cartethyia 2.5.9 → 2.6.0

package/src/console/providers/catalog/store.ts

@@ -2,6 +2,11 @@
 import { and, asc, eq, inArray, isNull, or, sql, type SQL } from "drizzle-orm";
 import { ConsoleDomainError } from "../../shared/errors";
 import { parseCustomProviderId, isBundledProviderId } from "../../../providers/provider-contracts";
+import {
+  asRecord,
+  firstNonEmptyString as firstString,
+  tryParseJson as safeParseJson,
+} from "../../../shared/coerce";
 import type { ModelDefinition } from "../../../providers/provider-model-definition";
 import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { BUNDLED_PROVIDER_MODULES } from "../../../providers/default-registry";
@@ -10,8 +15,7 @@ import { globalOrOwnedBy, ownedByOnly } from "../../../persistence/tenant-scope"
 import { nextSortIndex, reorderSortIndex } from "../../../persistence/sort-order";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
 import { buddyTaskLedger, models, providerAccounts, providerOauthStates, providers, telemetryUsageTotals, tenantDisabledModels } from "../../../persistence/schema";
-import { queryTelemetryEvents } from "../../../observability/event-log";
-import { isGatewayError } from "../../../observability/telemetry-status";
+import { breakdownTelemetry } from "../../../observability/event-query";
 import type { WireFamily } from "../../../protocol/canonical-model";
 import { listAccountHealthEvents, recoverAccount, deleteAccountHealthEvents, type AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
 import { invalidateCredentialCache } from "../../../providers/operations/provider-credential-service";
@@ -39,14 +43,6 @@ const OAUTH_ACCESS_FIELDS = ["accessToken", "access_token", "access", "token"] a
 /** Field names a pasted OAuth credential may carry its refresh token under. */
 const OAUTH_REFRESH_FIELDS = ["refreshToken", "refresh_token", "refresh"] as const;
 
-function firstString(record: Record<string, unknown>, fields: readonly string[]): string | undefined {
-  for (const field of fields) {
-    const value = record[field];
-    if (typeof value === "string" && value.trim().length > 0) return value.trim();
-  }
-  return undefined;
-}
-
 /** Parses an expiry field that may be an ISO string, an epoch ms, or epoch seconds. */
 function parseExpiry(value: unknown): Date | undefined {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -203,12 +199,6 @@ function pastedAuthState(
   };
 }
 
-function asRecord(value: unknown): Record<string, unknown> | undefined {
-  return value !== null && typeof value === "object" && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : undefined;
-}
-
 /**
  * Adds or removes the `image` input modality on a stored modalities blob.
  *
@@ -235,15 +225,6 @@ export function withImageModality(stored: string | null | undefined, image: bool
   });
 }
 
-function safeParseJson(value: string | null | undefined): unknown {
-  if (typeof value !== "string" || value.length === 0) return undefined;
-  try {
-    return JSON.parse(value) as unknown;
-  } catch {
-    return undefined;
-  }
-}
-
 /** Normalizes a text column read as `unknown` back to a string or null. */
 function asStoredText(value: unknown): string | null {
   return typeof value === "string" ? value : null;
@@ -957,17 +938,23 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     const todayStart = new Date();
     todayStart.setUTCHours(0, 0, 0, 0);
     const accountIds = rows.map((row) => row.id);
-    const todayEvents = await queryTelemetryEvents({ tenantId, accountIds, since: todayStart });
-    const todayByAccount = new Map<string, { requests: number; errors: number; inputTokens: number; outputTokens: number }>();
-    for (const event of todayEvents) {
-      if (!event.accountId) continue;
-      const bucket = todayByAccount.get(event.accountId) ?? { requests: 0, errors: 0, inputTokens: 0, outputTokens: 0 };
-      bucket.requests += 1;
-      if (isGatewayError(event.status, event.httpStatus)) bucket.errors += 1;
-      bucket.inputTokens += event.inputTokens ?? 0;
-      bucket.outputTokens += event.outputTokens ?? 0;
-      todayByAccount.set(event.accountId, bucket);
-    }
+    // Today's per-account usage is one GROUP BY, not a read of every event
+    // since midnight. `breakdownTelemetry("account")` is capped at 100 groups;
+    // a page of accounts never exceeds it, and the lookup below is by id, so a
+    // group that fell outside the cap simply reads as "no usage today" — the
+    // same value an account with no traffic gets.
+    const todayGroups = await breakdownTelemetry(this.db, tenantId, "account", todayStart);
+    const todayByAccount = new Map(
+      todayGroups.map((group) => [
+        group.key,
+        {
+          requests: group.requests,
+          errors: group.errors,
+          inputTokens: group.inputTokens,
+          outputTokens: group.outputTokens,
+        },
+      ]),
+    );
     const [lifetimeRows] = await Promise.all([
       this.db
         .select()

package/src/console/quota/account-quota-shared.ts

@@ -1,52 +1,52 @@
-import type { ConsoleAccessResolver } from "../auth/access";
-import type { AuditRecorder } from "../auth/audit-recorder";
-import { markClineApiKeyCredential } from "../../providers/integrations/cline/cline-quota";
-import { type QuotaRefreshDeps } from "./refresh";
-import type { AccountTestEgressDeps } from "./account-test-egress";
-
-/**
- * Dependencies shared by the tenant-scoped and global-admin account/quota route
- * groups. Both groups are composed onto one Elysia instance by
- * `createAccountQuotaRoutes`.
- */
-export interface AccountQuotaRoutesDeps extends QuotaRefreshDeps {
-  readonly poolSelector?: AccountTestEgressDeps["poolSelector"];
-  readonly networkBindingFactory?: AccountTestEgressDeps["networkBindingFactory"];
-  readonly accessResolver: ConsoleAccessResolver;
-  readonly snapshotInvalidator?: { invalidate(): Promise<number> };
-  /** Records privileged account mutations (e.g. hard deletion) to `admin_audit_log`. */
-  readonly auditRecorder?: AuditRecorder | undefined;
-}
-
-export const ACCOUNT_STATUSES = ["active", "cooldown", "disabled"] as const;
-export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
-
-/**
- * Wraps a stored api_key credential in the envelope its collector expects.
- *
- * Exported because every refresh path needs it, and the ones that omit it
- * fail in a way that looks like the credential is dead: an unmarked `cline`
- * `sk_...` key takes the OAuth branch, gets `workos:` prepended, and is
- * refused with a message naming a version problem. The scheduled sweep once
- * omitted it, so a working account was cooled with `quota_fetch_failed` every
- * minute while refreshing fine from the console.
- */
-export function markProviderApiKeyCredential(providerId: string, credential: string): string {
-  return providerId === "cline" ? markClineApiKeyCredential(credential) : credential;
-}
-
-/**
- * Builds the refresh dependency bundle from the route deps, binding the
- * provider-specific credential normalisation (`cline` API keys) once so every
- * caller refreshes through the same wiring.
- */
-export function createQuotaRefreshDeps(deps: AccountQuotaRoutesDeps): QuotaRefreshDeps {
-  return {
-    db: deps.db,
-    redis: deps.redis,
-    providerRegistry: deps.providerRegistry,
-    resolveCredential: deps.resolveCredential,
-    ...(deps.snapshotInvalidator ? { snapshotInvalidator: deps.snapshotInvalidator } : {}),
-    markApiKeyCredential: markProviderApiKeyCredential,
-  };
-}
+import type { ConsoleAccessResolver } from "../auth/access";
+import type { AuditRecorder } from "../auth/audit-recorder";
+import { markClineApiKeyCredential } from "../../providers/integrations/cline/cline-quota";
+import { type QuotaRefreshDeps } from "./refresh";
+import type { AccountTestEgressDeps } from "./account-test-egress";
+
+/**
+ * Dependencies shared by the tenant-scoped and global-admin account/quota route
+ * groups. Both groups are composed onto one Elysia instance by
+ * `createAccountQuotaRoutes`.
+ */
+export interface AccountQuotaRoutesDeps extends QuotaRefreshDeps {
+  readonly poolSelector?: AccountTestEgressDeps["poolSelector"];
+  readonly networkBindingFactory?: AccountTestEgressDeps["networkBindingFactory"];
+  readonly accessResolver: ConsoleAccessResolver;
+  readonly snapshotInvalidator?: { invalidate(): Promise<number> };
+  /** Records privileged account mutations (e.g. hard deletion) to `admin_audit_log`. */
+  readonly auditRecorder?: AuditRecorder | undefined;
+}
+
+export const ACCOUNT_STATUSES = ["active", "cooldown", "disabled"] as const;
+export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
+
+/**
+ * Wraps a stored api_key credential in the envelope its collector expects.
+ *
+ * Exported because every refresh path needs it, and the ones that omit it
+ * fail in a way that looks like the credential is dead: an unmarked `cline`
+ * `sk_...` key takes the OAuth branch, gets `workos:` prepended, and is
+ * refused with a message naming a version problem. The scheduled sweep once
+ * omitted it, so a working account was cooled with `quota_fetch_failed` every
+ * minute while refreshing fine from the console.
+ */
+export function markProviderApiKeyCredential(providerId: string, credential: string): string {
+  return providerId === "cline" ? markClineApiKeyCredential(credential) : credential;
+}
+
+/**
+ * Builds the refresh dependency bundle from the route deps, binding the
+ * provider-specific credential normalisation (`cline` API keys) once so every
+ * caller refreshes through the same wiring.
+ */
+export function createQuotaRefreshDeps(deps: AccountQuotaRoutesDeps): QuotaRefreshDeps {
+  return {
+    db: deps.db,
+    redis: deps.redis,
+    providerRegistry: deps.providerRegistry,
+    resolveCredential: deps.resolveCredential,
+    ...(deps.snapshotInvalidator ? { snapshotInvalidator: deps.snapshotInvalidator } : {}),
+    markApiKeyCredential: markProviderApiKeyCredential,
+  };
+}

package/src/console/quota/account-quota-tenant.ts

@@ -115,7 +115,6 @@ async function runAccountCheckin(
 }
 
 /** Bound on accounts one manual daily-growth batch may cover. */
-const DAILY_GROWTH_MAX_IDS = 100;
 /** Concurrent accounts inside one manual daily-growth batch. */
 const DAILY_GROWTH_CONCURRENCY = 3;
 
@@ -253,8 +252,17 @@ function checkinStateMessage(result: DailyCheckinResult): string {
   }
 }
 
+/**
+ * How many accounts are refreshed at once.
+ *
+ * This is the bound, not a cap on how many may be requested. A tenant with
+ * several hundred accounts used to be refused outright at 100 — "accountIds
+ * exceeds the limit of 100" — so refreshing the whole fleet meant hand-batching
+ * in the UI. Concurrency is what actually protects the upstream and the
+ * gateway, and it does so regardless of how many ids arrive, so the request is
+ * accepted at any size and drained through this many workers.
+ */
 const QUOTA_REFRESH_CONCURRENCY = 5;
-const QUOTA_REFRESH_MAX_IDS = 100;
 
 /**
  * Registers the tenant-scoped account/quota routes onto `app`. Every route here
@@ -547,13 +555,6 @@ export function registerAccountQuotaTenantRoutes(
           set.status = 400;
           return { error: "accountIds must be a non-empty array", code: "invalid_request" };
         }
-        if (ids.length > QUOTA_REFRESH_MAX_IDS) {
-          set.status = 400;
-          return {
-            error: `accountIds exceeds the limit of ${QUOTA_REFRESH_MAX_IDS}`,
-            code: "invalid_request",
-          };
-        }
         const accounts = await db
           .select({
             accountId: providerAccounts.id,
@@ -668,16 +669,11 @@ export function registerAccountQuotaTenantRoutes(
           active: t.Boolean(),
         }),
       },
-      async ({ request, body, set }) => {
+      async ({ request, body }) => {
         const access = requireTenantScope(accessResolver(request), "dashboard:write");
+        // No size cap: a tenant-wide enable/disable is a legitimate single
+        // request, and the UPDATE is one statement over `inArray` either way.
         if (body.ids.length === 0) return { ok: true, updated: 0 };
-        if (body.ids.length > QUOTA_REFRESH_MAX_IDS) {
-          set.status = 400;
-          return {
-            error: `ids exceeds the limit of ${QUOTA_REFRESH_MAX_IDS}`,
-            code: "invalid_request",
-          };
-        }
         const status = body.active ? ("active" as const) : ("disabled" as const);
         const updated = await db
           .update(providerAccounts)
@@ -780,13 +776,9 @@ export function registerAccountQuotaTenantRoutes(
             code: "not_found",
           };
         }
-        if (accounts.length > DAILY_GROWTH_MAX_IDS) {
-          set.status = 400;
-          return {
-            error: `accountIds exceeds the limit of ${DAILY_GROWTH_MAX_IDS}`,
-            code: "invalid_request",
-          };
-        }
+        // No size cap, for the same reason as the quota refresh: the work is
+        // already drained through a bounded worker pool, so refusing the request
+        // protected nothing and just forced the operator to batch by hand.
         // One egress rotator for the whole request, exactly as the sweep builds
         // it, so consecutive accounts leave from consecutive pools.
         const rotator =