cartethyia 2.7.2 → 2.7.4

package/src/console/routing/pools/relay-deploy.ts

@@ -151,7 +151,7 @@ async function deployCloudflare(
   request: RelayDeployRequest,
 ): Promise<RelayDeployResult> {
   const accountId = request.accountId?.trim();
-  if (!accountId) throw new GatewayError("invalid_request", 400, "Cloudflare account id is required");
+  if (!accountId) throw new GatewayError("invalid_request", 400, "Cloudflare account id is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
   const projectName = request.projectName?.trim() || generateName("relay");
   const scriptUrl = `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(projectName)}`;
   const form = new FormData();
@@ -174,7 +174,7 @@ async function deployCloudflare(
     body: form,
   });
   if (!upload.ok)
-    throw new GatewayError("platform_unavailable", upload.status, `Cloudflare deploy failed: ${await readError(upload)}`);
+    throw new GatewayError("platform_unavailable", upload.status, `Cloudflare deploy failed (request {requestId}): ${await readError(upload)}. Flip the switch back on when ready 🔌`);
   // Enable the workers.dev route; a failure here is non-fatal because the
   // subdomain lookup below decides the final URL and reports its own error.
   await fetchImpl(`${scriptUrl}/subdomain`, {
@@ -190,7 +190,7 @@ async function deployCloudflare(
     throw new GatewayError(
       "platform_unavailable",
       subdomainRes.status,
-      `Worker uploaded but its workers.dev subdomain could not be read: ${await readError(subdomainRes)}`,
+      `Worker uploaded but its workers.dev subdomain could not be read (request {requestId}): ${await readError(subdomainRes)}. Flip the switch back on when ready 🔌`,
     );
   const subdomainData = (await subdomainRes.json().catch(() => ({}))) as {
     result?: { subdomain?: string };
@@ -200,7 +200,7 @@ async function deployCloudflare(
     throw new GatewayError(
       "platform_unavailable",
       502,
-      "Worker uploaded but no workers.dev subdomain is configured for this Cloudflare account.",
+      "Worker uploaded but no workers.dev subdomain is configured for this Cloudflare account (request {requestId}). Flip the switch back on when ready 🔌",
     );
   return { target: "cloudflare", projectName, relayUrl: `https://${projectName}.${subdomain}.workers.dev` };
 }
@@ -251,7 +251,7 @@ async function deployVercel(
     }),
   });
   if (!deployRes.ok)
-    throw new GatewayError("platform_unavailable", deployRes.status, `Vercel deploy failed: ${await readError(deployRes)}`);
+    throw new GatewayError("platform_unavailable", deployRes.status, `Vercel deploy failed (request {requestId}): ${await readError(deployRes)}. Flip the switch back on when ready 🔌`);
   // Pin the region again after the deploy created the project: the PATCH above
   // is a no-op on first deploy (the project does not exist yet), and a redeploy
   // is what Vercel requires for a region change to take effect anyway. The SSO
@@ -280,7 +280,7 @@ async function deployVercel(
   }).catch(() => undefined);
   const deployment = (await deployRes.json().catch(() => ({}))) as { url?: string };
   if (!deployment.url)
-    throw new GatewayError("platform_unavailable", 502, "Vercel deploy returned no URL");
+    throw new GatewayError("platform_unavailable", 502, "Vercel deploy returned no URL (request {requestId}). Flip the switch back on when ready 🔌");
   return {
     target: "vercel",
     projectName,
@@ -300,11 +300,11 @@ async function deployDeno(
     body: JSON.stringify({ project: projectName, entryPoint: "main.ts", files: { "main.ts": RELAY_DENO_SOURCE } }),
   });
   if (!deployRes.ok)
-    throw new GatewayError("platform_unavailable", deployRes.status, `Deno deploy failed: ${await readError(deployRes)}`);
+    throw new GatewayError("platform_unavailable", deployRes.status, `Deno deploy failed (request {requestId}): ${await readError(deployRes)}. Flip the switch back on when ready 🔌`);
   const deployment = (await deployRes.json().catch(() => ({}))) as { url?: string; domains?: string[] };
   const url = deployment.url ?? deployment.domains?.[0];
   if (!url)
-    throw new GatewayError("platform_unavailable", 502, "Deno deploy returned no URL");
+    throw new GatewayError("platform_unavailable", 502, "Deno deploy returned no URL (request {requestId}). Flip the switch back on when ready 🔌");
   return {
     target: "deno",
     projectName,
@@ -333,6 +333,6 @@ export async function deployRelay(
   request: RelayDeployRequest,
 ): Promise<RelayDeployResult> {
   if (!request.token.trim())
-    throw new GatewayError("invalid_request", 400, `${request.target} API token is required`);
+    throw new GatewayError("invalid_request", 400, `${request.target} API token is required (request {requestId}). Wrong key, right door — check the credential 🔑`);
   return DEPLOYERS[request.target](fetchImpl, request);
 }

package/src/console/routing/pools/routes.ts

@@ -1,5 +1,5 @@
 // Network-pool control-plane HTTP routes. The only module that touches Elysia.
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { consoleErrorHandler } from "../../shared/errors";
 import { literalUnion } from "../../shared/elysia-schema";
 import { RELAY_TARGETS, type RelayDeployRequest } from "./relay-deploy";
@@ -56,7 +56,7 @@ const importPoolsBody = t.Object({
   family: t.Optional(t.Union([t.String(), t.Null()])),
   labelPrefix: t.Optional(t.String()),
 });
-export function createNetworkPoolRoutes(config: NetworkPoolConfig): Elysia {
+export function createNetworkPoolRoutes(config: NetworkPoolConfig): AnyElysia {
   const factory = createNetworkPoolOperations(config);
   return new Elysia({ prefix: "/network/pools" })
     .error(consoleErrorHandler("Network pool operation failed"))
@@ -207,5 +207,5 @@ export function createNetworkPoolRoutes(config: NetworkPoolConfig): Elysia {
           body as Partial<PoolStrategySetting>,
         );
 },
-    ) as unknown as Elysia;
+    );
 }

package/src/console/routing/pools/store.ts

@@ -1,7 +1,9 @@
 // Drizzle-backed console persistence for network pools.
+import { randomUUID } from "node:crypto";
 import { and, asc, eq, inArray, sql } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
-import { networkPools, poolRoutingSettings } from "../../../persistence/schema";
+import { networkPools, poolRoutingSettings, providerPoolAccounts } from "../../../persistence/schema";
+import { providerRateLimitIsIpScoped } from "../../../providers/provider-metadata";
 import {
   DEFAULT_POOL_STRATEGY,
   type CreateNetworkPoolRequest,
@@ -444,6 +446,24 @@ export class DrizzleNetworkPoolStore implements NetworkPoolStore {
       ...(record.family !== undefined ? { family: record.family } : {}),
     }));
     await this.db.insert(networkPools).values(values);
+
+    // Materialize pool-as-account rows for ip-scoped, credential-less
+    // providers (OpenCode Free today): the operator sees the egress in the
+    // provider's Accounts card, and routing excludes a spent egress like a
+    // cooling account. Every other provider gets no row.
+    if (providerRateLimitIsIpScoped("opencode")) {
+      const now = new Date();
+      const poolAccounts = values.map((value) => ({
+        id: randomUUID(),
+        tenantId: value.tenantId,
+        networkPoolId: value.id,
+        providerId: "opencode",
+        label: `Pool ${value.id.slice(0, 8)}`,
+        createdAt: now,
+        updatedAt: now,
+      }));
+      await this.db.insert(providerPoolAccounts).values(poolAccounts);
+    }
     return values.length;
   }
 

package/src/console/settings/routes.ts

@@ -1,4 +1,4 @@
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import {
   createRuntimeSettingsOperations,
   runtimeUpdateBody,
@@ -7,7 +7,7 @@ import {
   type UpdateRuntimeSettingsRequest,
 } from "./contracts";
 
-export function createRuntimeSettingsRoutes(config: RuntimeSettingsConfig): Elysia {
+export function createRuntimeSettingsRoutes(config: RuntimeSettingsConfig): AnyElysia {
   const factory = createRuntimeSettingsOperations(config);
   return new Elysia({ prefix: "/settings/runtime" })
     .get("/", async ({ request, set }) => {
@@ -26,5 +26,5 @@ export function createRuntimeSettingsRoutes(config: RuntimeSettingsConfig): Elys
       } catch (e) {
         return runtimeSettingsErrorResponse(e, set);
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/share/share-router.ts

@@ -4,8 +4,8 @@ import { globalOrOwnedBy } from "../../persistence/tenant-scope";
 // Share URLs reveal policy and allow one child key to be created per canonical
 // client IP. The child bearer is returned only by the successful issue call.
 
-import { Elysia } from "elysia";
-import { and, eq } from "drizzle-orm";
+import { Elysia, type AnyElysia } from "elysia";
+import { and, eq, sql } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import { apiKeys, models, providers } from "../../persistence/schema";
 import { PublicModelCatalogStore } from "../providers/catalog/public-model-store";
@@ -34,12 +34,12 @@ const MIN_TOKEN_LENGTH = 20;
 /**
  * Cadence of the share stats SSE snapshot.
  *
- * Raised with `SHARE_STATS_CACHE_TTL_SECONDS` (10 s). At 2 s the tick was
- * shorter than the rollup's own cache TTL, so every push re-parsed the whole
- * retained telemetry window — the interval was the thing making this read
- * expensive, not the number of viewers. Short enough to still read as live.
+ * Roughly one tenth of the cache TTL (`SHARE_STATS_CACHE_TTL_SECONDS`, 300
+ * s), so nearly every tick is served from the cache and the cold-compute
+ * path runs at most once per five minutes per family. Short enough to still
+ * read as live.
  */
-const SHARE_STATS_STREAM_INTERVAL_MS = 10_000;
+const SHARE_STATS_STREAM_INTERVAL_MS = 30_000;
 
 /**
  * Context and capabilities for one allowed model, sourced from the public
@@ -89,12 +89,12 @@ function json(body: unknown, status = 200): Response {
 function notFound(refusal: ShareLinkRefusal = "not_found"): Response {
   const message =
     refusal === "expired"
-      ? "This share link has expired"
+      ? "This share link has expired (request {requestId}). Time for a fresh one 🌷"
       : refusal === "revoked"
-        ? "This share link's key has been revoked"
+        ? "This share link's key has been revoked (request {requestId}). Ask for a new one 📩"
         : refusal === "disabled"
-          ? "This share link's key is paused"
-          : "Share link is unavailable";
+          ? "This share link's key is paused (request {requestId}). Re-enable it when ready 🌱"
+          : "Share link is unavailable (request {requestId}). This link leads nowhere — check it again 🔗";
   const error = new GatewayError(`link_${refusal}`, 404, message);
   return json(publicGatewayErrorBody(error), error.status);
 }
@@ -227,12 +227,20 @@ async function resolveFamilyStats(
   if (resolved === null) return null;
   const templateId = resolved.key.id;
   const tenantId = resolved.key.tenantId;
-  const children = await db
-    .select({ id: apiKeys.id, revokedAt: apiKeys.revokedAt })
+  // Recipient counts come back as one aggregate row: a family minted by the
+  // tenant can carry tens of thousands of children, and materializing their
+  // ids only to count them made every share-page view pay for the family's
+  // size. The fingerprint/quote keys the rollup needs are addressed by the
+  // template id (`familyApiKeyId`), which scopes in SQL without any id list.
+  const [counts] = await db
+    .select({
+      total: sql<number>`count(*)`,
+      active: sql<number>`sum(case when ${apiKeys.revokedAt} is null then 1 else 0 end)`,
+    })
     .from(apiKeys)
     .where(eq(apiKeys.parentKeyId, templateId));
-  const active = children.filter((child) => child.revokedAt === null).length;
-  const keyIds = [templateId, ...children.map((child) => child.id)];
+  const total = Number(counts?.total ?? 0);
+  const active = Number(counts?.active ?? 0);
   // Rank only the models this link grants. A refused request still writes a
   // telemetry row carrying the name the client asked for, so an unfiltered
   // top-models table would list the very names the grant excludes. An
@@ -244,11 +252,16 @@ async function resolveFamilyStats(
     configured !== null && configured.length > 0
       ? await modelsForShare(db, resolved.key)
       : undefined;
-  return stats.getFamilyStats(tenantId, keyIds, { total: children.length, active }, allowedModels);
+  return stats.getFamilyStats(
+    tenantId,
+    { templateKeyId: templateId, memberCount: total + 1 },
+    { total, active },
+    allowedModels,
+  );
 }
 
 /** Creates the public enrollment page and one-time shared-key issuance route. */
-export function createShareRouter(options: ShareRouterOptions): Elysia {
+export function createShareRouter(options: ShareRouterOptions): AnyElysia {
   const { db, shareStore } = options;
 
   return new Elysia()
@@ -379,6 +392,26 @@ export function createShareRouter(options: ShareRouterOptions): Elysia {
         nameHint,
       });
       if (issued.kind === "link_unavailable") return notFound();
+      if (issued.kind === "slot_full") {
+        return json({
+          error: {
+            code: "template_slot_full",
+            message: "This template has reached its maximum number of recipients.",
+          },
+        }, 429);
+      }
+      if (issued.kind === "already_issued") {
+        // The recipient's IP already enrolled from this link. The original
+        // bearer secret is not stored server-side, so it cannot be returned;
+        // refuse the duplicate mint instead. The share page surfaces this as
+        // a clear message rather than minting an unbounded key set.
+        return json({
+          error: {
+            code: "already_issued",
+            message: "This address already has a key from this share link.",
+          },
+        }, 409);
+      }
       set.status = 201;
       return json({
         key: generated.secret,
@@ -453,5 +486,5 @@ export function createShareRouter(options: ShareRouterOptions): Elysia {
           };
         }),
       );
-    }) as unknown as Elysia;
+    })
 }

package/src/console/share/share-stats.ts

@@ -11,10 +11,19 @@
 // masked addresses. No request or response bodies cross this boundary.
 
 import { createHash } from "node:crypto";
+import { eq } from "drizzle-orm";
 import { maskClientIp } from "../../observability/redaction";
 import { type TelemetryEventRecord } from "../../observability/event-log";
-import { queryTelemetryEvents as querySqlEvents } from "../../observability/event-query";
+import {
+  queryTelemetryEvents as querySqlEvents,
+  sumTelemetryTokens,
+  familyKpiTotals,
+  familyWindowRequests,
+  familyHourlyTelemetry,
+  familyIpBreakdown,
+} from "../../observability/event-query";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { apiKeys } from "../../persistence/schema";
 import { isGatewayError } from "../../observability/telemetry-status";
 import type { RedisClient } from "../../persistence/redis";
 import { cachedRead } from "../shared/read-through-cache";
@@ -67,6 +76,12 @@ export interface ShareTopClientIp {
    * the tool rather than the machine.
    */
   readonly clientType: string | null;
+  /**
+   * True when this address made a request within {@link ACTIVE_IP_WINDOW_MS}.
+   * A recipient watching the link can tell which addresses are still using it
+   * versus ones that stopped days ago.
+   */
+  readonly active: boolean;
 }
 
 export interface ShareFamilyStats {
@@ -81,6 +96,14 @@ export interface ShareFamilyStats {
 /** Read-only family rollup for one share link. */
 export interface ShareStatsPort {
   /**
+   * The family is addressed by its template key (`templateKeyId`) plus the
+   * number of keys it covers at call time (`memberCount`), not by an id list:
+   * a family grows with every key the link mints, and enumerating its ids to
+   * build a query — or a cache key — scaled both with the family instead of
+   * with the request. `memberCount` keeps the cache key sensitive to minting:
+   * a newly issued child starts a fresh entry rather than being folded into
+   * the previous one for a full TTL.
+   *
    * `allowedModels`, when supplied, restricts the top-models table to the names
    * the link actually grants. A rejected request still writes a telemetry row
    * (with the requested name), so without this the table would rank models the
@@ -90,7 +113,7 @@ export interface ShareStatsPort {
    */
   getFamilyStats(
     tenantId: string,
-    keyIds: readonly string[],
+    family: { readonly templateKeyId: string; readonly memberCount: number },
     recipients: { readonly total: number; readonly active: number },
     allowedModels?: readonly string[],
   ): Promise<ShareFamilyStats>;
@@ -98,6 +121,24 @@ export interface ShareStatsPort {
 
 const HOUR_MS = 3_600_000;
 
+/**
+ * How old an address's last request may be and still count as active on the
+ * share page. 24 hours matches the page's own "last 24 hours" framing: an IP
+ * that made a request since yesterday is "active", one that stopped before
+ * that window is "inactive".
+ */
+const ACTIVE_IP_WINDOW_MS = 24 * HOUR_MS;
+
+/**
+ * Recency window for the client-IP ranking's *work set*: the GROUP BY only
+ * scans this slice of telemetry instead of the whole retained window every
+ * tick. Within the window, addresses are ranked by request volume (highest
+ * first), and older addresses fall out of the ranking entirely. 7 days keeps
+ * the ranking useful while staying orders of magnitude smaller than the
+ * retained window.
+ */
+const IP_WINDOW_MS = 7 * 24 * HOUR_MS;
+
 /**
  * Names the client behind a request from its User-Agent.
  *
@@ -141,7 +182,7 @@ interface FamilyRollup {
   totals: ShareFamilyTotals;
   byHour: Map<string, { requests: number; tokens: number }>;
   models: Map<string, { modelId: string; requests: number; tokens: number; rateSum: number; rateCount: number; ttfbSum: number; ttfbCount: number }>;
-  ips: Map<string, { ip: string; requests: number; tokens: number; lastSeenAt: string | null; userAgent: string | null }>;
+  ips: Map<string, { ip: string; requests: number; tokens: number; lastSeenAt: string | null; userAgent: string | null; active: boolean }>;
 }
 
 /**
@@ -150,7 +191,7 @@ interface FamilyRollup {
  */
 function rollupFamily(
   events: readonly TelemetryEventRecord[],
-  bounds: { dayStart: number; monthStart: number; lastHourStart: number; windowStart: number; allowed: ReadonlySet<string> | null },
+  bounds: { dayStart: number; monthStart: number; lastHourStart: number; windowStart: number; activeIpCutoff: number; allowed: ReadonlySet<string> | null },
 ): FamilyRollup {
   const totals = { requests: 0, errors: 0, inputTokens: 0, outputTokens: 0, totalTokens: 0, lastHourRequests: 0, todayTokens: 0, monthTokens: 0 };
   const byHour = new Map<string, { requests: number; tokens: number }>();
@@ -183,13 +224,14 @@ function rollupFamily(
       models.set(event.requestedModel, model);
     }
     if (event.clientIp !== null) {
-      const ip = ips.get(event.clientIp) ?? { ip: event.clientIp, requests: 0, tokens: 0, lastSeenAt: null, userAgent: null };
+      const ip = ips.get(event.clientIp) ?? { ip: event.clientIp, requests: 0, tokens: 0, lastSeenAt: null, userAgent: null, active: false };
       ip.requests += 1;
       ip.tokens += tokens;
       // Events arrive newest first, so the first one seen is the most recent.
       if (ip.lastSeenAt === null) {
         ip.lastSeenAt = event.createdAt;
         ip.userAgent = event.userAgent;
+        ip.active = at >= bounds.activeIpCutoff;
       }
       ips.set(event.clientIp, ip);
     }
@@ -231,32 +273,35 @@ const HOURS_WINDOW = 24;
 /**
  * Cache lifetime for one family's rollup.
  *
- * Matched to the share page's SSE tick, which was the point of the old 2 s
- * value — but at 2 s the cache expired on every tick, so every single push was
- * a full parse of the retained telemetry window. A share page's numbers move
- * when a request does, not every 2 s; 10 s still reads as live, and cuts the
- * parse rate by five.
+ * Longer than the SSE tick (30s) so most ticks are served from cache. The
+ * cold-compute path reads the family's telemetry windows (24h chart, 7d IP
+ * ranking), which on a busy family is the single most expensive thing the
+ * share page does; a 5-minute TTL caps that to once per family per 5
+ * minutes while the page still reads as live — KPI numbers move with
+ * traffic, not on a per-minute cadence.
  *
  * Declared here rather than imported from the router so this port does not
- * depend on it. `SHARE_STATS_STREAM_INTERVAL_MS` must be raised with it, or
- * the two drift apart and the cache expires between ticks for no reason.
+ * depend on it. `SHARE_STATS_STREAM_INTERVAL_MS` must stay below it, or the
+ * tick and cache drift apart and every tick bypasses the cache.
  */
-export const SHARE_STATS_CACHE_TTL_SECONDS = 10;
+export const SHARE_STATS_CACHE_TTL_SECONDS = 300;
 
 /**
- * Cache key for one family's rollup. Both inputs change the payload — `keyIds`
- * selects the family and `allowedModels` filters the model table — so both are
- * hashed in; the key ids are sorted so key order cannot split one family across
- * two entries.
+ * Cache key for one family's rollup. The family is named by its template key
+ * and the number of keys it covers — both change the payload — and
+ * `allowedModels` filters the model table, so all three are hashed in.
+ * (The key used to hash the sorted list of every family id; on a family with
+ * tens of thousands of minted children that built and sorted a multi-megabyte
+ * string on every page view, before the cache could even answer.)
  */
 function shareFamilyStatsKey(
   tenantId: string,
-  keyIds: readonly string[],
+  family: { readonly templateKeyId: string; readonly memberCount: number },
   allowedModels: readonly string[] | undefined,
 ): string {
   const models = allowedModels === undefined ? "*" : [...allowedModels].sort().join(",");
   const hash = createHash("sha256")
-    .update([...keyIds].sort().join(",") + "|" + models)
+    .update(`${family.templateKeyId}#${family.memberCount}|${models}`)
     .digest("hex");
   return `share:v1:stats:${tenantId}:${hash}`;
 }
@@ -271,12 +316,12 @@ interface ShareStatsPortDeps {
 
 export function createShareStatsPort(deps: ShareStatsPortDeps): ShareStatsPort {
   return {
-    async getFamilyStats(tenantId, keyIds, recipients, allowedModels) {
-      if (keyIds.length === 0) return emptyStats(recipients);
+    async getFamilyStats(tenantId, family, recipients, allowedModels) {
+      if (family.templateKeyId.length === 0) return emptyStats(recipients);
       const cached = await cachedRead<Omit<ShareFamilyStats, "recipients">>(
         deps.redis,
-        shareFamilyStatsKey(tenantId, keyIds, allowedModels),
-        () => computeFamilyStatsBody(deps.db, tenantId, keyIds, allowedModels),
+        shareFamilyStatsKey(tenantId, family, allowedModels),
+        () => computeFamilyStatsBody(deps.db, tenantId, family.templateKeyId, allowedModels),
         SHARE_STATS_CACHE_TTL_SECONDS,
       );
       return { ...cached, recipients };
@@ -288,7 +333,7 @@ export function createShareStatsPort(deps: ShareStatsPortDeps): ShareStatsPort {
 async function computeFamilyStatsBody(
   db: CartethyiaDatabase,
   tenantId: string,
-  keyIds: readonly string[],
+  templateKeyId: string,
   allowedModels: readonly string[] | undefined,
 ): Promise<Omit<ShareFamilyStats, "recipients">> {
   // A share that grants a fixed set ranks only that set. Telemetry keeps the
@@ -303,21 +348,43 @@ async function computeFamilyStatsBody(
   const hourStart = utcHourStart(now);
   const lastHourStart = new Date(now.getTime() - HOUR_MS);
   const windowStart = new Date(hourStart.getTime() - (HOURS_WINDOW - 1) * HOUR_MS);
+  // The IP breakdown is bounded to this recency window: a family's "who is
+  // using the link" answer only needs addresses that were active recently,
+  // and an unbounded GROUP BY over every retained event is the one remaining
+  // full-window scan on the share page.
+  const ipWindowStart = new Date(now.getTime() - IP_WINDOW_MS);
 
-  // Rank only names the grant actually authorizes. Telemetry keeps the
-  // requested name even when the request was refused, so an unfiltered table
-  // would list exactly the invalid names an abuser probed. Filtering before
-  // the top-50 cut means refused names cannot hide a model the recipient may
-  // use.
-  //
-  // Bounded by the retention floor, not by the oldest counter: `totalTokens`
-  // is all-time, so cutting at `monthStart` would silently drop the rows that
-  // make it differ from `monthTokens`. Retention already caps the window, and
-  // the rows are read newest-first under a page cap, so a very large family
-  // cannot pull the whole table.
+  // All-time family KPI comes from the durable rollup
+  // (`telemetry_usage_totals`, charged at write time), not from re-aggregating
+  // the entire retained telemetry window on every tick: the share page's tick
+  // would otherwise read every event a busy family ever produced just to draw
+  // four numbers. Today's/month's spend and the last-hour count are bounded
+  // window reads over the time index, which stay small.
+  const [kpi, todayTokens, monthTokens, lastHourRequests, template] = await Promise.all([
+    familyKpiTotals(db, tenantId, templateKeyId),
+    sumTelemetryTokens(db, tenantId, { familyKeyId: templateKeyId, since: dayStart }),
+    sumTelemetryTokens(db, tenantId, { familyKeyId: templateKeyId, since: monthStart }),
+    familyWindowRequests(db, tenantId, templateKeyId, lastHourStart),
+    db
+      .select({ lifetime: apiKeys.lifetimeTokensConsumed })
+      .from(apiKeys)
+      .where(eq(apiKeys.id, templateKeyId))
+      .limit(1),
+  ]);
+  // Cumulative family spend: the template's own counter plus the telemetry
+  // total. The counter is a manually-configured seed (an operator limit), not
+  // traffic, and it is never reset; azmetry rows for revoked/deleted children
+  // likewise stay counted, so the running total is monotonic and consistent
+  // across the overview, the share dialog, and this page.
+  const templateLifetime = Number(template[0]?.lifetime ?? 0);
+
+  // The ranked tables need real events, bounded to the 24-hour window. The
+  // totals and hourly chart are computed in SQL, so the page cap here only
+  // shapes the model/IP rankings — never the KPI numbers.
   const page = await querySqlEvents(db, {
     tenantId,
-    apiKeyIds: [...keyIds],
+    familyApiKeyId: templateKeyId,
+    since: windowStart,
     limit: MAX_FAMILY_EVENTS,
   });
   const events = page.events;
@@ -326,12 +393,36 @@ async function computeFamilyStatsBody(
     monthStart: monthStart.getTime(),
     lastHourStart: lastHourStart.getTime(),
     windowStart: windowStart.getTime(),
+    activeIpCutoff: now.getTime() - ACTIVE_IP_WINDOW_MS,
     allowed: allowedSet,
   });
+  rollup.totals = {
+    ...rollup.totals,
+    // The template counter is the seed on the running total, not a distinct
+    // bucket: daily/monthly windows are telemetry-only (the counter has no
+    // time axis), so those keep their own sums.
+    totalTokens: templateLifetime + kpi.tokens,
+    todayTokens,
+    monthTokens,
+    // Lifetime counts come from the durable rollup, not the page: a family
+    // busier than the page cap must not freeze at 500 requests/errors.
+    requests: kpi.requests,
+    errors: kpi.errors,
+    lastHourRequests,
+  };
 
-  // Fill the 24 buckets in JS: only hours that saw traffic are present, and
-  // a chart drawn from sparse rows would silently compress the axis.
-  const byHour = rollup.byHour;
+  // The hourly chart is a SQL aggregate over the whole family window, so a
+  // busy family's bars stay true. Buckets are filled in JS because only hours
+  // that saw traffic are present; a chart drawn from sparse rows would
+  // silently compress the axis.
+  const bucketSeconds = HOUR_MS / 1000;
+  const sqlHourly = await familyHourlyTelemetry(db, tenantId, templateKeyId, windowStart, bucketSeconds);
+  const byHour = new Map(
+    sqlHourly.map((bucket) => [
+      new Date(bucket.at).toISOString(),
+      { requests: bucket.requests, tokens: bucket.inputTokens + bucket.outputTokens },
+    ]),
+  );
   const hourly: ShareHourlyBucket[] = [];
   for (let index = 0; index < HOURS_WINDOW; index += 1) {
     const hour = new Date(windowStart.getTime() + index * HOUR_MS).toISOString();
@@ -339,6 +430,33 @@ async function computeFamilyStatsBody(
     hourly.push({ hour, requests: bucket?.requests ?? 0, tokens: bucket?.tokens ?? 0 });
   }
 
+  // Client IPs come from a SQL aggregate over a bounded recent window, ranked
+  // by request volume — so a family's "who is using the link most" answer
+  // stays cheap instead of scanning the whole retained telemetry on every
+  // tick. `clientType` is best-effort from the page's events (the most recent
+  // 24 hours), which carry the User-Agent.
+  const ipRows = await familyIpBreakdown(db, tenantId, templateKeyId, TOP_IPS_LIMIT, ipWindowStart);
+  const clientTypeByIp = new Map<string, string | null>();
+  for (const event of events) {
+    if (event.clientIp !== null && !clientTypeByIp.has(event.clientIp)) {
+      clientTypeByIp.set(event.clientIp, clientTypeFromUserAgent(event.userAgent));
+    }
+  }
+  const activeIpCutoff = now.getTime() - ACTIVE_IP_WINDOW_MS;
+  const clientIps = ipRows.map((row) => {
+    const lastSeenAt =
+      row.lastSeenAt instanceof Date ? row.lastSeenAt : new Date(String(row.lastSeenAt ?? ""));
+    const lastSeenMs = Number.isFinite(lastSeenAt.getTime()) ? lastSeenAt.getTime() : 0;
+    return {
+      ip: maskClientIp(row.ip),
+      requests: row.requests,
+      tokens: row.tokens,
+      lastSeenAt: lastSeenMs > 0 ? lastSeenAt.toISOString() : null,
+      clientType: clientTypeByIp.get(row.ip) ?? null,
+      active: lastSeenMs >= activeIpCutoff,
+    };
+  });
+
   return {
     totals: rollup.totals,
     hourly,
@@ -352,15 +470,6 @@ async function computeFamilyStatsBody(
         avgTokensPerSec: row.rateCount > 0 ? row.rateSum / row.rateCount : null,
         avgTtfbMs: row.ttfbCount > 0 ? Math.round(row.ttfbSum / row.ttfbCount) : null,
       })),
-    clientIps: [...rollup.ips.values()]
-      .sort((a, b) => b.requests - a.requests)
-      .slice(0, TOP_IPS_LIMIT)
-      .map((row) => ({
-        ip: maskClientIp(row.ip),
-        requests: row.requests,
-        tokens: row.tokens,
-        lastSeenAt: row.lastSeenAt,
-        clientType: clientTypeFromUserAgent(row.userAgent),
-      })),
+    clientIps,
   };
 }