cartethyia 2.5.3 → 2.5.6

package/src/console/observability/usage-dimensions.ts

@@ -7,11 +7,11 @@
  * dashboard offers one breakdown tab per member (kept in sync by hand).
  *
  * This module is intentionally free of Elysia / node:crypto so the dashboard
- * can re-export the tuple as a value. The dashboard previously reached it
- * through `./contracts`, which imports Elysia and — through
+ * can re-export the tuple as a value. Reaching it through `./contracts` would
+ * import Elysia and — through
  * `console/shared/errors` → `protocol/codecs` → `security/outbound-headers`
- * — `node:crypto`, so the browser bundle externalized a Node builtin and
- * carried a slice of the backend graph for one string list.
+ * — `node:crypto`, so the browser bundle would externalize a Node builtin and
+ * carry a slice of the backend graph for one string list.
  */
 export const USAGE_DIMENSIONS = ["model", "provider", "key", "client", "client_ip"] as const;
 

package/src/console/providers/catalog/catalog-projections.ts

@@ -46,13 +46,12 @@ export function endpointPathForProviderModel(
   // Operator profile > the provider's own static catalog > the generic
   // per-wire default.
   //
-  // The path is returned as declared. It used to be rewritten against the
-  // base URL, stripping a segment the base already carried so a versioned root
-  // would not join into `/v1/v1/chat/completions`. That machinery hid the
-  // mistake it was papering over: a provider whose base is already versioned
-  // has to declare its own path, exactly as `cline` and `qianfan` do. A wrong
-  // URL should reach the operator as the wrong URL, not be quietly corrected
-  // into a different address that may or may not be the one they meant.
+  // The path is returned as declared, never rewritten against the base URL.
+  // Stripping a segment the base already carried would paper over the mistake
+  // instead of surfacing it: a provider whose base is already versioned has to
+  // declare its own path, exactly as `cline` and `qianfan` do. A wrong URL
+  // should reach the operator as the wrong URL, not be quietly corrected into
+  // a different address that may or may not be the one they meant.
   const endpointPath =
     profile?.endpoint_paths_by_wire_family?.[wireFamily] ??
     staticEndpoints?.[wireFamily] ??

package/src/console/providers/catalog/contracts.ts

@@ -792,6 +792,12 @@ export interface ProviderCatalogStore {
     providerId: string,
     accountId: string,
   ): Promise<readonly AccountHealthEventRecord[]>;
+  /** Deletes this account's stored health & error rows; returns the count. */
+  purgeAccountHealthEvents(
+    tenantId: string,
+    providerId: string,
+    accountId: string,
+  ): Promise<number>;
   listBuddyGrowthTasks(
     tenantId: string,
     providerId: string,

package/src/console/providers/catalog/model-operations.ts

@@ -60,9 +60,12 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
       },
     async listFlatModels(access: AccessDecision | undefined): Promise<readonly FlatModelCatalogEntry[]> {
       const a = requireTenantAnyScope(access, MODEL_READ_SCOPES);
-      const providers = await config.store.list(a.tenantId);
+      const [providers, allAccounts] = await Promise.all([
+        config.store.list(a.tenantId),
+        config.store.listAllAccounts(a.tenantId),
+      ]);
       const accountsByProvider = new Map<string, number>();
-      for (const account of await config.store.listAllAccounts(a.tenantId)) {
+      for (const account of allAccounts) {
         if (account.status === "active")
           accountsByProvider.set(account.providerId, (accountsByProvider.get(account.providerId) ?? 0) + 1);
       }

package/src/console/providers/catalog/provider-operations.ts

@@ -23,6 +23,7 @@ import { getProviderClientVersion, getRouteIdentityVersions } from "../../../pro
 import type { OAuthLoginField } from "../../../providers/authentication/oauth-flow-store";
 import { providerCredentialHint, providerCredentialUrl, providerDisplayName, providerHasAdapterUserAgent, providerOperatorNotice, providerServiceKinds, type CompatibilityProfile } from "../../../providers/provider-metadata";
 import type { AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
+import { healthEventBuffer } from "../../../persistence/health-event-flush";
 import { CREDENTIAL_MODES, PROVIDER_READ_SCOPES, PROVIDER_WRITE_SCOPES, type BuddyGrowthTaskLedgerEntry } from "./contracts";
 import { enqueueCheckin } from "../../../workers/daily-checkin";
 import {
@@ -469,8 +470,8 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
      * uses, so a batch cannot accept a shape the single create rejects. The
      * expensive per-account bookkeeping — the audit row and the routing snapshot
      * invalidation that forces a 10-table catalog rebuild — is done ONCE for the
-     * whole batch instead of once per account, which is most of why the old
-     * client-side loop scaled linearly with paste size.
+     * whole batch instead of once per account, so cost does not scale linearly
+     * with paste size the way a client-side loop over single creates would.
      *
      * Email/label enrichment is deliberately NOT done here. Persisting the
      * credential is local work (encrypt + hash + insert) and needs no upstream;
@@ -515,8 +516,8 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
         if (created.account !== undefined) queueNewAccountCheckin(providerId, created.account);
       }
 
-      // One audit row per successful account, but written after the batch lands
-      // rather than inside the request path that used to await it per account.
+      // One audit row per batch, written after the batch lands rather than
+      // awaited per account inside the request path.
       if (result.created > 0) {
         await config.auditSink?.record({
           access: a,
@@ -569,6 +570,25 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
         const a = requireTenantAnyScope(access, PROVIDER_READ_SCOPES);
         return config.store.listAccountHealthEvents(a.tenantId, providerId, accountId);
       },
+    async purgeAccountHealthEvents(
+        access: AccessDecision | undefined,
+        providerId: string,
+        accountId: string,
+      ): Promise<{ deleted: number }> {
+        const a = requireTenantAnyScope(access, PROVIDER_WRITE_SCOPES);
+        // Barrier before the delete: buffered rows for this account must not
+        // land after the purge counted them gone, or the modal refetch shows
+        // ghost history the operator just purged.
+        await healthEventBuffer()?.drain(accountId);
+        const deleted = await config.store.purgeAccountHealthEvents(a.tenantId, providerId, accountId);
+        await config.auditSink?.record({
+          access: a,
+          action: "provider_account.health_events_purged",
+          target: accountId,
+          detail: { providerId, deleted },
+        });
+        return { deleted };
+      },
     async listBuddyGrowthTasks(
       access: AccessDecision | undefined,
       providerId: string,

package/src/console/providers/catalog/public-model-store.ts

@@ -359,11 +359,9 @@ export class PublicModelCatalogStore {
   /**
    * Lists the models this key may see.
    *
-   * `modelPrefix` is accepted and currently has NO effect on the result. It
-   * used to feed a `matchesModelPrefix(...) || isModelAllowed(...)` disjunct
-   * that was immediately followed by `isModelAllowed(...)` on its own — so the
-   * prefix could never add a row, and dropping it changes nothing. The
-   * parameter is kept so the call sites and the auth shape stay stable; if a
+   * `modelPrefix` is accepted and has NO effect on the result — a prefix
+   * disjunct fed into `isModelAllowed(...)` on its own could never add a row.
+   * The parameter is kept so the call sites and the auth shape stay stable; if a
    * real prefix filter is wanted later it needs to be an AND, not the OR it
    * was written as.
    */
@@ -449,12 +447,11 @@ export class PublicModelCatalogStore {
         tenantId === null ? row.providerRequiresAccount === false : activeProviderIds.has(row.providerId);
       if (!listed) continue;
       const qualified = `${row.providerId}/${row.modelId}`;
-      // The prefix test is deliberately gone from this path: the chain used to
-      // be `(prefixMatch || isAllowed)` followed by `isAllowed`, which reduces
-      // to `isAllowed` alone — the prefix disjunct could never change the
-      // outcome, only cost a second full pass over the catalog. Collapsing the
-      // four chained filters into one loop also drops the three intermediate
-      // arrays they materialized.
+      // The prefix test is deliberately gone from this path: `(prefixMatch ||
+      // isAllowed)` followed by `isAllowed` reduces to `isAllowed` alone — the
+      // prefix disjunct could never change the outcome, only cost a second full
+      // pass over the catalog. Collapsing the four chained filters into one loop
+      // also drops the three intermediate arrays they materialized.
       if (!isModelAllowed(snapshot, row.modelId, row.providerId)) continue;
       if (shadowsAliasOrCombo(row, aliasTargets, comboNames, snapshot)) continue;
       const capabilities = normalizeModalities(row.modalities);

package/src/console/providers/catalog/routes.ts

@@ -346,6 +346,13 @@ export function createProviderCatalogRoutes(config: ProviderCatalogConfig): Elys
         params.accountId,
       );
 })
+    .delete("/:providerId/accounts/:accountId/health-events", async ({ request, params }) => {
+      return await factory.purgeAccountHealthEvents(
+        config.accessResolver(request),
+        params.providerId,
+        params.accountId,
+      );
+    })
     .get("/:providerId/accounts/:accountId/growth-tasks", async ({ request, params }) => {
       const dayKey = buddyDayKey();
       return await factory.listBuddyGrowthTasks(