cartethyia 2.6.7 → 2.7.1

package/src/config/cooldowns.ts

@@ -168,6 +168,21 @@ export function resolveAccountDisabledRecoveryMs(): number {
   return _disabledRecovery;
 }
 
+let _poolProviderRateLimitCooldown: number | undefined;
+/**
+ * Fallback cooldown for a provider-scoped egress 429 when the upstream named no
+ * window (default 1h). See `CARTETHYIA_POOL_PROVIDER_RATE_LIMIT_COOLDOWN_MS`.
+ * An upstream `retryAfterMs` always wins over this.
+ */
+export function resolvePoolProviderRateLimitCooldownMs(): number {
+  if (_poolProviderRateLimitCooldown === undefined)
+    _poolProviderRateLimitCooldown = readInt(
+    "CARTETHYIA_POOL_PROVIDER_RATE_LIMIT_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_POOL_PROVIDER_RATE_LIMIT_COOLDOWN_MS,
+  );
+  return _poolProviderRateLimitCooldown;
+}
+
 /**
  * Resets all cached cooldown values. Call this in tests that override
  * cooldown env-vars between test cases.
@@ -180,6 +195,7 @@ export function resetCooldownCacheForTests(): void {
   _unclassifiedCooldown = undefined;
   _escalationMaxCooldown = undefined;
   _poolCooldown = undefined;
+  _poolProviderRateLimitCooldown = undefined;
   _authRejectedCooldown = undefined;
   _policyBlockCooldown = undefined;
   _disabledRecovery = undefined;

package/src/config/providers.ts

@@ -4,7 +4,7 @@
  * public origin.
  */
 
-import { CONFIG_SPEC, readInt, readRequired, readText } from "./spec";
+import { CONFIG_SPEC, readInt, readOptionalText, readRequired, readText } from "./spec";
 
 /** Reads and normalizes the public OAuth origin. */
 export function requirePublicOrigin(): string {
@@ -48,6 +48,18 @@ export function resolveKimiQuotaBaseUrl(): string {
   );
 }
 
+/**
+ * Operator override for the directory installation identities are persisted in.
+ * Read here so the only literal `process.env` for this value stays in config;
+ * the providers that stamp an install id consume the resolver instead.
+ */
+export function resolveInstallIdDir(): string | undefined {
+  return readOptionalText(
+    "CARTETHYIA_INSTALL_ID_DIR",
+    CONFIG_SPEC.CARTETHYIA_INSTALL_ID_DIR,
+  );
+}
+
 /**
  * Operator override for the OpenCode free-tier ids upstream refuses, or
  * `undefined` when unset — meaning the bundled, measured list stands.

package/src/config/resources.ts

@@ -1,40 +1,26 @@
 /**
  * Canonical resource policy: how much memory this process may use, and how
- * much work it may hold at once.
+ * much room it must keep free.
  *
- * These two numbers were previously decided in three unrelated places — a
- * hardcoded cap in `concurrency-guard.ts`, a host-wide `os.totalmem()` in the
- * headroom guard, and a fallback constant in `runtime-metrics.ts` — which
- * meant a container limited to 512 MiB admitted the same concurrency as a 4 GiB
- * one and only started shedding once the *host* was nearly full. On a 1-core /
- * 2 GiB VPS that is the difference between shedding early and being
- * OOM-killed, and the OOM kills the dashboard too — the one surface that would
- * have explained what happened.
+ * The memory figure used to be decided in unrelated places — a host-wide
+ * `os.totalmem()` in the headroom guard, a fallback constant in
+ * `runtime-metrics.ts` — which meant a container limited to 512 MiB shed on
+ * the same threshold as a 4 GiB one and only reacted once the *host* was
+ * nearly full. On a 1-core / 2 GiB VPS that is the difference between
+ * shedding early and being OOM-killed, and the OOM kills the dashboard too —
+ * the one surface that would have explained what happened.
  *
- * Everything here is derived from one limit and one body ceiling, so the
- * numbers cannot disagree with each other:
- *
- *   concurrency = floor(limit × BUDGET_FRACTION / (TRANSIENT_COPIES × body))
- *
- * The transient-copies factor is why this is not simply "limit / body": a
- * request body is held more than once between the socket read, the JSON parse,
- * and the upstream re-serialization, so budgeting one copy per request
- * understates the real hold by a factor of about two.
+ * How many requests may run at once is NOT decided here. That is admission's
+ * job: the tenant ceiling and each key's own limit, both set in Settings. A
+ * second, process-wide ceiling derived from memory sat below the number an
+ * operator could configure and refused requests that every configured limit
+ * still allowed, which is why it is gone.
  */
 import { CONFIG_SPEC, readOptionalInt } from "./spec";
-import { resolveMaxBodyBytes } from "./runtime";
 
 /** Used when no limit is discoverable at all (native dev, macOS, Windows). */
 export const FALLBACK_MEMORY_LIMIT_BYTES = 512 * 1024 * 1024;
 
-/**
- * Ceiling on concurrent in-flight requests per process.
- *
- * A hard ceiling even when memory would allow more: this process is one core,
- * and past this point queueing delay, not memory, is what degrades. It also
- * bounds every per-request structure that is sized by concurrency.
- */
-export const MAX_PROCESS_CONCURRENCY = 64;
 
 /**
  * How many copies of a request body are resident at once.
@@ -52,35 +38,6 @@ export const REQUEST_BODY_BUDGET_FRACTION = 0.25;
 /** Share of the memory limit kept free for allocation spikes and GC slack. */
 export const MEMORY_HEADROOM_FRACTION = 0.2;
 
-/**
- * Concurrency this process should admit, derived from the memory limit and the
- * body ceiling rather than guessed.
- *
- * Worked examples, which are the point of having one formula:
- * - 2 GiB limit, 4 MiB bodies → 64 (the ceiling; memory is not the binder)
- * - 512 MiB limit, 4 MiB bodies → 16
- * - 256 MiB limit, 16 MiB bodies → 2
- *
- * An explicit override is honoured, clamped to 1..MAX_PROCESS_CONCURRENCY. It
- * is the operator's call and is never silently raised back to the derived
- * value; exceeding the derived figure is a deliberate choice, so it is
- * reported at the call site rather than corrected here.
- */
-export function deriveProcessConcurrency(options: {
-  readonly memoryLimitBytes: number;
-  readonly maxBodyBytes: number;
-  readonly override?: number | undefined;
-}): number {
-  if (options.override !== undefined) {
-    if (!Number.isInteger(options.override)) return 1;
-    return Math.min(MAX_PROCESS_CONCURRENCY, Math.max(1, options.override));
-  }
-  const body = Math.max(1, options.maxBodyBytes);
-  const perRequest = REQUEST_BODY_TRANSIENT_COPIES * body;
-  const budget = Math.max(1, Math.floor(options.memoryLimitBytes * REQUEST_BODY_BUDGET_FRACTION));
-  const derived = Math.floor(budget / perRequest);
-  return Math.min(MAX_PROCESS_CONCURRENCY, Math.max(1, derived));
-}
 
 /**
  * Bytes kept free below the memory limit.
@@ -94,16 +51,6 @@ export function deriveMemoryHeadroomBytes(memoryLimitBytes: number): number {
   return Math.ceil(memoryLimitBytes * MEMORY_HEADROOM_FRACTION);
 }
 
-/**
- * The optional operator override, read through the config spec so "unset" and
- * "out of range" are treated the way every other knob treats them.
- */
-export function resolveProcessConcurrencyOverride(): number | undefined {
-  return readOptionalInt(
-    "CARTETHYIA_PROCESS_CONCURRENCY_LIMIT",
-    CONFIG_SPEC.CARTETHYIA_PROCESS_CONCURRENCY_LIMIT,
-  );
-}
 
 /**
  * Slack added on top of every key's concurrency limit.
@@ -121,17 +68,3 @@ export function resolveConcurrencyTolerance(): number {
   return value === undefined ? 0 : Math.max(0, value);
 }
 
-/**
- * The effective concurrency for this process.
- *
- * Takes the limit as an argument rather than resolving it here: the limit
- * owner is `resolveMemoryLimitBytes()` in `observability/runtime-metrics.ts`,
- * and duplicating that resolution would let the two drift.
- */
-export function resolveProcessConcurrency(memoryLimitBytes: number): number {
-  return deriveProcessConcurrency({
-    memoryLimitBytes,
-    maxBodyBytes: resolveMaxBodyBytes(),
-    override: resolveProcessConcurrencyOverride(),
-  });
-}

package/src/config/security.ts

@@ -1,6 +1,6 @@
 /**
- * Security resolvers: the application encryption key, the abuse-protection
- * ceiling, and model-abuse strike/ban windows.
+ * Security resolvers: the application encryption key and the abuse-protection
+ * ceiling.
  */
 
 import { CONFIG_SPEC, readInt, readRequired } from "./spec";
@@ -16,42 +16,6 @@ export function resolveIpRateLimit(): number {
   return readInt("IP_RATE_MAX_PER_WINDOW", CONFIG_SPEC.IP_RATE_MAX_PER_WINDOW);
 }
 
-/** Invalid-model attempts inside the window that ban a client address. */
-export function resolveModelStrikeThreshold(): number {
-  return readInt(
-    "CARTETHYIA_MODEL_STRIKE_THRESHOLD",
-    CONFIG_SPEC.CARTETHYIA_MODEL_STRIKE_THRESHOLD,
-  );
-}
-
-/** Sliding window (ms) that keeps an invalid-model attempt countable. */
-export function resolveModelStrikeWindowMs(): number {
-  return readInt(
-    "CARTETHYIA_MODEL_STRIKE_WINDOW_MS",
-    CONFIG_SPEC.CARTETHYIA_MODEL_STRIKE_WINDOW_MS,
-  );
-}
-
-/** How long (ms) a model-abuse ban lasts before it lapses on its own. */
-export function resolveModelBanTtlMs(): number {
-  return readInt("CARTETHYIA_MODEL_BAN_TTL_MS", CONFIG_SPEC.CARTETHYIA_MODEL_BAN_TTL_MS);
-}
-
-/**
- * The longest model-abuse ban the console will record, however long a request
- * asks for.
- *
- * A separate knob from the ban TTL because the two are different decisions:
- * the TTL is what a graduated ban gets, this is the ceiling on what an
- * operator may ask for by hand. Raising one was never meant to raise the other.
- */
-export function resolveModelBanMaxTtlMs(): number {
-  return readInt(
-    "CARTETHYIA_MODEL_BAN_MAX_TTL_MS",
-    CONFIG_SPEC.CARTETHYIA_MODEL_BAN_MAX_TTL_MS,
-  );
-}
-
 /** Reads the application encryption key without caching it. */
 export function requireEncryptionKeyEnv(): string {
   return readRequired("CARTETHYIA_ENCRYPTION_KEY", CONFIG_SPEC.CARTETHYIA_ENCRYPTION_KEY);

package/src/config/spec.ts

@@ -90,10 +90,9 @@ export const CONFIG_SPEC = {
   CARTETHYIA_SERVER_MAX_BODY_BYTES: {
     kind: "int",
     // A 500K-token context is roughly 2 MB of text, so 4 MB admits every real
-    // request while halving the worst-case hold. Worst-case retained bytes
-    // across the process is `PROCESS_CONCURRENCY_CAP × this`, so on a 1 GB box
-    // the product should stay within about 40% of the limit; an operator with
-    // larger payloads raises this.
+    // request while halving the worst-case hold. How many may be in flight is
+    // admission's job, so an operator with larger payloads raises this and
+    // sets the ceiling in Settings.
     default: 4 * 1024 * 1024,
     min: 1024,
     max: Number.MAX_SAFE_INTEGER,
@@ -119,7 +118,6 @@ export const CONFIG_SPEC = {
   // Optional-int, not int-with-a-zero-default: "unset" and "explicitly zero"
   // must not be the same thing. Zero is not a valid ceiling, so a default of 0
   // would need a second sentinel to mean "derive".
-  CARTETHYIA_PROCESS_CONCURRENCY_LIMIT: { kind: "optional-int", min: 1, max: 64 },
   // Slack above each key's concurrency limit. Effective ceiling is
   // limit + tolerance; only requests past it are refused.
   CARTETHYIA_CONCURRENCY_TOLERANCE: { kind: "optional-int", min: 0, max: 1024 },
@@ -139,6 +137,7 @@ export const CONFIG_SPEC = {
   // requires a loopback peer and a timing-safe token match; unset = the route
   // does not exist.
   CARTETHYIA_DRAIN_TOKEN: { kind: "optional-text" },
+  CARTETHYIA_INSTALL_ID_DIR: { kind: "optional-text" },
 
   // Network policy (trusted proxy + SSRF)
   TRUSTED_PROXY_CIDRS: { kind: "list" },
@@ -242,6 +241,18 @@ export const CONFIG_SPEC = {
   },
   CARTETHYIA_ACCOUNT_COOLDOWN_ESCALATION_MAX_MS: { kind: "int", default: 3_600_000, min: 0, max: 86_400_000 },
   CARTETHYIA_POOL_COOLDOWN_MS: { kind: "int", default: 120_000, min: 0, max: 86_400_000 },
+  /**
+   * A provider-scoped egress cooldown (a 429 the pool itself earned) when the
+   * upstream named no window. Default 1h: an egress that exhausted a
+   * request-counted allowance stays refused long past minute 15, and a short
+   * default sent the pool back into rotation to be refused again.
+   */
+  CARTETHYIA_POOL_PROVIDER_RATE_LIMIT_COOLDOWN_MS: {
+    kind: "int",
+    default: 3_600_000,
+    min: 0,
+    max: 86_400_000,
+  },
   CARTETHYIA_ACCOUNT_AUTH_REJECTED_COOLDOWN_MS: { kind: "int", default: 300_000, min: 0, max: 86_400_000 },
   CARTETHYIA_ACCOUNT_POLICY_BLOCK_COOLDOWN_MS: { kind: "int", default: 300_000, min: 0, max: 86_400_000 },
   CARTETHYIA_ACCOUNT_DISABLED_RECOVERY_MS: { kind: "int", default: 86_400_000, min: 0, max: 604_800_000 },
@@ -252,24 +263,6 @@ export const CONFIG_SPEC = {
 
   // Security (encryption key, public origin, abuse ceiling)
   IP_RATE_MAX_PER_WINDOW: { kind: "int", default: 240, min: 1, max: Number.MAX_SAFE_INTEGER },
-  // Invalid-model attempts inside the sliding window that ban the client
-  // address, how long an attempt stays countable, and how long the ban lasts.
-  // A valid request does not reset the window.
-  CARTETHYIA_MODEL_STRIKE_THRESHOLD: { kind: "int", default: 10, min: 1, max: 100 },
-  CARTETHYIA_MODEL_STRIKE_WINDOW_MS: { kind: "int", default: 1_800_000, min: 1_000, max: 86_400_000 },
-  CARTETHYIA_MODEL_BAN_TTL_MS: { kind: "int", default: 21_600_000, min: 1_000, max: 604_800_000 },
-  /**
-   * The longest ban the console will record, however long a request asks for.
-   * The "Permanent" choice is a very long TTL rather than an unbounded one,
-   * and this is what keeps a typo in a duration from parking a caller for a
-   * decade.
-   */
-  CARTETHYIA_MODEL_BAN_MAX_TTL_MS: {
-    kind: "int",
-    default: 604_800_000,
-    min: 1_000,
-    max: 604_800_000,
-  },
   CARTETHYIA_ENCRYPTION_KEY: {
     kind: "required",
     error:

package/src/console/console-router.ts

@@ -26,11 +26,11 @@ import type { NetworkPoolSelector } from "../network/pool/selector";
 import type { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
 import type { OAuthRefreshService } from "../providers/authentication/oauth-refresh-service";
 import type { ApiKeyAdmissionService } from "../security/admission/service";
-import type { ModelStrikeService } from "../security/model-abuse";
 import type { RedisClient } from "../persistence/redis";
 import { CliToolMappingStore } from "./cli-tools/store";
 import { CliToolService } from "./cli-tools/service";
 import { DrizzleCliToolSecretSource } from "./cli-tools/secret-source";
+import type { ShareLinkStore } from "../persistence/stores/share-store";
 import type { ProviderRegistry } from "../providers/provider-registry";
 import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
 import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
@@ -65,13 +65,13 @@ export interface ConsoleApiCompositionDeps {
   readonly networkBindingFactory: ValidatedNetworkBindingFactory;
   readonly redis: RedisClient | undefined;
   readonly oauthRefreshService: OAuthRefreshService;
-  readonly admissionService: Pick<ApiKeyAdmissionService, "purgeKey">;
   /**
-   * Graduated model-abuse strikes: list and lift bans from the console.
-   * Optional so reduced compositions (route-only shell, console stubs) stay
-   * valid; absent means the `/model-bans` routes are not mounted.
+   * Share-link store shared with the public share router, so both surfaces
+   * wrap the same table through one instance. Optional: absent means the
+   * console builds its own store from `db`.
    */
-  readonly modelStrikes?: Pick<ModelStrikeService, "listBans" | "unban" | "ban">;
+  readonly shareStore?: ShareLinkStore;
+  readonly admissionService: Pick<ApiKeyAdmissionService, "purgeKey">;
   readonly readRoutingAccountInflight?:
     | ((
         providerId: string,
@@ -190,11 +190,11 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
     poolSelector,
     telemetryBuffer,
     ...(deps.stateStore ? { stateStore: deps.stateStore } : {}),
+    ...(deps.shareStore ? { shareStore: deps.shareStore } : {}),
     providerRegistry: deps.providerRegistry,
     bundledModelCatalog: deps.bundledModelCatalog,
     networkBindingFactory: deps.networkBindingFactory,
     admissionService: deps.admissionService,
-    ...(deps.modelStrikes ? { modelStrikes: deps.modelStrikes } : {}),
     readRoutingAccountInflight: deps.readRoutingAccountInflight,
     ...(deps.flushBuffers ? { flushBuffers: deps.flushBuffers } : {}),
     credentialService,

package/src/console/domain-registration.ts

@@ -34,7 +34,6 @@ import { DrizzleObservabilityStore } from "./observability/store";
 import { createLiveRoutes } from "./observability/live";
 import { createLogRoutes } from "./observability/logs";
 import { createAuditRoutes } from "./audit/routes";
-import { createModelAbuseRoutes } from "./admin/model-abuse/routes";
 import { DrizzleAuditReadStore } from "./audit/store";
 import { createPerformanceRoutes } from "./observability/performance";
 import { createUpdateRoutes } from "./updates/routes";
@@ -47,6 +46,7 @@ import type { ConsoleCredentialService } from "./auth/credentials";
 import { resolveTelemetryRetentionDays } from "../config/telemetry";
 import { payloadRetentionMs, resolvePayloadCapture } from "../observability/payload-capture";
 import { TELEMETRY_EVENT_DIR } from "../observability/event-log";
+import { providerUsageMatrix } from "../observability/event-query";
 
 import { InMemoryOAuthFlowStore, OAuthFlowStore } from "../providers/authentication/oauth-flow-store";
 import { OAuthCallbackListener } from "./providers/oauth/callback-listener";
@@ -56,7 +56,10 @@ import {
 } from "../providers/operations/provider-credential-service";
 import { syncByokProvider } from "../providers/operations/provider-catalog-service";
 import { DrizzleApiKeyStore } from "../persistence/stores/api-key-store";
-import { DrizzleShareLinkStore } from "../persistence/stores/share-store";
+import {
+  DrizzleShareLinkStore,
+  type ShareLinkStore,
+} from "../persistence/stores/share-store";
 import { createShareUsagePort } from "./share/share-usage";
 import { resolveSsrfPolicy } from "../config/network";
 import { createValidatedFetch } from "../network/outbound-fetch";
@@ -65,7 +68,6 @@ import type { CliToolService } from "./cli-tools/service";
 import type { NetworkPoolSelector } from "../network/pool/selector";
 import type { LiveInFlightSource } from "./observability/live";
 import type { ApiKeyAdmissionService } from "../security/admission/service";
-import type { ModelStrikeService } from "../security/model-abuse";
 import type { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
 import type { OAuthRefreshService } from "../providers/authentication/oauth-refresh-service";
 import { resolveRedisBackend } from "../persistence/redis";
@@ -101,9 +103,13 @@ export interface ConsoleDomainContext {
   };
   /** Owns the live in-flight gauge the console surfaces. */
   readonly stateStore?: LiveInFlightSource;
+  /**
+   * Share-link store shared with the public share router, so both surfaces
+   * wrap the same table through one instance. Falls back to a fresh store
+   * when absent (reduced compositions, tests).
+   */
+  readonly shareStore?: ShareLinkStore;
   readonly admissionService: Pick<ApiKeyAdmissionService, "purgeKey">;
-  /** Graduated model-abuse strikes: list and lift bans from the console. */
-  readonly modelStrikes?: Pick<ModelStrikeService, "listBans" | "unban" | "ban">;
   readonly readRoutingAccountInflight?:
     | ((
         providerId: string,
@@ -229,7 +235,7 @@ export function registerConsoleDomains(
   const runtimeSettingsStore = new DrizzleRuntimeSettingsStore(ctx.db, resolveRedisBackend(ctx.redis));
   const modelRoutingStore = new DrizzleModelRoutingStore(ctx.db);
   const apiKeyStore = new DrizzleApiKeyStore(ctx.db);
-  const shareStore = new DrizzleShareLinkStore(ctx.db);
+  const shareStore = ctx.shareStore ?? new DrizzleShareLinkStore(ctx.db);
   const shareActivity = createShareUsagePort({ db: ctx.db, redis: ctx.redis });
 
 
@@ -259,12 +265,6 @@ export function registerConsoleDomains(
     resolveConfigKey: () => inferhubKeys.read(),
     keyStore: inferhubKeys,
   }));
-  if (ctx.modelStrikes) {
-    console.use(createModelAbuseRoutes({
-      strikes: ctx.modelStrikes,
-      accessResolver: ctx.accessResolver,
-    }));
-  }
   console.use(createProviderCatalogRoutes({
     store: providerCatalogStore,
     accessResolver: ctx.accessResolver,
@@ -280,6 +280,13 @@ export function registerConsoleDomains(
       aliases: await modelRoutingStore.listAliases(tenantId),
       combos: await modelRoutingStore.listCombos(tenantId),
     }),
+    providerUsageMatrix: (tenantId, providerId, days) =>
+      providerUsageMatrix(
+        ctx.db,
+        tenantId,
+        providerId,
+        new Date(Date.now() - days * 86_400_000),
+      ),
   }));
   console.use(createProviderDetailRoutes({
     store: providerDetailStore,

package/src/console/providers/catalog/catalog-projections.ts

@@ -9,6 +9,7 @@
  * segment. `mapProviderRow` is the single `providers` row projection.
  */
 import { isBundledProviderId } from "../../../providers/provider-contracts";
+import { BUILTIN_DEFAULT_ENDPOINTS } from "../../../protocol/codecs";
 
 import { providerDisplayName, providerServiceKinds } from "../../../providers/provider-metadata";
 import type { CompatibilityProfile } from "../../../providers/provider-metadata";
@@ -26,12 +27,7 @@ export interface ProviderDiscoveryLookup {
   hasModelDiscovery(providerId: string): boolean;
 }
 
-export const DEFAULT_ENDPOINT_BY_WIRE_FAMILY: Record<WireFamily, string> = {
-  chat: "/v1/chat/completions",
-  responses: "/v1/responses",
-  messages: "/v1/messages",
-  gemini: "/api/llm/g/v1/generate",
-};
+export const DEFAULT_ENDPOINT_BY_WIRE_FAMILY: Record<WireFamily, string> = BUILTIN_DEFAULT_ENDPOINTS;
 export function endpointPathForProviderModel(
   wireFamily: WireFamily,
   compatibilityProfile: unknown,

package/src/console/providers/catalog/contracts.ts

@@ -557,6 +557,14 @@ export interface ProviderAccountExport {
   accessToken: string;
   /** Decrypted OAuth refresh token, omitted when the account has none. */
   refreshToken?: string;
+  /**
+   * Non-secret upstream auth configuration carried on the account (the
+   * upstream user id, provisioned region, auth method, profile). Re-import
+   * must restore it: Trae refresh is addressed per upstream user id, and the
+   * data-plane host is region-scoped, so dropping it breaks re-imported
+   * accounts on their first refresh or dispatch.
+   */
+  authState?: Readonly<Record<string, unknown>>;
   createdAt: string;
   /** Live routing admission count at export time; absent when unavailable. */
   inflight?: number;
@@ -771,6 +779,17 @@ export interface ProviderCatalogStore {
   syncModels(tenantId: string, providerId: string): Promise<{ synced: number }>;
   listAccounts(tenantId: string, providerId: string): Promise<readonly ProviderAccountResponse[]>;
   listAllAccounts(tenantId: string): Promise<readonly ProviderAccountResponse[]>;
+  /**
+   * Non-secret upstream auth configuration for the given owned accounts,
+   * keyed by account id. Used by the account-export route so a re-import can
+   * restore the upstream user id / region that refresh and dispatch are
+   * addressed by; never surfaced on the read models.
+   */
+  listAccountAuthStates(
+    tenantId: string,
+    providerId: string,
+    accountIds: readonly string[],
+  ): Promise<Readonly<Record<string, Readonly<Record<string, unknown>>>>>;
   createAccount(
     tenantId: string,
     providerId: string,

package/src/console/providers/catalog/provider-operations.ts

@@ -17,6 +17,7 @@ import {
   requireTenantAnyScope,
 } from "../../shared/errors";
 import type { AccessDecision } from "../../../security/access-control";
+import type { ProviderUsageDayRow } from "../../../observability/event-query";
 import { isBundledProviderId } from "../../../providers/provider-contracts";
 import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { getProviderClientVersion, getRouteIdentityVersions } from "../../../providers/operations/client-versions";
@@ -146,6 +147,16 @@ export interface ProviderCatalogConfig {
       readonly members: readonly string[];
     }[];
   }>;
+  /**
+   * Day × model usage aggregate feeding the provider's Activity Matrix card.
+   * Optional so hosts without telemetry reads (and existing test doubles) keep
+   * the route returning an empty matrix instead of failing.
+   */
+  readonly providerUsageMatrix?: (
+    tenantId: string,
+    providerId: string,
+    days: number,
+  ) => Promise<readonly ProviderUsageDayRow[]>;
   /**
    * Resolves the stored credential and optional OAuth refresh token for export,
    * decrypting them without applying provider-specific dispatch codecs.
@@ -249,6 +260,19 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
           throw new ConsoleDomainError("provider_not_found", 404, `Provider ${providerId} not found`);
         return attachProviderCapabilities(sanitizeProviderResponse(rec, true), config.providerRegistry);
       },
+    async getUsageMatrix(
+      access: AccessDecision | undefined,
+      providerId: string,
+      days: number,
+    ): Promise<{ readonly days: number; readonly rows: readonly ProviderUsageDayRow[] }> {
+      const a = requireTenantAnyScope(access, PROVIDER_READ_SCOPES);
+      // Bounded window even on a hostile query string: the card reads a
+      // calendar, not history, and the aggregate scan cost grows with `days`.
+      const bounded = Math.min(Math.max(Math.trunc(days) || 1, 1), 366);
+      if (!config.providerUsageMatrix) return { days: bounded, rows: [] };
+      const rows = await config.providerUsageMatrix(a.tenantId, providerId, bounded);
+      return { days: bounded, rows };
+    },
     async createProvider(
         access: AccessDecision | undefined,
         request: CreateProviderRequest,
@@ -639,6 +663,11 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
         const selected = owned.filter(
           (account) => wanted.has(account.id) && account.tenantId === a.tenantId,
         );
+        const authStates = await config.store.listAccountAuthStates(
+          a.tenantId,
+          providerId,
+          selected.map((account) => account.id),
+        );
         const accounts = await Promise.all(
           selected.map(async (account): Promise<ProviderAccountExport> => {
             let accessToken = "";
@@ -661,6 +690,15 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
               status: account.status,
               accessToken,
               ...(refreshToken === undefined ? {} : { refreshToken }),
+              // Non-secret auth state is part of the credential export: without
+              // it a re-import loses the upstream user id and region that Trae
+              // refresh and dispatch are addressed by.
+              ...(() => {
+                const authState = authStates[account.id];
+                return authState !== undefined && Object.keys(authState).length > 0
+                  ? { authState }
+                  : {};
+              })(),
               ...(account.inflight === undefined ? {} : { inflight: account.inflight }),
               createdAt: account.createdAt,
               ...(account.cooldownUntil ? { cooldownUntil: account.cooldownUntil } : {}),

package/src/console/providers/catalog/routes.ts

@@ -147,6 +147,9 @@ const deleteModelBody = t.Object({
 const bulkDeleteModelsBody = t.Object({
   items: t.Array(deleteModelBody, { minItems: 1, maxItems: 1000 }),
 });
+const usageMatrixQuery = t.Object({
+  days: t.Optional(t.Integer({ minimum: 1, maximum: 366 })),
+});
 export function createProviderCatalogRoutes(config: ProviderCatalogConfig): Elysia {
   const factory = createProviderCatalogOperations(config);
   const modelFactory = createModelCatalogOperations(config);
@@ -191,6 +194,17 @@ export function createProviderCatalogRoutes(config: ProviderCatalogConfig): Elys
     .get("/:providerId", async ({ request, params }) => {
       return await factory.getProviderDetail(config.accessResolver(request), params.providerId);
 })
+    .get(
+      "/:providerId/usage/matrix",
+      { query: usageMatrixQuery },
+      async ({ request, params, query }) => {
+        return await factory.getUsageMatrix(
+          config.accessResolver(request),
+          params.providerId,
+          query.days ?? 30,
+        );
+      },
+    )
     .post("/", { body: createProviderBody }, async ({ request, body, set }) => {
       set.status = 201;
       return await factory.createProvider(