cartethyia 2.7.3 → 2.7.5

package/src/console/cli-tools/injectors/opencode.ts

@@ -1,153 +1,153 @@
-import type {} from "../contracts";
-import { ensureV1Suffix, homeDir, join, readJsonFile, writeJsonFile } from "../fs-ops";
-import type { InjectorSpec } from "../contracts";
-
-
-// OpenCode injector spec.
-interface OpencodeModel {
-  name: string;
-  modalities: { input: string[]; output: string[] };
-}
-
-interface OpencodeProvider {
-  npm: string;
-  options: { baseURL?: string; apiKey?: string };
-  models: Record<string, OpencodeModel>;
-}
-
-interface OpencodeConfig {
-  provider?: Record<string, OpencodeProvider>;
-  model?: string;
-  agent?: {
-    explorer?: {
-      description?: string;
-      mode?: string;
-      model?: string;
-    };
-    [k: string]: unknown;
-  };
-  [k: string]: unknown;
-}
-
-function buildOpencodeModels(models: readonly string[]): Record<string, OpencodeModel> {
-  const map: Record<string, OpencodeModel> = {};
-  for (const m of models) {
-    if (!m) continue;
-    map[m] = { name: m, modalities: { input: ["text", "image"], output: ["text"] } };
-  }
-  return map;
-}
-
-export const opencodeSpec: InjectorSpec = {
-  toolId: "opencode",
-  displayName: "OpenCode",
-  binary: "opencode",
-  resolvePath: () => join(homeDir(), ".config", "opencode", "opencode.json"),
-  resolveDir: () => join(homeDir(), ".config", "opencode"),
-
-  async readStatus(path) {
-    const config = (await readJsonFile(path)) as OpencodeConfig | null;
-    if (!config) {
-      return { configured: false, currentEndpoint: null, rawApiKey: null, currentModels: null };
-    }
-    const provider = config.provider?.cartethyia;
-    const endpoint = provider?.options?.baseURL ?? null;
-    const models = provider?.models ? Object.keys(provider.models) : null;
-    const active =
-      typeof config.model === "string" && config.model.startsWith("cartethyia/")
-        ? config.model.split("/").slice(1).join("/")
-        : null;
-    return {
-      configured: !!provider,
-      currentEndpoint: endpoint,
-      rawApiKey: provider?.options?.apiKey ?? null,
-      currentModels: active && models ? [active, ...models.filter((m) => m !== active)] : models,
-    };
-  },
-
-  async apply(input, path) {
-    const existing = (await readJsonFile(path)) as OpencodeConfig | null;
-    const config: OpencodeConfig = (existing ?? {}) as OpencodeConfig;
-
-    if (!config.provider) config.provider = {};
-    const prior = config.provider.cartethyia;
-    config.provider.cartethyia = {
-      npm: "@ai-sdk/openai-compatible",
-      options: {
-        ...(prior?.options ?? {}),
-        baseURL: ensureV1Suffix(input.endpoint),
-        apiKey: input.apiKey,
-      },
-      models: { ...(prior?.models ?? {}), ...buildOpencodeModels(input.modelIds) },
-    };
-
-    const activeModel = input.activeModel ?? input.modelIds[0] ?? "";
-    config.model = activeModel === "" ? "" : `cartethyia/${activeModel}`;
-
-    if (!config.agent) config.agent = {};
-    const subagentModel = input.subagentModel ?? input.modelIds[0] ?? activeModel;
-    config.agent.explorer = {
-      description: "Fast explorer subagent",
-      mode: "subagent",
-      model: `cartethyia/${subagentModel}`,
-    };
-
-    await writeJsonFile(path, config);
-  },
-
-  async reset(path) {
-    const config = (await readJsonFile(path)) as OpencodeConfig | null;
-    if (!config) return false;
-
-    if (config.provider) {
-      delete config.provider.cartethyia;
-      if (Object.keys(config.provider).length === 0) delete config.provider;
-    }
-
-    if (typeof config.model === "string" && config.model.startsWith("cartethyia/")) {
-      delete config.model;
-    }
-
-    if (config.agent?.explorer?.model?.startsWith("cartethyia/")) {
-      delete config.agent.explorer;
-      if (Object.keys(config.agent).length === 0) delete config.agent;
-    }
-
-    await writeJsonFile(path, config);
-  },
-
-  download(input) {
-    const activeModel = input.activeModel ?? input.modelIds[0] ?? "";
-    const subagentModel = input.subagentModel ?? input.modelIds[0] ?? activeModel;
-    const config: OpencodeConfig = {
-      provider: {
-        cartethyia: {
-          npm: "@ai-sdk/openai-compatible",
-          options: {
-            baseURL: ensureV1Suffix(input.endpoint),
-            apiKey: input.apiKey,
-          },
-          models: buildOpencodeModels(input.modelIds),
-        },
-      },
-      model: activeModel === "" ? "" : `cartethyia/${activeModel}`,
-      agent: {
-        explorer: {
-          description: "Fast explorer subagent",
-          mode: "subagent",
-          model: `cartethyia/${subagentModel}`,
-        },
-      },
-    };
-    return {
-      content: JSON.stringify(config, null, 2),
-      filename: "opencode.json",
-      mimeType: "application/json",
-    };
-  },
-
-  messages: {
-    applied: "OpenCode settings applied",
-    reset: "Cartethyia settings removed from OpenCode",
-  },
-};
+import type {} from "../contracts";
+import { ensureV1Suffix, homeDir, join, readJsonFile, writeJsonFile } from "../fs-ops";
+import type { InjectorSpec } from "../contracts";
+
+
+// OpenCode injector spec.
+interface OpencodeModel {
+  name: string;
+  modalities: { input: string[]; output: string[] };
+}
+
+interface OpencodeProvider {
+  npm: string;
+  options: { baseURL?: string; apiKey?: string };
+  models: Record<string, OpencodeModel>;
+}
+
+interface OpencodeConfig {
+  provider?: Record<string, OpencodeProvider>;
+  model?: string;
+  agent?: {
+    explorer?: {
+      description?: string;
+      mode?: string;
+      model?: string;
+    };
+    [k: string]: unknown;
+  };
+  [k: string]: unknown;
+}
+
+function buildOpencodeModels(models: readonly string[]): Record<string, OpencodeModel> {
+  const map: Record<string, OpencodeModel> = {};
+  for (const m of models) {
+    if (!m) continue;
+    map[m] = { name: m, modalities: { input: ["text", "image"], output: ["text"] } };
+  }
+  return map;
+}
+
+export const opencodeSpec: InjectorSpec = {
+  toolId: "opencode",
+  displayName: "OpenCode",
+  binary: "opencode",
+  resolvePath: () => join(homeDir(), ".config", "opencode", "opencode.json"),
+  resolveDir: () => join(homeDir(), ".config", "opencode"),
+
+  async readStatus(path) {
+    const config = (await readJsonFile(path)) as OpencodeConfig | null;
+    if (!config) {
+      return { configured: false, currentEndpoint: null, rawApiKey: null, currentModels: null };
+    }
+    const provider = config.provider?.cartethyia;
+    const endpoint = provider?.options?.baseURL ?? null;
+    const models = provider?.models ? Object.keys(provider.models) : null;
+    const active =
+      typeof config.model === "string" && config.model.startsWith("cartethyia/")
+        ? config.model.split("/").slice(1).join("/")
+        : null;
+    return {
+      configured: !!provider,
+      currentEndpoint: endpoint,
+      rawApiKey: provider?.options?.apiKey ?? null,
+      currentModels: active && models ? [active, ...models.filter((m) => m !== active)] : models,
+    };
+  },
+
+  async apply(input, path) {
+    const existing = (await readJsonFile(path)) as OpencodeConfig | null;
+    const config: OpencodeConfig = (existing ?? {}) as OpencodeConfig;
+
+    if (!config.provider) config.provider = {};
+    const prior = config.provider.cartethyia;
+    config.provider.cartethyia = {
+      npm: "@ai-sdk/openai-compatible",
+      options: {
+        ...(prior?.options ?? {}),
+        baseURL: ensureV1Suffix(input.endpoint),
+        apiKey: input.apiKey,
+      },
+      models: { ...(prior?.models ?? {}), ...buildOpencodeModels(input.modelIds) },
+    };
+
+    const activeModel = input.activeModel ?? input.modelIds[0] ?? "";
+    config.model = activeModel === "" ? "" : `cartethyia/${activeModel}`;
+
+    if (!config.agent) config.agent = {};
+    const subagentModel = input.subagentModel ?? input.modelIds[0] ?? activeModel;
+    config.agent.explorer = {
+      description: "Fast explorer subagent",
+      mode: "subagent",
+      model: `cartethyia/${subagentModel}`,
+    };
+
+    await writeJsonFile(path, config);
+  },
+
+  async reset(path) {
+    const config = (await readJsonFile(path)) as OpencodeConfig | null;
+    if (!config) return false;
+
+    if (config.provider) {
+      delete config.provider.cartethyia;
+      if (Object.keys(config.provider).length === 0) delete config.provider;
+    }
+
+    if (typeof config.model === "string" && config.model.startsWith("cartethyia/")) {
+      delete config.model;
+    }
+
+    if (config.agent?.explorer?.model?.startsWith("cartethyia/")) {
+      delete config.agent.explorer;
+      if (Object.keys(config.agent).length === 0) delete config.agent;
+    }
+
+    await writeJsonFile(path, config);
+  },
+
+  download(input) {
+    const activeModel = input.activeModel ?? input.modelIds[0] ?? "";
+    const subagentModel = input.subagentModel ?? input.modelIds[0] ?? activeModel;
+    const config: OpencodeConfig = {
+      provider: {
+        cartethyia: {
+          npm: "@ai-sdk/openai-compatible",
+          options: {
+            baseURL: ensureV1Suffix(input.endpoint),
+            apiKey: input.apiKey,
+          },
+          models: buildOpencodeModels(input.modelIds),
+        },
+      },
+      model: activeModel === "" ? "" : `cartethyia/${activeModel}`,
+      agent: {
+        explorer: {
+          description: "Fast explorer subagent",
+          mode: "subagent",
+          model: `cartethyia/${subagentModel}`,
+        },
+      },
+    };
+    return {
+      content: JSON.stringify(config, null, 2),
+      filename: "opencode.json",
+      mimeType: "application/json",
+    };
+  },
+
+  messages: {
+    applied: "OpenCode settings applied",
+    reset: "Cartethyia settings removed from OpenCode",
+  },
+};

package/src/console/cli-tools/routes.ts

@@ -1,6 +1,6 @@
 import type { ConsoleAccessResolver } from "../auth/access";
 import type { AuditSink } from "../audit/contracts";
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { errorResponse, requireTenantScope } from "../shared/errors";
 import type { CliToolService } from "./service";
 import type { ApplyInput, CliMappingInput, CliModelMapping } from "./contracts";
@@ -23,7 +23,7 @@ import type { ApplyInput, CliMappingInput, CliModelMapping } from "./contracts";
  * `download` and `apply` require `keyId`; the server resolves the recoverable
  * AES-256-GCM copy so the operator never pastes a raw secret.
  */
-export interface CliToolsRoutesConfig {
+interface CliToolsRoutesConfig {
   readonly service: CliToolService;
   readonly accessResolver: ConsoleAccessResolver;
   readonly auditSink?: AuditSink;
@@ -143,7 +143,7 @@ const mappingBody = t.Object({
   ),
 });
 
-export function createCliToolsRoutes(config: CliToolsRoutesConfig): Elysia {
+export function createCliToolsRoutes(config: CliToolsRoutesConfig): AnyElysia {
   const { service, accessResolver, auditSink, snapshotInvalidator } = config;
 
   return new Elysia({ prefix: "/cli-tools" })
@@ -335,5 +335,5 @@ export function createCliToolsRoutes(config: CliToolsRoutesConfig): Elysia {
       } catch (e) {
         return errorResponse(e, set, "CLI tool operation failed");
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/cli-tools/service.ts

@@ -27,7 +27,7 @@ import { ConsoleDomainError } from "../shared/errors";
  * and share one process's home directory (they are not tenant-scoped).
  */
 
-export function toToolRegistryEntry(def: ToolDef): ToolRegistryEntry {
+function toToolRegistryEntry(def: ToolDef): ToolRegistryEntry {
   return {
     id: def.id,
     name: def.name,

package/src/console/cli-tools/store.ts

@@ -14,13 +14,13 @@ import type {
  * The API-layer service owns validation against the registry; this store
  * only serializes rows in and out of Postgres.
  */
-export interface StoredMappingRow extends CliModelMapping {
+interface StoredMappingRow extends CliModelMapping {
   readonly toolId: string;
   readonly tenantId: string;
   readonly apiKeyId: string;
 }
 
-export interface StoredSettings {
+interface StoredSettings {
   readonly tenantId: string;
   readonly toolId: string;
   readonly apiKeyId: string;

package/src/console/console-router-guards.ts

@@ -35,7 +35,7 @@ export function createConsoleCsrfMiddleware(): Elysia {
       // CSRF enforcement applies exactly when a session cookie is present.
       if (!token) return;
       if (!isCsrfValid(request))
-        throw new GatewayError("invalid_request", 403, "CSRF validation failed");
+        throw new GatewayError("policy_rejected", 403, "CSRF validation failed (request {requestId}). Not allowed by policy — no hard feelings 🫂");
     })
     .as("plugin");
 }
@@ -102,7 +102,7 @@ export function createConsoleMutationLimiterMiddleware(): Elysia {
             ? Math.ceil(CONSOLE_MUTATION_WINDOW_MS / 1000)
             : Math.max(1, Math.ceil((oldest + CONSOLE_MUTATION_WINDOW_MS - now) / 1000));
         set.headers["retry-after"] = String(retryAfterSeconds);
-        throw new GatewayError("quota_exceeded", 429, "Console mutation rate limit exceeded");
+        throw new GatewayError("rate_limited", 429, "Console mutation rate limit exceeded (request {requestId}). Retry shortly. You've maxed this window — pace yourself ⏳");
       }
       hits.push(now);
       consoleMutationHits.set(key, hits);

package/src/console/console-router.ts

@@ -4,7 +4,7 @@
  * composition time; concrete Drizzle stores are the defaults, so this file
  * is the single place that knows them.
  */
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import { log } from "../observability/logger";
 import { resolveConsoleAccess, resolveConsoleUser } from "./auth/session-resolver";
 import { ConsoleCredentialService } from "./auth/credentials";
@@ -36,6 +36,7 @@ import type { BundledProviderCatalog } from "../providers/operations/provider-ca
 import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
 import type { TrustedProxyBoundary } from "../config/network";
 import { gzipResponse } from "./response-compression";
+import { beginConsoleActivity } from "../shared/invoke-guard";
 
 export interface ConsoleApiCompositionDeps {
   readonly db: CartethyiaDatabase;
@@ -80,6 +81,15 @@ export interface ConsoleApiCompositionDeps {
     | undefined;
   readonly resolvePeerAddress?: (request: Request) => string | null;
   readonly trustedProxyBoundary?: TrustedProxyBoundary;
+  /**
+   * The process shutdown coordinator, narrowed to the surface the update apply
+   * route needs. Declared structural (not the class) so the console composition
+   * root does not import the boot layer; `ShutdownCoordinator` satisfies it.
+   */
+  readonly shutdownCoordinator?: {
+    readonly begin: (reason: "update") => Promise<void>;
+    readonly totalShutdownBudgetMs: () => number;
+  };
 }
 /**
  * Extracts a bearer API key from a console request, or `undefined`.
@@ -100,7 +110,7 @@ function readApiKeyBearer(request: Request): string | undefined {
   return match?.[1];
 }
 
-export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
+export function createConsoleRouter(deps: ConsoleApiCompositionDeps): AnyElysia {
   const { db, routeSnapshotService, poolSelector, telemetryBuffer, redis } = deps;
   /**
    * Per-request cache: `beforeHandle` resolves the session asynchronously, and
@@ -109,6 +119,12 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
    * process (tests, or a second app instance) never share decisions.
    */
   const sessionAccessCache = new WeakMap<Request, AccessDecision | null>();
+  /**
+   * G-03 InvokeGuard: the console control plane's foreground-activity count.
+   * `beforeHandle` bumps it for the request; `afterResponse` releases it. The
+   * end callback is keyed by request so parallel requests pair correctly.
+   */
+  const consoleActivityEnds = new WeakMap<Request, () => void>();
   const cookiePolicy = defaultSessionCookiePolicy;
   const credentialService = new ConsoleCredentialService();
   const sessionService = new ConsoleSessionService(db, cookiePolicy);
@@ -137,6 +153,12 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
     .use(createConsoleCsrfMiddleware())
     .use(createConsoleMutationLimiterMiddleware())
     .beforeHandle(async ({ request }: { request: Request }) => {
+      // G-03: count this console request as foreground activity for the
+      // duration of its handling. Released in `afterResponse` below (or by
+      // the catch-all in the error path, which also runs before the response
+      // leaves). The scheduled worker registry uses this to defer sweeps
+      // while the operator is actively using the console.
+      consoleActivityEnds.set(request, beginConsoleActivity());
       // The auth routes (`/console/api/auth/*`) resolve the session themselves
       // and never read `accessResolver`, so resolving here too would repeat the
       // session lookup plus its user query on every login/session/logout call
@@ -167,6 +189,15 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
         }),
       );
     })
+    .afterResponse(({ request }: { request: Request }) => {
+      // G-03: release the foreground-activity count for this request.
+      // Elysia runs `afterResponse` for every completed request, errored ones
+      // included (the error is converted to a response first), so this is the
+      // single reliable release point — a failing route can never leak an
+      // elevated foreground count (which would defer sweeps forever).
+      consoleActivityEnds.get(request)?.();
+      consoleActivityEnds.delete(request);
+    })
     .use(
       createConsoleAuthRoutes(
         db,
@@ -197,6 +228,7 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
     admissionService: deps.admissionService,
     readRoutingAccountInflight: deps.readRoutingAccountInflight,
     ...(deps.flushBuffers ? { flushBuffers: deps.flushBuffers } : {}),
+    ...(deps.shutdownCoordinator ? { shutdownCoordinator: deps.shutdownCoordinator } : {}),
     credentialService,
     // The backup surface re-authenticates the operator, so it needs the current
     // user's hash. Read from the session on the request that asks for it, never
@@ -207,7 +239,7 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
       return user === null ? null : { passwordHash: user.passwordHash };
     },
   };
-  registerConsoleDomains(console as unknown as Elysia, ctx);
+  registerConsoleDomains(console, ctx);
   // Compress the JSON control plane on the way out.
   //
   // `wrap` is used rather than a lifecycle hook because this Elysia beta does
@@ -229,5 +261,5 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
         gzipResponse(request, response),
       ),
   );
-  return console as unknown as Elysia;
+  return console;
 }

package/src/console/dashboard-assets.ts

@@ -9,7 +9,7 @@ import { acceptsGzip } from "./response-compression";
 /**
  * Represents the result of serving a static file.
  */
-export interface StaticServeResult {
+interface StaticServeResult {
   status: number;
   body: Uint8Array | undefined;
   headers: Record<string, string>;
@@ -18,7 +18,7 @@ export interface StaticServeResult {
 /**
  * Configuration for the static file handler.
  */
-export interface StaticHandlerConfig {
+interface StaticHandlerConfig {
   /** Absolute path to the dashboard build directory */
   buildDir: string;
   /**
@@ -30,7 +30,7 @@ export interface StaticHandlerConfig {
 }
 
 /** Shared landing, console, and public share entry document produced by Vite. */
-export const DEFAULT_ENTRY_DOCUMENTS: Readonly<Record<string, string>> = {
+const DEFAULT_ENTRY_DOCUMENTS: Readonly<Record<string, string>> = {
   "/": "index.html",
   "/share": "index.html",
   "/console": "index.html",
@@ -47,7 +47,7 @@ function dashboardBuildHeader(html: string): Record<string, string> {
  * their own card here — crawlers do not run the client bundle, so a
  * `document.title` set at runtime cannot reach them.
  */
-export interface SocialMeta {
+interface SocialMeta {
   title: string;
   description: string;
   image: string;
@@ -62,11 +62,11 @@ export const SHARE_SOCIAL_META: SocialMeta = {
   title: "Cartethyia — Bansos Token",
   description:
     "Come and save your tokens 💖 Shared Cartethyia API key — Bansos Token with live quota, usage and model allowlist.",
-  image: "/assets/brand/og_bansos.webp",
-  imageType: "image/webp",
-  // Read from the file's own VP8 header, not carried over from the JPEG this
-  // replaced: og:image:width/height are what a crawler uses to allocate the
-  // card before the bytes arrive, so a copied size makes every preview crop.
+  image: "/assets/brand/og_bansos.jpg",
+  imageType: "image/jpeg",
+  // Read from the file's own header, not carried over from a previous image:
+  // og:image:width/height are what a crawler uses to allocate the card before
+  // the bytes arrive, so a copied size makes every preview crop.
   imageWidth: 1760,
   imageHeight: 576,
   imageAlt: "Cartethyia Bansos Token — Come and save your tokens",

package/src/console/data-management/routes.ts

@@ -1,4 +1,4 @@
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import { t } from "elysia";
 import { errorResponse, requireAnyScope } from "../shared/errors";
 import type { AccessDecision } from "../../security/access-control";
@@ -39,7 +39,7 @@ export function createDataManagementRoutes(
     } | undefined;
     readonly flusher?: { flush(): Promise<void> } | undefined;
   },
-): Elysia {
+): AnyElysia {
   const operations = createDataManagementOperations(config);
 
   return new Elysia({ prefix: "/data-management" })
@@ -101,5 +101,5 @@ export function createDataManagementRoutes(
       } catch (error) {
         return errorResponse(error, set, "Purge failed");
       }
-    }) as unknown as Elysia;
+    });
 }

package/src/console/domain-registration.ts

@@ -1,4 +1,4 @@
-import { Elysia } from "elysia";
+import { type AnyElysia } from "elysia";
 import { ConsoleDomainError } from "./shared/errors";
 import { createCliToolsRoutes } from "./cli-tools/routes";
 import { createAccountQuotaRoutes } from "./quota/account-quota";
@@ -124,6 +124,16 @@ export interface ConsoleDomainContext {
   readonly loadConsoleUser: (request: Request) => Promise<{ readonly passwordHash: string } | null>;
   /** Password verification against the console user's stored hash. */
   readonly credentialService: Pick<ConsoleCredentialService, "verifyPassword">;
+  /**
+   * The process shutdown coordinator, narrowed to the update apply route's
+   * drain surface. Optional because reduced compositions (tests) legitimately
+   * build a console that cannot apply updates; the apply route answers 503
+   * rather than exiting undrained when it is absent.
+   */
+  readonly shutdownCoordinator?: {
+    readonly begin: (reason: "update") => Promise<void>;
+    readonly totalShutdownBudgetMs: () => number;
+  };
 }
 import { and, eq, isNull, or } from "drizzle-orm";
 import { networkPools, providerRoutingSettings } from "../persistence/schema";
@@ -133,7 +143,7 @@ import type { ProbeOutboundBinding } from "../providers/discovery/probing-servic
 
 
 export function registerConsoleDomains(
-  console: Elysia<any, any, any, any, any, any, any, any>,
+  console: AnyElysia,
   ctx: ConsoleDomainContext,
 ): void {
   const observabilityStore = new DrizzleObservabilityStore(ctx.db, ctx.redis);
@@ -252,6 +262,9 @@ export function registerConsoleDomains(
   console.use(createUpdateRoutes({
     accessResolver: ctx.accessResolver,
     observabilityStore,
+    ...(ctx.shutdownCoordinator === undefined
+      ? {}
+      : { shutdownCoordinator: ctx.shutdownCoordinator }),
   }));
   console.use(createRemoteSupportRoutes({
     accessResolver: ctx.accessResolver,
@@ -271,6 +284,7 @@ export function registerConsoleDomains(
     accessResolver: ctx.accessResolver,
     auditSink: ctx.auditRecorder,
     providerRegistry: ctx.providerRegistry,
+    redis: ctx.redis,
     snapshotInvalidator: ctx.routeSnapshotService,
     resolveExportCredentials,
     // Without this, a custom provider only becomes dispatchable after a
@@ -384,8 +398,8 @@ export function registerConsoleDomains(
   // it is released when the last of those flows settles.
   const oauthCallbackListener = new OAuthCallbackListener({
     completer: {
-      complete: (providerId, code, state) =>
-        completeLogin(oauthConfig, providerId, code, state),
+      complete: (providerId, code, state, callbackParams) =>
+        completeLogin(oauthConfig, providerId, code, state, callbackParams),
     },
   });
   const oauthConfig: OAuthLoginConfig = {

package/src/console/inferhub/client.ts

@@ -54,13 +54,6 @@ export interface InferhubClientOptions {
   readonly now?: () => number;
 }
 
-export class InferhubRateLimited extends Error {
-  constructor() {
-    super("inferhub management rate limit reached");
-    this.name = "InferhubRateLimited";
-  }
-}
-
 /**
  * One management GET.
  *

package/src/console/inferhub/key-store.ts

@@ -20,7 +20,7 @@ import { decryptCredentialToString, encryptCredential, hashSecret } from "../../
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 
 /** Shape returned to the console: whether a key is set, and never the key. */
-export interface InferhubKeyStatus {
+interface InferhubKeyStatus {
   readonly configured: boolean;
   /** Last four characters, so an operator can tell two keys apart. */
   readonly last4: string | null;