cartethyia 2.5.3 → 2.5.4

package/src/config/spec.ts

@@ -148,7 +148,62 @@ export const CONFIG_SPEC = {
    */
   CARTETHYIA_DISABLED_TASKS: { kind: "list" },
 
+  /**
+   * How long a day's telemetry is kept, in days.
+   *
+   * The retention unit is the whole day: a day's event file and its index are
+   * deleted together, and the current day is never touched. Past this age an
+   * individual request no longer exists anywhere, so its detail is gone —
+   * totals, breakdowns and spend are unaffected, because the index keeps
+   * running sums rather than the rows.
+   *
+   * This is the knob that decides how long the request list, per-request
+   * filters, and the detail drawer stay complete.
+   */
   CARTETHYIA_TELEMETRY_RETENTION_DAYS: { kind: "int", default: 30, min: 3, max: 365 },
+  /**
+   * Age at which a request's detail is described as no longer stored.
+   *
+   * Retention itself is `CARTETHYIA_TELEMETRY_RETENTION_DAYS`; this only words
+   * the message shown when a request that old is asked for. Kept because the
+   * message is operator-facing and was written against this knob.
+   */
+  CARTETHYIA_TELEMETRY_COMPACT_AFTER_DAYS: { kind: "int", default: 7, min: 1, max: 365 },
+  /**
+   * How often each day's index is brought up to date, in minutes.
+   *
+   * Bringing an index up to date means folding the bytes appended since the
+   * last pass — not re-reading the day. Reads fold before they answer too, so
+   * raising this does not make the numbers stale; it only leaves the on-disk
+   * index further behind, and the next read pays for the remainder.
+   */
+  CARTETHYIA_TELEMETRY_COMPACT_INTERVAL_MINUTES: {
+    kind: "int",
+    default: 60,
+    min: 5,
+    max: 1440,
+  },
+  /**
+   * Inert. Accepted so existing deployments keep booting; nothing reads it.
+   *
+   * It sized the one-file-per-window scheme — events were written to a file
+   * per this many minutes, 96 a day at the default. Events now append to one
+   * file per UTC day, so there is no window left to size.
+   */
+  CARTETHYIA_TELEMETRY_WINDOW_MINUTES: {
+    kind: "int",
+    default: 15,
+    min: 1,
+    max: 1440,
+  },
+  /**
+   * Inert. Accepted so existing deployments keep booting; nothing reads it.
+   *
+   * It capped how many window files one pass could fold. Folding is driven by
+   * a byte offset into the day file now and never deletes the file, so there
+   * is no per-pass batch to bound.
+   */
+  CARTETHYIA_TELEMETRY_COMPACT_MAX_FILES: { kind: "int", default: 48, min: 1, max: 10_000 },
   CARTETHYIA_TELEMETRY_PAYLOAD_MAX_BYTES: {
     kind: "int",
     default: 16 * 1024 * 1024,

package/src/config/telemetry.ts

@@ -19,3 +19,49 @@ export function resolveTelemetryPayloadMaxBytes(): number {
     CONFIG_SPEC.CARTETHYIA_TELEMETRY_PAYLOAD_MAX_BYTES,
   );
 }
+
+/**
+ * Age at which hourly telemetry files are compacted into a per-day summary.
+ *
+ * Clamped below the retention window: compacting at or past the delete age
+ * would fold a file and throw it away in the same pass, spending the read for
+ * totals that were about to be discarded.
+ */
+export function resolveTelemetryCompactAfterDays(): number {
+  const compacted = readInt(
+    "CARTETHYIA_TELEMETRY_COMPACT_AFTER_DAYS",
+    CONFIG_SPEC.CARTETHYIA_TELEMETRY_COMPACT_AFTER_DAYS,
+  );
+  return Math.min(compacted, resolveTelemetryRetentionDays());
+}
+
+/** Minutes between compaction passes. */
+export function resolveTelemetryCompactIntervalMs(): number {
+  const minutes = readInt(
+    "CARTETHYIA_TELEMETRY_COMPACT_INTERVAL_MINUTES",
+    CONFIG_SPEC.CARTETHYIA_TELEMETRY_COMPACT_INTERVAL_MINUTES,
+  );
+  return minutes * 60_000;
+}
+
+/**
+ * Minutes of events per source file, before it is folded into the day summary.
+ *
+ * Defaults to the sweep interval so exactly one window closes per pass: a
+ * window longer than the interval would leave files waiting several passes, and
+ * a shorter one would let several close between passes.
+ */
+export function resolveTelemetryWindowMinutes(): number {
+  return readInt(
+    "CARTETHYIA_TELEMETRY_WINDOW_MINUTES",
+    CONFIG_SPEC.CARTETHYIA_TELEMETRY_WINDOW_MINUTES,
+  );
+}
+
+/** Maximum hourly files folded in one compaction pass. */
+export function resolveTelemetryCompactMaxFiles(): number {
+  return readInt(
+    "CARTETHYIA_TELEMETRY_COMPACT_MAX_FILES",
+    CONFIG_SPEC.CARTETHYIA_TELEMETRY_COMPACT_MAX_FILES,
+  );
+}

package/src/console/api-keys/bucket-spend.ts

@@ -2,7 +2,7 @@ import { eq } from "drizzle-orm";
 
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import { apiKeys } from "../../persistence/schema";
-import { queryTelemetryEvents } from "../../observability/event-log";
+import { queryIndexedBuckets } from "../../observability/event-day-index";
 import { utcDayStart, utcMonthStart } from "../shared/day";
 
 /**
@@ -33,9 +33,20 @@ export async function familyBucketSpend(
     .where(eq(apiKeys.parentKeyId, keyId));
   const keyIds = [keyId, ...children.map((child) => child.id)];
   const spentSince = async (start: Date): Promise<number> => {
-    const events = await queryTelemetryEvents({ apiKeyIds: keyIds, since: start });
-    return events
-      .reduce((sum, event) => sum + (event.inputTokens ?? 0) + (event.outputTokens ?? 0), 0);
+    // Folded first, so the index covers every event written so far including the
+    // current day's — then read from the index alone.
+    //
+    // Deliberately not index *plus* events: they hold the same requests, and
+    // adding them doubled every bucket. Folding first is what makes the index
+    // sufficient on its own; the watermark is the point up to which it is
+    // complete.
+    const allowed = new Set(keyIds);
+    const indexed = await queryIndexedBuckets({ since: start, foldFirst: true }).catch(
+      () => [],
+    );
+    return indexed
+      .filter((bucket) => bucket.apiKeyId !== null && allowed.has(bucket.apiKeyId))
+      .reduce((sum, bucket) => sum + bucket.inputTokens + bucket.outputTokens, 0);
   };
   const [daily, monthly] = await Promise.all([
     spentSince(utcDayStart(now)),

package/src/console/backup/contracts.ts

@@ -20,6 +20,7 @@
  * as sensitive as the database.
  */
 import { getTableColumns, getTableName, type Column, type Table } from "drizzle-orm";
+import { resolveMaxBodyBytes } from "../../config/runtime";
 import {
   apiKeys,
   cliToolMappings,
@@ -45,8 +46,20 @@ import {
 export const BACKUP_APP = "cartethyia";
 export const BACKUP_VERSION = 1;
 
-/** Upper bound for restore payloads; the listener enforces the same ceiling. */
-export const MAX_BACKUP_BYTES = 8 * 1024 * 1024 * 1024;
+/**
+ * Upper bound for restore payloads.
+ *
+ * Deliberately not larger than the listener's own body cap. It used to claim
+ * 8 GiB while the server admitted 4 MiB, so the number described a limit that
+ * could never be reached: a file above the listener's cap is cut off before
+ * this check runs, and a large upload fails as a reset connection rather than
+ * the 413 this constant promises. The bound now states what the install
+ * actually admits, so the message an operator sees matches what happened.
+ *
+ * Raise `CARTETHYIA_SERVER_MAX_BODY_BYTES` to accept larger backups; this
+ * constant follows it rather than the two drifting apart again.
+ */
+export const MAX_BACKUP_BYTES = resolveMaxBodyBytes();
 
 /** Defense-in-depth row cap per table, after the byte bound. */
 export const MAX_ROWS_PER_TABLE = 500_000;

package/src/console/console-router.ts

@@ -48,6 +48,13 @@ export interface ConsoleApiCompositionDeps {
   readonly routeSnapshotService: { invalidate(): Promise<number> };
   readonly poolSelector: NetworkPoolSelector;
   readonly telemetryBuffer: TelemetryBatchBuffer;
+  /**
+   * Queued writers the console can drain on demand (telemetry, usage, health
+   * events). Optional for the same reason the other reduced composition
+   * surface is: absent means the flush control is not offered rather than the
+   * console failing to build.
+   */
+  readonly flushBuffers?: { flush(): Promise<void> };
   /**
    * The request state store owns the live in-flight gauge, so the console reads
    * its snapshot/subscription from here rather than a free-standing module.
@@ -189,6 +196,7 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
     admissionService: deps.admissionService,
     ...(deps.modelStrikes ? { modelStrikes: deps.modelStrikes } : {}),
     readRoutingAccountInflight: deps.readRoutingAccountInflight,
+    ...(deps.flushBuffers ? { flushBuffers: deps.flushBuffers } : {}),
     credentialService,
     // The backup surface re-authenticates the operator, so it needs the current
     // user's hash. Read from the session on the request that asks for it, never

package/src/console/data-management/contracts.ts

@@ -0,0 +1,93 @@
+/**
+ * Disk housekeeping: what the telemetry and payload directories hold, and the
+ * reclaim actions an operator can run from the console.
+ *
+ * Everything here is files on disk, except one deliberate row-level action.
+ * Reclaiming a file is safe because the data it held is already past the point
+ * where the gateway would read it: payload frames expire 15 minutes after they
+ * are written, and telemetry files past the retention window are outside every
+ * query's scan bound. Deleting rows is a different decision with a different
+ * blast radius, and the only row data the console offers purging is the health
+ * & error log — purely an operator's diagnostic trail with no request-path
+ * reader, unlike everything else in this panel.
+ *
+ * Sizes are bytes as `number`. A directory is scanned on each read rather than
+ * cached, because the point of the panel is to show what is true now — a
+ * stale size would be worse than none.
+ */
+
+/** One measured category of on-disk data. */
+export interface DiskUsageBucket {
+  /** Stable id, so the dashboard can key rows without matching on copy. */
+  readonly id: "telemetry_hourly" | "telemetry_compacted" | "payload_frames";
+  readonly label: string;
+  readonly bytes: number;
+  readonly files: number;
+  /** Why this data exists, shown next to the size. */
+  readonly note: string;
+  /** Bytes reclaimable right now, when that is knowable without a dry run. */
+  readonly reclaimableBytes: number | null;
+  readonly reclaimableFiles: number | null;
+}
+
+export interface DiskUsageResponse {
+  readonly buckets: readonly DiskUsageBucket[];
+  readonly totalBytes: number;
+  /** Retention in days; telemetry older than this is outside every scan. */
+  readonly retentionDays: number;
+  /** Payload frames live this long before they are reclaimable. */
+  readonly payloadRetentionMs: number;
+  /**
+   * Stored health & error rows, for the purge row's label. Absent when the
+   * composition does not wire the health-event store (a reduced console),
+   * which is also when the purge control is not offered.
+   */
+  readonly healthEventCount?: number;
+}
+
+export type ReclaimAction = "payload_frames" | "telemetry_retention" | "telemetry_hourly";
+
+export interface ReclaimResponse {
+  readonly action: ReclaimAction;
+  readonly deletedFiles: number;
+  readonly reclaimedBytes: number;
+}
+
+/** Row-level deletion targets. The health & error log is the only one. */
+export type PurgeTarget = "health_events";
+
+export interface PurgeResponse {
+  readonly target: PurgeTarget;
+  /** Rows actually deleted — the number the operator's decision produced. */
+  readonly deleted: number;
+}
+
+export interface FlushResponse {
+  readonly flushed: boolean;
+}
+
+/**
+ * A reclaim the caller is not allowed to make.
+ *
+ * Kept as a named class so the route maps it to 403 rather than letting it
+ * surface as a 500 — an operator asking for something out of policy is a
+ * normal request, not a failure.
+ */
+export class ReclaimNotAllowedError extends Error {
+  readonly status = 403;
+
+  constructor(message: string) {
+    super(message);
+    this.name = "ReclaimNotAllowedError";
+  }
+}
+
+/** A purge whose backing store is not wired in this composition. */
+export class PurgeNotWiredError extends Error {
+  readonly status = 501;
+
+  constructor() {
+    super("Health & error log purging is not offered in this deployment's console composition.");
+    this.name = "PurgeNotWiredError";
+  }
+}

package/src/console/data-management/operations.ts

@@ -0,0 +1,229 @@
+import { readdir, stat, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { payloadDirectory, prunePayloadFrames } from "../../observability/payload-store";
+import type {
+  DiskUsageBucket,
+  DiskUsageResponse,
+  PurgeTarget,
+  ReclaimAction,
+  ReclaimResponse,
+} from "./contracts";
+import { PurgeNotWiredError, ReclaimNotAllowedError } from "./contracts";
+
+/**
+ * Reads and reclaims the on-disk telemetry and payload directories, and
+ * purges the health & error log — the console's one row-level deletion.
+ *
+ * Reclaiming files is safe because the data is already past the point the
+ * gateway would read it: payload frames expire minutes after they are written,
+ * and telemetry past the retention window sits outside every query's scan
+ * bound. The health & error log purge is the deliberate exception: the rows are
+ * an operator's diagnostic trail that no request-path code reads, so clearing
+ * them costs nothing but the history itself.
+ *
+ * The telemetry directory is injected rather than read from its module
+ * constant so the scanner can be pointed at a fixture. The payload directory
+ * is not: reclaim goes through `prunePayloadFrames`, which resolves the
+ * directory itself, and a second path would let the two drift so the scanner
+ * measured one place while the prune emptied another. The health-event store
+ * hook is injected for the same reason: this module should know its numbers,
+ * not how storage reaches them.
+ */
+
+export interface DataManagementConfig {
+  readonly telemetryDir: string;
+  readonly retentionDays: number;
+  readonly payloadRetentionMs: number;
+  /**
+   * Whether hourly files may be dropped from the console. Off unless a caller
+   * opts in: an hourly file still inside the compaction window is the only
+   * copy of its requests, so removing one loses real history.
+   */
+  readonly allowHourlyReclaim: boolean;
+  /**
+   * The health & error log store, backing the console's only row-level purge.
+   * Absent (a reduced console composition) means the purge is not offered
+   * rather than failing to boot.
+   */
+  readonly healthEvents?:
+    | {
+        count(): Promise<number>;
+        purgeAll(): Promise<number>;
+      }
+    | undefined;
+}
+
+interface Scan {
+  readonly bytes: number;
+  readonly files: number;
+}
+
+async function scan(
+  directory: string,
+  match: (name: string) => boolean,
+  modifiedBefore?: number,
+): Promise<Scan> {
+  const names = await readdir(directory).catch(() => [] as string[]);
+  let bytes = 0;
+  let files = 0;
+  for (const name of names) {
+    if (!match(name)) continue;
+    const info = await stat(join(directory, name)).catch(() => undefined);
+    if (!info?.isFile()) continue;
+    if (modifiedBefore !== undefined && info.mtimeMs >= modifiedBefore) continue;
+    bytes += info.size;
+    files += 1;
+  }
+  return { bytes, files };
+}
+
+const isIndex = (name: string): boolean => name.endsWith(".index.json");
+const isHourly = (name: string): boolean => name.endsWith(".events.jsonl");
+// Both extensions: old `.jsonb` files are still on disk and still counted.
+const isFrame = (name: string): boolean =>
+  name.endsWith(".jsonl") || name.endsWith(".jsonb");
+
+/** The UTC day a telemetry file name starts with, compared to a cutoff. */
+function dayBefore(name: string, cutoff: number): boolean {
+  const at = Date.parse(`${name.slice(0, 10)}T00:00:00Z`);
+  return Number.isFinite(at) && at < cutoff;
+}
+
+export function createDataManagementOperations(config: DataManagementConfig) {
+  const payloadDir = (): string => payloadDirectory();
+
+  async function usage(): Promise<DiskUsageResponse> {
+    const retentionCutoff = Date.now() - config.retentionDays * 24 * 60 * 60_000;
+    const payloadCutoff = Date.now() - config.payloadRetentionMs;
+
+    const [hourly, compacted, staleCompacted, frames, staleFrames, healthEventCount] = await Promise.all([
+      scan(config.telemetryDir, isHourly),
+      scan(config.telemetryDir, isIndex),
+      scan(config.telemetryDir, (name) => isIndex(name) && dayBefore(name, retentionCutoff)),
+      scan(payloadDir(), isFrame),
+      scan(payloadDir(), isFrame, payloadCutoff),
+      config.healthEvents?.count(),
+    ]);
+
+    const buckets: DiskUsageBucket[] = [
+      {
+        id: "telemetry_hourly",
+        label: "Daily request files",
+        bytes: hourly.bytes,
+        files: hourly.files,
+        note: "Feeds the request list and detail drawer.",
+        reclaimableBytes: null,
+        reclaimableFiles: null,
+      },
+      {
+        id: "telemetry_compacted",
+        label: "Day indexes",
+        bytes: compacted.bytes,
+        files: compacted.files,
+        note: "Feeds usage totals, breakdowns and the chart.",
+        reclaimableBytes: staleCompacted.bytes,
+        reclaimableFiles: staleCompacted.files,
+      },
+      {
+        id: "payload_frames",
+        label: "Payload frames",
+        bytes: frames.bytes,
+        files: frames.files,
+        note: `Captured bodies, expiring ${Math.round(
+          config.payloadRetentionMs / 60_000,
+        )} min after write.`,
+        reclaimableBytes: staleFrames.bytes,
+        reclaimableFiles: staleFrames.files,
+      },
+    ];
+
+    return {
+      buckets,
+      totalBytes: buckets.reduce((sum, bucket) => sum + bucket.bytes, 0),
+      retentionDays: config.retentionDays,
+      payloadRetentionMs: config.payloadRetentionMs,
+      ...(healthEventCount === undefined ? {} : { healthEventCount }),
+    };
+  }
+
+  async function reclaim(action: ReclaimAction): Promise<ReclaimResponse> {
+    if (action === "payload_frames") {
+      // Delegated rather than reimplemented: frame expiry lives inside each
+      // file, so a file's mtime alone cannot say whether it still holds a live
+      // frame. Measuring around the call is how the bytes are reported without
+      // duplicating that rule.
+      const before = await scan(payloadDir(), isFrame);
+      // `before` is the expiry bound: a frame still live at this instant is
+      // kept. The second argument covers files that cannot be parsed — one
+      // written after that bound might still hold a live frame in the part
+      // that failed to parse, so it is left for a later pass.
+      const now = new Date();
+      const deletedFiles = await prunePayloadFrames(
+        now,
+        new Date(now.getTime() - config.payloadRetentionMs),
+      );
+      const after = await scan(payloadDir(), isFrame);
+      return {
+        action,
+        deletedFiles,
+        reclaimedBytes: Math.max(0, before.bytes - after.bytes),
+      };
+    }
+    if (action === "telemetry_retention") {
+      // Only day indexes past retention, and only together with their events.
+      // Deleting one without the other is the failure this avoids: an index
+      // with no events reports totals for requests that are gone.
+      const cutoff = Date.now() - config.retentionDays * 24 * 60 * 60_000;
+      return unlinkWhere(action, config.telemetryDir, (name) =>
+        (isIndex(name) || isHourly(name)) && dayBefore(name, cutoff),
+      );
+    }
+    if (!config.allowHourlyReclaim) {
+      throw new ReclaimNotAllowedError(
+        "Hourly files are the only copy of their requests until compaction folds them up, so the console will not delete them.",
+      );
+    }
+    return unlinkWhere(action, config.telemetryDir, isHourly);
+  }
+
+  /** The one row-level deletion the console offers. */
+  async function purge(target: PurgeTarget): Promise<number> {
+    switch (target) {
+      case "health_events": {
+        const store = config.healthEvents;
+        if (store === undefined) throw new PurgeNotWiredError();
+        return await store.purgeAll();
+      }
+    }
+  }
+
+  return { usage, reclaim, purge };
+}
+
+async function unlinkWhere(
+  action: ReclaimAction,
+  directory: string,
+  match: (name: string) => boolean,
+): Promise<ReclaimResponse> {
+  const names = await readdir(directory).catch(() => [] as string[]);
+  let deletedFiles = 0;
+  let reclaimedBytes = 0;
+  for (const name of names) {
+    if (!match(name)) continue;
+    const path = join(directory, name);
+    // Measured before the unlink, since the size is gone afterwards.
+    const size = await stat(path)
+      .then((value) => value.size)
+      .catch(() => 0);
+    const removed = await unlink(path).then(
+      () => true,
+      () => false,
+    );
+    if (!removed) continue;
+    deletedFiles += 1;
+    reclaimedBytes += size;
+  }
+  // The response names the action, so a caller that fired two reclaims can
+  // tell which result is which rather than both reading the same thing.
+  return { action, deletedFiles, reclaimedBytes };
+}

package/src/console/data-management/routes.ts

@@ -0,0 +1,104 @@
+import { Elysia } from "elysia";
+import { t } from "elysia";
+import { errorResponse, requireAnyScope } from "../shared/errors";
+import type { AccessDecision } from "../../security/access-control";
+import { createDataManagementOperations, type DataManagementConfig } from "./operations";
+import type { PurgeTarget, ReclaimAction, ReclaimResponse } from "./contracts";
+
+const WRITE_SCOPES = ["dashboard:write"] as const;
+
+const reclaimBody = t.Object({
+  action: t.Union([
+    t.Literal("payload_frames"),
+    t.Literal("telemetry_retention"),
+    t.Literal("telemetry_hourly"),
+  ]),
+});
+
+const purgeBody = t.Object({
+  target: t.Literal("health_events"),
+});
+
+/**
+ * Console routes for disk housekeeping.
+ *
+ * Reclaim and flush both need `dashboard:write`. Reading is deliberately the
+ * same scope as the rest of the console rather than something narrower: the
+ * sizes are not sensitive, but splitting the two would mean a caller who can
+ * already write could not see what they are about to affect.
+ */
+export function createDataManagementRoutes(
+  config: DataManagementConfig & {
+    readonly accessResolver: (request: Request) => AccessDecision | undefined;
+    readonly auditSink?: {
+      record(entry: {
+        readonly access: AccessDecision;
+        readonly action: string;
+        readonly target: string | null;
+        readonly detail?: Record<string, unknown>;
+      }): Promise<void> | void;
+    } | undefined;
+    readonly flusher?: { flush(): Promise<void> } | undefined;
+  },
+): Elysia {
+  const operations = createDataManagementOperations(config);
+
+  return new Elysia({ prefix: "/data-management" })
+    .get("/usage", async ({ request, set }) => {
+      try {
+        const access = requireAnyScope(config.accessResolver(request), WRITE_SCOPES);
+        void access;
+        return await operations.usage();
+      } catch (error) {
+        return errorResponse(error, set, "Could not read disk usage");
+      }
+    })
+    .post("/reclaim", { body: reclaimBody }, async ({ request, body, set }) => {
+      try {
+        const access = requireAnyScope(config.accessResolver(request), WRITE_SCOPES);
+        const action = body.action as ReclaimAction;
+        const result: ReclaimResponse = await operations.reclaim(action);
+        await config.auditSink?.record({
+          access,
+          action: `data_management.reclaim.${action}`,
+          target: access.tenantId ?? null,
+          detail: { deletedFiles: result.deletedFiles, reclaimedBytes: result.reclaimedBytes },
+        });
+        set.status = 200;
+        return result;
+      } catch (error) {
+        return errorResponse(error, set, "Reclaim failed");
+      }
+    })
+    .post("/flush", async ({ request, set }) => {
+      try {
+        const access = requireAnyScope(config.accessResolver(request), WRITE_SCOPES);
+        await config.flusher?.flush();
+        await config.auditSink?.record({
+          access,
+          action: "data_management.flush",
+          target: access.tenantId ?? null,
+        });
+        set.status = 200;
+        return { flushed: true };
+      } catch (error) {
+        return errorResponse(error, set, "Flush failed");
+      }
+    })
+    .post("/purge", { body: purgeBody }, async ({ request, body, set }) => {
+      try {
+        const access = requireAnyScope(config.accessResolver(request), WRITE_SCOPES);
+        const deleted: number = await operations.purge(body.target as PurgeTarget);
+        await config.auditSink?.record({
+          access,
+          action: `data_management.purge.${body.target}`,
+          target: access.tenantId ?? null,
+          detail: { deleted },
+        });
+        set.status = 200;
+        return { target: body.target, deleted } satisfies { target: PurgeTarget; deleted: number };
+      } catch (error) {
+        return errorResponse(error, set, "Purge failed");
+      }
+    }) as unknown as Elysia;
+}