cartethyia 2.7.3 → 2.7.4

package/src/console/providers/catalog/contracts.ts

@@ -123,42 +123,42 @@ const ADAPTER_OWNED: Record<string, true> = {
 export function validateCompatibilityProfile(profile: CompatibilityProfile): void {
   if (profile.cli_identity !== undefined) {
     if (typeof profile.cli_identity !== "boolean") {
-      throw new GatewayError("invalid_request", 400, "cli_identity must be boolean");
+      throw new GatewayError("invalid_request", 400, "cli_identity must be boolean (request {requestId}). Check the shape of what you sent — then resend 🪞");
     }
   }
   if (profile.gateway_user_agent !== undefined) {
     if (typeof profile.gateway_user_agent !== "boolean") {
-      throw new GatewayError("invalid_request", 400, "gateway_user_agent must be boolean");
+      throw new GatewayError("invalid_request", 400, "gateway_user_agent must be boolean (request {requestId}). Check the shape of what you sent — then resend 🪞");
     }
   }
   if (profile.extra_headers) {
     for (const [rawName, rawValue] of Object.entries(profile.extra_headers)) {
       const name = rawName.toLowerCase();
       if (name.length < 1 || name.length > 64 || !TOKEN_REGEX.test(name)) {
-        throw new GatewayError("invalid_request", 400, `invalid header name ${rawName}`);
+        throw new GatewayError("invalid_request", 400, `invalid header name ${rawName} (request {requestId}). Check the shape of what you sent — then resend 🪞`);
       }
       if (isProtectedHeader(name, ADAPTER_OWNED)) {
         throw new GatewayError(
           "invalid_request",
           400,
-          `header ${rawName} is not allowed as custom header`,
+          `header ${rawName} is not allowed as custom header (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
       if (typeof rawValue !== "string") {
         throw new GatewayError(
           "invalid_request",
           400,
-          `header value for ${rawName} must be string`,
+          `header value for ${rawName} must be string (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
       if (Buffer.byteLength(rawValue, "utf8") > 4096) {
-        throw new GatewayError("invalid_request", 400, `header value for ${rawName} exceeds 4KiB`);
+        throw new GatewayError("invalid_request", 400, `header value for ${rawName} exceeds 4KiB (request {requestId}). We love long reads, but not that long 📚`);
       }
       if (/[\r\n\x00-\x1f\x7f]/.test(rawValue)) {
         throw new GatewayError(
           "invalid_request",
           400,
-          `header value for ${rawName} contains control characters`,
+          `header value for ${rawName} contains control characters (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
     }
@@ -166,9 +166,9 @@ export function validateCompatibilityProfile(profile: CompatibilityProfile): voi
   if (profile.extra_query_params) {
     for (const [k, v] of Object.entries(profile.extra_query_params)) {
       if (typeof v !== "string")
-        throw new GatewayError("invalid_request", 400, `query param ${k} must be string`);
+        throw new GatewayError("invalid_request", 400, `query param ${k} must be string (request {requestId}). Check the shape of what you sent — then resend 🪞`);
       if (/[\r\n]/.test(k) || /[\r\n]/.test(v))
-        throw new GatewayError("invalid_request", 400, `query param contains CRLF`);
+        throw new GatewayError("invalid_request", 400, `query param contains CRLF (request {requestId}). Check the shape of what you sent — then resend 🪞`);
     }
   }
   if (profile.endpoint_paths_by_wire_family) {
@@ -177,56 +177,56 @@ export function validateCompatibilityProfile(profile: CompatibilityProfile): voi
         throw new GatewayError(
           "invalid_request",
           400,
-          `endpoint_paths_by_wire_family: unknown wire family ${wf}`,
+          `endpoint_paths_by_wire_family: unknown wire family ${wf} (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
       if (typeof path !== "string") {
         throw new GatewayError(
           "invalid_request",
           400,
-          `endpoint_paths_by_wire_family.${wf} must be string`,
+          `endpoint_paths_by_wire_family.${wf} must be string (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
       if (path.length === 0 || path.length > 256) {
         throw new GatewayError(
           "invalid_request",
           400,
-          `endpoint_paths_by_wire_family.${wf} path length must be 1-256 chars`,
+          `endpoint_paths_by_wire_family.${wf} path length must be 1-256 chars (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
       if (!path.startsWith("/")) {
         throw new GatewayError(
           "invalid_request",
           400,
-          `endpoint_paths_by_wire_family.${wf} path must start with /`,
+          `endpoint_paths_by_wire_family.${wf} path must start with / (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
       if (/[\s\r\n\x00-\x1f\x7f]/.test(path)) {
         throw new GatewayError(
           "invalid_request",
           400,
-          `endpoint_paths_by_wire_family.${wf} path contains invalid characters`,
+          `endpoint_paths_by_wire_family.${wf} path contains invalid characters (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
     }
   }
   if (profile.model_wire_families) {
     if (!Array.isArray(profile.model_wire_families)) {
-      throw new GatewayError("invalid_request", 400, "model_wire_families must be an array");
+      throw new GatewayError("invalid_request", 400, "model_wire_families must be an array (request {requestId}). Check the shape of what you sent — then resend 🪞");
     }
     for (const rule of profile.model_wire_families) {
       if (typeof rule?.pattern !== "string" || rule.pattern.length === 0) {
         throw new GatewayError(
           "invalid_request",
           400,
-          "model_wire_families[].pattern must be a non-empty string",
+          "model_wire_families[].pattern must be a non-empty string (request {requestId}). Check the shape of what you sent — then resend 🪞",
         );
       }
       if (rule.pattern.length > 256) {
         throw new GatewayError(
           "invalid_request",
           400,
-          "model_wire_families[].pattern must be at most 256 chars",
+          "model_wire_families[].pattern must be at most 256 chars (request {requestId}). Check the shape of what you sent — then resend 🪞",
         );
       }
       try {
@@ -235,14 +235,14 @@ export function validateCompatibilityProfile(profile: CompatibilityProfile): voi
         throw new GatewayError(
           "invalid_request",
           400,
-          `model_wire_families[].pattern ${rule.pattern} is not a valid regular expression`,
+          `model_wire_families[].pattern ${rule.pattern} is not a valid regular expression (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
       if (!isWireFamily(rule.wire_family)) {
         throw new GatewayError(
           "invalid_request",
           400,
-          `model_wire_families[].wire_family: unknown wire family ${String(rule.wire_family)}`,
+          `model_wire_families[].wire_family: unknown wire family ${String(rule.wire_family)} (request {requestId}). Check the shape of what you sent — then resend 🪞`,
         );
       }
     }
@@ -251,10 +251,10 @@ export function validateCompatibilityProfile(profile: CompatibilityProfile): voi
     profile.streaming_usage_mode &&
     !["include_usage", "none"].includes(profile.streaming_usage_mode)
   ) {
-    throw new GatewayError("invalid_request", 400, "invalid streaming_usage_mode");
+    throw new GatewayError("invalid_request", 400, "invalid streaming_usage_mode (request {requestId}). Check the shape of what you sent — then resend 🪞");
   }
   if (profile.structured_output && typeof profile.structured_output.enabled !== "boolean") {
-    throw new GatewayError("invalid_request", 400, "structured_output.enabled must be boolean");
+    throw new GatewayError("invalid_request", 400, "structured_output.enabled must be boolean (request {requestId}). Check the shape of what you sent — then resend 🪞");
   }
   // If any field is present but has no runtime reader, our current reader set covers all fields above.
   const allowed: Record<string, true> = {
@@ -281,7 +281,7 @@ export function validateCompatibilityProfile(profile: CompatibilityProfile): voi
       throw new GatewayError(
         "invalid_request",
         400,
-        `unknown compatibility_profile field ${k} has no runtime reader`,
+        `unknown compatibility_profile field ${k} has no runtime reader (request {requestId}). Check the shape of what you sent — then resend 🪞`,
       );
     }
   }
@@ -539,6 +539,27 @@ export interface ProviderAccountResponse {
   staticToken?: boolean;
   /** Stable list position within this provider; the console's "Added" order. */
   sortIndex: number;
+  /**
+   * Row flavor. `"pool"` marks a pool-as-account entity (see
+   * `provider_pool_accounts`): it is an account-equivalent for an
+   * ip-scoped, credential-less provider, resolves no credential, and is
+   * owned by its pool. Absent means a real `provider_accounts` row.
+   */
+  kind?: "pool";
+  /** The owning pool row (present for `kind: "pool"`). */
+  networkPoolId?: string;
+  /**
+   * Provider-scoped rate-limit markers on the owning pool, when this is a
+   * pool-as-account row. Mirrors `NetworkPoolResponse.providerCooldowns`: a
+   * 429 cooldown refills, a block means the upstream retired the egress
+   * address. Absent for real accounts and for pools with no markers.
+   */
+  providerCooldowns?: Array<{
+    providerId: string;
+    until: string;
+    reason: string;
+    blocked: boolean;
+  }>;
 }
 /**
  * Plaintext export of one account's decrypted provider tokens.

package/src/console/providers/catalog/provider-operations.ts

@@ -25,6 +25,7 @@ import type { OAuthLoginField } from "../../../providers/authentication/oauth-fl
 import { providerCredentialHint, providerCredentialUrl, providerDisplayName, providerHasAdapterUserAgent, providerOperatorNotice, providerServiceKinds, type CompatibilityProfile } from "../../../providers/provider-metadata";
 import type { AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
 import { healthEventBuffer } from "../../../persistence/health-event-flush";
+import { materializeBuddyDeviceBinding } from "../../../providers/integrations/buddy/buddy-identity";
 import { CREDENTIAL_MODES, PROVIDER_READ_SCOPES, PROVIDER_WRITE_SCOPES, type BuddyGrowthTaskLedgerEntry } from "./contracts";
 import { enqueueCheckin } from "../../../workers/daily-checkin";
 import {
@@ -695,8 +696,22 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
               // refresh and dispatch are addressed by.
               ...(() => {
                 const authState = authStates[account.id];
-                return authState !== undefined && Object.keys(authState).length > 0
-                  ? { authState }
+                // Buddy providers bind a per-account device identity
+                // (qimei36) that is normally derived from the INTERNAL account
+                // id. Export must materialize that raw binding into the
+                // exported auth state — otherwise a re-import mints a new
+                // account id, the derived binding changes, and the upstream
+                // channel check (11128) rejects the imported account.
+                const materialized =
+                  account.providerId === "cb" ||
+                  account.providerId === "cbcn" ||
+                  account.providerId === "workbuddy" ||
+                  account.providerId === "workbuddycn"
+                    ? materializeBuddyDeviceBinding(account.id, authState)
+                    : undefined;
+                const effectiveAuthState = materialized ?? authState;
+                return effectiveAuthState !== undefined && Object.keys(effectiveAuthState).length > 0
+                  ? { authState: effectiveAuthState }
                   : {};
               })(),
               ...(account.inflight === undefined ? {} : { inflight: account.inflight }),

package/src/console/providers/catalog/routes.ts

@@ -1,6 +1,6 @@
 import { consoleErrorHandler } from "../../shared/errors";
 import { literalUnion } from "../../shared/elysia-schema";
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { SERVICE_KINDS, WIRE_FAMILIES } from "../../../protocol/canonical-model";
 import { PROBE_REASONING_EFFORTS } from "../../../providers/discovery/discovery-types";
 import {
@@ -150,7 +150,7 @@ const bulkDeleteModelsBody = t.Object({
 const usageMatrixQuery = t.Object({
   days: t.Optional(t.Integer({ minimum: 1, maximum: 366 })),
 });
-export function createProviderCatalogRoutes(config: ProviderCatalogConfig): Elysia {
+export function createProviderCatalogRoutes(config: ProviderCatalogConfig): AnyElysia {
   const factory = createProviderCatalogOperations(config);
   const modelFactory = createModelCatalogOperations(config);
   return new Elysia({ prefix: "/providers" })
@@ -394,5 +394,5 @@ export function createProviderCatalogRoutes(config: ProviderCatalogConfig): Elys
           body.accountIds,
         );
 },
-    ) as unknown as Elysia;
+    );
 }