cartethyia 2.7.4 → 2.7.5

package/src/console/api-keys/routes.ts

@@ -11,7 +11,7 @@ import { generateShareSlug, hashShareToken } from "../../persistence/stores/shar
 import type { AccessDecision } from "../../security/access-control";
 import { ConsoleDomainError, errorResponse, requireTenantScope } from "../shared/errors";
 import { literalUnion } from "../shared/elysia-schema";
-import { API_KEY_MODES, API_KEY_MODEL_ACCESS_MODES, type ShareLinkKind } from "../../persistence/schema";
+import { API_KEY_MODES, API_KEY_MODEL_ACCESS_MODES, API_KEY_CONCURRENCY_SCOPES, type ShareLinkKind } from "../../persistence/schema";
 import type { ApiKeyConfig, ApiKeyResponse, BanApiKeyRequest, UpdateApiKeyResponse } from "./contracts";
 import type {
   ApiKeyPatch,
@@ -20,6 +20,7 @@ import type {
   SharedChildrenPageOptions,
 } from "../../persistence/stores/api-key-store";
 import {
+  API_KEY_BAN_REASONS,
   BAN_DURATION_CHOICES,
   DEFAULT_BAN_MINUTES,
   generateApiKeySecret,
@@ -40,6 +41,7 @@ import {
 } from "./contracts";
 import type { SharedKeyActivityDetail, SharedKeySummary } from "../share/share-usage";
 import { popupImageBytes } from "./share-popup-image";
+import { log } from "../../observability/logger";
 
 const SHARED_CHILD_SORT_COLUMNS = new Set<SharedChildSortColumn>([
   "createdAt",
@@ -50,6 +52,9 @@ const SHARED_CHILD_SORT_COLUMNS = new Set<SharedChildSortColumn>([
   "enabled",
 ]);
 
+/** The offered ban durations as a set of minute values, hoisted once. */
+const BAN_DURATION_MINUTES = new Set(BAN_DURATION_CHOICES.map((choice) => choice.minutes));
+
 /** Parses and bounds the paginated share-child list query. */
 function parseSharedChildrenQuery(query: URLSearchParams): SharedChildrenPageOptions {
   const limitRaw = query.get("limit");
@@ -95,7 +100,16 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
             if (record.keyMode !== "share") return response;
             const family = await config.store
               .sumFamilyTelemetryConsumed(authorized.tenantId, record.id)
-              .catch(() => 0);
+              .catch((error) => {
+                // A failed sum must not fail the whole list, but it must not
+                // be silent either: reporting the share template's spend as 0
+                // under-reports consumed tokens in the console list.
+                log.warn(
+                  `[api-keys] sumFamilyTelemetryConsumed failed for key ${record.id}; reporting 0`,
+                  error as Error,
+                );
+                return 0;
+              });
             return { ...response, tokensConsumed: response.tokensConsumed + family };
           }),
         );
@@ -187,6 +201,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         ...(request.monthlyTokenLimit == null ? {} : { monthlyTokenLimit: request.monthlyTokenLimit }),
         ...(request.lifetimeTokenBudget == null ? {} : { lifetimeTokenBudget: request.lifetimeTokenBudget }),
         ...(request.maxConcurrentRequests == null ? {} : { maxConcurrentRequests: request.maxConcurrentRequests }),
+        ...(request.concurrencyScope !== undefined ? { concurrencyScope: request.concurrencyScope } : {}),
         ...(request.maxChildren == null ? {} : { maxChildren: request.maxChildren }),
         ...(request.modelPrefix === undefined ? {} : { modelPrefix: request.modelPrefix }),
         modelAccessMode: request.modelAccessMode ?? "whitelist",
@@ -322,6 +337,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         ...(patchRequest.monthlyTokenLimit === undefined ? {} : { monthlyTokenLimit: patchRequest.monthlyTokenLimit }),
         ...(patchRequest.lifetimeTokenBudget === undefined ? {} : { lifetimeTokenBudget: patchRequest.lifetimeTokenBudget }),
         ...(patchRequest.maxConcurrentRequests === undefined ? {} : { maxConcurrentRequests: patchRequest.maxConcurrentRequests }),
+        ...(patchRequest.concurrencyScope !== undefined ? { concurrencyScope: patchRequest.concurrencyScope } : {}),
         ...(patchRequest.maxChildren === undefined ? {} : { maxChildren: patchRequest.maxChildren }),
         ...(patchRequest.modelPrefix === undefined ? {} : { modelPrefix: patchRequest.modelPrefix }),
         ...(patchRequest.modelAccessMode === undefined ? {} : { modelAccessMode: patchRequest.modelAccessMode }),
@@ -791,8 +807,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
       // clamping would answer a request for 90 days with a week and report
       // success.
       const chosenMinutes = request.minutes === undefined ? DEFAULT_BAN_MINUTES : request.minutes;
-      const allowed = new Set(BAN_DURATION_CHOICES.map((choice) => choice.minutes));
-      if (!allowed.has(chosenMinutes)) {
+      if (!BAN_DURATION_MINUTES.has(chosenMinutes)) {
         throw new ConsoleDomainError(
           "invalid_request",
           400,
@@ -814,11 +829,27 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         access: authorized,
         action: "api_key.banned",
         target: keyId,
-        detail: { reason, ...(bannedUntil === null ? { permanent: true } : { bannedUntil: bannedUntil.toISOString() }) },
+        detail: {
+          reason,
+          // The human-readable label is derived server-side from the machine
+          // `reason`, so the audit trail cannot be skewed by a client-authored
+          // label. Unknown reasons (custom text) simply carry no label; the
+          // free-text `reason` above is still recorded verbatim.
+          ...(API_KEY_BAN_REASONS.find((r) => r.value === reason)?.label === undefined
+            ? {}
+            : { reasonLabel: API_KEY_BAN_REASONS.find((r) => r.value === reason)!.label }),
+          ...(bannedUntil === null ? { permanent: true } : { bannedUntil: bannedUntil.toISOString() }),
+        },
+      });
+      // The ban mutates the row already fetched; derive the response from that
+      // record instead of re-fetching after the write. Match the store's own
+      // mapping: a `null` (permanent) `bannedUntil` is omitted, not carried.
+      return sanitizeApiKeyResponse({
+        ...current,
+        bannedAt: new Date(),
+        banReason: reason,
+        ...(bannedUntil ? { bannedUntil } : {}),
       });
-      const record = await config.store.get(authorized.tenantId, keyId);
-      if (!record) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
-      return sanitizeApiKeyResponse(record);
     },
     async unbanKey(
       access: AccessDecision | undefined,
@@ -836,9 +867,11 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         action: "api_key.unbanned",
         target: keyId,
       });
-      const record = await config.store.get(authorized.tenantId, keyId);
-      if (!record) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
-      return sanitizeApiKeyResponse(record);
+      // Unban clears all three ban columns and re-enables the key; derive the
+      // response from the pre-fetch instead of re-fetching after the write.
+      const { bannedAt: _bannedAt, banReason: _banReason, bannedUntil: _bannedUntil, ...currentRest } = current;
+      const unbannedRecord: ApiKeyRecord = { ...currentRest, enabled: true };
+      return sanitizeApiKeyResponse(unbannedRecord);
     },
   };
   return operations;
@@ -858,6 +891,7 @@ const apiKeyBody = t.Object({
   monthlyTokenLimit: t.Optional(t.Union([t.Number(), t.Null()])),
   lifetimeTokenBudget: t.Optional(t.Union([t.Number(), t.Null()])),
   maxConcurrentRequests: t.Optional(t.Union([t.Number(), t.Null()])),
+  concurrencyScope: t.Optional(literalUnion(API_KEY_CONCURRENCY_SCOPES)),
   modelPrefix: t.Optional(t.String()),
   modelAccessMode: t.Optional(literalUnion(API_KEY_MODEL_ACCESS_MODES)),
   modelList: t.Optional(t.Array(t.String())),
@@ -1020,7 +1054,9 @@ export function createApiKeyRoutes(config: ApiKeyConfig): AnyElysia {
       {
         body: t.Object({
           reason: t.String(),
-          reasonLabel: t.Optional(t.String()),
+          // `reasonLabel` is deliberately not accepted: the audit label is
+          // derived server-side from `reason` (see `banKey`), so a client
+          // cannot author the human-readable audit entry.
           minutes: t.Optional(t.Union([t.Number({ minimum: 1 }), t.Null()])),
         }),
       },

package/src/console/auth/access.ts

@@ -1,4 +1,4 @@
-import type { AccessDecision } from "../../security/access-control";
-
-/** Resolves the authenticated console request to a tenant-scoped decision. */
-export type ConsoleAccessResolver = (request: Request) => AccessDecision | undefined;
+import type { AccessDecision } from "../../security/access-control";
+
+/** Resolves the authenticated console request to a tenant-scoped decision. */
+export type ConsoleAccessResolver = (request: Request) => AccessDecision | undefined;

package/src/console/auth/account-reset.ts

@@ -25,7 +25,7 @@
 import { GatewayError } from "../../protocol/gateway-error";
 import { isLoopbackPeer, tokenMatches } from "../../transport/drain-endpoint";
 
-export interface ConsoleAccountResetDeps {
+interface ConsoleAccountResetDeps {
   /** Shared secret; the route is registered only when this is set. */
   readonly token: string;
   /** Removes every console user and session. Resolves to the number removed. */

package/src/console/auth/audit-recorder.ts

@@ -8,7 +8,7 @@ import {
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import { type AccessDecision } from "../../security/access-control";
 
-export interface AuditRecordInput {
+interface AuditRecordInput {
   readonly access: AccessDecision;
   readonly action: string;
   readonly target: string;

package/src/console/auth/lockout.ts

@@ -7,8 +7,9 @@ import {
 } from "../../persistence/schema";
 
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { log } from "../../observability/logger";
 
-export class ConsoleLockoutStore {
+class ConsoleLockoutStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
   async getLockedUntil(ip: string): Promise<Date | null | undefined> {
@@ -143,8 +144,11 @@ export class ConsoleLockoutService {
           enforcement: "full_network_lockout",
         },
       });
-    } catch {
-      // Best-effort audit logging; the ban itself remains enforced via the DB row.
+    } catch (error) {
+      // Best-effort audit logging; the ban itself remains enforced via the DB
+      // row. A failed write is logged — for a security-relevant event
+      // (`security.ip_banned`) total silence would hide a broken audit trail.
+      log.error(`[auth] failed to record ip_banned audit for ${ip}`, error as Error, reason);
     }
   }
 

package/src/console/auth/row-coercion.ts

@@ -3,7 +3,7 @@ import type { ConsoleSession, ConsoleUser } from "../../persistence/schema";
 
 import { isRecord } from "../../protocol/codecs";
 
-export function asDate(value: unknown): Date | undefined {
+function asDate(value: unknown): Date | undefined {
   if (value instanceof Date && !Number.isNaN(value.getTime())) return value;
   if (typeof value === "string" || typeof value === "number") {
     const date = new Date(value);
@@ -14,33 +14,78 @@ export function asDate(value: unknown): Date | undefined {
 
 export function sessionRecord(value: unknown): ConsoleSession | undefined {
   if (!isRecord(value)) return undefined;
+  const id = value.id;
+  const userId = value.userId;
+  const sessionToken = value.sessionToken;
+  const ipAddress = value.ipAddress;
+  const userAgent = value.userAgent;
   if (
-    typeof value.id !== "string" ||
-    typeof value.userId !== "string" ||
-    typeof value.sessionToken !== "string"
+    typeof id !== "string" ||
+    typeof userId !== "string" ||
+    typeof sessionToken !== "string"
   ) {
     return undefined;
   }
   const expiresAt = asDate(value.expiresAt);
   const createdAt = asDate(value.createdAt);
   if (!expiresAt || !createdAt) return undefined;
-  return { ...value, expiresAt, createdAt } as unknown as ConsoleSession;
+  // Construct the result explicitly field-by-field so the output shape is
+  // exactly what was validated — arbitrary extra keys on a driver row must
+  // not survive into the typed session.
+  return {
+    id,
+    userId,
+    sessionToken,
+    ...(ipAddress === null || typeof ipAddress === "string" ? { ipAddress } : { ipAddress: null }),
+    ...(userAgent === null || typeof userAgent === "string" ? { userAgent } : { userAgent: null }),
+    expiresAt,
+    createdAt,
+  };
 }
 
 export function userRecord(value: unknown): ConsoleUser | undefined {
   if (!isRecord(value)) return undefined;
+  const id = value.id;
+  const username = value.username;
+  const passwordHash = value.passwordHash;
+  const isActive = value.isActive;
   if (
-    typeof value.id !== "string" ||
-    typeof value.username !== "string" ||
-    typeof value.passwordHash !== "string" ||
-    typeof value.isActive !== "boolean"
+    typeof id !== "string" ||
+    typeof username !== "string" ||
+    typeof passwordHash !== "string" ||
+    typeof isActive !== "boolean"
   ) {
     return undefined;
   }
-  return value as unknown as ConsoleUser;
+  // Timestamps are coerced through `asDate` because SQLite hands them back as
+  // text; a login path that rejects non-Date values must still work there.
+  const createdAt = asDate(value.createdAt);
+  const updatedAt = asDate(value.updatedAt);
+  if (!createdAt || !updatedAt) return undefined;
+  const tenantId = value.tenantId;
+  const email = value.email;
+  const displayName = value.displayName;
+  const isFirstBoot = value.isFirstBoot;
+  const isPlatformAdmin = value.isPlatformAdmin;
+  // Construct the result explicitly field-by-field so the output shape is
+  // exactly what was validated — arbitrary extra keys on a driver row must
+  // not survive into the typed user.
+  return {
+    id,
+    tenantId: typeof tenantId === "string" ? tenantId : "",
+    username,
+    email: typeof email === "string" ? email : null,
+    passwordHash,
+    displayName: typeof displayName === "string" ? displayName : null,
+    isActive,
+    isPlatformAdmin: isPlatformAdmin === true,
+    isFirstBoot: isFirstBoot === true,
+    createdAt,
+    updatedAt,
+  };
 }
 
-export function mutationAffectedRows(value: unknown): number | undefined {
+function mutationAffectedRows(value: unknown): number | undefined {
   if (!isRecord(value)) return undefined;
   for (const key of ["rowCount", "rowsAffected", "changes"] as const) {
     const count = value[key];
@@ -50,7 +95,7 @@ export function mutationAffectedRows(value: unknown): number | undefined {
 }
 
 /** Awaitable Drizzle mutation builder that may expose `.returning()`. */
-export interface ReturningBuilder extends PromiseLike<unknown> {
+interface ReturningBuilder extends PromiseLike<unknown> {
   returning?: (...columns: unknown[]) => PromiseLike<unknown[]>;
 }
 

package/src/console/auth/session-resolver.ts

@@ -45,7 +45,7 @@ export async function resolveConsoleAccess(
 }
 
 /** The signed-in console user behind a request, or `null` when unauthenticated. */
-export interface ResolvedConsoleUser {
+interface ResolvedConsoleUser {
   readonly id: string;
   readonly sessionId: string;
   readonly tenantId: string;

package/src/console/auth/session-service.ts

@@ -58,7 +58,7 @@ function newSessionToken(): string {
   return randomBytes(32).toString("base64url");
 }
 
-export class ConsoleSessionStore {
+class ConsoleSessionStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
   async create(newSession: {
@@ -73,7 +73,13 @@ export class ConsoleSessionStore {
     const inserted = await returningRows(this.db.insert(consoleSessions).values(newSession));
     assertMutationApplied(inserted, "Console session");
     const persisted = sessionRecord(inserted.rows[0]);
-    return persisted ?? ({ ...newSession } as unknown as ConsoleSession);
+    if (!persisted) {
+      // `assertMutationApplied` already refused a failed insert, so an
+      // unshaped row here is a driver/schema mismatch — pretending success by
+      // returning the input cast to ConsoleSession would mask it.
+      throw new Error("Console session row could not be coerced after insert");
+    }
+    return persisted;
   }
 
   async findValidByTokenHash(tokenHash: string, now: Date): Promise<ConsoleSession | null> {

package/src/console/auth/session.ts

@@ -13,12 +13,13 @@ import type { FirstBootSetupService } from "./setup-service";
 import { isTrustedProxyPeer, resolveClientIdentity } from "../../security/ip-boundary";
 import type { TrustedProxyBoundary } from "../../config/network";
 import { readSessionCookie } from "./session-resolver";
-export interface LoginRequest {
+import { asConsoleDb } from "../shared/transaction";
+interface LoginRequest {
   readonly username: string;
   readonly password: string;
 }
 
-export interface LoginResponse {
+interface LoginResponse {
   readonly status: "success" | "failed";
   /** Session secrets are cookie-only and are never returned in JSON. */
   readonly session_id?: never;
@@ -47,13 +48,13 @@ export type SessionStatusResponse =
     }
   | { readonly status: "unauthenticated" };
 
-export interface SetupRequest {
+interface SetupRequest {
   readonly password: string;
   readonly username?: string;
   readonly display_name?: string;
 }
 
-export interface SetupResponse {
+interface SetupResponse {
   readonly status: "success" | "failed";
   readonly message?: string;
 }
@@ -65,7 +66,7 @@ export interface SetupResponse {
  * report that instead of only "it worked".
  */
 /** A backup's cover, so the wizard can show what a file holds before restoring. */
-export interface SetupInspectResponse extends SetupResponse {
+interface SetupInspectResponse extends SetupResponse {
   readonly format?: "native" | "nine_router";
   readonly version?: number;
   readonly exportedAt?: string;
@@ -79,18 +80,18 @@ export interface SetupInspectResponse extends SetupResponse {
   readonly warnings?: readonly { readonly table?: string; readonly column?: string; readonly reason: string }[];
 }
 
-export interface SetupRestoreResponse extends SetupResponse {
+interface SetupRestoreResponse extends SetupResponse {
   readonly restored?: Record<string, number>;
   readonly warnings?: readonly { readonly table?: string; readonly column?: string; readonly reason: string }[];
   /** The administrator this install was given, since the file carries none. */
   readonly createdAdmin?: boolean;
 }
 
-export interface LogoutResponse {
+interface LogoutResponse {
   readonly status: "success";
 }
 
-export interface ChangePasswordResponse {
+interface ChangePasswordResponse {
   readonly status: "success" | "failed";
   readonly message?: string;
 }
@@ -183,6 +184,31 @@ async function lockedOutMessage(
   };
 }
 
+/**
+ * Records one failed login and answers with the 429/401 result, including the
+ * `retry-after` header when the failure took the lock. Shared by the unknown /
+ * inactive-user and wrong-password branches, which differ only in the audit
+ * reason string.
+ */
+async function rejectLogin(
+  lockoutService: ConsoleLockoutService,
+  lockoutKey: string,
+  reason: string,
+  set: { status?: number | string; headers: Record<string, string | number | string[]> },
+): Promise<LoginResponse> {
+  const isBanned = await lockoutService.recordFailure(lockoutKey, reason);
+  if (isBanned) {
+    set.status = 429;
+    set.headers["retry-after"] = String(await lockoutService.remainingLockSeconds(lockoutKey));
+    return lockedOutMessage(lockoutService, lockoutKey);
+  }
+  set.status = 401;
+  return {
+    status: "failed",
+    message: await failedLoginMessage(lockoutService, lockoutKey),
+  } satisfies LoginResponse;
+}
+
 function parseLoginRequest(body: unknown): LoginRequest | undefined {
   if (!isRecord(body) || typeof body.password !== "string") {
     return undefined;
@@ -266,32 +292,12 @@ export function createConsoleAuthRoutes(
       const rows = await readUsers(database, input.username);
       const user = userRecord(rows[0]);
       if (!user || !user.isActive) {
-        const isBanned = await lockoutService.recordFailure(lockoutKey, "unknown_user");
-        if (isBanned) {
-          set.status = 429;
-          set.headers["retry-after"] = String(await lockoutService.remainingLockSeconds(lockoutKey));
-          return lockedOutMessage(lockoutService, lockoutKey);
-        }
-        set.status = 401;
-        return {
-          status: "failed",
-          message: await failedLoginMessage(lockoutService, lockoutKey),
-        } satisfies LoginResponse;
+        return rejectLogin(lockoutService, lockoutKey, "unknown_user", set);
       }
 
       const valid = await credentialService.verifyPassword(input.password, user.passwordHash);
       if (!valid) {
-        const isBanned = await lockoutService.recordFailure(lockoutKey, "invalid_password");
-        if (isBanned) {
-          set.status = 429;
-          set.headers["retry-after"] = String(await lockoutService.remainingLockSeconds(lockoutKey));
-          return lockedOutMessage(lockoutService, lockoutKey);
-        }
-        set.status = 401;
-        return {
-          status: "failed",
-          message: await failedLoginMessage(lockoutService, lockoutKey),
-        } satisfies LoginResponse;
+        return rejectLogin(lockoutService, lockoutKey, "invalid_password", set);
       }
 
       await lockoutService.clearFailures(lockoutKey);
@@ -526,7 +532,7 @@ export function createConsoleAuthRoutes(
         });
         return invalidated;
       };
-      await database.transaction((tx) => rotateInScope(tx as unknown as CartethyiaDatabase));
+      await database.transaction((tx) => rotateInScope(asConsoleDb(tx)));
       set.status = 200;
       return { status: "success" } satisfies ChangePasswordResponse;
     },

package/src/console/auth/setup-service.ts

@@ -20,6 +20,7 @@ import {
 import { resolveDefaultGatewayApiKey } from "../../config/runtime";
 import { TENANT_KEY_SCOPES } from "../../security/access-control";
 import { isRecord } from "../../protocol/codecs";
+import { asConsoleDb } from "../shared/transaction";
 import { BackupService } from "../backup/service";
 import type { BackupInspection } from "../backup/service";
 import type { RestoreWarning } from "../backup/contracts";
@@ -28,14 +29,14 @@ import type { RestoreWarning } from "../backup/contracts";
 // and the mode is read from the environment the process was started with.
 
 /** The administrator to create when a restored backup left none to sign in with. */
-export interface AdminBootstrap {
+interface AdminBootstrap {
   readonly password: string;
   readonly username?: string;
   readonly displayName?: string;
 }
 
 /** What a first-boot restore did, so the console can report it honestly. */
-export interface RestoreBackupOutcome {
+interface RestoreBackupOutcome {
   readonly restored: Record<string, number>;
   readonly skipped: Record<string, number>;
   /** Parts of the file that could not be restored. */
@@ -171,7 +172,7 @@ export class FirstBootSetupService {
     // unserialized lets two boots both pass the check.
     await this.db.transaction(async (transaction) => {
       await transaction.execute(firstBootSetupLock());
-      await create(transaction as unknown as CartethyiaDatabase);
+      await create(asConsoleDb(transaction));
     });
   }
 

package/src/console/auth/user-store.ts

@@ -6,7 +6,7 @@ import {
 
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 
-export class ConsoleUserStore {
+class ConsoleUserStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
   async findByUsername(username: string): Promise<unknown | undefined> {

package/src/console/backup/9router-map.ts

@@ -106,9 +106,6 @@ export const PROXY_KINDS: Readonly<Record<string, "http" | "https" | "socks5">>
   workers: "https",
 };
 
-/** Proxy types we recognize but cannot represent, with the reason. */
-export const REFUSED_PROXY_KINDS: Readonly<Record<string, string>> = {};
-
 /**
  * Router combo strategy → ours.
  *

package/src/console/backup/contracts.ts

@@ -170,9 +170,15 @@ const SEALED_COLUMNS: Readonly<Record<string, Readonly<Record<string, string>>>>
   share_links: { token_encrypted: "share_token" },
 };
 
+const SEALED_COLUMNS_CACHE = new WeakMap<Table, ReadonlySet<string>>();
+
 /** The sealed columns of `table`, by column name. */
 export function sealedColumns(table: Table): ReadonlySet<string> {
-  return new Set(Object.keys(SEALED_COLUMNS[getTableName(table)] ?? {}));
+  const cached = SEALED_COLUMNS_CACHE.get(table);
+  if (cached) return cached;
+  const names = new Set(Object.keys(SEALED_COLUMNS[getTableName(table)] ?? {}));
+  SEALED_COLUMNS_CACHE.set(table, names);
+  return names;
 }
 
 /**
@@ -205,7 +211,6 @@ export function sealedAliases(table: Table): ReadonlyMap<string, string> {
   return out;
 }
 
-
 /**
  * Which rows of a table belong to one tenant, and how a restore replaces them.
  *
@@ -236,7 +241,7 @@ export function sealedAliases(table: Table): ReadonlyMap<string, string> {
  * - `self` — the tenant row itself, matched on its own id, upserted and never
  *   deleted.
  */
-export type TableOwnership =
+type TableOwnership =
   | { readonly kind: "direct"; readonly column: Column; readonly replace: "delete" | "upsert" }
   | {
       readonly kind: "viaParent";
@@ -493,7 +498,7 @@ export function findTable(section: BackupSection, name: string): Table | undefin
   return tablesForSection(section).find((table) => tableName(table) === name);
 }
 
-export interface BackupExportResult {
+export interface BackupPayloadExport {
   readonly payload: BackupPayload;
   readonly counts: Record<string, number>;
 }
@@ -511,11 +516,6 @@ export interface ValidatedTable {
   readonly rows: readonly BackupRow[];
 }
 
-export interface RestoreResult {
-  readonly restored: Record<string, number>;
-  readonly skipped: Record<string, number>;
-}
-
 /**
  * One part of a backup that could not be restored, and why.
  *

package/src/console/backup/export-endpoint.ts

@@ -23,11 +23,11 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { GatewayError } from "../../protocol/gateway-error";
 import { isLoopbackPeer, tokenMatches } from "../../transport/drain-endpoint";
-import { BACKUP_SECTIONS, tablesForSection } from "./contracts";
+import { tablesForSection } from "./contracts";
 import { compressBackupStream, exportBackupStream } from "./store";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 
-export interface BackupExportDeps {
+interface BackupExportDeps {
   readonly db: CartethyiaDatabase;
   /** Shared secret; the route is registered only when this is set. */
   readonly token: string;
@@ -37,7 +37,8 @@ export interface BackupExportDeps {
   readonly resolvePeerAddress: (request: Request) => string | null;
 }
 
-export interface BackupExportResult {
+/** The file-write result of an operator export, distinct from the payload shape `BackupPayloadExport` in `contracts.ts`. */
+export interface BackupExportFileResult {
   readonly path: string;
   readonly bytes: number;
   readonly counts: Record<string, number>;
@@ -89,7 +90,7 @@ export function createBackupExportHandler(
       );
     }
 
-    const result: BackupExportResult = { path, bytes: gzipped.byteLength, counts };
+    const result: BackupExportFileResult = { path, bytes: gzipped.byteLength, counts };
     return new Response(JSON.stringify(result), {
       status: 200,
       headers: { "content-type": "application/json", "cache-control": "no-store" },
@@ -108,5 +109,3 @@ function downloadDirectory(): string {
         : join(process.env.XDG_DOWNLOAD_DIR ?? join(home, "Downloads"));
   return candidate;
 }
-
-export { BACKUP_SECTIONS };

package/src/console/backup/nine-router.ts

@@ -29,7 +29,6 @@ import {
   isNodeProviderId,
   NODE_WIRE_FAMILIES,
   PROXY_KINDS,
-  REFUSED_PROXY_KINDS,
   UNSUPPORTED_PROVIDERS,
   UPSTREAM_PROVIDERS,
 } from "./9router-map";
@@ -50,7 +49,7 @@ export interface ImportReport {
   readonly remapped: readonly string[];
 }
 
-export interface ConversionResult {
+interface ConversionResult {
   readonly payload: BackupPayload;
   readonly report: ImportReport;
 }
@@ -479,11 +478,6 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
       return;
     }
     const rawKind = text(entry.type) ?? "http";
-    const refused = REFUSED_PROXY_KINDS[rawKind];
-    if (refused !== undefined) {
-      skipped.push(`proxy pool "${label}": type "${rawKind}" (${refused})`);
-      return;
-    }
     const kind = PROXY_KINDS[rawKind];
     if (kind === undefined) {
       skipped.push(`proxy pool "${label}": unknown type "${rawKind}"`);