cartethyia 2.7.7 → 2.7.9

package/src/console/providers/catalog/provider-operations.ts

@@ -15,6 +15,7 @@ import {
   ConsoleDomainError,
   requireGlobalAdmin,
   requireTenantAnyScope,
+  requireTenantScope,
 } from "../../shared/errors";
 import { cachedReadWithEtag, conditionalResponse } from "../../shared/read-through-cache";
 import type { RedisClient } from "../../../persistence/redis";
@@ -24,10 +25,11 @@ import { isBundledProviderId } from "../../../providers/provider-contracts";
 import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { getProviderClientVersion, getRouteIdentityVersions } from "../../../providers/operations/client-versions";
 import type { OAuthLoginField } from "../../../providers/authentication/oauth-flow-store";
-import { providerCredentialHint, providerCredentialUrl, providerDisplayName, providerHasAdapterUserAgent, providerOperatorNotice, providerServiceKinds, type CompatibilityProfile } from "../../../providers/provider-metadata";
+import { providerCredentialHint, providerCredentialUrl, providerDisplayName, providerHasAdapterUserAgent, providerOperatorNotice, providerServiceKinds, customProviderServiceKinds, type CompatibilityProfile } from "../../../providers/provider-metadata";
 import type { AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
 import { healthEventBuffer } from "../../../persistence/health-event-flush";
-import { CREDENTIAL_MODES, PROVIDER_READ_SCOPES, PROVIDER_WRITE_SCOPES, type BuddyGrowthTaskLedgerEntry } from "./contracts";
+import { CREDENTIAL_MODES, PROVIDER_READ_SCOPES, PROVIDER_WRITE_SCOPES, type BuddyGrowthTaskLedgerEntry, type ProviderAccountBulkActionResult, type RefreshAccountTokenResponse } from "./contracts";
+import type { RefreshAccountStatusOutcome } from "../../../providers/operations/account-refresh-status";
 import { enqueueCheckin } from "../../../workers/daily-checkin";
 import {
   isWireFamily,
@@ -87,12 +89,16 @@ export function sanitizeProviderResponse(
   const credentialHint = providerCredentialHint(p.providerId);
   const operatorNotice = providerOperatorNotice(p.providerId);
   const clientVersion = getProviderClientVersion(p.providerId);
+  const compatibilityProfile = p.compatibilityProfile as CompatibilityProfile | undefined;
+  const isBuiltIn = (p.isBuiltIn as boolean | undefined) ?? false;
   const response: ProviderResponse = {
     providerId: p.providerId,
-    serviceKinds: providerServiceKinds(p.providerId),
+    serviceKinds: isBuiltIn
+      ? providerServiceKinds(p.providerId)
+      : customProviderServiceKinds(compatibilityProfile),
     displayName: providerDisplayName(p.providerId),
     enabled: (p.enabled as boolean | undefined) ?? true,
-    isBuiltIn: (p.isBuiltIn as boolean | undefined) ?? false,
+    isBuiltIn,
     requiresAccount: (p.requiresAccount as boolean | undefined) ?? true,
     hasAdapterUserAgent: providerHasAdapterUserAgent(p.providerId),
     // No model advertises search; see the note in provider-metadata.ts.
@@ -102,7 +108,7 @@ export function sanitizeProviderResponse(
     ...(operatorNotice === undefined ? {} : { operatorNotice }),
     ...(clientVersion === undefined ? {} : { clientVersion }),
     routeIdentityVersions: getRouteIdentityVersions(),
-    supportsModelDiscovery: (p.supportsModelDiscovery as boolean | undefined) ?? !p.isBuiltIn,
+    supportsModelDiscovery: (p.supportsModelDiscovery as boolean | undefined) ?? !isBuiltIn,
     ...(typeof p.createdAt === "string" ? { createdAt: p.createdAt } : {}),
     ...(typeof p.updatedAt === "string" ? { updatedAt: p.updatedAt } : {}),
   };
@@ -182,6 +188,15 @@ export interface ProviderCatalogConfig {
     providerId: string,
     accountId: string,
   ) => Promise<{ readonly accessToken: string; readonly refreshToken?: string }>;
+  /**
+   * One-shot manual OAuth token refresh (area 04). Provided by the composition
+   * root; when absent the refresh-token route answers 501 rather than silently
+   * reporting success.
+   */
+  readonly refreshAccountStatus?: (
+    accountId: string,
+    opts?: { readonly origin?: "ui" | "sweep" | "dispatch" },
+  ) => Promise<RefreshAccountStatusOutcome>;
 }
 async function attachProviderCapabilities(
   response: ProviderResponse,
@@ -715,6 +730,101 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
         await config.snapshotInvalidator?.invalidate();
         return { success: true };
       },
+    /**
+     * One UPDATE over the tenant's cooling accounts, with `cooldownUntil` and
+     * `modelCooldowns` preserved as evidence (D07/D08). Shared rows are not
+     * writable here: the platform-admin pair of routes owns them (D10).
+     */
+    async disableCooldowns(
+      access: AccessDecision | undefined,
+      providerId: string,
+    ): Promise<ProviderAccountBulkActionResult> {
+      const a = requireTenantAnyScope(access, PROVIDER_WRITE_SCOPES);
+      const result = await config.store.disableCooldowns(a.tenantId, providerId);
+      await config.auditSink?.record({
+        access: a,
+        action: "provider_account.bulk_disabled_cooldowns",
+        target: providerId,
+        detail: { providerId, updated: result.updated, globalSkipped: result.globalSkipped },
+      });
+      await config.snapshotInvalidator?.invalidate();
+      return { ok: true, updated: result.updated, globalSkipped: result.globalSkipped };
+    },
+    /**
+     * One DELETE over the tenant's strictly banned accounts (D12). Empty
+     * matches are a successful no-op, so a second click is idempotent.
+     */
+    async deleteBanned(
+      access: AccessDecision | undefined,
+      providerId: string,
+    ): Promise<ProviderAccountBulkActionResult> {
+      const a = requireTenantAnyScope(access, PROVIDER_WRITE_SCOPES);
+      const result = await config.store.deleteBanned(a.tenantId, providerId);
+      await config.auditSink?.record({
+        access: a,
+        action: "provider_account.bulk_deleted_banned",
+        target: providerId,
+        detail: {
+          providerId,
+          deleted: result.deleted ?? [],
+          missing: result.missing ?? [],
+          globalSkipped: result.globalSkipped,
+        },
+      });
+      await config.snapshotInvalidator?.invalidate();
+      return {
+        ok: true,
+        updated: 0,
+        deleted: result.deleted ?? [],
+        missing: result.missing ?? [],
+        globalSkipped: result.globalSkipped,
+      };
+    },
+    async refreshAccountToken(
+        access: AccessDecision | undefined,
+        providerId: string,
+        accountId: string,
+      ): Promise<RefreshAccountTokenResponse> {
+        // The refresh changes no routing state and is a per-account operator
+        // action, so the browser session's own write scope is sufficient.
+        const a = requireTenantScope(access, "dashboard:write");
+        // 404 unless the account exists and belongs to this provider/tenant.
+        const accounts = await config.store.listAccounts(a.tenantId, providerId);
+        const owned = accounts.find((account) => account.id === accountId && account.tenantId === a.tenantId);
+        if (!owned)
+          throw new ConsoleDomainError("account_not_found", 404, `Account ${accountId} not found`);
+        // 409 for a static token (nothing to re-mint), 400 for non-OAuth —
+        // before calling the refresher, so the row is never touched on a
+        // rejectable request.
+        if (owned.staticToken === true)
+          throw new ConsoleDomainError("static_token", 409, "Account carries a static token that cannot be refreshed");
+        if (owned.credentialKind !== "oauth")
+          throw new ConsoleDomainError("not_oauth", 400, "Account is not OAuth; token refresh is not applicable");
+        if (!config.refreshAccountStatus)
+          throw new ConsoleDomainError("refresh_unavailable", 501, "Token refresh is not configured on this host");
+        const outcome = await config.refreshAccountStatus(accountId, { origin: "ui" });
+        await config.auditSink?.record({
+          access: a,
+          action: "provider_account.token_refreshed",
+          target: accountId,
+          detail: {
+            providerId,
+            ok: outcome.ok,
+            statusAfter: outcome.statusAfter,
+            ...(outcome.error === undefined ? {} : { error: outcome.error }),
+          },
+        });
+        await config.snapshotInvalidator?.invalidate();
+        return {
+          ok: outcome.ok,
+          statusAfter: outcome.statusAfter,
+          ...(outcome.tokenRefreshed ? { tokenRefreshed: true } : {}),
+          ...(outcome.expiresAt === undefined ? {} : { expiresAt: outcome.expiresAt }),
+          ...(outcome.refreshedAt === undefined ? {} : { refreshedAt: outcome.refreshedAt }),
+          ...(outcome.error === undefined ? {} : { error: outcome.error }),
+          ...(outcome.category === undefined ? {} : { category: outcome.category }),
+        };
+      },
     /**
      * Exports the requested accounts with their decrypted credentials.
      *
@@ -778,9 +888,7 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
                 // channel check (11128) rejects the imported account.
                 const materialized =
                   account.providerId === "cb" ||
-                  account.providerId === "cbcn" ||
-                  account.providerId === "workbuddy" ||
-                  account.providerId === "workbuddycn"
+                  account.providerId === "cbcn"
                     // dynamic-import: B-02 lazy graph — buddy device-binding materializer, buddy-family only.
                     // The buddy-identity graph is lazy-loaded: the device-binding
                     // materializer only runs for buddy-family accounts (B-02).

package/src/console/providers/catalog/routes.ts

@@ -2,9 +2,10 @@ import { consoleErrorHandler } from "../../shared/errors";
 import { literalUnion } from "../../shared/elysia-schema";
 import { Elysia, t, type AnyElysia } from "elysia";
 import { SERVICE_KINDS, WIRE_FAMILIES } from "../../../protocol/canonical-model";
-import { PROBE_REASONING_EFFORTS } from "../../../providers/discovery/discovery-types";
+import { PROBE_MODES, PROBE_REASONING_EFFORTS } from "../../../providers/discovery/discovery-types";
 import {
   ACCOUNT_STATUSES,
+  DISCOVER_MODEL_COMMIT_MAX,
   CREDENTIAL_KINDS,
   CREDENTIAL_MODES,
 } from "./contracts";
@@ -18,6 +19,7 @@ import type {
   ByokConnectionTestRequest,
   CreateProviderAccountRequest,
   CreateProviderRequest,
+  DiscoverModelCommitRequest,
   ProbeModelRequest,
   RegisterModelsRequest,
   SetModelEnabledRequest,
@@ -110,12 +112,28 @@ const modelMetadataOverrideBody = t.Object({
   image: t.Optional(t.Boolean()),
   reasoning: t.Optional(t.Boolean()),
   toolCall: t.Optional(t.Boolean()),
+  warnings: t.Optional(
+    t.Union([
+      t.Null(),
+      t.Array(
+        t.Object({
+          kind: t.String(),
+          message: t.String(),
+          severity: t.Optional(literalUnion(["info", "warn", "critical"])),
+          updatedAt: t.Optional(t.String()),
+        }),
+      ),
+    ]),
+  ),
 });
 const registerModelsBody = t.Object({
   modelIds: t.Array(t.String()),
   wireFamily: t.Optional(t.String()),
   metadata: t.Optional(modelMetadataOverrideBody),
 });
+const discoverCommitBody = t.Object({
+  modelIds: t.Array(t.String(), { minItems: 1, maxItems: DISCOVER_MODEL_COMMIT_MAX }),
+});
 const probeModelBody = t.Object({
   modelId: t.String(),
   serviceKind: t.Optional(literalUnion(SERVICE_KINDS)),
@@ -127,6 +145,7 @@ const probeModelBody = t.Object({
   maxOutputTokens: t.Optional(t.Integer({ minimum: 1, maximum: 131072 })),
   stream: t.Optional(t.Boolean()),
   surface: t.Optional(literalUnion(["default", "cosy", "grpc", "ide"])),
+  mode: t.Optional(literalUnion(PROBE_MODES)),
 });
 const byokConnectionTestBody = t.Object({
   baseUrl: t.String(),
@@ -275,9 +294,42 @@ export function createProviderCatalogRoutes(config: ProviderCatalogConfig): AnyE
         );
 },
     )
-    .post("/:providerId/models/test-models", async ({ request, params }) => {
-      return await modelFactory.probeAllModels(config.accessResolver(request), params.providerId);
-})
+    .post(
+      "/:providerId/models/test-models",
+      { body: t.Optional(t.Object({ mode: t.Optional(literalUnion(PROBE_MODES)) })) },
+      async ({ request, params, body }) => {
+        return await modelFactory.probeAllModels(
+          config.accessResolver(request),
+          params.providerId,
+          body?.mode,
+        );
+      },
+    )
+    // Discovery must be declared before `/:providerId/models/discover/commit`
+    // would be shadowed by a dynamic segment; Elysia resolves both here.
+    .get("/:providerId/models/discover", async ({ request, params }) => {
+      return await modelFactory.listDiscoveryCandidates(
+        config.accessResolver(request),
+        params.providerId,
+      );
+    })
+    .post(
+      "/:providerId/models/discover/commit",
+      { body: discoverCommitBody },
+      async ({ request, params, body }) => {
+        return await modelFactory.commitDiscoveredModels(
+          config.accessResolver(request),
+          params.providerId,
+          (body as DiscoverModelCommitRequest).modelIds,
+        );
+      },
+    )
+    .post("/:providerId/accounts/actions/disable-cooldowns", async ({ request, params }) => {
+      return await factory.disableCooldowns(config.accessResolver(request), params.providerId);
+    })
+    .post("/:providerId/accounts/actions/delete-banned", async ({ request, params }) => {
+      return await factory.deleteBanned(config.accessResolver(request), params.providerId);
+    })
     .post(
       "/:providerId/accounts/probe",
       { body: probeModelBody },
@@ -408,6 +460,14 @@ export function createProviderCatalogRoutes(config: ProviderCatalogConfig): AnyE
         params.accountId,
       );
       return recovered;
+})
+    .post("/:providerId/accounts/:accountId/refresh-token", async ({ request, params }) => {
+      const refreshed = await factory.refreshAccountToken(
+        config.accessResolver(request),
+        params.providerId,
+        params.accountId,
+      );
+      return refreshed;
 })
     .post(
       "/:providerId/accounts/export",

package/src/console/providers/catalog/store-helpers.ts

@@ -10,7 +10,7 @@ import {
   firstNonEmptyString as firstString,
   tryParseJson as safeParseJson,
 } from "../../../shared/coerce";
-import type { CredentialMode, ModelCatalogEntry } from "./contracts";
+import type { CredentialMode, ModelCatalogEntry, ModelWarning } from "./contracts";
 import {
   FALLBACK_CONTEXT_LIMIT,
   FALLBACK_OUTPUT_LIMIT,
@@ -285,6 +285,32 @@ export function liveModelCooldowns(
 }
 
 
+/**
+ * Reads the display-only warning blob. Postgres returns `jsonb` already
+ * decoded; SQLite returns the JSON string its `text` column carries, so both
+ * shapes are accepted. A value that is not `{ warnings: [...] }` is ignored —
+ * a malformed row must not break the entire model list.
+ */
+function parseWarningMetadata(raw: unknown): { warnings: ModelWarning[] } | undefined {
+  let value: unknown = raw;
+  if (typeof value === "string") {
+    try {
+      value = JSON.parse(value) as unknown;
+    } catch {
+      return undefined;
+    }
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const warnings = (value as Record<string, unknown>)["warnings"];
+  if (!Array.isArray(warnings)) return undefined;
+  const projected = warnings.filter((warning): warning is ModelWarning => {
+    if (warning === null || typeof warning !== "object" || Array.isArray(warning)) return false;
+    const item = warning as Record<string, unknown>;
+    return typeof item["kind"] === "string" && typeof item["message"] === "string";
+  });
+  return projected.length > 0 ? { warnings: projected } : undefined;
+}
+
 /**
  * Projects one persisted `models` row into the console's catalog entry.
  *
@@ -344,6 +370,9 @@ export function mapModelRow(
     // Same three-valued rule, from the provider's own directory. Qoder states
     // `is_free` per row, so a plan change moves the pill without a code change.
     ...(row.freeTier === true ? { freeTier: true } : {}),
+    // Display-only: a `NULL` column (or a malformed legacy value) projects no
+    // warnings at all rather than leaking the raw JSON shape to the dashboard.
+    ...(parseWarningMetadata(row.warningMetadata) ?? {}),
     sourceUpdatedAt: row.sourceUpdatedAt?.toISOString() ?? null,
   } satisfies ModelCatalogEntry;
 }

package/src/console/providers/catalog/store.ts

@@ -1,5 +1,6 @@
 // Drizzle-backed provider, account, model, routing, and API-key repositories.
 import { and, asc, eq, gte, inArray, isNull, or, sql, type SQL } from "drizzle-orm";
+import { isSqliteDatabase } from "../../../persistence/dialect";
 import { ConsoleDomainError } from "../../shared/errors";
 import { parseCustomProviderId, isBundledProviderId } from "../../../providers/provider-contracts";
 import { providerRateLimitIsIpScoped } from "../../../providers/provider-metadata";
@@ -13,11 +14,13 @@ import { buddyTaskLedger, models, networkPools, providerAccounts, providerOauthS
 import { IS_GATEWAY_ERROR_SQL } from "../../../observability/event-query";
 import type { WireFamily } from "../../../protocol/canonical-model";
 import { listAccountHealthEvents, recoverAccount, deleteAccountHealthEvents, type AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
-import { invalidateCredentialCache } from "../../../providers/operations/provider-credential-service";
+import { invalidateCredentialCache, invalidateCredentialCaches } from "../../../providers/operations/provider-credential-service";
+import { invalidateQuotaCaches } from "../../../providers/quota/cache";
 import { encryptCredential, hashSecret } from "../../../security/crypto";
 import type { TelemetryBatchBuffer } from "../../../observability/telemetry-buffer";
+import type { RedisClient } from "../../../persistence/redis";
 import { bumpCatalogRevision, type BundledProviderCatalog } from "../../../providers/operations/provider-catalog-service";
-import type { AccountInflightReading, BuddyGrowthTaskLedgerEntry, ByokConnectionTestRequest, ByokConnectionTestResult, CreateProviderAccountBatchItemResult, CreateProviderAccountBatchResult, CreateProviderAccountRequest, CredentialMode, ModelCatalogEntry, ProbeAllAccountsResult, ProbeAllModelsResult, ProbeModelRequest, ProbeModelResult, ProviderAccountResponse, ProviderAccountTokenUsage, ProviderCatalogStore, ProviderRecord, SetModelEnabledRequest, UpdateModelMetadataRequest, UpdateProviderAccountRequest, ModelMetadataOverride } from "./contracts";
+import type { AccountInflightReading, BuddyGrowthTaskLedgerEntry, ByokConnectionTestRequest, ByokConnectionTestResult, CreateProviderAccountBatchItemResult, CreateProviderAccountBatchResult, CreateProviderAccountRequest, CredentialMode, DiscoverModelCandidate, ModelCatalogEntry, ProbeAllAccountsResult, ProbeAllModelsResult, ProbeModelRequest, ProbeModelResult, ProviderAccountBulkActionResult, ProviderAccountResponse, ProviderAccountTokenUsage, ProviderCatalogStore, ProviderRecord, SetModelEnabledRequest, UpdateModelMetadataRequest, UpdateProviderAccountRequest, ModelMetadataOverride } from "./contracts";
 import { isServiceKind, validateCompatibilityProfile } from "./contracts";
 import { ProviderProbingService, type ProbeOutboundResolver } from "../../../providers/discovery/probing-service";
 import {
@@ -75,6 +78,7 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
   private readonly probing: ProviderProbingService;
   private readonly bundledModelCatalog: ReadonlyMap<string, readonly ModelDefinition[]>;
   private readonly providerRegistry: ProviderRegistry;
+  private readonly redis: RedisClient | undefined;
 
   private readonly readAccountInflight:
     | ((
@@ -97,11 +101,14 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
             tenantId: string,
           ) => Promise<readonly AccountInflightReading[]>)
         | undefined;
+      /** Shared Redis handle for quota-cache invalidation on bulk delete. */
+      readonly redis?: RedisClient | undefined;
     },
   ) {
     this.bundledModelCatalog = options.bundledModelCatalog.modelsByProvider;
     this.providerRegistry = options.providerRegistry;
     this.readAccountInflight = options.readAccountInflight;
+    this.redis = options.redis;
     this.probing = new ProviderProbingService({
       db,
       telemetryBuffer: options.telemetryBuffer,
@@ -430,12 +437,17 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
    * (warms OAuth token / connection pools), the rest run concurrently bounded
    * to 5. Registered model ids come from this store's own catalog read.
    */
-  async probeAllModels(tenantId: string, providerId: string): Promise<ProbeAllModelsResult> {
+  async probeAllModels(
+    tenantId: string,
+    providerId: string,
+    mode?: ProbeModelRequest["mode"],
+  ): Promise<ProbeAllModelsResult> {
     const entries = await this.listModels(tenantId, providerId);
     const requests = entries.map((entry) => ({
       modelId: entry.modelId,
       route: entry.route,
       serviceKind: isServiceKind(entry.serviceKind) ? entry.serviceKind : ("llm" as const),
+      ...(mode === undefined ? {} : { mode }),
     }));
     const uniqueRequests = requests.filter(
       (request, index, all) =>
@@ -559,6 +571,8 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     const findRow = (ownership: SQL) =>
       this.db
         .select({ id: models.id, modalities: models.modalities, source: models.source })
+        // source is read for both the global builtin guard above and the new
+        // non-builtin-only warning edit.
         .from(models)
         .innerJoin(providers, eq(models.providerId, providers.id))
         .where(
@@ -594,6 +608,29 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     // per-flag field: the point of the flag is that the operator does not know
     // which capabilities the model has, so an explicit `false` alongside it is
     // either stale or a mistake.
+    // Builtin rows are re-seeded from the static catalog on every boot, so a
+    // warning edit there would be reverted. Non-builtin rows (including ones a
+    // discovery commit created) are operator-owned and may set or clear them.
+    if (override?.warnings !== undefined) {
+      if (row.source === "builtin") {
+        throw new ConsoleDomainError(
+          "builtin_model_immutable",
+          403,
+          `Built-in model ${providerId}/${request.modelId} warnings cannot be edited — the bundle re-seeds them on every boot`,
+        );
+      }
+      set.warningMetadata =
+        override.warnings === null
+          ? null
+          : {
+              warnings: override.warnings.map((warning) => ({
+                kind: warning.kind,
+                message: warning.message,
+                ...(warning.severity === undefined ? {} : { severity: warning.severity }),
+                ...(warning.updatedAt === undefined ? {} : { updatedAt: warning.updatedAt }),
+              })),
+            };
+    }
     if (override?.passthrough === true) {
       set.reasoning = true;
       set.toolCall = true;
@@ -1655,8 +1692,211 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     return recoverAccount(this.db, accountId, "manual_operator_recovery");
   }
 
+  /**
+   * One `UPDATE ... WHERE <cooldown predicate>` (D07/D08/D09). The predicate
+   * is evaluated in SQL, so the whole provider is handled in one statement
+   * without reading rows into the process. `cooldown_until` and
+   * `model_cooldowns` are left untouched: they are the evidence the operator
+   * sees on a disabled row until an explicit Recover clears them.
+   *
+   * Pool-as-account rows live in `provider_pool_accounts`, not this table, so
+   * they are excluded by construction. Shared (`tenant_id IS NULL`) rows are
+   * counted in `globalSkipped` but never written by a tenant; the global-admin
+   * pair of routes owns those.
+   */
+  async disableCooldowns(
+    tenantId: string,
+    providerId: string,
+  ): Promise<ProviderAccountBulkActionResult> {
+    const nowIso = new Date().toISOString();
+    const [globalRows, updatedRows] = await Promise.all([
+      this.db
+        .select({ id: providerAccounts.id })
+        .from(providerAccounts)
+        .where(
+          and(
+            eq(providerAccounts.providerId, providerId),
+            isNull(providerAccounts.tenantId),
+            this.liveCooldownPredicate(nowIso),
+          ),
+        ),
+      this.db
+        .update(providerAccounts)
+        .set({ status: "disabled" })
+        .where(
+          and(
+            eq(providerAccounts.providerId, providerId),
+            eq(providerAccounts.tenantId, tenantId),
+            this.liveCooldownPredicate(nowIso),
+          ),
+        )
+        .returning({ id: providerAccounts.id }),
+    ]);
+    // Status is part of the cached credential's admission decision, so every
+    // newly disabled id must be dropped here — not only on delete.
+    invalidateCredentialCaches(updatedRows.map((row) => row.id));
+    return { ok: true, updated: updatedRows.length, globalSkipped: globalRows.length };
+  }
+
+  /**
+   * One `DELETE ... WHERE <strict banned predicate> RETURNING id` (D12).
+   * Credential and quota caches are dropped for the deleted ids in one pass
+   * each, exactly like the existing batch-delete route. A delete is strictly
+   * `status='disabled' AND last_error_category='policy_blocked_banned'`;
+   * `auth_invalidated` is remediated by replacing the credential, not here.
+   */
+  async deleteBanned(
+    tenantId: string,
+    providerId: string,
+  ): Promise<ProviderAccountBulkActionResult> {
+    const globalRows = await this.db
+      .select({ id: providerAccounts.id })
+      .from(providerAccounts)
+      .where(
+        and(
+          eq(providerAccounts.providerId, providerId),
+          isNull(providerAccounts.tenantId),
+          this.bannedPredicate(),
+        ),
+      );
+    const deletedRows = await this.db
+      .delete(providerAccounts)
+      .where(
+        and(
+          eq(providerAccounts.providerId, providerId),
+          eq(providerAccounts.tenantId, tenantId),
+          this.bannedPredicate(),
+        ),
+      )
+      .returning({ id: providerAccounts.id });
+    const deletedIds = deletedRows.map((row) => row.id);
+    invalidateCredentialCaches(deletedIds);
+    await invalidateQuotaCaches(tenantId, deletedIds, this.redis);
+    return {
+      ok: true,
+      updated: 0,
+      deleted: deletedIds,
+      missing: [],
+      globalSkipped: globalRows.length,
+    };
+  }
+
+  /** Strict banned definition shared by the tenant and global DELETE paths. */
+  private bannedPredicate(): SQL {
+    return and(
+      eq(providerAccounts.status, "disabled"),
+      eq(providerAccounts.lastErrorCategory, "policy_blocked_banned"),
+    ) as SQL;
+  }
+
+  /**
+   * `status='cooldown' OR cooldown_until > now OR model_cooldowns` carries a
+   * live entry. The JSON check is dialect-specific: PostgreSQL uses
+   * `jsonb_each_text` (with a shape guard), SQLite `json_each` on its `text`
+   * column. Only entries whose ISO deadline is still in the future count, mirroring
+   * `liveModelCooldowns`. Timestamps are stored as ISO strings on both backends,
+   * so the lexical comparison against `nowIso` is stable.
+   */
+  private liveCooldownPredicate(nowIso: string): SQL {
+    const liveModelCooldown = isSqliteDatabase(this.db)
+      ? sql`EXISTS (SELECT 1 FROM json_each(${providerAccounts.modelCooldowns}) AS entry WHERE json_valid(${providerAccounts.modelCooldowns}) AND json_type(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`
+      : sql`EXISTS (SELECT 1 FROM jsonb_each_text(${providerAccounts.modelCooldowns}) AS entry WHERE jsonb_typeof(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`;
+    return or(
+      eq(providerAccounts.status, "cooldown"),
+      sql`${providerAccounts.cooldownUntil} > ${nowIso}`,
+      liveModelCooldown,
+    ) as SQL;
+  }
 
   async syncModels(tenantId: string, providerId: string): Promise<{ synced: number }> {
     return this.probing.syncModels(tenantId, providerId);
   }
+
+  /** Read-only discovery; delegates to the same fetch path as sync (area 05). */
+  async listDiscoveryCandidates(
+    tenantId: string,
+    providerId: string,
+  ): Promise<{
+    readonly supported: boolean;
+    readonly candidates: readonly DiscoverModelCandidate[];
+    readonly accountLabel?: string;
+  }> {
+    const discovery = await this.probing.discoverModels(tenantId, providerId);
+    if (!discovery.supported) return { supported: false, candidates: [] };
+    const registered = await this.listModelsForTenant(tenantId, providerId);
+    const ids = new Set(
+      (registered.get(providerId) ?? []).map((entry) => entry.modelId),
+    );
+    // The picker exists to add models, so rows already on the roster are
+    // excluded rather than listed disabled — a fully-registered catalog would
+    // otherwise render an all-"Registered" list that reads as empty.
+    const candidates: DiscoverModelCandidate[] = discovery.models
+      .filter((definition) => !ids.has(definition.modelId))
+      .map((definition) => ({
+        modelId: definition.modelId,
+        wireFamily: definition.wireFamily,
+        serviceKind: definition.serviceKind ?? "llm",
+        endpointPath: definition.endpointPath,
+        contextLimit: definition.contextLimit,
+        outputLimit: definition.outputLimit,
+        modalities: definition.modalities,
+        reasoning: definition.reasoning,
+        toolCall: definition.toolCall,
+        ...(definition.freeTier === undefined ? {} : { freeTier: definition.freeTier }),
+        ...(definition.proOnly === undefined ? {} : { proOnly: definition.proOnly }),
+        alreadyRegistered: false,
+      }));
+    return {
+      supported: true,
+      candidates,
+      ...(discovery.accountLabel === undefined ? {} : { accountLabel: discovery.accountLabel }),
+    };
+  }
+
+  /**
+   * Re-runs discovery on the server, then persists only ids the fresh roster
+   * actually advertised (D28/D29/D30/D31). This is the anti-forgery gate: a
+   * caller cannot attach a hand-built metadata object to an arbitrary id.
+   */
+  async commitDiscoveredModels(
+    tenantId: string,
+    providerId: string,
+    modelIds: readonly string[],
+  ): Promise<{
+    readonly committed: readonly string[];
+    readonly skipped: readonly string[];
+    readonly synced: number;
+  }> {
+    const discovery = await this.probing.discoverModels(tenantId, providerId);
+    if (!discovery.supported) {
+      throw new ConsoleDomainError(
+        "model_discovery_unsupported",
+        400,
+        `${providerId} publishes no model-listing endpoint; add the model manually`,
+      );
+    }
+    const byId = new Map(discovery.models.map((definition) => [definition.modelId, definition]));
+    const wanted = [...new Set(modelIds)];
+    const unknown = wanted.filter((id) => !byId.has(id));
+    if (unknown.length > 0) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `Models are no longer in the provider's listing: ${unknown.join(", ")} (request {requestId}). Fetch the model list again 🪞`,
+      );
+    }
+    const registered = await this.listModelsForTenant(tenantId, providerId);
+    const existing = new Set(
+      (registered.get(providerId) ?? []).map((entry) => entry.modelId),
+    );
+    const selected = wanted.filter((id) => !existing.has(id));
+    const skipped = wanted.filter((id) => existing.has(id));
+    if (selected.length === 0) return { committed: [], skipped, synced: 0 };
+    const { synced } = await this.probing.commitDiscoveredModels(
+      tenantId,
+      providerId,
+      selected,
+    );
+    return { committed: selected, skipped, synced };
+  }
 }