cartethyia 2.7.8 → 2.8.0

package/src/console/console-router-guards.ts

@@ -11,6 +11,27 @@ import { GatewayError } from "../protocol/gateway-error";
 import { fastPathname } from "../transport/pathname";
 import { parseCookieValue, SESSION_COOKIE_NAME, isCsrfValid } from "../security/csrf";
 
+/**
+ * Console auth routes are excluded from CSRF and mutation-rate limiting: they
+ * run before a session exists or are the very requests that mint the session,
+ * so they must not require a CSRF token or count against the session's budget.
+ */
+const AUTH_ROUTE_SUFFIXES = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"] as const;
+
+/**
+ * Whether `request` is a protected console mutation: a `/console/api/*` route
+ * in an unsafe method, excluding the auth-route suffixes. Shared by the CSRF
+ * and mutation-limiter guards so a change to the protected set lands in both.
+ */
+function isProtectedConsoleMutation(request: Request): boolean {
+  const path = fastPathname(request.url);
+  return (
+    path.startsWith("/console/api/") &&
+    ["POST", "PUT", "PATCH", "DELETE"].includes(request.method) &&
+    !AUTH_ROUTE_SUFFIXES.some((suffix) => path.endsWith(suffix))
+  );
+}
+
 /**
  * Stateless double-submit CSRF guard for unsafe `/console/api/*` mutations.
  * Compares the `x-csrf-token` header against the readable `csrf_token`
@@ -19,16 +40,9 @@ import { parseCookieValue, SESSION_COOKIE_NAME, isCsrfValid } from "../security/
  * store whose outage could masquerade as an auth failure.
  */
 export function createConsoleCsrfMiddleware(): Elysia {
-  const excluded = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"];
   return new Elysia()
     .beforeHandle(async ({ request }) => {
-      const path = fastPathname(request.url);
-      if (
-        !path.startsWith("/console/api/") ||
-        !["POST", "PUT", "PATCH", "DELETE"].includes(request.method) ||
-        excluded.some((suffix) => path.endsWith(suffix))
-      )
-        return;
+      if (!isProtectedConsoleMutation(request)) return;
       const token = parseCookieValue(request, SESSION_COOKIE_NAME);
       // No session cookie means no ambient authority to forge: logout and
       // other mutations without a session fail authentication downstream.
@@ -75,16 +89,9 @@ function pruneConsoleMutationHits(now: number): void {
 }
 
 export function createConsoleMutationLimiterMiddleware(): Elysia {
-  const excluded = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"];
   return new Elysia()
     .beforeHandle(async ({ request, set }) => {
-      const path = fastPathname(request.url);
-      if (
-        !path.startsWith("/console/api/") ||
-        !["POST", "PUT", "PATCH", "DELETE"].includes(request.method) ||
-        excluded.some((suffix) => path.endsWith(suffix))
-      )
-        return;
+      if (!isProtectedConsoleMutation(request)) return;
       const key = consoleMutationKey(request);
       // No session cookie means no ambient authority to abuse: the request
       // fails authentication downstream. Only tracked sessions are throttled.

package/src/console/console-router.ts

@@ -35,12 +35,18 @@ import type { ProviderRegistry } from "../providers/provider-registry";
 import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
 import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
 import type { TrustedProxyBoundary } from "../config/network";
+import type { IpAbuseStore } from "../security/abuse";
 import { gzipResponse } from "./response-compression";
 import { beginConsoleActivity } from "../shared/invoke-guard";
 
 export interface ConsoleApiCompositionDeps {
   readonly db: CartethyiaDatabase;
   readonly accessResolver: ConsoleAccessResolver;
+  /**
+   * The IP-abuse store backing manual IP bans and the live ban list. Absent
+   * (reduced compositions) means the IP-ban routes are not offered.
+   */
+  readonly ipAbuseStore?: IpAbuseStore;
   /**
    * Drops the cached route snapshot after a console write changes the catalog.
    * Structurally satisfied by `RouteSnapshotService`; declared here so the
@@ -222,6 +228,7 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): AnyElysia
     telemetryBuffer,
     ...(deps.stateStore ? { stateStore: deps.stateStore } : {}),
     ...(deps.shareStore ? { shareStore: deps.shareStore } : {}),
+    ...(deps.ipAbuseStore ? { ipAbuseStore: deps.ipAbuseStore } : {}),
     providerRegistry: deps.providerRegistry,
     bundledModelCatalog: deps.bundledModelCatalog,
     networkBindingFactory: deps.networkBindingFactory,

package/src/console/dashboard-assets.ts

@@ -62,13 +62,13 @@ export const SHARE_SOCIAL_META: SocialMeta = {
   title: "Cartethyia — Bansos Token",
   description:
     "Come and save your tokens 💖 Shared Cartethyia API key — Bansos Token with live quota, usage and model allowlist.",
-  image: "/assets/brand/og_bansos.jpg",
-  imageType: "image/jpeg",
+  image: "/assets/brand/og_bansos.webp",
+  imageType: "image/webp",
   // Read from the file's own header, not carried over from a previous image:
   // og:image:width/height are what a crawler uses to allocate the card before
   // the bytes arrive, so a copied size makes every preview crop.
-  imageWidth: 1760,
-  imageHeight: 576,
+  imageWidth: 1200,
+  imageHeight: 393,
   imageAlt: "Cartethyia Bansos Token — Come and save your tokens",
 };
 
@@ -405,7 +405,7 @@ function getMimeType(filePath: string): string {
  * and the modern Vite spelling `app-BCnqn3N3.js` — plus `_`, and then required
  * to *look generated*: the segment must contain a digit or mix upper and lower
  * case. The second half is what keeps a plain word out of the set, since
- * `console-backgrounds.jpg` and `openai-light.svg` both match the separator
+ * `console-backgrounds.webp` and `openai-light.svg` both match the separator
  * alone and are emphatically not immutable.
  *
  * Getting this wrong in either direction costs real money: a hashed asset

package/src/console/domain-registration.ts

@@ -36,7 +36,8 @@ import { createLiveRoutes } from "./observability/live";
 import { createLogRoutes } from "./observability/logs";
 import { createAuditRoutes } from "./audit/routes";
 import { DrizzleAuditReadStore } from "./audit/store";
-import { createPerformanceRoutes } from "./observability/performance";
+import { createIpBanRoutes } from "./ip-bans/routes";
+import type { IpAbuseStore } from "../security/abuse";
 import { createUpdateRoutes } from "./updates/routes";
 import { createRemoteSupportRoutes } from "./remote-support/routes";
 import { createRemoteSupportService } from "./remote-support/service";
@@ -55,6 +56,7 @@ import {
   createAccountExportCredentialsResolver,
   createAccountSecretResolver,
 } from "../providers/operations/provider-credential-service";
+import { refreshAccountStatus } from "../providers/operations/account-refresh-status";
 import { syncByokProvider } from "../providers/operations/provider-catalog-service";
 import { DrizzleApiKeyStore } from "../persistence/stores/api-key-store";
 import {
@@ -82,6 +84,11 @@ import type { ConsoleAccessResolver } from "./auth/access";
 export interface ConsoleDomainContext {
   readonly db: CartethyiaDatabase;
   readonly accessResolver: ConsoleAccessResolver;
+  /**
+   * The IP-abuse store backing manual IP bans and the live ban list. Absent
+   * (reduced compositions) means the IP-ban routes are not offered.
+   */
+  readonly ipAbuseStore?: IpAbuseStore;
   readonly providerRegistry: ProviderRegistry;
   readonly bundledModelCatalog: BundledProviderCatalog;
   readonly networkBindingFactory: ValidatedNetworkBindingFactory;
@@ -159,6 +166,17 @@ export function registerConsoleDomains(
     resolveRefresher: (id) => ctx.providerRegistry.resolveRefresher(id),
     refreshService: ctx.oauthRefreshService,
   });
+  /** Manual OAuth token refresh for the catalog route (area 04). */
+  const refreshAccountStatusForConsole = (accountId: string, opts?: { readonly origin?: "ui" | "sweep" | "dispatch" }) =>
+    refreshAccountStatus(
+      {
+        db: ctx.db,
+        refreshService: ctx.oauthRefreshService,
+        resolveRefresher: (id) => ctx.providerRegistry.resolveRefresher(id),
+      },
+      accountId,
+      opts,
+    );
   const providerCatalogStore = new DrizzleProviderCatalogStore(ctx.db, {
     telemetryBuffer: ctx.telemetryBuffer,
     bundledModelCatalog: ctx.bundledModelCatalog,
@@ -238,6 +256,7 @@ export function registerConsoleDomains(
       };
     },
     snapshotInvalidator: ctx.routeSnapshotService,
+    redis: ctx.redis,
     readAccountInflight: async (providerId, tenantId) =>
       ctx.readRoutingAccountInflight ? ctx.readRoutingAccountInflight(providerId, tenantId) : [],
   });
@@ -258,7 +277,6 @@ export function registerConsoleDomains(
     ...(ctx.stateStore ? { stateStore: ctx.stateStore } : {}),
   }));
   console.use(createLogRoutes({ accessResolver: ctx.accessResolver, auditSink: ctx.auditRecorder }));
-  console.use(createPerformanceRoutes({ accessResolver: ctx.accessResolver }));
   console.use(createUpdateRoutes({
     accessResolver: ctx.accessResolver,
     observabilityStore,
@@ -271,6 +289,12 @@ export function registerConsoleDomains(
     service: createRemoteSupportService({ port: resolvePort() }),
   }));
   console.use(createAuditRoutes({ store: auditReadStore, accessResolver: ctx.accessResolver }));
+  if (ctx.ipAbuseStore) {
+    console.use(createIpBanRoutes({
+      accessResolver: ctx.accessResolver,
+      store: ctx.ipAbuseStore,
+    }));
+  }
   // InferHub market data. On demand only: a route fetches when its snapshot is
   // past its freshness window, so a page nobody opens causes no upstream calls.
   const inferhubKeys = createInferhubKeyStore(ctx.db);
@@ -287,6 +311,7 @@ export function registerConsoleDomains(
     redis: ctx.redis,
     snapshotInvalidator: ctx.routeSnapshotService,
     resolveExportCredentials,
+    refreshAccountStatus: refreshAccountStatusForConsole,
     // Without this, a custom provider only becomes dispatchable after a
     // restart: boot registers BYOK rows once, and the catalog routes are the
     syncByokProvider: (providerId) =>

package/src/console/inferhub/normalize.ts

@@ -35,19 +35,12 @@ const FAMILY_STATES: readonly FamilyState[] = [
   "low_traffic",
 ];
 
-/** Reads a finite number, or null. Never coerces a missing metric to zero. */
-function num(value: unknown): number | null {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  // Catalog and budgets carry decimal strings; market carries numbers. Both
-  // are read here so one helper covers the wire's own inconsistency.
-  if (typeof value === "string" && value.trim().length > 0) {
-    const parsed = Number(value);
-    if (Number.isFinite(parsed)) return parsed;
-  }
-  return null;
-}
-
-/** Reads a finite number, or null. Never coerces a missing metric to zero. */
+/**
+ * Reads a finite number, or null. Never coerces a missing metric to zero.
+ *
+ * Catalog and budgets carry decimal strings; market carries numbers. Both
+ * are read here so one helper covers the wire's own inconsistency.
+ */
 export function numOrNull(value: unknown): number | null {
   if (typeof value === "number" && Number.isFinite(value)) return value;
   if (typeof value === "string" && value.trim().length > 0) {
@@ -122,8 +115,8 @@ function pricePointsToTiers(
   const seen = new Map<number, Tier>();
   for (const point of points) {
     if (!Array.isArray(point) || point.length < 2) continue;
-    const price = num(point[0]);
-    const avail = num(point[1]);
+    const price = numOrNull(point[0]);
+    const avail = numOrNull(point[1]);
     if (price === null || avail === null) continue;
     const count = Math.max(0, Math.trunc(avail));
     const key = Math.round(price * 10 ** PRICE_PRECISION) / 10 ** PRICE_PRECISION;
@@ -208,8 +201,8 @@ export function normalizeCatalogModel(
   const prefix = str(upstream.prefix) ?? "";
   if (modelSlug === null || prefix.length === 0) return null;
   const id = `${prefix}/${modelSlug}`;
-  const officialIn = num(raw.officialIn);
-  const officialOut = num(raw.officialOut);
+  const officialIn = numOrNull(raw.officialIn);
+  const officialOut = numOrNull(raw.officialOut);
   const tiersIn = pricePointsToTiers(raw.pricePointsIn, officialIn);
   const tiersOut = pricePointsToTiers(raw.pricePointsOut, officialOut);
   // Live providers is the capacity behind the cheapest tier, not a row count:
@@ -234,10 +227,13 @@ export function normalizeCatalogModel(
     minAskOut: tiersOut[0]?.price ?? null,
     maxAskIn: tiersIn.at(-1)?.price ?? null,
     maxAskOut: tiersOut.at(-1)?.price ?? null,
+    // Computed by the route layer before sending; starts null in internal models.
+    capacityPriceIn: null,
+    capacityPriceOut: null,
     providersLive,
     // Not carried by the catalog; merged from `/api/market` by the store.
     lastRate: null,
-    cacheHitRate: num(raw.cacheHitRate),
+    cacheHitRate: numOrNull(raw.cacheHitRate),
     health: {
       successRatePct: null,
       avgTtftMs: null,
@@ -245,8 +241,8 @@ export function normalizeCatalogModel(
       familyState: null,
     },
     capabilities: {
-      contextWindow: num(raw.contextWindow),
-      maxOutputTokens: num(raw.maxOutputTokens),
+      contextWindow: numOrNull(raw.contextWindow),
+      maxOutputTokens: numOrNull(raw.maxOutputTokens),
       modalities: stringArray(raw.modalities),
       outputModality:
         outputModality === "image" || outputModality === "video" ? outputModality : "text",
@@ -274,13 +270,13 @@ export function mergeMarketPrices(
     if (entry === undefined) return model;
     return {
       ...model,
-      lastRate: num(entry.lastRate),
+      lastRate: numOrNull(entry.lastRate),
       // Market is the cheaper source for the extremes, but the catalog's tier
       // grouping is what gives them capacity, so only the nulls are filled.
-      minAskIn: model.minAskIn ?? num(entry.minAskIn),
-      minAskOut: model.minAskOut ?? num(entry.minAskOut),
-      maxAskIn: model.maxAskIn ?? num(entry.maxAskIn),
-      maxAskOut: model.maxAskOut ?? num(entry.maxAskOut),
+      minAskIn: model.minAskIn ?? numOrNull(entry.minAskIn),
+      minAskOut: model.minAskOut ?? numOrNull(entry.minAskOut),
+      maxAskIn: model.maxAskIn ?? numOrNull(entry.maxAskIn),
+      maxAskOut: model.maxAskOut ?? numOrNull(entry.maxAskOut),
     };
   });
 }
@@ -306,9 +302,9 @@ export function mergeModelHealth(
       ...model,
       health: {
         ...model.health,
-        successRatePct: num(entry.successRatePct),
-        avgTtftMs: num(entry.avgTtftMs),
-        avgTps: num(entry.avgTps),
+        successRatePct: numOrNull(entry.successRatePct),
+        avgTtftMs: numOrNull(entry.avgTtftMs),
+        avgTps: numOrNull(entry.avgTps),
       },
     };
   });

package/src/console/inferhub/types.ts

@@ -61,6 +61,9 @@ export interface ModelMarket {
   readonly minAskOut: number | null;
   readonly maxAskIn: number | null;
   readonly maxAskOut: number | null;
+  /** Capacity-weighted price computed by the route layer; null when no tiers. */
+  readonly capacityPriceIn: number | null;
+  readonly capacityPriceOut: number | null;
   /** Zero means no live provider — listed, but never routed to. */
   readonly providersLive: number;
   readonly lastRate: number | null;

package/src/console/ip-bans/routes.ts

@@ -0,0 +1,93 @@
+// IP-ban domain: manual IP bans visible in the Banned Users modal.
+//
+// The gateway's abuse store keeps automatic bans (escalation after a burst).
+// This domain exposes the same store to the operator so an address can be
+// banned BY HAND and listed/unbanned from the console. IP bans are instance
+// state, not tenant data, so every route is guarded by `platform:admin` like
+// the other instance-level operations.
+
+import { Elysia, t, type AnyElysia } from "elysia";
+import { errorResponse, requireGlobalAdmin } from "../shared/errors";
+import type { IpAbuseStore } from "../../security/abuse";
+import type { ConsoleAccessResolver } from "../auth/access";
+import { BAN_DURATION_CHOICES } from "../api-keys/ban-constants";
+
+/** One active IP ban, as the console returns it. */
+export interface IpBanResponse {
+  /** The banned address. */
+  readonly ip: string;
+  /** When the ban lifts, as ISO timestamp; null = permanent. */
+  readonly bannedUntil: string | null;
+  /** True when the ban was set by hand rather than by abuse escalation. */
+  readonly manual: boolean;
+}
+
+export interface IpBanRoutesConfig {
+  readonly accessResolver: ConsoleAccessResolver;
+  readonly store: IpAbuseStore;
+}
+
+/** Parses a duration choice into minutes; null = permanent; undefined = invalid. */
+function parseBanDuration(value: unknown): number | null | undefined {
+  if (value === null || value === undefined) return value === null ? null : undefined;
+  const minutes = Number(value);
+  if (!Number.isFinite(minutes) || minutes <= 0) return undefined;
+  return Math.round(minutes);
+}
+
+export function createIpBanRoutes(config: IpBanRoutesConfig): AnyElysia {
+  const { accessResolver, store } = config;
+  return new Elysia()
+    .get("/ip-bans", async ({ request, set }) => {
+      try {
+        requireGlobalAdmin(accessResolver(request));
+        const bans = await store.listBans();
+        return bans.map((ban) => ({
+          ip: ban.identity,
+          bannedUntil: ban.bannedUntil === null ? null : new Date(ban.bannedUntil).toISOString(),
+          manual: true,
+        }));
+      } catch (e) {
+        return errorResponse(e, set, "Could not list IP bans");
+      }
+    })
+    .post(
+      "/ip-bans",
+      { body: t.Object({ ip: t.String(), minutes: t.Optional(t.Nullable(t.Number())) }) },
+      async ({ request, body, set }) => {
+        try {
+          requireGlobalAdmin(accessResolver(request));
+          const ip = body.ip.trim();
+          if (ip.length === 0)
+            return errorResponse(new Error("ip is required"), set, "Invalid IP ban request");
+          // Absent is permanent (the default), exactly like an explicit null;
+          // parseBanDuration maps those to null and rejects anything else.
+          const minutes = body.minutes === undefined ? null : parseBanDuration(body.minutes);
+          if (minutes === undefined)
+            return errorResponse(new Error("minutes must be a positive integer or null"), set, "Invalid IP ban request");
+          await store.ban(ip, minutes === null ? 0 : minutes * 60_000);
+          return {
+            ip,
+            bannedUntil: minutes === null ? null : new Date(Date.now() + minutes * 60_000).toISOString(),
+            manual: true,
+          };
+        } catch (e) {
+          return errorResponse(e, set, "Could not ban IP");
+        }
+      },
+    )
+    .delete("/ip-bans/:ip", async ({ request, params, set }) => {
+      try {
+        requireGlobalAdmin(accessResolver(request));
+        const ip = typeof params?.["ip"] === "string" ? decodeURIComponent(params["ip"]) : "";
+        if (ip.length === 0)
+          return errorResponse(new Error("ip is required"), set, "Invalid unban request");
+        await store.unban(ip);
+        return { success: true, ip };
+      } catch (e) {
+        return errorResponse(e, set, "Could not unban IP");
+      }
+    });
+}
+
+export { BAN_DURATION_CHOICES };

package/src/console/observability/store.ts

@@ -196,59 +196,6 @@ const TOP_N = 50;
  */
 const USAGE_READ_THROUGH_TTL_SECONDS = 30;
 
-/**
- * Nearest-rank percentile over a sorted array — kept for the JS-side
- * `summarizeUsagePerformance` (still used by callers that already hold a
- * bounded event list). The usage endpoints read percentiles from SQL via
- * `summarizeUsagePerformanceSql`, which is what the dashboard polls.
- */
-function percentile(sorted: readonly number[], fraction: number): number {
-  if (sorted.length === 0) return 0;
-  const index = Math.min(sorted.length - 1, Math.max(0, Math.ceil(fraction * sorted.length) - 1));
-  return Math.round(sorted[index] ?? 0);
-}
-
-interface UsagePerformanceSummary {
-  avgResolveMs: number;
-  avgDurationMs: number;
-  latencyP50Ms: number;
-  latencyP95Ms: number;
-  latencyP99Ms: number;
-  /** Events each series was computed from; see `UsageSummaryTotals`. */
-  latencySampleCount: number;
-  resolveSampleCount: number;
-}
-
-/** Summarizes routing delay and request latency for an already-filtered period. */
-export function summarizeUsagePerformance(
-  events: readonly Pick<TelemetryEventRecord, "latencyMs" | "resolveMs">[],
-): UsagePerformanceSummary {
-  const latencies: number[] = [];
-  let latencySum = 0;
-  let resolveSum = 0;
-  let resolveCount = 0;
-  for (const event of events) {
-    if (event.latencyMs !== null) {
-      latencies.push(event.latencyMs);
-      latencySum += event.latencyMs;
-    }
-    if (event.resolveMs !== null) {
-      resolveSum += event.resolveMs;
-      resolveCount += 1;
-    }
-  }
-  latencies.sort((a, b) => a - b);
-  return {
-    avgResolveMs: resolveCount > 0 ? resolveSum / resolveCount : 0,
-    avgDurationMs: latencies.length > 0 ? latencySum / latencies.length : 0,
-    latencyP50Ms: percentile(latencies, 0.5),
-    latencyP95Ms: percentile(latencies, 0.95),
-    latencyP99Ms: percentile(latencies, 0.99),
-    latencySampleCount: latencies.length,
-    resolveSampleCount: resolveCount,
-  };
-}
-
 /**
  * The console dimension as the SQL reader's grouping key.
  *

package/src/console/providers/catalog/catalog-projections.ts

@@ -11,7 +11,7 @@
 import { isBundledProviderId } from "../../../providers/provider-contracts";
 import { BUILTIN_DEFAULT_ENDPOINTS } from "../../../protocol/codecs";
 
-import { providerDisplayName, providerServiceKinds } from "../../../providers/provider-metadata";
+import { providerDisplayName, providerServiceKinds, customProviderServiceKinds } from "../../../providers/provider-metadata";
 import type { CompatibilityProfile } from "../../../providers/provider-metadata";
 import { supportedWireFamiliesForProvider } from "../../../providers/discovery/probe-wire";
 import { providers } from "../../../persistence/schema";
@@ -74,6 +74,7 @@ export function mapProviderRow(
     row.wireFamilyDefault,
     row.compatibilityProfile,
   );
+  const compatibilityProfile = row.compatibilityProfile as CompatibilityProfile | null;
   return {
     providerId: row.id,
     displayName: providerDisplayName(row.id),
@@ -82,7 +83,9 @@ export function mapProviderRow(
     isBuiltIn: isBundledProviderId(row.id),
     configured: false,
     requiresAccount: row.requiresAccount,
-    serviceKinds: providerServiceKinds(row.id),
+    serviceKinds: isBundledProviderId(row.id)
+      ? providerServiceKinds(row.id)
+      : customProviderServiceKinds(compatibilityProfile),
     // No model advertises search; see the note in provider-metadata.ts.
     supportsWebSearch: false,
     supportsModelDiscovery: