cartethyia 2.7.2 → 2.7.4

package/src/console/providers/detail/routes.ts

@@ -1,4 +1,4 @@
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { ConsoleDomainError, errorResponse, requireTenantScope } from "../../shared/errors";
 import { literalUnion } from "../../shared/elysia-schema";
 import type { AccessDecision } from "../../../security/access-control";
@@ -160,7 +160,7 @@ const updateRoutingBody = t.Object({
 });
 
 
-export function createProviderDetailRoutes(config: ProviderDetailConfig): Elysia {
+export function createProviderDetailRoutes(config: ProviderDetailConfig): AnyElysia {
   const factory = createProviderDetailOperations(config);
   return new Elysia({ prefix: "/providers" })
     .get("/:providerId/routing", async ({ request, params, set }) => {
@@ -191,5 +191,5 @@ export function createProviderDetailRoutes(config: ProviderDetailConfig): Elysia
           return providerDetailErrorResponse(e, set);
         }
       },
-    ) as unknown as Elysia;
+    )
 }

package/src/console/providers/oauth/routes.ts

@@ -9,7 +9,7 @@ import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { browserAuthorizeRedirectUri } from "../../../config/providers";
 import { log } from "../../../observability/logger";
 import { GatewayError } from "../../../protocol/gateway-error";
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { ConsoleDomainError, errorResponse, requireScope } from "../../shared/errors";
 import { generateOAuthState, generatePkcePair } from "../../../providers/authentication/oauth-flow-store";
 import type { OAuthFlowStorage } from "../../../providers/authentication/oauth-flow-store";
@@ -639,7 +639,7 @@ const importBody = t.Object({
   accountLabel: t.Optional(t.String()),
 });
 
-export function createOAuthLoginRoutes(config: OAuthLoginConfig): Elysia {
+export function createOAuthLoginRoutes(config: OAuthLoginConfig): AnyElysia {
   const factory = createOAuthLoginOperations(config);
   return new Elysia({ prefix: "/providers" })
     .post(
@@ -721,6 +721,6 @@ export function createOAuthLoginRoutes(config: OAuthLoginConfig): Elysia {
           return oauthErrorResponse(e, set);
         }
       },
-    ) as unknown as Elysia;
+    )
 }
 

package/src/console/quota/account-quota-tenant.ts

@@ -43,6 +43,10 @@ import {
   fetchQoderDailyCheckin,
   isQoderCheckinProvider,
 } from "../../providers/integrations/qoder/qoder-checkin";
+import {
+  DrizzleQoderNativeIdentityStore,
+  type QoderNativeIdentityStore,
+} from "../../providers/integrations/qoder/qoder-native-identity-store";
 import { buddyAccountUid } from "../../providers/integrations/buddy/buddy-oauth-shared";
 import {
   supportsAccountReset,
@@ -50,6 +54,7 @@ import {
   listAccountResetCredits,
 } from "../../providers/operations/account-reset-service";
 import {
+  enqueueBackgroundQuotaRefresh,
   pendingQuotaRefreshes,
   toQuotaAccountHealth,
   toQuotaView,
@@ -108,6 +113,7 @@ async function runAccountCheckin(
   account: { id: string; providerId: string },
   credential: string,
   forceClaim: boolean,
+  nativeIdentityStore?: QoderNativeIdentityStore,
 ): Promise<DailyCheckinResult> {
   if (isQoderCheckinProvider(account.providerId)) {
     return fetchQoderDailyCheckin({
@@ -115,6 +121,7 @@ async function runAccountCheckin(
       accountId: account.id,
       credential,
       fetcher: globalThis.fetch,
+      ...(nativeIdentityStore ? { nativeIdentityStore } : {}),
     });
   }
   return fetchDailyCheckin({
@@ -202,6 +209,7 @@ async function runDailyGrowthForAccount(
           accountId: account.id,
           credential,
           fetcher,
+          nativeIdentityStore: new DrizzleQoderNativeIdentityStore(refreshDeps.db),
         })
       : await fetchDailyCheckin({
           providerId,
@@ -362,6 +370,15 @@ export function registerAccountQuotaTenantRoutes(
           icon: providerId,
         }));
       let refreshing = 0;
+      // Cold-cache backfill: the overview renders whatever is cached, and the
+      // periodic sweep owns freshness — but with many accounts (e.g. a large
+      // Qoder roster) the sweep's per-pass cap cannot keep every cache warm,
+      // so a page open would show accounts with no badge for minutes. Enqueue
+      // a bounded background refresh for accounts whose cache entry is missing
+      // (not merely stale), so the badge fills in without waiting for the next
+      // sweep pass and without fanning out to the whole roster at once.
+      const coldCacheCap = 20;
+      let coldCacheEnqueued = 0;
       // The sweep's day markers answer "attempted today" without an upstream
       // request; only check-in-capable accounts can carry one, so only they
       // are read.
@@ -397,6 +414,21 @@ export function registerAccountQuotaTenantRoutes(
         const canRefresh = providerRegistry.hasQuotaCollector(row.providerId);
         const isRefreshing = canRefresh && (pending.has(row.id) || entry === undefined);
         if (isRefreshing) refreshing += 1;
+        // Backfill a missing cache entry on page open (bounded, see above).
+        if (
+          canRefresh &&
+          entry === undefined &&
+          !pending.has(row.id) &&
+          coldCacheEnqueued < coldCacheCap
+        ) {
+          coldCacheEnqueued += 1;
+          enqueueBackgroundQuotaRefresh(refreshDeps, {
+            accountId: row.id,
+            providerId: row.providerId,
+            tenantId: row.tenantId,
+            credentialKind: row.credentialKind,
+          });
+        }
         return {
           id: row.id,
           provider: row.providerId,
@@ -518,7 +550,7 @@ export function registerAccountQuotaTenantRoutes(
         throw new GatewayError(
           "proxy_pool_unavailable",
           503,
-          "Account test cannot select a proxy because proxy routing is not configured.",
+          "Account test cannot select a proxy because proxy routing is not configured (request {requestId}). No bridge to cross — configure a pool first 🏗️",
           { reason: "proxy_routing_unconfigured" },
           "network",
         );
@@ -884,7 +916,7 @@ export function registerAccountQuotaTenantRoutes(
           account.providerId as ProviderId,
           account.id,
         );
-        result = await runAccountCheckin(account, credential, true);
+        result = await runAccountCheckin(account, credential, true, new DrizzleQoderNativeIdentityStore(db));
       } catch (error) {
         result = {
           providerId: account.providerId,

package/src/console/quota/account-quota.ts

@@ -2,13 +2,15 @@ import { Elysia } from "elysia";
 import { consoleErrorHandler } from "../shared/errors";
 import { registerAccountQuotaGlobalRoutes } from "./account-quota-global";
 import { registerAccountQuotaTenantRoutes } from "./account-quota-tenant";
+import { registerNativeIdentityRoutes } from "./native-identity";
 import { createQuotaRefreshDeps, type AccountQuotaRoutesDeps } from "./account-quota-shared";
 
 /**
  * Mounts the account/quota console routes: the tenant-scoped group (the
  * caller's own accounts) and the platform-admin group (shared accounts). Each
  * group lives in its own module and authorises every route with its own
- * access check.
+ * access check. The native-identity routes are mounted once, here, because
+ * they serve both owned and shared accounts with per-account authorization.
  */
 export function createAccountQuotaRoutes(deps: AccountQuotaRoutesDeps): Elysia {
   const refreshDeps = createQuotaRefreshDeps(deps);
@@ -18,5 +20,6 @@ export function createAccountQuotaRoutes(deps: AccountQuotaRoutesDeps): Elysia {
   app.error(consoleErrorHandler("Quota operation failed"));
   registerAccountQuotaTenantRoutes(app, deps, refreshDeps);
   registerAccountQuotaGlobalRoutes(app, deps, refreshDeps);
+  registerNativeIdentityRoutes(app, { db: deps.db, accessResolver: deps.accessResolver });
   return app;
 }

package/src/console/quota/account-test-egress.ts

@@ -138,7 +138,7 @@ export async function selectAccountTestEgress(
     throw new GatewayError(
       "proxy_pool_unavailable",
       503,
-      "No active proxy pool is available because coordination is unavailable.",
+      "No active proxy pool is available because coordination is unavailable (request {requestId}). The bouncer stepped out — come back shortly 🚪",
       { reason: "coordination_unavailable" },
       "network",
     );
@@ -159,10 +159,10 @@ export async function selectAccountTestEgress(
     const status = failure.reason === "at_capacity" ? 429 : 503;
     const message =
       failure.reason === "at_capacity"
-        ? "Every proxy pool for this provider is at its concurrency limit. Retry shortly, or add a pool or raise its capacity."
+        ? "Every proxy pool for this provider is at its concurrency limit (request {requestId}). Retry shortly, or add a pool or raise its capacity. The pools are full right now — chill 🌊"
         : failure.reason === "cooldown"
-          ? "Every proxy pool for this provider is cooling down after upstream failures. Retry once the cooldown resets."
-          : "No active proxy pool is configured for this tenant and provider. Add one, or route this provider through direct egress.";
+          ? "Every proxy pool for this provider is cooling down after upstream failures (request {requestId}). Retry once the cooldown resets. The proxies are catching their breath — zzz 💤"
+          : "No active proxy pool is configured for this tenant and provider (request {requestId}). Add one, or route this provider through direct egress. No bridge to cross — configure a pool first 🏗️";
     throw new GatewayError(
       code,
       status,

package/src/console/quota/native-identity.ts

@@ -0,0 +1,189 @@
+/**
+ * Qoder native-identity console operations, shared by the tenant-scoped and
+ * global-admin account route groups.
+ *
+ * The identity is the account's device identity (minted seed). The routes
+ * surface it for export/import/regenerate from the provider-detail screen;
+ * the device-uniqueness invariant lives in the store (and the partial unique
+ * index behind it).
+ */
+import { and, eq, isNull } from "drizzle-orm";
+import { Elysia, t } from "elysia";
+import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { providerAccounts, type NativeIdentityRecord } from "../../persistence/schema";
+import {
+  allocateQoderNativeIdentity,
+  DrizzleQoderNativeIdentityStore,
+  type QoderNativeIdentityStore,
+} from "../../providers/integrations/qoder/qoder-native-identity-store";
+import { ConsoleDomainError, requireGlobalAdmin, requireTenantScope } from "../shared/errors";
+import type { ConsoleAccessResolver } from "../auth/access";
+
+/** True when `token` looks like a plausible machine token. */
+export function isValidNativeIdentityToken(token: string): boolean {
+  return typeof token === "string" && token.length >= 8 && token.length <= 512;
+}
+
+/**
+ * Allocates a fresh device identity for regenerate. Injected so tests can stub
+ * the native bridge; the default runs the real `runtime-info` bridge through
+ * the store.
+ */
+export type NativeIdentityAllocator = (args: {
+  providerId: string;
+  accountId: string;
+  avoidToken?: string;
+}) => Promise<NativeIdentityRecord | null>;
+
+function defaultAllocator(store: QoderNativeIdentityStore): NativeIdentityAllocator {
+  return ({ providerId, accountId, avoidToken }) =>
+    allocateQoderNativeIdentity(store, providerId, accountId, {
+      ...(avoidToken !== undefined ? { avoidToken } : {}),
+    });
+}
+
+/** Loads one account row, scoped by tenant (null = global/shared). */
+async function loadAccount(
+  db: CartethyiaDatabase,
+  accountId: string,
+  tenantId: string | null,
+): Promise<{ providerId: string; nativeIdentity: NativeIdentityRecord | null } | undefined> {
+  const rows = await db
+    .select({
+      providerId: providerAccounts.providerId,
+      nativeIdentity: providerAccounts.nativeIdentity,
+    })
+    .from(providerAccounts)
+    .where(
+      tenantId === null
+        ? and(eq(providerAccounts.id, accountId), isNull(providerAccounts.tenantId))
+        : and(eq(providerAccounts.id, accountId), eq(providerAccounts.tenantId, tenantId)),
+    )
+    .limit(1);
+  return rows[0];
+}
+
+export interface NativeIdentityOps {
+  get(accountId: string, tenantId: string | null): Promise<NativeIdentityRecord | null>;
+  put(accountId: string, tenantId: string | null, record: NativeIdentityRecord): Promise<NativeIdentityRecord>;
+  regenerate(accountId: string, tenantId: string | null): Promise<NativeIdentityRecord | null>;
+}
+
+export function createNativeIdentityOps(
+  db: CartethyiaDatabase,
+  allocator: NativeIdentityAllocator = defaultAllocator(new DrizzleQoderNativeIdentityStore(db)),
+): NativeIdentityOps {
+  const store = new DrizzleQoderNativeIdentityStore(db);
+  return {
+    async get(accountId, tenantId) {
+      const account = await loadAccount(db, accountId, tenantId);
+      // A missing row under the narrowed tenant scope means the account is not
+      // visible to this caller (cross-tenant read) — report not-found, the
+      // same convention the account routes use, rather than echoing null.
+      if (!account) throw new ConsoleDomainError("not_found", 404, "Account not found");
+      return account.nativeIdentity;
+    },
+    async put(accountId, tenantId, record) {
+      const account = await loadAccount(db, accountId, tenantId);
+      if (!account) throw new ConsoleDomainError("not_found", 404, "Account not found");
+      if (!isValidNativeIdentityToken(record.machineToken)) {
+        throw new ConsoleDomainError("invalid_identity", 400, "machineToken must be a non-empty string (8–512 chars)");
+      }
+      if (!record.machineType || !record.machineCode) {
+        throw new ConsoleDomainError("invalid_identity", 400, "machineToken, machineType, and machineCode are required");
+      }
+      // Device uniqueness: another account already owns this token? The pool is
+      // global across Qoder accounts (both realms), matching the unique index.
+      const occupied = await store.occupied(accountId);
+      if (occupied.has(record.machineToken)) {
+        throw new ConsoleDomainError("slot_taken", 409, `Native identity token is already bound to another account`);
+      }
+      await store.bind(account.providerId, accountId, record);
+      return record;
+    },
+    async regenerate(accountId, tenantId) {
+      const account = await loadAccount(db, accountId, tenantId);
+      if (!account) throw new ConsoleDomainError("not_found", 404, "Account not found");
+      return allocator({
+        providerId: account.providerId,
+        accountId,
+        ...(account.nativeIdentity?.machineToken !== undefined ? { avoidToken: account.nativeIdentity.machineToken } : {}),
+      });
+    },
+  };
+}
+
+/**
+ * The authorization decision for one account's native-identity route.
+ *
+ * Account ownership decides which rule applies: shared accounts
+ * (`tenant_id IS NULL`) need platform admin; tenant-owned accounts need the
+ * tenant scope for the owning tenant.
+ */
+export interface NativeIdentityScope {
+  readonly tenantId: string | null;
+}
+
+/**
+ * Registers the native-identity routes on `app` (path
+ * `/provider-accounts/:id/native-identity`).
+ *
+ * `authorize` performs the access check based on the account's owner and
+ * returns the tenant scope to load the row under, so a shared account is
+ * reachable only by a platform admin and a tenant-owned account only by its
+ * tenant.
+ */
+export function registerNativeIdentityRoutes(
+  app: Elysia,
+  deps: { readonly db: CartethyiaDatabase; readonly accessResolver: ConsoleAccessResolver },
+  allocator?: NativeIdentityAllocator,
+): void {
+  const ops = createNativeIdentityOps(deps.db, allocator);
+  const authorize = async (
+    request: Request,
+    accountId: string,
+    scope: "dashboard:read" | "dashboard:write",
+  ): Promise<NativeIdentityScope> => {
+    const rows = await deps.db
+      .select({ tenantId: providerAccounts.tenantId })
+      .from(providerAccounts)
+      .where(eq(providerAccounts.id, accountId))
+      .limit(1);
+    if (rows.length === 0) {
+      throw new ConsoleDomainError("not_found", 404, "Account not found");
+    }
+    const ownerTenantId = rows[0]!.tenantId;
+    if (ownerTenantId === null) {
+      requireGlobalAdmin(deps.accessResolver(request));
+      return { tenantId: null };
+    }
+    const access = requireTenantScope(deps.accessResolver(request), scope);
+    return { tenantId: access.tenantId };
+  };
+  app
+    .get("/provider-accounts/:id/native-identity", async ({ request, params }) => {
+      const { tenantId } = await authorize(request, params.id, "dashboard:read");
+      return { identity: await ops.get(params.id, tenantId) };
+    })
+    .put(
+      "/provider-accounts/:id/native-identity",
+      {
+        body: t.Object({
+          machineToken: t.String(),
+          machineType: t.String(),
+          machineCode: t.String(),
+          seed: t.Optional(t.String()),
+        }),
+      },
+      async ({ request, params, body }) => {
+        const { tenantId } = await authorize(request, params.id, "dashboard:write");
+        const identity = await ops.put(params.id, tenantId, body as NativeIdentityRecord);
+        return { identity };
+      },
+    )
+    .post("/provider-accounts/:id/native-identity/regenerate", async ({ request, params }) => {
+      const { tenantId } = await authorize(request, params.id, "dashboard:write");
+      const identity = await ops.regenerate(params.id, tenantId);
+      return { identity };
+    });
+}

package/src/console/remote-support/contracts.ts

@@ -51,12 +51,18 @@ export interface RemoteSupportStartResponse extends RemoteSupportStatus {
 }
 
 /** Human-readable install guidance, keyed by tool. Never an installer. */
-export const REMOTE_SUPPORT_INSTALL_HINT: Readonly<Record<RemoteSupportTool, string>> = {
-  cloudflared:
-    "cloudflared is not installed. Install it yourself (winget install Cloudflare.cloudflared) and try again.",
-  tailscale:
-    "tailscale is not installed. Install it yourself (winget install Tailscale.Tailscale), run `tailscale up` once, then try again.",
-};
+export function remoteSupportInstallHint(tool: RemoteSupportTool): string {
+  // Cross-OS install hint: pick the host's package manager. A Windows-only
+  // hint on Linux/macOS would be nonsense (and vice versa).
+  const win = process.platform === "win32";
+  const mac = process.platform === "darwin";
+  const installCommand = (pkg: string): string =>
+    win ? `winget install ${pkg}` : mac ? `brew install ${pkg}` : `sudo apt-get install -y ${pkg}`;
+  if (tool === "cloudflared") {
+    return `cloudflared is not installed. Install it yourself (${installCommand("cloudflared")}) and try again.`;
+  }
+  return `tailscale is not installed. Install it yourself (${installCommand("tailscale")}), run \`tailscale up\` once, then try again.`;
+}
 
 export function isRemoteSupportTool(value: unknown): value is RemoteSupportTool {
   return typeof value === "string" && (REMOTE_SUPPORT_TOOLS as readonly string[]).includes(value);

package/src/console/remote-support/service.ts

@@ -18,7 +18,7 @@ import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, write
 import { join } from "node:path";
 import { resolveUserConfigDir } from "../../config/package-paths";
 import {
-  REMOTE_SUPPORT_INSTALL_HINT,
+  remoteSupportInstallHint,
   REMOTE_SUPPORT_TOOLS,
   type RemoteSupportBlocker,
   type RemoteSupportStatus,
@@ -430,7 +430,7 @@ export function createRemoteSupportService(config: RemoteSupportServiceConfig):
           active: null,
           url: null,
           blocker: "not_installed",
-          message: REMOTE_SUPPORT_INSTALL_HINT[tool],
+          message: remoteSupportInstallHint(tool),
           port,
           installed: await detectInstalled(),
         };

package/src/console/routing/model/routes.ts

@@ -1,5 +1,5 @@
 // Model routing control-plane HTTP routes. The only module that touches Elysia.
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { errorResponse } from "../../shared/errors";
 import { literalUnion } from "../../shared/elysia-schema";
 import { modelComboStrategy, type ComboStrategy } from "../../../persistence/schema";
@@ -41,7 +41,7 @@ const updateComboBody = t.Object({
   members: t.Optional(t.Array(t.String(), { minItems: 1 })),
   strategy: t.Optional(comboStrategySchema),
 });
-export function createModelRoutingRoutes(config: ModelRoutingConfig): Elysia {
+export function createModelRoutingRoutes(config: ModelRoutingConfig): AnyElysia {
   const factory = createModelRoutingOperations(config);
   return new Elysia({ prefix: "/routing" })
     .get("/aliases", async ({ request, set }) => {
@@ -132,5 +132,5 @@ export function createModelRoutingRoutes(config: ModelRoutingConfig): Elysia {
       } catch (e) {
         return modelRoutingErrorResponse(e, set);
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/routing/pools/contracts.ts

@@ -188,7 +188,7 @@ export function validateTransportConfig(
     case "http":
     case "https":
       if (cfg.timeout !== undefined && typeof cfg.timeout !== "number")
-        throw new ConsoleDomainError("invalid_config", 400, "HTTP timeout must be a number");
+        throw new ConsoleDomainError("invalid_pool", 400, "HTTP timeout must be a number", { field: "timeout" });
       return;
     case "socks5":
       return;
@@ -196,9 +196,10 @@ export function validateTransportConfig(
       // Compile-time exhaustiveness: new TransportKind variants must add a case.
       kind satisfies never;
       throw new ConsoleDomainError(
-        "invalid_config",
+        "invalid_pool",
         400,
         `Unsupported transport kind: ${String(kind)}`,
+        { field: "kind" },
       );
   }
 }
@@ -494,10 +495,10 @@ export function validateEndpoint(
     try {
       u = new URL(candidate);
     } catch {
-      throw new ConsoleDomainError("invalid_endpoint", 400, "Endpoint must be host:port");
+      throw new ConsoleDomainError("invalid_pool", 400, "Endpoint must be host:port", { field: "endpoint" });
     }
     if (!u.hostname || !u.port)
-      throw new ConsoleDomainError("invalid_endpoint", 400, "Endpoint must be host:port");
+      throw new ConsoleDomainError("invalid_pool", 400, "Endpoint must be host:port", { field: "endpoint" });
     if (u.hostname === "localhost" || u.hostname.endsWith(".internal"))
       throw new ConsoleDomainError("ssrf_rejected", 400, "Private endpoint rejected");
     if (isIP(u.hostname) !== 0 && !isAddressAllowed(u.hostname, policy))
@@ -508,10 +509,10 @@ export function validateEndpoint(
   try {
     u = new URL(endpoint);
   } catch {
-    throw new ConsoleDomainError("invalid_endpoint", 400, "Endpoint must be a valid http(s) URL");
+    throw new ConsoleDomainError("invalid_pool", 400, "Endpoint must be a valid http(s) URL", { field: "endpoint" });
   }
   if (!["http:", "https:"].includes(u.protocol)) {
-    throw new ConsoleDomainError("invalid_endpoint", 400, "Endpoint must be a valid http(s) URL");
+    throw new ConsoleDomainError("invalid_pool", 400, "Endpoint must be a valid http(s) URL", { field: "endpoint" });
   }
   if (u.hostname === "localhost" || u.hostname.endsWith(".internal")) {
     throw new ConsoleDomainError("ssrf_rejected", 400, "Private endpoint rejected");
@@ -529,9 +530,10 @@ export function validatePoolLimits(maxInflight?: number, weight?: number): void
     (!Number.isInteger(maxInflight) || maxInflight < 1 || maxInflight > MAX_POOL_INFLIGHT)
   ) {
     throw new ConsoleDomainError(
-      "invalid_pool_limits",
+      "invalid_pool",
       400,
       "maxInflight must be an integer between 1 and 1000000",
+      { field: "maxInflight" },
     );
   }
   if (
@@ -539,9 +541,10 @@ export function validatePoolLimits(maxInflight?: number, weight?: number): void
     (!Number.isInteger(weight) || weight < 1 || weight > MAX_POOL_WEIGHT)
   ) {
     throw new ConsoleDomainError(
-      "invalid_pool_limits",
+      "invalid_pool",
       400,
       "weight must be an integer between 1 and 1000",
+      { field: "weight" },
     );
   }
 }

package/src/console/routing/pools/operations.ts

@@ -141,9 +141,10 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
         const rotateCount = request.rotateCount ?? current.rotateCount;
         if (!Number.isInteger(rotateCount) || rotateCount < 1 || rotateCount > 1000) {
           throw new ConsoleDomainError(
-            "invalid_pool_limits",
+            "invalid_pool",
             400,
             "rotateCount must be an integer between 1 and 1000",
+            { field: "rotateCount" },
           );
         }
         const saved = await config.store.setStrategy(a.tenantId, { strategy, rotateCount });
@@ -447,6 +448,12 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
       const a = requireTenantScope(access, "dashboard:write");
       const recovered = await config.store.recover(a.tenantId, poolId);
       if (!recovered) throw new ConsoleDomainError("pool_not_found", 404, `Pool ${poolId} not found`);
+      // Recover is the operator's "make this pool healthy again": besides
+      // resetting the pool-level state, drop every provider-rate-limit marker
+      // (volatile and durable) so a just-cleared pool is not still excluded
+      // by a stale 429 flag.
+      await config.poolSelector?.clearPoolCooldowns(poolId).catch(() => undefined);
+      await config.store.dropAllProviderCooldownMarkers?.(a.tenantId, poolId);
       await config.poolAgentReleaser?.releasePool(poolId, a.tenantId);
       await config.auditSink?.record({
         access: a,
@@ -482,7 +489,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
     ): Promise<PoolSpeedTestResult> {
       const a = requireTenantScope(access, "dashboard:read");
       if (!config.store.speedTest) {
-        throw new ConsoleDomainError("not_supported", 400, "Speed tests are unavailable");
+        throw new ConsoleDomainError("capability_unsupported", 400, "Speed tests are unavailable");
       }
       if (!Number.isInteger(bytes) || bytes < SPEED_TEST_MIN_BYTES || bytes > SPEED_TEST_MAX_BYTES) {
         throw new ConsoleDomainError(
@@ -507,7 +514,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
     ): Promise<PoolProviderProbeResult> {
       const a = requireTenantScope(access, "dashboard:read");
       if (!config.store.providerProbe) {
-        throw new ConsoleDomainError("not_supported", 400, "Provider probing is unavailable");
+        throw new ConsoleDomainError("capability_unsupported", 400, "Provider probing is unavailable");
       }
       const result = await config.store.providerProbe(a.tenantId, poolId, providerId);
       if (!config.poolSelector) return result;
@@ -596,7 +603,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
         );
       }
       if (!config.store.probeAdHocProvider) {
-        throw new ConsoleDomainError("not_supported", 400, "Provider probing is unavailable");
+        throw new ConsoleDomainError("capability_unsupported", 400, "Provider probing is unavailable");
       }
       const probe = config.store.probeAdHocProvider.bind(config.store);
       const results: PoolBatchProviderProbeResult[] = new Array(requests.length);
@@ -632,7 +639,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
       if (config.store.probeAdHoc) {
         return config.store.probeAdHoc(a.tenantId, request);
       }
-      throw new ConsoleDomainError("not_supported", 400, "Ad-hoc pool probing is unavailable");
+      throw new ConsoleDomainError("capability_unsupported", 400, "Ad-hoc pool probing is unavailable");
     },
     /**
      * Probes many unsaved pool definitions in one call.
@@ -656,7 +663,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
         );
       }
       if (!config.store.probeAdHoc) {
-        throw new ConsoleDomainError("not_supported", 400, "Ad-hoc pool probing is unavailable");
+        throw new ConsoleDomainError("capability_unsupported", 400, "Ad-hoc pool probing is unavailable");
       }
       const probe = config.store.probeAdHoc.bind(config.store);
       const results: PoolBatchProbeResult[] = new Array(requests.length);
@@ -700,7 +707,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
     ): Promise<NetworkPoolResponse & { relayUrl: string }> {
       const a = requireTenantScope(access, "dashboard:write");
       if (!config.relayFetch)
-        throw new ConsoleDomainError("not_supported", 503, "Relay deployment is unavailable");
+        throw new ConsoleDomainError("capability_unsupported", 503, "Relay deployment is unavailable");
       if (!isRelayTarget(request.target))
         throw new ConsoleDomainError("invalid_request", 422, `Unsupported relay target: ${String(request.target)}`);
       const result = await deployRelayWorker(config.relayFetch, request);

package/src/console/routing/pools/probe-verdict.ts

@@ -15,8 +15,16 @@
  * the address works (`allowed`, `throttled`) or says nothing about it
  * (`unreachable`), and treating "says nothing" as "refused" would drop a usable
  * pool for good.
+ *
+ * The 403-free-tier and 429 verdicts are the probe's reading of the same facts
+ * `classifyEgressFailure` (in `network/rate-limit-verdict`) reads on the
+ * dispatch path — for the probe they arrive as an HTTP status + body instead of
+ * a `GatewayError`, so the shared free-tier regex is borrowed from there to
+ * keep the two classifiers' boundaries honest.
  */
 
+import { FREE_TIER_REFUSAL } from "../../../network/rate-limit-verdict";
+
 export type ProbeVerdict = "allowed" | "blocked" | "throttled" | "unreachable";
 
 export interface ProbeAnswer {
@@ -25,9 +33,6 @@ export interface ProbeAnswer {
   readonly reason?: string;
 }
 
-/** The upstream's own wording for "this address is retired". */
-const FREE_TIER_REFUSAL = /freetier|free tier can only be used/i;
-
 /**
  * Classifies one upstream response.
  *