passes. */
-export function resolveTelemetryCompactIntervalMs(): number {
-  const minutes = readInt(
-    "CARTETHYIA_TELEMETRY_COMPACT_INTERVAL_MINUTES",
-    CONFIG_SPEC.CARTETHYIA_TELEMETRY_COMPACT_INTERVAL_MINUTES,
-  );
-  return minutes * 60_000;
-}
-
-

package/src/console/api-keys/bucket-spend.ts

@@ -2,7 +2,7 @@ import { eq } from "drizzle-orm";
 
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import { apiKeys } from "../../persistence/schema";
-import { queryIndexedBuckets } from "../../observability/event-day-index";
+import { sumTelemetryTokens } from "../../observability/event-query";
 import { utcDayStart, utcMonthStart } from "../shared/day";
 
 /**
@@ -27,27 +27,24 @@ export async function familyBucketSpend(
   keyId: string,
   now: Date,
 ): Promise<{ daily: number; monthly: number }> {
+  // The tenant comes from the key row itself: the caller passes only the key
+  // id, and the SQL sums are tenant-scoped so scoping must not be guessed.
+  const [parent] = await db
+    .select({ tenantId: apiKeys.tenantId })
+    .from(apiKeys)
+    .where(eq(apiKeys.id, keyId))
+    .limit(1);
+  const tenantId = parent?.tenantId;
+  if (tenantId === undefined) return { daily: 0, monthly: 0 };
   const children = await db
     .select({ id: apiKeys.id })
     .from(apiKeys)
     .where(eq(apiKeys.parentKeyId, keyId));
   const keyIds = [keyId, ...children.map((child) => child.id)];
-  const spentSince = async (start: Date): Promise<number> => {
-    // Folded first, so the index covers every event written so far including the
-    // current day's — then read from the index alone.
-    //
-    // Deliberately not index *plus* events: they hold the same requests, and
-    // adding them doubled every bucket. Folding first is what makes the index
-    // sufficient on its own; the watermark is the point up to which it is
-    // complete.
-    const allowed = new Set(keyIds);
-    const indexed = await queryIndexedBuckets({ since: start, foldFirst: true }).catch(
-      () => [],
-    );
-    return indexed
-      .filter((bucket) => bucket.apiKeyId !== null && allowed.has(bucket.apiKeyId))
-      .reduce((sum, bucket) => sum + bucket.inputTokens + bucket.outputTokens, 0);
-  };
+  // Two SQL sums instead of reading every event of the family: the bucket
+  // spend only needs a total, and this runs on the key-creation path.
+  const spentSince = async (start: Date): Promise<number> =>
+    sumTelemetryTokens(db, tenantId, { apiKeyIds: keyIds, since: start });
   const [daily, monthly] = await Promise.all([
     spentSince(utcDayStart(now)),
     spentSince(utcMonthStart(now)),