cartethyia 2.7.3 → 2.7.5

package/src/providers/bundled-discovery-providers.ts

@@ -10,39 +10,13 @@ import { createApiKeyAdapter, type ApiKeyProviderSpec } from "./configured-provi
  * OpenAI-compatible contract. Providers with static catalogs or additional
  * upstream behavior remain declared beside their special handling.
  */
-export const DISCOVERY_BACKED_PROVIDER_IDS = [
-  "groq",
-  "together",
-  "deepinfra",
-  "siliconflow",
-  "siliconflowcn",
-  "novita",
-  "larprouter",
-  "venice",
-  "nanogpt",
-  "baseten",
-  "synthetic",
-  "stepfun",
-  "sakana",
-  "helmcode",
-  "coralbricks",
-  "aiand",
-  "wafer",
-  "firepass",
-  "zhipucoding",
-  "dashscope",
-  "qianfan",
-] as const;
-
-export type DiscoveryBackedProviderId = (typeof DISCOVERY_BACKED_PROVIDER_IDS)[number];
-
 type DiscoveryBackedCapabilities = Pick<
   ProviderModule,
   "endpointPathsByWireFamily" | "loadAdapter" | "loadModelDiscovery"
 >;
 
 type ModelDiscoveryFactory = NonNullable<ProviderModule["loadModelDiscovery"]>;
-type OpenAIModelDiscoveryFactory = (
+export type OpenAIModelDiscoveryFactory = (
   providerId: string,
   options?: {
     readonly headers?: (credential: string) => Readonly<Record<string, string>>;
@@ -71,10 +45,12 @@ const DISCOVERY_BACKED_PROVIDER_SPECS = {
   zhipucoding: VERSIONED_ROOT_API_KEY_SPECS.zhipucoding,
   dashscope: GENERIC_API_KEY_SPECS.dashscope,
   qianfan: VERSIONED_ROOT_API_KEY_SPECS.qianfan,
-} satisfies Readonly<Record<DiscoveryBackedProviderId, ApiKeyProviderSpec>>;
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
 
-function discoveryBackedCapabilities(
-  providerId: DiscoveryBackedProviderId,
+type DiscoveryBackedProviderId = keyof typeof DISCOVERY_BACKED_PROVIDER_SPECS;
+
+export function discoveryBackedCapabilities(
+  providerId: string,
   spec: ApiKeyProviderSpec,
   openAIModelDiscovery: OpenAIModelDiscoveryFactory,
 ): DiscoveryBackedCapabilities {

package/src/providers/configured-openai-providers.ts

@@ -1,12 +1,36 @@
 import type { ApiKeyProviderSpec } from "./configured-provider";
 import type { ProviderId } from "./provider-contracts";
 
+/**
+ * The shared spec builder for every builtin bearer-AI provider: "bearer auth
+ * against the provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible
+ * chat + responses, with the endpoint paths declared *below* the version root".
+ *
+ * `joinUrl` is plain concatenation and nothing rewrites a declared path, so a
+ * base already rooted at a version (`/openai/v1`, `/v1/openai`, `/v3/openai`,
+ * `/api/v1`, `/v2`, `/inference/v1`) plus a `/v1/…` path would double the
+ * segment and 404 every request. These specs therefore declare the path below
+ * the version root — the provider stating the truth about its own wire, not a
+ * correction applied to it.
+ */
+function apiKeySpec(
+  providerId: ProviderId,
+  paths: Readonly<Partial<Record<"chat" | "responses", string>>>,
+): ApiKeyProviderSpec {
+  return {
+    provider_id: providerId,
+    endpoint_paths_by_wire_family: paths,
+  };
+}
+
+const BEARER_PATHS = { chat: "/chat/completions", responses: "/responses" } as const;
+
 /**
  * Builtin providers whose entire adapter contract is "bearer auth against the
  * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
- * responses, `/v1`-prefixed paths". They carry no catalog, no OAuth, and no
- * provider-specific payload hook, so they share one spec shape rather than
- * one module each.
+ * responses, with endpoint paths declared below the base's version root". They
+ * carry no catalog, no OAuth, and no provider-specific payload hook, so they
+ * share one spec shape rather than one module each.
  *
  * `base_url` is resolved per provider by `providerBaseUrl(provider_id)`.
  *
@@ -14,29 +38,31 @@ import type { ProviderId } from "./provider-contracts";
  * than a static catalog: every one of them republishes an aggregator's whole
  * roster, which changes faster than a committed array can. Each registry row
  * pairs this spec with `openAIModelDiscovery`.
+ *
+ * The id list is derived from the spec record so the two cannot drift apart.
  */
-export const GENERIC_API_KEY_PROVIDER_IDS = [
-  "larprouter",
-  "mistral",
-  "fireworks",
-  "nvidia",
-  "gmi",
-  "ollamacloud",
-  "together",
-  "siliconflow",
-  "siliconflowcn",
-  "nanogpt",
-  "baseten",
-  "synthetic",
-  "stepfun",
-  "sakana",
-  "helmcode",
-  "coralbricks",
-  "aiand",
-  "wafer",
-  "coreweave",
-  "qwen-portal",
-  "dashscope",
+export const GENERIC_API_KEY_SPECS = {
+  larprouter: apiKeySpec("larprouter", BEARER_PATHS),
+  mistral: apiKeySpec("mistral", BEARER_PATHS),
+  fireworks: apiKeySpec("fireworks", BEARER_PATHS),
+  nvidia: apiKeySpec("nvidia", BEARER_PATHS),
+  gmi: apiKeySpec("gmi", BEARER_PATHS),
+  ollamacloud: apiKeySpec("ollamacloud", BEARER_PATHS),
+  together: apiKeySpec("together", BEARER_PATHS),
+  siliconflow: apiKeySpec("siliconflow", BEARER_PATHS),
+  siliconflowcn: apiKeySpec("siliconflowcn", BEARER_PATHS),
+  nanogpt: apiKeySpec("nanogpt", BEARER_PATHS),
+  baseten: apiKeySpec("baseten", BEARER_PATHS),
+  synthetic: apiKeySpec("synthetic", BEARER_PATHS),
+  stepfun: apiKeySpec("stepfun", BEARER_PATHS),
+  sakana: apiKeySpec("sakana", BEARER_PATHS),
+  helmcode: apiKeySpec("helmcode", BEARER_PATHS),
+  coralbricks: apiKeySpec("coralbricks", BEARER_PATHS),
+  aiand: apiKeySpec("aiand", BEARER_PATHS),
+  wafer: apiKeySpec("wafer", BEARER_PATHS),
+  coreweave: apiKeySpec("coreweave", BEARER_PATHS),
+  dashscope: apiKeySpec("dashscope", BEARER_PATHS),
+  "qwen-portal": apiKeySpec("qwen-portal", BEARER_PATHS),
   // `deepseek` is intentionally absent: it dispatches on the Anthropic Messages
   // wire at its `/anthropic` root, not the OpenAI chat/responses wires, so it
   // carries a dedicated entry in `default-registry.ts` instead.
@@ -45,10 +71,24 @@ export const GENERIC_API_KEY_PROVIDER_IDS = [
   // already rooted at a version segment that the `/v1`-prefixed path this shape
   // pins would duplicate (`/openai/v1`, `/v1/openai`, `/v3/openai`, `/api/v1`,
   // `/v2`, and `/inference/v1`), so `joinUrl` would produce
-  // `…/v1/v1/chat/completions`. They use `versionedRootApiKeySpec` instead,
+  // `…/v1/v1/chat/completions`. They use the versioned-root spec instead,
   // which pins the path below the version root — the same reason `cerebras`
   // declares `/chat/completions` explicitly.
-] as const;
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+/**
+ * One id that has both a generic spec and a registry row.
+ *
+ * Exported so the registry can be checked against the spec list rather than
+ * repeating the id as a string: `discoveryBackedProvider` takes this type, so a
+ * row naming a provider with no spec is a compile error instead of an
+ * `undefined` adapter at first dispatch.
+ */
+export type GenericApiKeyProviderId = keyof typeof GENERIC_API_KEY_SPECS;
+
+export const GENERIC_API_KEY_PROVIDER_IDS = Object.keys(
+  GENERIC_API_KEY_SPECS,
+) as readonly GenericApiKeyProviderId[];
 
 /**
  * Ids whose base URL already ends at a version segment.
@@ -59,77 +99,22 @@ export const GENERIC_API_KEY_PROVIDER_IDS = [
  * version root. That is the provider stating the truth about its own wire, not
  * a correction applied to it: a wrong path now reaches the operator as the
  * wrong URL instead of being quietly rewritten into a different address.
- */
-export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = [
-  "groq",
-  "deepinfra",
-  "novita",
-  "venice",
-  "qianfan",
-  "zhipucoding",
-  "firepass",
-] as const;
-
-export type VersionedRootApiKeyProviderId =
-  (typeof VERSIONED_ROOT_API_KEY_PROVIDER_IDS)[number];
-
-function versionedRootApiKeySpec(providerId: ProviderId): ApiKeyProviderSpec {
-  return {
-    provider_id: providerId,
-    endpoint_paths_by_wire_family: {
-      chat: "/chat/completions",
-      responses: "/responses",
-    },
-  };
-}
-
-export const VERSIONED_ROOT_API_KEY_SPECS = {
-  groq: versionedRootApiKeySpec("groq"),
-  deepinfra: versionedRootApiKeySpec("deepinfra"),
-  novita: versionedRootApiKeySpec("novita"),
-  venice: versionedRootApiKeySpec("venice"),
-  qianfan: versionedRootApiKeySpec("qianfan"),
-  zhipucoding: versionedRootApiKeySpec("zhipucoding"),
-  firepass: versionedRootApiKeySpec("firepass"),
-} satisfies Readonly<Record<VersionedRootApiKeyProviderId, ApiKeyProviderSpec>>;
-
-/**
- * One id that has both a generic spec and a registry row.
  *
- * Exported so the registry can be checked against the spec list rather than
- * repeating the id as a string: `discoveryBackedProvider` takes this type, so a
- * row naming a provider with no spec is a compile error instead of an
- * `undefined` adapter at first dispatch.
+ * The id list is derived from the spec record so the two cannot drift apart.
  */
-export type GenericApiKeyProviderId = (typeof GENERIC_API_KEY_PROVIDER_IDS)[number];
+export const VERSIONED_ROOT_API_KEY_SPECS = {
+  groq: apiKeySpec("groq", BEARER_PATHS),
+  deepinfra: apiKeySpec("deepinfra", BEARER_PATHS),
+  novita: apiKeySpec("novita", BEARER_PATHS),
+  venice: apiKeySpec("venice", BEARER_PATHS),
+  qianfan: apiKeySpec("qianfan", BEARER_PATHS),
+  zhipucoding: apiKeySpec("zhipucoding", BEARER_PATHS),
+  firepass: apiKeySpec("firepass", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
 
-function genericApiKeySpec(providerId: GenericApiKeyProviderId): ApiKeyProviderSpec {
-  // These roots are *not* bare hosts — every one of them already ends at `/v1`
-  // — so the path is declared below that root. Both spec shapes declare the same
-  // thing, so this is the one implementation.
-  return versionedRootApiKeySpec(providerId);
-}
+export type VersionedRootApiKeyProviderId =
+  keyof typeof VERSIONED_ROOT_API_KEY_SPECS;
 
-export const GENERIC_API_KEY_SPECS = {
-  larprouter: genericApiKeySpec("larprouter"),
-  mistral: genericApiKeySpec("mistral"),
-  fireworks: genericApiKeySpec("fireworks"),
-  nvidia: genericApiKeySpec("nvidia"),
-  gmi: genericApiKeySpec("gmi"),
-  ollamacloud: genericApiKeySpec("ollamacloud"),
-  together: genericApiKeySpec("together"),
-  siliconflow: genericApiKeySpec("siliconflow"),
-  siliconflowcn: genericApiKeySpec("siliconflowcn"),
-  nanogpt: genericApiKeySpec("nanogpt"),
-  baseten: genericApiKeySpec("baseten"),
-  synthetic: genericApiKeySpec("synthetic"),
-  stepfun: genericApiKeySpec("stepfun"),
-  sakana: genericApiKeySpec("sakana"),
-  helmcode: genericApiKeySpec("helmcode"),
-  coralbricks: genericApiKeySpec("coralbricks"),
-  aiand: genericApiKeySpec("aiand"),
-  wafer: genericApiKeySpec("wafer"),
-  coreweave: genericApiKeySpec("coreweave"),
-  dashscope: genericApiKeySpec("dashscope"),
-  "qwen-portal": genericApiKeySpec("qwen-portal"),
-} satisfies Readonly<Record<GenericApiKeyProviderId, ApiKeyProviderSpec>>;
+export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = Object.keys(
+  VERSIONED_ROOT_API_KEY_SPECS,
+) as readonly VersionedRootApiKeyProviderId[];

package/src/providers/configured-provider.ts

@@ -11,7 +11,7 @@ export function ensurePayloadModel(
 ): string {
   const value = payload["model"];
   const model = typeof value === "string" && value.trim() ? value.trim() : candidate.model_id.trim();
-  if (!model) throw new GatewayError("invalid_request", 400, `${providerName} model is required`);
+  if (!model) throw new GatewayError("invalid_request", 400, `${providerName} model is required (request {requestId}). Check the shape of what you sent — then resend 🪞`);
   payload["model"] = model;
   return model;
 }

package/src/providers/default-registry.ts

@@ -5,7 +5,7 @@
 import {
   GENERIC_API_KEY_SPECS,
 } from "./configured-openai-providers";
-import { createDiscoveryBackedProviderCapabilities } from "./bundled-discovery-providers";
+import { createDiscoveryBackedProviderCapabilities, discoveryBackedCapabilities } from "./bundled-discovery-providers";
 import { createApiKeyAdapter } from "./configured-provider";
 import type { ApiKeyProviderSpec } from "./configured-provider";
 import { oauthCapability, quotaCapability, type ProviderModuleCapabilities } from "./provider-capabilities";
@@ -131,39 +131,6 @@ function qoderDiscovery(
 }
 
 
-/**
- * Builds the `loadAdapter` + `loadModelDiscovery` pair every plain bearer
- * provider needs.
- *
- * Only the base URL differs between them, so both halves are shared: the
- * adapter is the generic spec and the discovery call is a bearer
- * `GET {base}/models`. Keeping them in one function is what stops the pairing
- * from drifting — registering a provider with one half and not the other is
- * exactly how `gmi`, `nvidia`, and `fireworks` came to ship with no catalog
- * *and* no discovery, which is a provider that lists zero models with no way to
- * fetch any. `test/providers/generic-provider-completeness.test.ts` holds both.
- */
-function discoveryBacked(
-  providerId: string,
-  spec: ApiKeyProviderSpec,
-): ProviderModuleCapabilities {
-  return {
-    // The registry map is what discovery and probing read
-    // (`discoveryPathsFor`), while the spec's copy is what the adapter
-    // dispatches on. Setting only the spec leaves a discovered model resolving
-    // its wire from the generic default instead of the path the adapter will
-    // actually call, which is how a probe verifies one endpoint while dispatch
-    // hits another.
-    ...(spec.endpoint_paths_by_wire_family === undefined
-      ? {}
-      : { endpointPathsByWireFamily: spec.endpoint_paths_by_wire_family }),
-    loadAdapter: async () => createApiKeyAdapter(spec),
-    loadModelDiscovery: openAIModelDiscovery(providerId, {
-      headers: (credential) => ({ authorization: `Bearer ${credential}` }),
-    }),
-  };
-}
-
 function openAIModelDiscovery(
   providerId: string,
   options?: {
@@ -617,6 +584,27 @@ export const PROVIDER_CAPABILITIES = {
     // and Z.AI publishes no refresh grant for it (`refresh "none"` upstream).
     loadAuthentication: oauthCapability(() => import("./integrations/zcode/oauth"), "zcodeOAuthClient"),
   },
+  "zcode-start": {
+    // Free plan surface: an Anthropic-Messages endpoint that only accepts the
+    // dressed ZCode client request (see the integration). The credential is a
+    // ZCode login JWT — pasted, or minted by the sign-in flow below.
+    loadAdapter: async () =>
+      createApiKeyAdapter(
+        (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_SPEC,
+      ),
+    loadModels: async () =>
+      (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_MODELS,
+    // The device flow stores the issued ZCode login JWT, not a Coding Plan key.
+    loadAuthentication: oauthCapability(
+      () => import("./integrations/zcode-start-plan/oauth"),
+      "zcodeStartPlanOAuthClient",
+    ),
+    // Keep each reported entitlement and activation/reset window separate.
+    loadQuotaCollector: quotaCapability(
+      () => import("./integrations/zcode-start-plan/quota"),
+      "fetchZcodeStartPlanQuota",
+    ),
+  },
   "factory": {
     loadAdapter: async () => (await import("./integrations/factory/factory")).factoryAdapter,
     // Factory publishes no model-listing endpoint — the roster is a client-side
@@ -765,7 +753,7 @@ export const PROVIDER_CAPABILITIES = {
   // synced account sees whatever the plan currently serves. The catalog keeps
   // the provider usable before anyone syncs.
   dashscope: {
-    ...discoveryBacked("dashscope", GENERIC_API_KEY_SPECS.dashscope),
+    ...discoveryBackedCapabilities("dashscope", GENERIC_API_KEY_SPECS.dashscope, openAIModelDiscovery),
     loadModels: async () => (await import("./integrations/dashscope-models")).DASHSCOPE_MODELS,
   },
 

package/src/providers/discovery/catalog/catalog-format.ts

@@ -420,13 +420,24 @@ export class PackedCatalog {
     return metadata;
   }
 
-  /** Stated context limit, or `null`. */
+  /**
+   * Stated context limit, or `null`.
+   *
+   * Stored in a `Uint32Array` column; the generator
+   * (`scripts/tools/generate-models.ts`) refuses to write a value ≥ 2^31
+   * (`checkedPackedLimit`), so no row here can wrap modulo 2^32 and decode as a
+   * garbage limit.
+   */
   rowContext(index: number): number | null {
     const value = this.u32At(this.layout.ctx + index * 4);
     return value > 0 ? value : null;
   }
 
-  /** Stated output limit, or `null`. */
+  /**
+   * Stated output limit, or `null`.
+   *
+   * Same u32 storage contract as `rowContext` — see the generator guard.
+   */
   rowOutput(index: number): number | null {
     const value = this.u32At(this.layout.out + index * 4);
     return value > 0 ? value : null;

package/src/providers/discovery/discovery-types.ts

@@ -1,7 +1,6 @@
 import type { FetchLike } from "../quota/quota-contracts";
 import type { ModelDefinition } from "../provider-model-definition";
 import type { ServiceKind } from "../../protocol/canonical-model";
-
 /**
  * Credential-scoped model-discovery input.
  *

package/src/providers/discovery/openai-model-discovery.ts

@@ -3,6 +3,7 @@ import { isRecord } from "../../protocol/codecs";
 import { boundedUpstreamArray, boundedUpstreamNumber, sanitizeUpstreamLabel } from "../provider-sanitize";
 import { modelsDevCatalog } from "./models-dev-catalog";
 import { isResponsesNativeModelId } from "../provider-model-definition";
+import { composeAbortSignal } from "../authentication/oauth-flow-store";
 interface FetchModelsOptions {
   readonly baseUrl: string;
   /**
@@ -27,8 +28,7 @@ export async function fetchOpenAICompatibleModels(
 ): Promise<readonly ModelDefinition[] | null> {
   const fetcher = options.fetcher ?? fetch;
   const url = `${options.baseUrl.replace(/\/+$/, "")}/models`;
-  const timeoutSignal = AbortSignal.timeout(10_000);
-  const signal = options.signal === undefined ? timeoutSignal : AbortSignal.any([options.signal, timeoutSignal]);
+  const signal = composeAbortSignal(options.signal, 10_000);
   try {
     const response = await fetcher(url, {
       headers: {

package/src/providers/discovery/probe-phases.ts

@@ -74,8 +74,24 @@ export function wireContextFrom(
   };
 }
 
-/** Grok's account feature probe intentionally uses the same Responses request as live traffic. */
-export const GROK_407_PROBE_PROMPT = "reply my message with exact number 407";
+/**
+ * Grok's account feature probe intentionally uses the same Responses request as
+ * live traffic.
+ *
+ * The prompt must make the model actually reply `407` — that literal is the
+ * healthy-account signal the probe verdict keys on. Naive phrasing refused by
+ * the model ("I can't reply with only a specific number", "I won't comply
+ * with a demand to output only an exact phrase") are listed above; verified
+ * live 2026-11-02 (grok-4.7) that this prompt returns exactly `407`:
+ *
+ *   "Type the number 407."      → "407"
+ *   "Echo the diagnostic code 407." → "407"
+ *   "Print the number 407 and nothing else." → "407"
+ *
+ * The verdict normalizes away Grok's trailing confidence annotation
+ * (`407 \confidence{100}`), so the match is on the bare number.
+ */
+export const GROK_407_PROBE_PROMPT = "Type the number 407.";
 
 /**
  * Converts a failed/mismatched Grok feature probe into a quota-shaped upstream
@@ -91,8 +107,10 @@ export function grok407ProbeFailure(args: {
   if (args.providerId !== "grok" || args.prompt !== GROK_407_PROBE_PROMPT) return undefined;
   const sample = extractSample(args.events);
   const normalizedSample = sample?.replace(/\\confidence\{\d+\}\s*$/i, "").trim();
-  // A valid Grok answer may carry the provider's confidence annotation after
-  // the numeric result, and a terminal metadata error may arrive after text.
+  // A healthy account answers exactly `407` (optionally with Grok's trailing
+  // confidence annotation). The model refuses some phrasings of the same ask,
+  // but the probe prompt above is engineered to pass, so any other sample is a
+  // failure — quota-shaped, not a payload bug.
   if (normalizedSample === "407") return undefined;
   const priorDetails = args.dispatchError instanceof GatewayError ? args.dispatchError.details : {};
   const providerStatus =
@@ -109,7 +127,7 @@ export function grok407ProbeFailure(args: {
   return new GatewayError(
     "quota_exceeded",
     429,
-    detail,
+    `${detail} (request {requestId}). You've maxed this window — pace yourself ⏳`,
     {
       ...priorDetails,
       providerCode: "subscription:free-usage-exhausted",
@@ -289,7 +307,7 @@ export async function resolveProbeTarget(args: {
           throw new GatewayError(
             "model_not_found",
             404,
-            `No ${requestedServiceKind} model ${modelId} is registered for provider ${providerId}`,
+            `No ${requestedServiceKind} model ${modelId} is registered for provider ${providerId} (request {requestId}). Try another model — this one's off the menu 📚`,
           );
         }
         const ctx = wireContextFrom(providerWireRow);
@@ -348,6 +366,30 @@ export type ProbeAccountSelection =
   | { readonly ok: true; readonly accountId: string | undefined }
   | { readonly ok: false; readonly error: string };
 
+/**
+ * Selects the first usable account row: status ≠ disabled, cooldown elapsed
+ * (unless `allowCoolingAccount`), preferring a tenant-owned account over a
+ * shared global one. Shared by the discovery and probing paths so both
+ * agree on which account a provider answers as.
+ */
+export function selectUsableAccount<T extends {
+  readonly tenantId: string | null;
+  readonly status: string;
+  readonly cooldownUntil: Date | null;
+}>(
+  rows: readonly T[],
+  allowCoolingAccount = false,
+  now = Date.now(),
+): T | undefined {
+  return rows
+    .filter(
+      (row) =>
+        row.status !== "disabled" &&
+        (allowCoolingAccount || row.cooldownUntil === null || row.cooldownUntil.getTime() <= now),
+    )
+    .sort((left, right) => Number(right.tenantId !== null) - Number(left.tenantId !== null))[0];
+}
+
 /**
  * Phase 2 — pick the account the probe runs as. Snapshot-equivalent health
  * filtering: disabled accounts and live cooldowns never route, so probes must
@@ -388,15 +430,8 @@ export async function selectProbeAccount(args: {
           ),
         )
     : [];
-  const now = Date.now();
-  const usableAccounts = accountRows
-    .filter(
-      (row) =>
-        row.status !== "disabled" &&
-        (allowCoolingAccount || row.cooldownUntil === null || row.cooldownUntil.getTime() <= now),
-    )
-    .sort((left, right) => Number(right.tenantId !== null) - Number(left.tenantId !== null));
-  const accountId = requestedAccountId ?? usableAccounts[0]?.id;
+  const usableAccount = selectUsableAccount(accountRows, allowCoolingAccount);
+  const accountId = requestedAccountId ?? usableAccount?.id;
   if (!accountId && requiresAccount) {
     return {
       ok: false,