cartethyia 2.7.7 → 2.7.9

package/src/console/console-router.ts

@@ -35,12 +35,18 @@ import type { ProviderRegistry } from "../providers/provider-registry";
 import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
 import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
 import type { TrustedProxyBoundary } from "../config/network";
+import type { IpAbuseStore } from "../security/abuse";
 import { gzipResponse } from "./response-compression";
 import { beginConsoleActivity } from "../shared/invoke-guard";
 
 export interface ConsoleApiCompositionDeps {
   readonly db: CartethyiaDatabase;
   readonly accessResolver: ConsoleAccessResolver;
+  /**
+   * The IP-abuse store backing manual IP bans and the live ban list. Absent
+   * (reduced compositions) means the IP-ban routes are not offered.
+   */
+  readonly ipAbuseStore?: IpAbuseStore;
   /**
    * Drops the cached route snapshot after a console write changes the catalog.
    * Structurally satisfied by `RouteSnapshotService`; declared here so the
@@ -222,6 +228,7 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): AnyElysia
     telemetryBuffer,
     ...(deps.stateStore ? { stateStore: deps.stateStore } : {}),
     ...(deps.shareStore ? { shareStore: deps.shareStore } : {}),
+    ...(deps.ipAbuseStore ? { ipAbuseStore: deps.ipAbuseStore } : {}),
     providerRegistry: deps.providerRegistry,
     bundledModelCatalog: deps.bundledModelCatalog,
     networkBindingFactory: deps.networkBindingFactory,

package/src/console/dashboard-assets.ts

@@ -62,13 +62,13 @@ export const SHARE_SOCIAL_META: SocialMeta = {
   title: "Cartethyia — Bansos Token",
   description:
     "Come and save your tokens 💖 Shared Cartethyia API key — Bansos Token with live quota, usage and model allowlist.",
-  image: "/assets/brand/og_bansos.jpg",
-  imageType: "image/jpeg",
+  image: "/assets/brand/og_bansos.webp",
+  imageType: "image/webp",
   // Read from the file's own header, not carried over from a previous image:
   // og:image:width/height are what a crawler uses to allocate the card before
   // the bytes arrive, so a copied size makes every preview crop.
-  imageWidth: 1760,
-  imageHeight: 576,
+  imageWidth: 1200,
+  imageHeight: 393,
   imageAlt: "Cartethyia Bansos Token — Come and save your tokens",
 };
 
@@ -405,7 +405,7 @@ function getMimeType(filePath: string): string {
  * and the modern Vite spelling `app-BCnqn3N3.js` — plus `_`, and then required
  * to *look generated*: the segment must contain a digit or mix upper and lower
  * case. The second half is what keeps a plain word out of the set, since
- * `console-backgrounds.jpg` and `openai-light.svg` both match the separator
+ * `console-backgrounds.webp` and `openai-light.svg` both match the separator
  * alone and are emphatically not immutable.
  *
  * Getting this wrong in either direction costs real money: a hashed asset

package/src/console/domain-registration.ts

@@ -36,6 +36,8 @@ import { createLiveRoutes } from "./observability/live";
 import { createLogRoutes } from "./observability/logs";
 import { createAuditRoutes } from "./audit/routes";
 import { DrizzleAuditReadStore } from "./audit/store";
+import { createIpBanRoutes } from "./ip-bans/routes";
+import type { IpAbuseStore } from "../security/abuse";
 import { createPerformanceRoutes } from "./observability/performance";
 import { createUpdateRoutes } from "./updates/routes";
 import { createRemoteSupportRoutes } from "./remote-support/routes";
@@ -55,6 +57,7 @@ import {
   createAccountExportCredentialsResolver,
   createAccountSecretResolver,
 } from "../providers/operations/provider-credential-service";
+import { refreshAccountStatus } from "../providers/operations/account-refresh-status";
 import { syncByokProvider } from "../providers/operations/provider-catalog-service";
 import { DrizzleApiKeyStore } from "../persistence/stores/api-key-store";
 import {
@@ -82,6 +85,11 @@ import type { ConsoleAccessResolver } from "./auth/access";
 export interface ConsoleDomainContext {
   readonly db: CartethyiaDatabase;
   readonly accessResolver: ConsoleAccessResolver;
+  /**
+   * The IP-abuse store backing manual IP bans and the live ban list. Absent
+   * (reduced compositions) means the IP-ban routes are not offered.
+   */
+  readonly ipAbuseStore?: IpAbuseStore;
   readonly providerRegistry: ProviderRegistry;
   readonly bundledModelCatalog: BundledProviderCatalog;
   readonly networkBindingFactory: ValidatedNetworkBindingFactory;
@@ -159,6 +167,17 @@ export function registerConsoleDomains(
     resolveRefresher: (id) => ctx.providerRegistry.resolveRefresher(id),
     refreshService: ctx.oauthRefreshService,
   });
+  /** Manual OAuth token refresh for the catalog route (area 04). */
+  const refreshAccountStatusForConsole = (accountId: string, opts?: { readonly origin?: "ui" | "sweep" | "dispatch" }) =>
+    refreshAccountStatus(
+      {
+        db: ctx.db,
+        refreshService: ctx.oauthRefreshService,
+        resolveRefresher: (id) => ctx.providerRegistry.resolveRefresher(id),
+      },
+      accountId,
+      opts,
+    );
   const providerCatalogStore = new DrizzleProviderCatalogStore(ctx.db, {
     telemetryBuffer: ctx.telemetryBuffer,
     bundledModelCatalog: ctx.bundledModelCatalog,
@@ -238,6 +257,7 @@ export function registerConsoleDomains(
       };
     },
     snapshotInvalidator: ctx.routeSnapshotService,
+    redis: ctx.redis,
     readAccountInflight: async (providerId, tenantId) =>
       ctx.readRoutingAccountInflight ? ctx.readRoutingAccountInflight(providerId, tenantId) : [],
   });
@@ -271,6 +291,12 @@ export function registerConsoleDomains(
     service: createRemoteSupportService({ port: resolvePort() }),
   }));
   console.use(createAuditRoutes({ store: auditReadStore, accessResolver: ctx.accessResolver }));
+  if (ctx.ipAbuseStore) {
+    console.use(createIpBanRoutes({
+      accessResolver: ctx.accessResolver,
+      store: ctx.ipAbuseStore,
+    }));
+  }
   // InferHub market data. On demand only: a route fetches when its snapshot is
   // past its freshness window, so a page nobody opens causes no upstream calls.
   const inferhubKeys = createInferhubKeyStore(ctx.db);
@@ -287,6 +313,7 @@ export function registerConsoleDomains(
     redis: ctx.redis,
     snapshotInvalidator: ctx.routeSnapshotService,
     resolveExportCredentials,
+    refreshAccountStatus: refreshAccountStatusForConsole,
     // Without this, a custom provider only becomes dispatchable after a
     // restart: boot registers BYOK rows once, and the catalog routes are the
     syncByokProvider: (providerId) =>

package/src/console/ip-bans/routes.ts

@@ -0,0 +1,99 @@
+// IP-ban domain: manual IP bans visible in the Banned Users modal.
+//
+// The gateway's abuse store keeps automatic bans (escalation after a burst).
+// This domain exposes the same store to the operator so an address can be
+// banned BY HAND and listed/unbanned from the console. IP bans are instance
+// state, not tenant data, so every route is guarded by `platform:admin` like
+// the other instance-level operations.
+
+import { Elysia, t, type AnyElysia } from "elysia";
+import { errorResponse, requireGlobalAdmin } from "../shared/errors";
+import type { IpAbuseStore } from "../../security/abuse";
+import type { ConsoleAccessResolver } from "../auth/access";
+
+/** One active IP ban, as the console returns it. */
+export interface IpBanResponse {
+  /** The banned address. */
+  readonly ip: string;
+  /** When the ban lifts, as ISO timestamp; null = permanent. */
+  readonly bannedUntil: string | null;
+  /** True when the ban was set by hand rather than by abuse escalation. */
+  readonly manual: boolean;
+}
+
+export interface IpBanRoutesConfig {
+  readonly accessResolver: ConsoleAccessResolver;
+  readonly store: IpAbuseStore;
+}
+
+const BAN_DURATION_CHOICES: readonly { readonly minutes: number | null; readonly label: string }[] = [
+  { minutes: 60, label: "1 hour" },
+  { minutes: 6 * 60, label: "6 hours" },
+  { minutes: 12 * 60, label: "12 hours" },
+  { minutes: 24 * 60, label: "1 day" },
+  { minutes: 7 * 24 * 60, label: "7 days" },
+  { minutes: null, label: "Permanent" },
+] as const;
+
+/** Parses a duration choice into minutes; null = permanent. */
+export function parseBanDuration(value: unknown): number | null | undefined {
+  if (value === null || value === undefined) return value === null ? null : undefined;
+  const minutes = Number(value);
+  if (!Number.isFinite(minutes) || minutes <= 0) return undefined;
+  return Math.round(minutes);
+}
+
+export function createIpBanRoutes(config: IpBanRoutesConfig): AnyElysia {
+  const { accessResolver, store } = config;
+  return new Elysia()
+    .get("/ip-bans", async ({ request, set }) => {
+      try {
+        requireGlobalAdmin(accessResolver(request));
+        const bans = await store.listBans();
+        return bans.map((ban) => ({
+          ip: ban.identity,
+          bannedUntil: ban.bannedUntil === null ? null : new Date(ban.bannedUntil).toISOString(),
+          manual: true,
+        }));
+      } catch (e) {
+        return errorResponse(e, set, "Could not list IP bans");
+      }
+    })
+    .post(
+      "/ip-bans",
+      { body: t.Object({ ip: t.String(), minutes: t.Optional(t.Nullable(t.Number())) }) },
+      async ({ request, body, set }) => {
+        try {
+          requireGlobalAdmin(accessResolver(request));
+          const ip = body.ip.trim();
+          if (ip.length === 0)
+            return errorResponse(new Error("ip is required"), set, "Invalid IP ban request");
+          const minutes = body.minutes === undefined || body.minutes === null ? null : Math.round(body.minutes);
+          if (minutes !== null && (!Number.isFinite(minutes) || minutes <= 0))
+            return errorResponse(new Error("minutes must be a positive integer or null"), set, "Invalid IP ban request");
+          await store.ban(ip, minutes === null ? 0 : minutes * 60_000);
+          return {
+            ip,
+            bannedUntil: minutes === null ? null : new Date(Date.now() + minutes * 60_000).toISOString(),
+            manual: true,
+          };
+        } catch (e) {
+          return errorResponse(e, set, "Could not ban IP");
+        }
+      },
+    )
+    .delete("/ip-bans/:ip", async ({ request, params, set }) => {
+      try {
+        requireGlobalAdmin(accessResolver(request));
+        const ip = typeof params?.["ip"] === "string" ? decodeURIComponent(params["ip"]) : "";
+        if (ip.length === 0)
+          return errorResponse(new Error("ip is required"), set, "Invalid unban request");
+        await store.unban(ip);
+        return { success: true, ip };
+      } catch (e) {
+        return errorResponse(e, set, "Could not unban IP");
+      }
+    });
+}
+
+export { BAN_DURATION_CHOICES };

package/src/console/providers/catalog/catalog-projections.ts

@@ -11,7 +11,7 @@
 import { isBundledProviderId } from "../../../providers/provider-contracts";
 import { BUILTIN_DEFAULT_ENDPOINTS } from "../../../protocol/codecs";
 
-import { providerDisplayName, providerServiceKinds } from "../../../providers/provider-metadata";
+import { providerDisplayName, providerServiceKinds, customProviderServiceKinds } from "../../../providers/provider-metadata";
 import type { CompatibilityProfile } from "../../../providers/provider-metadata";
 import { supportedWireFamiliesForProvider } from "../../../providers/discovery/probe-wire";
 import { providers } from "../../../persistence/schema";
@@ -74,6 +74,7 @@ export function mapProviderRow(
     row.wireFamilyDefault,
     row.compatibilityProfile,
   );
+  const compatibilityProfile = row.compatibilityProfile as CompatibilityProfile | null;
   return {
     providerId: row.id,
     displayName: providerDisplayName(row.id),
@@ -82,7 +83,9 @@ export function mapProviderRow(
     isBuiltIn: isBundledProviderId(row.id),
     configured: false,
     requiresAccount: row.requiresAccount,
-    serviceKinds: providerServiceKinds(row.id),
+    serviceKinds: isBundledProviderId(row.id)
+      ? providerServiceKinds(row.id)
+      : customProviderServiceKinds(compatibilityProfile),
     // No model advertises search; see the note in provider-metadata.ts.
     supportsWebSearch: false,
     supportsModelDiscovery:

package/src/console/providers/catalog/contracts.ts

@@ -62,6 +62,72 @@ export const ACCOUNT_STATUSES = ["active", "disabled"] as const;
 /** One operator-settable account status. */
 export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
 
+/** Display-only warning type shared with the dashboard contract mirror. */
+export type { ModelWarning, ModelWarningSeverity } from "../../../providers/provider-model-definition";
+import type { ModelWarning } from "../../../providers/provider-model-definition";
+
+/**
+ * Outcome of one provider-scoped bulk account action (area 02).
+ *
+ * A tenant-scoped action never touches shared (`tenant_id IS NULL`) rows; the
+ * global-admin pair of routes does. `globalSkipped` counts those rows on the
+ * tenant path so the console can say why its visible list and the DB disagree.
+ * `deleted`/`missing` are present on delete; `updated` on disable. Both actions
+ * are idempotent: a second call finds no matching row and reports zero.
+ */
+export interface ProviderAccountBulkActionResult {
+  readonly ok: boolean;
+  readonly updated: number;
+  readonly deleted?: readonly string[];
+  readonly missing?: readonly string[];
+  readonly globalSkipped: number;
+}
+
+/** Cap on one discovery-commit request (D29). */
+export const DISCOVER_MODEL_COMMIT_MAX = 100;
+
+/**
+ * One model the provider's own listing advertised, projected for the Add-Model
+ * picker. Read-only: `GET .../models/discover` writes nothing. `models`
+ * metadata here is the fetched `ModelDefinition`, not the static catalog's
+ * guess, so the operator can see exactly what the commit will store.
+ */
+export interface DiscoverModelCandidate {
+  readonly modelId: string;
+  readonly wireFamily: string;
+  readonly serviceKind: string;
+  readonly endpointPath: string;
+  readonly contextLimit: number | null;
+  readonly outputLimit: number | null;
+  readonly modalities: { readonly input: readonly string[]; readonly output: readonly string[] };
+  readonly reasoning: boolean;
+  readonly toolCall: boolean;
+  readonly freeTier?: boolean;
+  readonly proOnly?: boolean;
+  readonly alreadyRegistered: boolean;
+}
+
+/** Result of `GET .../models/discover`. */
+export interface DiscoverModelCandidatesResponse {
+  readonly supported: boolean;
+  readonly candidates: readonly DiscoverModelCandidate[];
+  /** Label of the usable account whose credential fetched the listing (D27). */
+  readonly accountLabel?: string;
+}
+
+/** Body of `POST .../models/discover/commit`. */
+export interface DiscoverModelCommitRequest {
+  readonly modelIds: readonly string[];
+}
+
+/** Outcome of a discovery commit: the ids persisted and the ones skipped. */
+export interface DiscoverModelCommitResult {
+  readonly ok: boolean;
+  readonly committed: readonly string[];
+  readonly skipped: readonly string[];
+  readonly synced: number;
+}
+
 const VALID_WIRE_FAMILIES: Record<WireFamily, true> = {
   chat: true,
   responses: true,
@@ -121,6 +187,16 @@ const ADAPTER_OWNED: Record<string, true> = {
 };
 
 export function validateCompatibilityProfile(profile: CompatibilityProfile): void {
+  if (profile.service_kinds !== undefined) {
+    if (!Array.isArray(profile.service_kinds)) {
+      throw new GatewayError("invalid_request", 400, "service_kinds must be an array (request {requestId}). Check the shape of what you sent — then resend 🪞");
+    }
+    for (const kind of profile.service_kinds) {
+      if (!isServiceKind(kind)) {
+        throw new GatewayError("invalid_request", 400, `unknown service kind ${String(kind)} (request {requestId}). Check the shape of what you sent — then resend 🪞`);
+      }
+    }
+  }
   if (profile.cli_identity !== undefined) {
     if (typeof profile.cli_identity !== "boolean") {
       throw new GatewayError("invalid_request", 400, "cli_identity must be boolean (request {requestId}). Check the shape of what you sent — then resend 🪞");
@@ -358,6 +434,8 @@ export interface ModelCatalogEntry {
    * provider's own model directory states it.
    */
   freeTier?: boolean;
+  /** Display-only warnings; `null` in storage means none. */
+  warnings?: readonly ModelWarning[];
 }
 export interface FlatModelCatalogEntry {
   readonly providerId: string;
@@ -407,6 +485,11 @@ export interface ModelMetadataOverride {
   readonly image?: boolean;
   readonly reasoning?: boolean;
   readonly toolCall?: boolean;
+  /**
+   * Display-only warnings, editable only on non-builtin rows. `null` clears
+   * the stored value; absence leaves it alone.
+   */
+  readonly warnings?: readonly ModelWarning[] | null;
 }
 
 /** Register payload: model ids plus optional operator metadata. */
@@ -484,6 +567,27 @@ export interface UpdateProviderAccountRequest {
    */
   staticToken?: boolean;
 }
+/**
+ * Response of `POST /providers/:providerId/accounts/:accountId/refresh-token`
+ * (area 04). The refresh never changes `status`: `statusAfter` is re-read from
+ * the database after the attempt and is never `"active"` by fiat — a disabled
+ * account stays disabled, only an operator can re-enable it.
+ */
+export interface RefreshAccountTokenResponse {
+  readonly ok: boolean;
+  readonly statusAfter: string;
+  /** True when an upstream token refresh actually minted a fresh token. */
+  readonly tokenRefreshed?: boolean;
+  /** ISO timestamp of the fresh access-token expiry, when known. */
+  readonly expiresAt?: string;
+  /** ISO timestamp of the refresh attempt. */
+  readonly refreshedAt?: string;
+  /** Structured reason when `ok` is false (`not_oauth`, `static_token`, …). */
+  readonly error?: string;
+  /** Human detail (failure message) when available. */
+  readonly category?: string;
+}
+
 export interface ProviderAccountTokenUsage {
   readonly requests: number;
   readonly errors: number;
@@ -786,6 +890,7 @@ export interface ProviderCatalogStore {
   probeAllModels(
     tenantId: string,
     providerId: string,
+    mode?: ProbeModelRequest["mode"],
   ): Promise<ProbeAllModelsResult>;
   probeAllAccounts(
     tenantId: string,
@@ -817,6 +922,20 @@ export interface ProviderCatalogStore {
     request: UpdateModelMetadataRequest,
   ): Promise<boolean>;
   syncModels(tenantId: string, providerId: string): Promise<{ synced: number }>;
+  /**
+   * Read-only `/models` discovery. Never persists. `supported: false` names a
+   * provider with no listing endpoint so the UI can fall back to manual add.
+   */
+  listDiscoveryCandidates(
+    tenantId: string,
+    providerId: string,
+  ): Promise<{ readonly supported: boolean; readonly candidates: readonly DiscoverModelCandidate[]; readonly accountLabel?: string }>;
+  /** Persists a verified subset of a fresh discovery as `source="manual"`. */
+  commitDiscoveredModels(
+    tenantId: string,
+    providerId: string,
+    modelIds: readonly string[],
+  ): Promise<{ readonly committed: readonly string[]; readonly skipped: readonly string[]; readonly synced: number }>;
   listAccounts(tenantId: string, providerId: string): Promise<readonly ProviderAccountResponse[]>;
   listAllAccounts(tenantId: string): Promise<readonly ProviderAccountResponse[]>;
   /**
@@ -891,6 +1010,10 @@ export interface ProviderCatalogStore {
     dayKey: string,
   ): Promise<readonly BuddyGrowthTaskLedgerEntry[]>;
   recoverAccount(tenantId: string, providerId: string, accountId: string): Promise<boolean>;
+  /** One UPDATE over this tenant's cooling accounts (D07/D08); evidence kept. */
+  disableCooldowns(tenantId: string, providerId: string): Promise<ProviderAccountBulkActionResult>;
+  /** One DELETE over this tenant's banned accounts (D12); idempotent. */
+  deleteBanned(tenantId: string, providerId: string): Promise<ProviderAccountBulkActionResult>;
 }
 
 /**

package/src/console/providers/catalog/model-operations.ts

@@ -11,7 +11,17 @@
 import type { AccessDecision } from "../../../security/access-control";
 import { ConsoleDomainError, requireScope, requireTenantAnyScope } from "../../shared/errors";
 import { GatewayError } from "../../../protocol/gateway-error";
-import { MODEL_READ_SCOPES, MODEL_WRITE_SCOPES } from "./contracts";
+import {
+  DISCOVER_MODEL_COMMIT_MAX,
+  MODEL_READ_SCOPES,
+  MODEL_WRITE_SCOPES,
+} from "./contracts";
+import type { DiscoverModelCandidatesResponse, DiscoverModelCommitResult } from "./contracts";
+import {
+  MODEL_WARNING_KIND_MAX_LENGTH,
+  MODEL_WARNING_MESSAGE_MAX_LENGTH,
+  MODEL_WARNING_SEVERITIES,
+} from "../../../providers/provider-model-definition";
 import type {
   ByokConnectionTestRequest,
   ByokConnectionTestResult,
@@ -47,6 +57,60 @@ function validateModelMetadata(metadata: ModelMetadataOverride | undefined): voi
         `${field} must be a positive integer, or null for unknown`,
       );
   }
+  // `null` clears the stored blob; an absent field leaves it alone. Only a
+  // non-builtin row can actually carry an edit — the store enforces that
+  // invariant. Bounds here stop a hostile payload from persisting a multi-MB
+  // display banner; severity is a closed whitelist.
+  if (metadata.warnings === null || metadata.warnings === undefined) return;
+  if (!Array.isArray(metadata.warnings)) {
+    throw new ConsoleDomainError("invalid_request", 400, "warnings must be an array or null");
+  }
+  for (const [index, warning] of metadata.warnings.entries()) {
+    if (warning === null || typeof warning !== "object" || Array.isArray(warning)) {
+      throw new ConsoleDomainError("invalid_request", 400, `warnings[${index}] must be an object`);
+    }
+    const kind = (warning as { kind?: unknown }).kind;
+    const message = (warning as { message?: unknown }).message;
+    const severity = (warning as { severity?: unknown }).severity;
+    if (typeof kind !== "string" || kind.trim().length === 0 || kind.length > MODEL_WARNING_KIND_MAX_LENGTH) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `warnings[${index}].kind must be a non-empty string up to ${MODEL_WARNING_KIND_MAX_LENGTH} chars`,
+      );
+    }
+    if (typeof message !== "string" || message.trim().length === 0 || message.length > MODEL_WARNING_MESSAGE_MAX_LENGTH) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `warnings[${index}].message must be a non-empty string up to ${MODEL_WARNING_MESSAGE_MAX_LENGTH} chars`,
+      );
+    }
+    if (
+      severity !== undefined &&
+      (typeof severity !== "string" ||
+        !(MODEL_WARNING_SEVERITIES as readonly string[]).includes(severity))
+    ) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `warnings[${index}].severity must be one of ${MODEL_WARNING_SEVERITIES.join(", ")}`,
+      );
+    }
+  }
+}
+
+/**
+ * Discovery lives in the provider layer and raises `GatewayError`; the console
+ * speaks `ConsoleDomainError`. Keeping the exact code/status/message lets the
+ * dashboard toast name the real upstream reason rather than a generic failure.
+ */
+function translateDiscoveryError(error: unknown): unknown {
+  if (error instanceof ConsoleDomainError) return error;
+  if (error instanceof GatewayError) {
+    return new ConsoleDomainError(error.code, error.status, error.message);
+  }
+  return error;
 }
 
 export function createModelCatalogOperations(config: ProviderCatalogConfig) {
@@ -164,14 +228,7 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
           await config.snapshotInvalidator?.invalidate();
           return result;
         } catch (error) {
-          // Discovery runs in the provider layer and raises `GatewayError`; the
-          // console speaks `ConsoleDomainError`. Translating here keeps the
-          // upstream-vs-operator distinction and the status code intact, so the
-          // dashboard toast names the real reason instead of a generic failure.
-          if (error instanceof GatewayError) {
-            throw new ConsoleDomainError(error.code, error.status, error.message);
-          }
-          throw error;
+          throw translateDiscoveryError(error);
         }
       }
       /** Manually registers additional model ids on an existing provider (tenant-bound, no upstream call). */,
@@ -247,9 +304,10 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
     async probeAllModels(
         access: AccessDecision | undefined,
         providerId: string,
+        mode?: ProbeModelRequest["mode"],
       ): Promise<ProbeAllModelsResult> {
         const a = requireTenantAnyScope(access, MODEL_WRITE_SCOPES);
-        return config.store.probeAllModels(a.tenantId, providerId);
+        return config.store.probeAllModels(a.tenantId, providerId, mode);
       },
       async probeAllAccounts(
         access: AccessDecision | undefined,
@@ -299,6 +357,60 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
         await config.snapshotInvalidator?.invalidate();
         return { success: true };
       },
+    /**
+     * `GET .../models/discover`: fetch the provider's own listing without any
+     * write (D30). A provider with no listing endpoint answers `supported:false`
+     * so the UI can fall back to manual add instead of showing an error.
+     */
+    async listDiscoveryCandidates(
+      access: AccessDecision | undefined,
+      providerId: string,
+    ): Promise<DiscoverModelCandidatesResponse> {
+      const a = requireTenantAnyScope(access, MODEL_READ_SCOPES);
+      try {
+        return await config.store.listDiscoveryCandidates(a.tenantId, providerId);
+      } catch (error) {
+        throw translateDiscoveryError(error);
+      }
+    },
+    /**
+     * `POST .../models/discover/commit`: the store re-fetches the roster and
+     * rejects ids outside it (D31), so no hand-forged id can be persisted.
+     */
+    async commitDiscoveredModels(
+      access: AccessDecision | undefined,
+      providerId: string,
+      modelIds: readonly string[],
+    ): Promise<DiscoverModelCommitResult> {
+      const a = requireTenantAnyScope(access, MODEL_WRITE_SCOPES);
+      if (modelIds.some((id) => typeof id !== "string" || id.trim().length === 0)) {
+        throw new ConsoleDomainError(
+          "invalid_request",
+          400,
+          "modelIds must be non-empty model ids",
+        );
+      }
+      if (modelIds.length === 0 || modelIds.length > DISCOVER_MODEL_COMMIT_MAX) {
+        throw new ConsoleDomainError(
+          "invalid_request",
+          400,
+          `modelIds must contain 1-${DISCOVER_MODEL_COMMIT_MAX} entries`,
+        );
+      }
+      try {
+        const result = await config.store.commitDiscoveredModels(a.tenantId, providerId, modelIds);
+        await config.auditSink?.record({
+          access: a,
+          action: "provider.models.registered",
+          target: providerId,
+          detail: { modelIds: result.committed, source: "discover-commit" },
+        });
+        await config.snapshotInvalidator?.invalidate();
+        return { ok: true, ...result };
+      } catch (error) {
+        throw translateDiscoveryError(error);
+      }
+    },
     async deleteModelsBulk(
         access: AccessDecision | undefined,
         providerId: string,