cartethyia 2.7.3 → 2.7.4

package/src/console/api-keys/routes.ts

@@ -2,7 +2,7 @@
 //
 // Owns validation, CRUD operations, and route wiring through the ApiKeyStore.
 
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { randomBytes, randomUUID } from "node:crypto";
 import { decryptCredentialToString, encryptCredential } from "../../security/crypto";
 import { invalidateApiKeyCache } from "../../security/api-key-auth";
@@ -12,7 +12,7 @@ import type { AccessDecision } from "../../security/access-control";
 import { ConsoleDomainError, errorResponse, requireTenantScope } from "../shared/errors";
 import { literalUnion } from "../shared/elysia-schema";
 import { API_KEY_MODES, API_KEY_MODEL_ACCESS_MODES, type ShareLinkKind } from "../../persistence/schema";
-import type { ApiKeyConfig, ApiKeyResponse, UpdateApiKeyResponse } from "./contracts";
+import type { ApiKeyConfig, ApiKeyResponse, BanApiKeyRequest, UpdateApiKeyResponse } from "./contracts";
 import type {
   ApiKeyPatch,
   ApiKeyRecord,
@@ -20,6 +20,8 @@ import type {
   SharedChildrenPageOptions,
 } from "../../persistence/stores/api-key-store";
 import {
+  BAN_DURATION_CHOICES,
+  DEFAULT_BAN_MINUTES,
   generateApiKeySecret,
   isDefaultGatewayApiKey,
   parseSharePopupImage,
@@ -775,6 +777,69 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
       });
       return { success: true };
     },
+    async banKey(
+      access: AccessDecision | undefined,
+      keyId: string,
+      request: BanApiKeyRequest,
+    ): Promise<ApiKeyResponse> {
+      const authorized = requireTenantScope(access, "dashboard:write");
+      const reason = request.reason.trim();
+      if (reason.length === 0)
+        throw new ConsoleDomainError("invalid_request", 400, "reason is required");
+      // Parse the duration choice. `null` is permanent; absent defaults to one
+      // hour. Anything not on the offered list is rejected rather than clamped —
+      // clamping would answer a request for 90 days with a week and report
+      // success.
+      const chosenMinutes = request.minutes === undefined ? DEFAULT_BAN_MINUTES : request.minutes;
+      const allowed = new Set(BAN_DURATION_CHOICES.map((choice) => choice.minutes));
+      if (!allowed.has(chosenMinutes)) {
+        throw new ConsoleDomainError(
+          "invalid_request",
+          400,
+          "Unsupported ban duration. Choose one of the offered durations.",
+        );
+      }
+      const bannedUntil = chosenMinutes === null ? null : new Date(Date.now() + chosenMinutes * 60_000);
+      const current = await config.store.get(authorized.tenantId, keyId);
+      if (!current || current.revokedAt !== undefined)
+        throw new ConsoleDomainError("key_not_found", 404, "Key not found");
+      const banned = await config.store.ban(authorized.tenantId, keyId, reason, bannedUntil);
+      if (!banned) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
+      // A banned child key does not affect its share template or sibling keys:
+      // `store.ban` only turns off the one row named by `keyId`, and the auth
+      // path rejects per key hash. The template keeps issuing working children.
+      // A banned key must leave the auth cache for every process at once.
+      invalidateApiKeyCache();
+      await config.auditSink?.record({
+        access: authorized,
+        action: "api_key.banned",
+        target: keyId,
+        detail: { reason, ...(bannedUntil === null ? { permanent: true } : { bannedUntil: bannedUntil.toISOString() }) },
+      });
+      const record = await config.store.get(authorized.tenantId, keyId);
+      if (!record) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
+      return sanitizeApiKeyResponse(record);
+    },
+    async unbanKey(
+      access: AccessDecision | undefined,
+      keyId: string,
+    ): Promise<ApiKeyResponse> {
+      const authorized = requireTenantScope(access, "dashboard:write");
+      const current = await config.store.get(authorized.tenantId, keyId);
+      if (!current || current.revokedAt !== undefined)
+        throw new ConsoleDomainError("key_not_found", 404, "Key not found");
+      const unbanned = await config.store.unban(authorized.tenantId, keyId);
+      if (!unbanned) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
+      invalidateApiKeyCache();
+      await config.auditSink?.record({
+        access: authorized,
+        action: "api_key.unbanned",
+        target: keyId,
+      });
+      const record = await config.store.get(authorized.tenantId, keyId);
+      if (!record) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
+      return sanitizeApiKeyResponse(record);
+    },
   };
   return operations;
 }
@@ -830,7 +895,7 @@ function jsonNull(): Response {
   });
 }
 /** Creates tenant-bound API-key routes with request-local authorization. */
-export function createApiKeyRoutes(config: ApiKeyConfig): Elysia {
+export function createApiKeyRoutes(config: ApiKeyConfig): AnyElysia {
   const factory = createApiKeyOperations(config);
   return new Elysia({ prefix: "/api-keys" })
     .get("/", async ({ request, set }) => {
@@ -950,6 +1015,30 @@ export function createApiKeyRoutes(config: ApiKeyConfig): Elysia {
         return errorResponse(error, set, "API-key operation failed");
       }
     })
+    .post(
+      "/:keyId/ban",
+      {
+        body: t.Object({
+          reason: t.String(),
+          reasonLabel: t.Optional(t.String()),
+          minutes: t.Optional(t.Union([t.Number({ minimum: 1 }), t.Null()])),
+        }),
+      },
+      async ({ request, params, body, set }) => {
+        try {
+          return await factory.banKey(config.accessResolver(request), params.keyId, body);
+        } catch (error) {
+          return errorResponse(error, set, "API-key operation failed");
+        }
+      },
+    )
+    .post("/:keyId/unban", async ({ request, params, set }) => {
+      try {
+        return await factory.unbanKey(config.accessResolver(request), params.keyId);
+      } catch (error) {
+        return errorResponse(error, set, "API-key operation failed");
+      }
+    })
     .get("/:keyId/share", async ({ request, params, set }) => {
       try {
         const share = await factory.getShare(config.accessResolver(request), params.keyId, {
@@ -988,5 +1077,5 @@ export function createApiKeyRoutes(config: ApiKeyConfig): Elysia {
       } catch (error) {
         return errorResponse(error, set, "API-key operation failed");
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/audit/routes.ts

@@ -1,4 +1,4 @@
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { errorResponse, requireGlobalAdmin, requireTenantScope } from "../shared/errors";
 import { parseQueryLimit } from "../shared/query";
 import type { AuditRoutesConfig } from "./contracts";
@@ -10,7 +10,7 @@ const listQuery = t.Object({
   actor: t.Optional(t.String()),
 });
 
-export function createAuditRoutes(config: AuditRoutesConfig): Elysia {
+export function createAuditRoutes(config: AuditRoutesConfig): AnyElysia {
   return new Elysia().get("/audit", { query: listQuery }, async ({ request, query, set }) => {
     try {
       const resolved = config.accessResolver(request);
@@ -28,5 +28,5 @@ export function createAuditRoutes(config: AuditRoutesConfig): Elysia {
     } catch (e) {
       return errorResponse(e, set, "Audit read failed");
     }
-  }) as unknown as Elysia;
+  });
 }

package/src/console/auth/account-reset.ts

@@ -42,12 +42,12 @@ export function createConsoleAccountResetHandler(
   return async ({ request, body }) => {
     if (!isLoopbackPeer(deps.resolvePeerAddress(request)))
       throw new GatewayError(
-        "invalid_request",
+        "policy_rejected",
         403,
-        "console account reset is only available from loopback",
+        "console account reset is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂",
       );
     if (!tokenMatches(request.headers.get("x-drain-token"), deps.token))
-      throw new GatewayError("invalid_request", 401, "invalid reset token");
+      throw new GatewayError("authentication_failed", 401, "invalid reset token (request {requestId}). Wrong key, right door — check the token 🔑");
     const confirm =
       body !== null && typeof body === "object" && "confirm" in body
         ? body.confirm
@@ -56,7 +56,7 @@ export function createConsoleAccountResetHandler(
       throw new GatewayError(
         "invalid_request",
         400,
-        `send {"confirm":"${CONFIRMATION}"} to confirm; this deletes every console account`,
+        `send {"confirm":"${CONFIRMATION}"} to confirm (request {requestId}); this deletes every console account. Make sure you mean it — there's no undo 🫂`,
       );
 
     const removed = await deps.resetConsoleAccount();

package/src/console/auth/session.ts

@@ -1,5 +1,5 @@
 import { asCookie, clearCsrfCookie, newCsrfToken, setCsrfCookie } from "../../security/csrf";
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { eq } from "drizzle-orm";
 import { isRecord } from "../../protocol/codecs";
 import { userRecord, returningRows, assertMutationApplied } from "./row-coercion";
@@ -217,7 +217,7 @@ export function createConsoleAuthRoutes(
   cookiePolicy: SessionCookiePolicy = defaultSessionCookiePolicy,
   trustedProxyBoundary: TrustedProxyBoundary = { mode: "disabled" },
   resolvePeerAddress: (request: Request) => string | undefined = () => undefined,
-): Elysia {
+): AnyElysia {
   const app = new Elysia({ prefix: "/auth" });
   const policy = cookiePolicy;
   const database = db;
@@ -532,5 +532,5 @@ export function createConsoleAuthRoutes(
     },
   );
 
-  return app as unknown as Elysia;
+  return app;
 }

package/src/console/backup/contracts.ts

@@ -33,6 +33,7 @@ import {
   poolRoutingSettings,
   providerAccounts,
   providerOauthStates,
+  providerPoolAccounts,
   providerRoutingSettings,
   providers,
   shareLinks,
@@ -96,6 +97,7 @@ export const CONFIG_TABLES = [
   models,
   providerRoutingSettings,
   providerAccounts,
+  providerPoolAccounts,
   poolRoutingSettings,
   networkPools,
   providers,

package/src/console/backup/export-endpoint.ts

@@ -52,20 +52,20 @@ export function createBackupExportHandler(
     // came from, the second is the credential it carried — and `invalid_request`
     // told an operator to fix a body that was never the problem.
     if (!isLoopbackPeer(deps.resolvePeerAddress(request)))
-      throw new GatewayError("policy_rejected", 403, "backup export is only available from loopback");
+      throw new GatewayError("policy_rejected", 403, "backup export is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂");
     if (!tokenMatches(request.headers.get("x-drain-token"), deps.token))
-      throw new GatewayError("authentication_failed", 401, "invalid export token");
+      throw new GatewayError("authentication_failed", 401, "invalid export token (request {requestId}). Wrong key, right door — check the token 🔑");
 
     const directory =
       body !== null && typeof body === "object" && "directory" in body
         ? body.directory
         : undefined;
     if (directory !== undefined && typeof directory !== "string")
-      throw new GatewayError("invalid_request", 400, "directory must be a string");
+      throw new GatewayError("invalid_request", 400, "directory must be a string (request {requestId}). Check the shape of what you sent — then resend 🪞");
 
     const tenantId = await deps.resolveTenantId();
     if (tenantId === null)
-      throw new GatewayError("invalid_request", 409, "no tenant exists; run setup first");
+      throw new GatewayError("invalid_request", 409, "no tenant exists; run setup first (request {requestId}). Nothing here but dust — run setup first 🌙");
 
     // One gzip pass over the streamed document: a tenant with hundreds of
     // thousands of rows is read page by page and only the compressed bytes
@@ -83,9 +83,9 @@ export function createBackupExportHandler(
       writeFileSync(path, gzipped);
     } catch (error) {
       throw new GatewayError(
-        "invalid_request",
+        "internal_error",
         500,
-        `could not write ${path}: ${error instanceof Error ? error.message : "unknown error"}`,
+        `could not write ${path}: ${error instanceof Error ? error.message : "unknown error"} (request {requestId}). Even we have bad days — retry, and quote the request id if it persists 🐻`,
       );
     }
 

package/src/console/backup/routes.ts

@@ -14,7 +14,7 @@
  * The body bound is enforced here, before the JSON parse, because the whole
  * point of the limit is to not buffer an unbounded file.
  */
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import type { ConsoleAccessResolver } from "../auth/access";
 import { invalidateApiKeyCache } from "../../security/api-key-auth";
 import { invalidatePublicModels } from "../providers/catalog/public-model-store";
@@ -139,7 +139,7 @@ function payloadDocument(chunks: AsyncGenerator<string, void, void>): ReadableSt
   });
 }
 
-export function createBackupRoutes(config: BackupRoutesConfig): Elysia {
+export function createBackupRoutes(config: BackupRoutesConfig): AnyElysia {
   return new Elysia({ prefix: "/backup" })
     .get("/export", { query: exportQuery }, async ({ request, query, set }) => {
       try {
@@ -304,5 +304,5 @@ export function createBackupRoutes(config: BackupRoutesConfig): Elysia {
       } catch (error) {
         return errorResponse(error, set, "Backup inspection failed");
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/cli-tools/routes.ts

@@ -1,6 +1,6 @@
 import type { ConsoleAccessResolver } from "../auth/access";
 import type { AuditSink } from "../audit/contracts";
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { errorResponse, requireTenantScope } from "../shared/errors";
 import type { CliToolService } from "./service";
 import type { ApplyInput, CliMappingInput, CliModelMapping } from "./contracts";
@@ -143,7 +143,7 @@ const mappingBody = t.Object({
   ),
 });
 
-export function createCliToolsRoutes(config: CliToolsRoutesConfig): Elysia {
+export function createCliToolsRoutes(config: CliToolsRoutesConfig): AnyElysia {
   const { service, accessResolver, auditSink, snapshotInvalidator } = config;
 
   return new Elysia({ prefix: "/cli-tools" })
@@ -335,5 +335,5 @@ export function createCliToolsRoutes(config: CliToolsRoutesConfig): Elysia {
       } catch (e) {
         return errorResponse(e, set, "CLI tool operation failed");
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/console-router-guards.ts

@@ -35,7 +35,7 @@ export function createConsoleCsrfMiddleware(): Elysia {
       // CSRF enforcement applies exactly when a session cookie is present.
       if (!token) return;
       if (!isCsrfValid(request))
-        throw new GatewayError("invalid_request", 403, "CSRF validation failed");
+        throw new GatewayError("policy_rejected", 403, "CSRF validation failed (request {requestId}). Not allowed by policy — no hard feelings 🫂");
     })
     .as("plugin");
 }
@@ -102,7 +102,7 @@ export function createConsoleMutationLimiterMiddleware(): Elysia {
             ? Math.ceil(CONSOLE_MUTATION_WINDOW_MS / 1000)
             : Math.max(1, Math.ceil((oldest + CONSOLE_MUTATION_WINDOW_MS - now) / 1000));
         set.headers["retry-after"] = String(retryAfterSeconds);
-        throw new GatewayError("quota_exceeded", 429, "Console mutation rate limit exceeded");
+        throw new GatewayError("rate_limited", 429, "Console mutation rate limit exceeded (request {requestId}). Retry shortly. You've maxed this window — pace yourself ⏳");
       }
       hits.push(now);
       consoleMutationHits.set(key, hits);

package/src/console/console-router.ts

@@ -4,7 +4,7 @@
  * composition time; concrete Drizzle stores are the defaults, so this file
  * is the single place that knows them.
  */
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import { log } from "../observability/logger";
 import { resolveConsoleAccess, resolveConsoleUser } from "./auth/session-resolver";
 import { ConsoleCredentialService } from "./auth/credentials";
@@ -100,7 +100,7 @@ function readApiKeyBearer(request: Request): string | undefined {
   return match?.[1];
 }
 
-export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
+export function createConsoleRouter(deps: ConsoleApiCompositionDeps): AnyElysia {
   const { db, routeSnapshotService, poolSelector, telemetryBuffer, redis } = deps;
   /**
    * Per-request cache: `beforeHandle` resolves the session asynchronously, and
@@ -207,7 +207,7 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
       return user === null ? null : { passwordHash: user.passwordHash };
     },
   };
-  registerConsoleDomains(console as unknown as Elysia, ctx);
+  registerConsoleDomains(console, ctx);
   // Compress the JSON control plane on the way out.
   //
   // `wrap` is used rather than a lifecycle hook because this Elysia beta does
@@ -229,5 +229,5 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
         gzipResponse(request, response),
       ),
   );
-  return console as unknown as Elysia;
+  return console;
 }

package/src/console/data-management/routes.ts

@@ -1,4 +1,4 @@
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import { t } from "elysia";
 import { errorResponse, requireAnyScope } from "../shared/errors";
 import type { AccessDecision } from "../../security/access-control";
@@ -39,7 +39,7 @@ export function createDataManagementRoutes(
     } | undefined;
     readonly flusher?: { flush(): Promise<void> } | undefined;
   },
-): Elysia {
+): AnyElysia {
   const operations = createDataManagementOperations(config);
 
   return new Elysia({ prefix: "/data-management" })
@@ -101,5 +101,5 @@ export function createDataManagementRoutes(
       } catch (error) {
         return errorResponse(error, set, "Purge failed");
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/domain-registration.ts

@@ -1,4 +1,4 @@
-import { Elysia } from "elysia";
+import { type AnyElysia } from "elysia";
 import { ConsoleDomainError } from "./shared/errors";
 import { createCliToolsRoutes } from "./cli-tools/routes";
 import { createAccountQuotaRoutes } from "./quota/account-quota";
@@ -133,7 +133,7 @@ import type { ProbeOutboundBinding } from "../providers/discovery/probing-servic
 
 
 export function registerConsoleDomains(
-  console: Elysia<any, any, any, any, any, any, any, any>,
+  console: AnyElysia,
   ctx: ConsoleDomainContext,
 ): void {
   const observabilityStore = new DrizzleObservabilityStore(ctx.db, ctx.redis);

package/src/console/observability/contracts.ts

@@ -191,6 +191,10 @@ export interface UsageRequestItem {
   apiKeyId?: string;
   userAgent?: string;
   clientName?: string;
+  /** The proxy pool that carried this request, when one was used. */
+  networkPoolId?: string;
+  /** Operator-facing label of the pool; absent when the pool is gone. */
+  networkPoolLabel?: string;
   estimatedCost?: number;
   /** Provider-billed credits; absent when the upstream reported no credit field. */
   creditUsed?: number;

package/src/console/observability/live.ts

@@ -7,7 +7,7 @@
 // Every endpoint requires `dashboard:read`. The global request count is
 // process-level; pool usage and health are filtered to the caller's tenant.
 
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import { errorResponse, requireScope } from "../shared/errors";
 import type { ConsoleAccessResolver } from "../auth/access";
 /**
@@ -86,7 +86,7 @@ function withPoolBytes<T extends { poolId: string; currentInflight?: number }>(
   });
 }
 
-export function createLiveRoutes(config: LiveConfig): Elysia {
+export function createLiveRoutes(config: LiveConfig): AnyElysia {
   return new Elysia()
     .get("/live/requests/stream", ({ request, set }) => {
       try {
@@ -176,5 +176,5 @@ export function createLiveRoutes(config: LiveConfig): Elysia {
           };
         }),
       );
-    }) as unknown as Elysia;
+    });
 }

package/src/console/observability/logs.ts

@@ -8,7 +8,7 @@
 // metadata and their args are redacted at the source, the same audience
 // that already reads request/response bodies on Usage.
 
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { ConsoleDomainError, errorResponse, requireScope } from "../shared/errors";
 import { parseQueryLimit } from "../shared/query";
 import type { ConsoleAccessResolver } from "../auth/access";
@@ -37,7 +37,7 @@ const logsQuery = t.Object({
   limit: t.Optional(t.String()),
 });
 
-export function createLogRoutes(config: LogsConfig): Elysia {
+export function createLogRoutes(config: LogsConfig): AnyElysia {
   const readLogs = (access: AccessDecision | undefined, level?: string, limitRaw?: string) => {
     requireScope(access, "dashboard:read");
     if (level !== undefined && !isLogLevel(level)) {
@@ -83,5 +83,5 @@ export function createLogRoutes(config: LogsConfig): Elysia {
           });
         }),
       );
-    }) as unknown as Elysia;
+    });
 }

package/src/console/observability/performance.ts

@@ -5,12 +5,12 @@
 // this instance's own module graph and egress), so the route is guarded by
 // `platform:admin` like the other instance-level operations.
 
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import { errorResponse, requireGlobalAdmin } from "../shared/errors";
 import { performanceMetricsSnapshot } from "../../observability/performance-metrics";
 import type { PerformanceConfig } from "./performance-contracts";
 
-export function createPerformanceRoutes(config: PerformanceConfig): Elysia {
+export function createPerformanceRoutes(config: PerformanceConfig): AnyElysia {
   return new Elysia()
     .get("/system/performance", ({ request, set }) => {
       try {
@@ -19,5 +19,5 @@ export function createPerformanceRoutes(config: PerformanceConfig): Elysia {
       } catch (e) {
         return errorResponse(e, set, "Performance operation failed");
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/observability/routes.ts

@@ -1,4 +1,4 @@
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { ConsoleDomainError, consoleErrorHandler } from "../shared/errors";
 import { USAGE_DIMENSIONS, type UsageDimension } from "./usage-dimensions";
 import { createObservabilityOperations, type ObservabilityConfig } from "./contracts";
@@ -18,7 +18,7 @@ const telemetryDetailQuery = t.Object({
   includePayload: t.Optional(t.String()),
   createdAt: t.Optional(t.String()),
 });
-export function createObservabilityRoutes(config: ObservabilityConfig): Elysia {
+export function createObservabilityRoutes(config: ObservabilityConfig): AnyElysia {
   const factory = createObservabilityOperations(config);
   return new Elysia()
     .error(consoleErrorHandler("Observability operation failed"))
@@ -114,5 +114,5 @@ export function createObservabilityRoutes(config: ObservabilityConfig): Elysia {
           query.createdAt,
         );
 },
-    ) as unknown as Elysia;
+    );
 }

package/src/console/observability/store.ts

@@ -7,11 +7,8 @@ import { type TelemetryEventRecord } from "../../observability/event-log";
 import {
   breakdownTelemetry,
   chartTelemetry,
-  healthTelemetry,
   queryTelemetryEvents as queryTelemetryEventPage,
-  summarizeHealthPerformance,
-  summarizeUsagePerformanceSql,
-  summarizeTelemetry,
+  summarizeUsageWithPerformance,
 } from "../../observability/event-query";
 import { clientNameFromUserAgent } from "../../observability/client-name";
 
@@ -145,6 +142,7 @@ function mapUsageRequestItem(
       : {}),
     ...(event.endpoint ? { endpoint: event.endpoint } : {}),
     ...(event.apiKeyId ? { apiKeyId: event.apiKeyId } : {}),
+    ...(event.networkPoolId ? { networkPoolId: event.networkPoolId } : {}),
     ...(event.userAgent ? { userAgent: event.userAgent } : {}),
     ...(event.userAgent ? { clientName: clientNameFromUserAgent(event.userAgent) } : {}),
     ...(event.clientIp
@@ -326,11 +324,10 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
       // cost on the dashboard. `healthTelemetry` returns the totals and the
       // database computes the percentiles.
       const since = new Date(Date.now() - HEALTH_WINDOW_MS);
-      const totals = await healthTelemetry(this.db, tenantId, since);
-      const performance = await summarizeHealthPerformance(this.db, tenantId, since);
+      const { summary: totals, performance } = await summarizeUsageWithPerformance(this.db, tenantId, since);
       total = totals.requests;
       errors = totals.errors;
-      avg = performance.latencyAvgMs === null ? 0 : Math.round(performance.latencyAvgMs);
+      avg = Math.round(performance.avgDurationMs ?? 0);
       p95 = performance.latencyP95Ms ?? 0;
       p99 = performance.latencyP99Ms ?? 0;
       const inputTokens = totals.inputTokens;
@@ -417,8 +414,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     // Totals AND the top-model/top-provider counts come from SQL: the old
     // shape parsed the whole retained window into an array to count two
     // dimensions in JavaScript.
-    const [summary, models, providers] = await Promise.all([
-      summarizeTelemetry(this.db, tenantId, since),
+    const [{ summary }, models, providers] = await Promise.all([
+      summarizeUsageWithPerformance(this.db, tenantId, since),
       breakdownTelemetry(this.db, tenantId, "model", since),
       breakdownTelemetry(this.db, tenantId, "provider", since),
     ]);
@@ -468,12 +465,11 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
   private async computeSummary(tenantId: string, period: string): Promise<UsageSummaryResponse> {
     const since = this.periodSince(period);
     // Totals, status breakdown, and latency percentiles all computed in SQL.
-    // This used to parse the whole retained window into JavaScript to sum six
-    // counters and sort a latency array.
-    const [summary, statuses, performance] = await Promise.all([
-      summarizeTelemetry(this.db, tenantId, since),
+    // The summary totals and performance figures come from ONE combined window
+    // scan (one percentile pass), not two independent scans.
+    const [{ summary, performance }, statuses] = await Promise.all([
+      summarizeUsageWithPerformance(this.db, tenantId, since),
       breakdownTelemetry(this.db, tenantId, "status", since),
-      summarizeUsagePerformanceSql(this.db, tenantId, since),
     ]);
     const inputTokens = summary.inputTokens;
     const cachedTokens = summary.cachedInputTokens;
@@ -655,7 +651,7 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
   }
 
   private async computeCache(tenantId: string, period: string): Promise<UsageCacheResponse> {
-    const summary = await summarizeTelemetry(this.db, tenantId, this.periodSince(period));
+    const { summary } = await summarizeUsageWithPerformance(this.db, tenantId, this.periodSince(period));
     const inputTokens = summary.inputTokens;
     const outputTokens = summary.outputTokens;
     const cachedTokens = summary.cachedInputTokens;
@@ -766,7 +762,11 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     const item = mapUsageRequestItem(event, hideClientIp);
     const keyLabel = event.apiKeyId ? keyLabels?.get(event.apiKeyId) : undefined;
     const labeled = keyLabel === undefined ? item : { ...item, apiKeyLabel: keyLabel };
-    const presented = { ...labeled, proxy };
+    const presented = {
+      ...labeled,
+      proxy,
+      ...(event.networkPoolId ? { networkPoolLabel: proxy } : {}),
+    };
     // Filter the payload table directly instead of joining `telemetry_events`
     // only to re-apply the tenant predicate: `telemetry_payloads` carries
     // `tenant_id` itself, so the join added a second table's rows to filter for