cartethyia 2.7.8 → 2.8.0

package/src/console/providers/catalog/store-helpers.ts

@@ -10,7 +10,7 @@ import {
   firstNonEmptyString as firstString,
   tryParseJson as safeParseJson,
 } from "../../../shared/coerce";
-import type { CredentialMode, ModelCatalogEntry } from "./contracts";
+import type { CredentialMode, ModelCatalogEntry, ModelWarning } from "./contracts";
 import {
   FALLBACK_CONTEXT_LIMIT,
   FALLBACK_OUTPUT_LIMIT,
@@ -285,6 +285,32 @@ export function liveModelCooldowns(
 }
 
 
+/**
+ * Reads the display-only warning blob. Postgres returns `jsonb` already
+ * decoded; SQLite returns the JSON string its `text` column carries, so both
+ * shapes are accepted. A value that is not `{ warnings: [...] }` is ignored —
+ * a malformed row must not break the entire model list.
+ */
+function parseWarningMetadata(raw: unknown): { warnings: ModelWarning[] } | undefined {
+  let value: unknown = raw;
+  if (typeof value === "string") {
+    try {
+      value = JSON.parse(value) as unknown;
+    } catch {
+      return undefined;
+    }
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const warnings = (value as Record<string, unknown>)["warnings"];
+  if (!Array.isArray(warnings)) return undefined;
+  const projected = warnings.filter((warning): warning is ModelWarning => {
+    if (warning === null || typeof warning !== "object" || Array.isArray(warning)) return false;
+    const item = warning as Record<string, unknown>;
+    return typeof item["kind"] === "string" && typeof item["message"] === "string";
+  });
+  return projected.length > 0 ? { warnings: projected } : undefined;
+}
+
 /**
  * Projects one persisted `models` row into the console's catalog entry.
  *
@@ -344,6 +370,9 @@ export function mapModelRow(
     // Same three-valued rule, from the provider's own directory. Qoder states
     // `is_free` per row, so a plan change moves the pill without a code change.
     ...(row.freeTier === true ? { freeTier: true } : {}),
+    // Display-only: a `NULL` column (or a malformed legacy value) projects no
+    // warnings at all rather than leaking the raw JSON shape to the dashboard.
+    ...(parseWarningMetadata(row.warningMetadata) ?? {}),
     sourceUpdatedAt: row.sourceUpdatedAt?.toISOString() ?? null,
   } satisfies ModelCatalogEntry;
 }

package/src/console/providers/catalog/store.ts

@@ -1,5 +1,6 @@
 // Drizzle-backed provider, account, model, routing, and API-key repositories.
-import { and, asc, eq, gte, inArray, isNull, or, sql, type SQL } from "drizzle-orm";
+import { and, asc, eq, gte, inArray, isNull, ne, or, sql, type SQL } from "drizzle-orm";
+import { liveModelCooldownExistsSql } from "../../../persistence/dialect";
 import { ConsoleDomainError } from "../../shared/errors";
 import { parseCustomProviderId, isBundledProviderId } from "../../../providers/provider-contracts";
 import { providerRateLimitIsIpScoped } from "../../../providers/provider-metadata";
@@ -13,11 +14,13 @@ import { buddyTaskLedger, models, networkPools, providerAccounts, providerOauthS
 import { IS_GATEWAY_ERROR_SQL } from "../../../observability/event-query";
 import type { WireFamily } from "../../../protocol/canonical-model";
 import { listAccountHealthEvents, recoverAccount, deleteAccountHealthEvents, type AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
-import { invalidateCredentialCache } from "../../../providers/operations/provider-credential-service";
+import { invalidateCredentialCache, invalidateCredentialCaches } from "../../../providers/operations/provider-credential-service";
+import { invalidateQuotaCaches } from "../../../providers/quota/cache";
 import { encryptCredential, hashSecret } from "../../../security/crypto";
 import type { TelemetryBatchBuffer } from "../../../observability/telemetry-buffer";
+import type { RedisClient } from "../../../persistence/redis";
 import { bumpCatalogRevision, type BundledProviderCatalog } from "../../../providers/operations/provider-catalog-service";
-import type { AccountInflightReading, BuddyGrowthTaskLedgerEntry, ByokConnectionTestRequest, ByokConnectionTestResult, CreateProviderAccountBatchItemResult, CreateProviderAccountBatchResult, CreateProviderAccountRequest, CredentialMode, ModelCatalogEntry, ProbeAllAccountsResult, ProbeAllModelsResult, ProbeModelRequest, ProbeModelResult, ProviderAccountResponse, ProviderAccountTokenUsage, ProviderCatalogStore, ProviderRecord, SetModelEnabledRequest, UpdateModelMetadataRequest, UpdateProviderAccountRequest, ModelMetadataOverride } from "./contracts";
+import type { AccountInflightReading, BuddyGrowthTaskLedgerEntry, ByokConnectionTestRequest, ByokConnectionTestResult, CreateProviderAccountBatchItemResult, CreateProviderAccountBatchResult, CreateProviderAccountRequest, CredentialMode, DiscoverModelCandidate, ModelCatalogEntry, ProbeAllAccountsResult, ProbeAllModelsResult, ProbeModelRequest, ProbeModelResult, ProviderAccountBulkActionResult, ProviderAccountResponse, ProviderAccountTokenUsage, ProviderCatalogStore, ProviderRecord, SetModelEnabledRequest, UpdateModelMetadataRequest, UpdateProviderAccountRequest, ModelMetadataOverride } from "./contracts";
 import { isServiceKind, validateCompatibilityProfile } from "./contracts";
 import { ProviderProbingService, type ProbeOutboundResolver } from "../../../providers/discovery/probing-service";
 import {
@@ -75,6 +78,7 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
   private readonly probing: ProviderProbingService;
   private readonly bundledModelCatalog: ReadonlyMap<string, readonly ModelDefinition[]>;
   private readonly providerRegistry: ProviderRegistry;
+  private readonly redis: RedisClient | undefined;
 
   private readonly readAccountInflight:
     | ((
@@ -97,11 +101,14 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
             tenantId: string,
           ) => Promise<readonly AccountInflightReading[]>)
         | undefined;
+      /** Shared Redis handle for quota-cache invalidation on bulk delete. */
+      readonly redis?: RedisClient | undefined;
     },
   ) {
     this.bundledModelCatalog = options.bundledModelCatalog.modelsByProvider;
     this.providerRegistry = options.providerRegistry;
     this.readAccountInflight = options.readAccountInflight;
+    this.redis = options.redis;
     this.probing = new ProviderProbingService({
       db,
       telemetryBuffer: options.telemetryBuffer,
@@ -430,12 +437,17 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
    * (warms OAuth token / connection pools), the rest run concurrently bounded
    * to 5. Registered model ids come from this store's own catalog read.
    */
-  async probeAllModels(tenantId: string, providerId: string): Promise<ProbeAllModelsResult> {
+  async probeAllModels(
+    tenantId: string,
+    providerId: string,
+    mode?: ProbeModelRequest["mode"],
+  ): Promise<ProbeAllModelsResult> {
     const entries = await this.listModels(tenantId, providerId);
     const requests = entries.map((entry) => ({
       modelId: entry.modelId,
       route: entry.route,
       serviceKind: isServiceKind(entry.serviceKind) ? entry.serviceKind : ("llm" as const),
+      ...(mode === undefined ? {} : { mode }),
     }));
     const uniqueRequests = requests.filter(
       (request, index, all) =>
@@ -559,6 +571,8 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     const findRow = (ownership: SQL) =>
       this.db
         .select({ id: models.id, modalities: models.modalities, source: models.source })
+        // source is read for both the global builtin guard above and the new
+        // non-builtin-only warning edit.
         .from(models)
         .innerJoin(providers, eq(models.providerId, providers.id))
         .where(
@@ -594,6 +608,29 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     // per-flag field: the point of the flag is that the operator does not know
     // which capabilities the model has, so an explicit `false` alongside it is
     // either stale or a mistake.
+    // Builtin rows are re-seeded from the static catalog on every boot, so a
+    // warning edit there would be reverted. Non-builtin rows (including ones a
+    // discovery commit created) are operator-owned and may set or clear them.
+    if (override?.warnings !== undefined) {
+      if (row.source === "builtin") {
+        throw new ConsoleDomainError(
+          "builtin_model_immutable",
+          403,
+          `Built-in model ${providerId}/${request.modelId} warnings cannot be edited — the bundle re-seeds them on every boot`,
+        );
+      }
+      set.warningMetadata =
+        override.warnings === null
+          ? null
+          : {
+              warnings: override.warnings.map((warning) => ({
+                kind: warning.kind,
+                message: warning.message,
+                ...(warning.severity === undefined ? {} : { severity: warning.severity }),
+                ...(warning.updatedAt === undefined ? {} : { updatedAt: warning.updatedAt }),
+              })),
+            };
+    }
     if (override?.passthrough === true) {
       set.reasoning = true;
       set.toolCall = true;
@@ -1655,8 +1692,216 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
     return recoverAccount(this.db, accountId, "manual_operator_recovery");
   }
 
+  /**
+   * One `UPDATE ... WHERE <cooldown predicate>` (D07/D08/D09). The predicate
+   * is evaluated in SQL, so the whole provider is handled in one statement
+   * without reading rows into the process. `cooldown_until` and
+   * `model_cooldowns` are left untouched: they are the evidence the operator
+   * sees on a disabled row until an explicit Recover clears them. A row that
+   * is already `disabled` is not a target — those columns surviving the
+   * status change would otherwise keep matching the predicate forever.
+   *
+   * Pool-as-account rows live in `provider_pool_accounts`, not this table, so
+   * they are excluded by construction. Shared (`tenant_id IS NULL`) rows are
+   * counted in `globalSkipped` but never written by a tenant; the global-admin
+   * pair of routes owns those.
+   */
+  async disableCooldowns(
+    tenantId: string,
+    providerId: string,
+  ): Promise<ProviderAccountBulkActionResult> {
+    const nowIso = new Date().toISOString();
+    const [globalRows, updatedRows] = await Promise.all([
+      this.db
+        .select({ id: providerAccounts.id })
+        .from(providerAccounts)
+        .where(
+          and(
+            eq(providerAccounts.providerId, providerId),
+            isNull(providerAccounts.tenantId),
+            this.liveCooldownPredicate(nowIso),
+          ),
+        ),
+      this.db
+        .update(providerAccounts)
+        .set({ status: "disabled" })
+        .where(
+          and(
+            eq(providerAccounts.providerId, providerId),
+            eq(providerAccounts.tenantId, tenantId),
+            this.liveCooldownPredicate(nowIso),
+          ),
+        )
+        .returning({ id: providerAccounts.id }),
+    ]);
+    // Status is part of the cached credential's admission decision, so every
+    // newly disabled id must be dropped here — not only on delete.
+    invalidateCredentialCaches(updatedRows.map((row) => row.id));
+    return { ok: true, updated: updatedRows.length, globalSkipped: globalRows.length };
+  }
+
+  /**
+   * One `DELETE ... WHERE <strict banned predicate> RETURNING id` (D12).
+   * Credential and quota caches are dropped for the deleted ids in one pass
+   * each, exactly like the existing batch-delete route. A delete is strictly
+   * `status='disabled' AND last_error_category='policy_blocked_banned'`;
+   * `auth_invalidated` is remediated by replacing the credential, not here.
+   */
+  async deleteBanned(
+    tenantId: string,
+    providerId: string,
+  ): Promise<ProviderAccountBulkActionResult> {
+    const globalRows = await this.db
+      .select({ id: providerAccounts.id })
+      .from(providerAccounts)
+      .where(
+        and(
+          eq(providerAccounts.providerId, providerId),
+          isNull(providerAccounts.tenantId),
+          this.bannedPredicate(),
+        ),
+      );
+    const deletedRows = await this.db
+      .delete(providerAccounts)
+      .where(
+        and(
+          eq(providerAccounts.providerId, providerId),
+          eq(providerAccounts.tenantId, tenantId),
+          this.bannedPredicate(),
+        ),
+      )
+      .returning({ id: providerAccounts.id });
+    const deletedIds = deletedRows.map((row) => row.id);
+    invalidateCredentialCaches(deletedIds);
+    await invalidateQuotaCaches(tenantId, deletedIds, this.redis);
+    return {
+      ok: true,
+      updated: 0,
+      deleted: deletedIds,
+      missing: [],
+      globalSkipped: globalRows.length,
+    };
+  }
+
+  /** Strict banned definition shared by the tenant and global DELETE paths. */
+  private bannedPredicate(): SQL {
+    return and(
+      eq(providerAccounts.status, "disabled"),
+      eq(providerAccounts.lastErrorCategory, "policy_blocked_banned"),
+    ) as SQL;
+  }
+
+  /**
+   * Not already disabled, and either `status='cooldown'`, `cooldown_until` is
+   * still in the future, or `model_cooldowns` carries a live entry. Scoped to
+   * the caller's own rows (the tenant path never touches `tenant_id IS NULL`
+   * rows). The shared JSON subquery lives in the dialect module; only the
+   * surrounding scoping is the store's.
+   *
+   * The disabled exclusion is load-bearing. Disable preserves the deadline
+   * columns as evidence, so without it a row this action just wrote matches
+   * the predicate again and the operator's count never drops to zero.
+   */
+  private liveCooldownPredicate(nowIso: string): SQL {
+    return and(
+      ne(providerAccounts.status, "disabled"),
+      or(
+        eq(providerAccounts.status, "cooldown"),
+        sql`${providerAccounts.cooldownUntil} > ${nowIso}`,
+        liveModelCooldownExistsSql(this.db, nowIso),
+      ),
+    ) as SQL;
+  }
 
   async syncModels(tenantId: string, providerId: string): Promise<{ synced: number }> {
     return this.probing.syncModels(tenantId, providerId);
   }
+
+  /** Read-only discovery; delegates to the same fetch path as sync (area 05). */
+  async listDiscoveryCandidates(
+    tenantId: string,
+    providerId: string,
+  ): Promise<{
+    readonly supported: boolean;
+    readonly candidates: readonly DiscoverModelCandidate[];
+    readonly accountLabel?: string;
+  }> {
+    const discovery = await this.probing.discoverModels(tenantId, providerId);
+    if (!discovery.supported) return { supported: false, candidates: [] };
+    const registered = await this.listModelsForTenant(tenantId, providerId);
+    const ids = new Set(
+      (registered.get(providerId) ?? []).map((entry) => entry.modelId),
+    );
+    // The picker exists to add models, so rows already on the roster are
+    // excluded rather than listed disabled — a fully-registered catalog would
+    // otherwise render an all-"Registered" list that reads as empty.
+    const candidates: DiscoverModelCandidate[] = discovery.models
+      .filter((definition) => !ids.has(definition.modelId))
+      .map((definition) => ({
+        modelId: definition.modelId,
+        wireFamily: definition.wireFamily,
+        serviceKind: definition.serviceKind ?? "llm",
+        endpointPath: definition.endpointPath,
+        contextLimit: definition.contextLimit,
+        outputLimit: definition.outputLimit,
+        modalities: definition.modalities,
+        reasoning: definition.reasoning,
+        toolCall: definition.toolCall,
+        ...(definition.freeTier === undefined ? {} : { freeTier: definition.freeTier }),
+        ...(definition.proOnly === undefined ? {} : { proOnly: definition.proOnly }),
+        alreadyRegistered: false,
+      }));
+    return {
+      supported: true,
+      candidates,
+      ...(discovery.accountLabel === undefined ? {} : { accountLabel: discovery.accountLabel }),
+    };
+  }
+
+  /**
+   * Re-runs discovery on the server, then persists only ids the fresh roster
+   * actually advertised (D28/D29/D30/D31). This is the anti-forgery gate: a
+   * caller cannot attach a hand-built metadata object to an arbitrary id.
+   */
+  async commitDiscoveredModels(
+    tenantId: string,
+    providerId: string,
+    modelIds: readonly string[],
+  ): Promise<{
+    readonly committed: readonly string[];
+    readonly skipped: readonly string[];
+    readonly synced: number;
+  }> {
+    const discovery = await this.probing.discoverModels(tenantId, providerId);
+    if (!discovery.supported) {
+      throw new ConsoleDomainError(
+        "model_discovery_unsupported",
+        400,
+        `${providerId} publishes no model-listing endpoint; add the model manually`,
+      );
+    }
+    const byId = new Map(discovery.models.map((definition) => [definition.modelId, definition]));
+    const wanted = [...new Set(modelIds)];
+    const unknown = wanted.filter((id) => !byId.has(id));
+    if (unknown.length > 0) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `Models are no longer in the provider's listing: ${unknown.join(", ")} (request {requestId}). Fetch the model list again 🪞`,
+      );
+    }
+    const registered = await this.listModelsForTenant(tenantId, providerId);
+    const existing = new Set(
+      (registered.get(providerId) ?? []).map((entry) => entry.modelId),
+    );
+    const selected = wanted.filter((id) => !existing.has(id));
+    const skipped = wanted.filter((id) => existing.has(id));
+    if (selected.length === 0) return { committed: [], skipped, synced: 0 };
+    const { synced } = await this.probing.commitDiscoveredModels(
+      tenantId,
+      providerId,
+      selected,
+    );
+    return { committed: selected, skipped, synced };
+  }
 }

package/src/console/quota/account-quota-global.ts

@@ -1,6 +1,7 @@
 import { t } from "elysia";
 import type { Elysia } from "elysia";
-import { and, eq, inArray, isNull } from "drizzle-orm";
+import { and, eq, inArray, isNull, sql } from "drizzle-orm";
+import { liveModelCooldownExistsSql } from "../../persistence/dialect";
 import { adminAuditLog, providerAccounts } from "../../persistence/schema";
 import { requireGlobalAdmin } from "../shared/errors";
 import {
@@ -22,10 +23,29 @@ import {
 } from "../../providers/quota/refresh";
 import { sanitizeGlobalAccount } from "./quota-view";
 import {
-  ACCOUNT_STATUSES,
+  resolveNextAccountStatus,
   type AccountQuotaRoutesDeps,
-  type AccountStatus,
 } from "./account-quota-shared";
+import type { ProviderAccountBulkActionResult } from "../providers/catalog/contracts";
+
+/**
+ * The same live-cooldown predicate as the tenant-scoped store, evaluated in
+ * SQL so one statement covers the whole shared-account set. `status='cooldown'`
+ * counts even when its deadline elapsed; a live `model_cooldowns` entry counts
+ * even while `status` is still `active` (D07). A row already `disabled` does
+ * not: disable keeps the deadline columns as evidence, and counting them would
+ * make a second pass look like it still has work. Scoped strictly to shared
+ * rows (`tenant_id IS NULL`); the shared JSON subquery lives in the dialect
+ * module.
+ */
+function globalLiveCooldownPredicate(database: unknown): ReturnType<typeof and> {
+  const nowIso = new Date().toISOString();
+  return and(
+    isNull(providerAccounts.tenantId),
+    sql`${providerAccounts.status} <> 'disabled'`,
+    sql`${providerAccounts.status} = 'cooldown' OR ${providerAccounts.cooldownUntil} > ${nowIso} OR ${liveModelCooldownExistsSql(database, nowIso)}`,
+  )!;
+}
 
 /**
  * Registers the platform-admin account/quota routes onto `app`. Every route here
@@ -38,6 +58,47 @@ export function registerAccountQuotaGlobalRoutes(
   refreshDeps: QuotaRefreshDeps,
 ): void {
   const { db, accessResolver, redis, snapshotInvalidator } = deps;
+  /**
+   * The two bulk actions are one statement each, scoped strictly to shared
+   * rows. Neither action takes a provider filter: the global-admin surface
+   * lists shared accounts across providers, and the same health predicate
+   * defines the target set everywhere.
+   */
+  const runGlobalBulk = async (
+    kind: "disable" | "delete",
+  ): Promise<ProviderAccountBulkActionResult> => {
+    if (kind === "disable") {
+      const updated = await db
+        .update(providerAccounts)
+        .set({ status: "disabled" })
+        .where(globalLiveCooldownPredicate(db))
+        .returning({ id: providerAccounts.id });
+      invalidateCredentialCaches(updated.map((row) => row.id));
+      await snapshotInvalidator?.invalidate();
+      return { ok: true, updated: updated.length, globalSkipped: 0 };
+    }
+    const deleted = await db
+      .delete(providerAccounts)
+      .where(
+        and(
+          isNull(providerAccounts.tenantId),
+          eq(providerAccounts.status, "disabled"),
+          eq(providerAccounts.lastErrorCategory, "policy_blocked_banned"),
+        ),
+      )
+      .returning({ id: providerAccounts.id });
+    const deletedIds = deleted.map((row) => row.id);
+    invalidateCredentialCaches(deletedIds);
+    await invalidateQuotaCaches(GLOBAL_QUOTA_LENS, deletedIds, redis);
+    await snapshotInvalidator?.invalidate();
+    return {
+      ok: true,
+      updated: 0,
+      deleted: deletedIds,
+      missing: [],
+      globalSkipped: 0,
+    };
+  };
   app
     .get("/global/accounts", async ({ request }) => {
       requireGlobalAdmin(accessResolver(request));
@@ -57,23 +118,12 @@ export function registerAccountQuotaGlobalRoutes(
       },
       async ({ request, params, body, set }) => {
         const access = requireGlobalAdmin(accessResolver(request));
-        if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
-          set.status = 400;
-          return {
-            error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
-            code: "invalid_status",
-          };
-        }
-        const nextStatus: AccountStatus | undefined =
-          body.active !== undefined
-            ? body.active
-              ? "active"
-              : "disabled"
-            : (body.status as AccountStatus | undefined);
-        if (!nextStatus) {
-          set.status = 400;
-          return { error: "active or status is required", code: "invalid_request" };
+        const resolved = resolveNextAccountStatus(body);
+        if (!resolved.ok) {
+          set.status = resolved.status;
+          return resolved.body;
         }
+        const nextStatus = resolved.nextStatus;
         const updated = await db
           .update(providerAccounts)
           .set({ status: nextStatus })
@@ -157,6 +207,34 @@ export function registerAccountQuotaGlobalRoutes(
       });
       return { ok: true, deleted: deletedIds, missing };
     })
+    /**
+     * Global counterparts of the provider-detail bulk actions (D10): shared
+     * accounts carry `tenant_id IS NULL`, so the tenant-scoped pair can never
+     * match them. Both are one statement, one audit row, one snapshot
+     * invalidation, and authorize through `requireGlobalAdmin`.
+     */
+    .post("/global/accounts/actions/disable-cooldowns", async ({ request }) => {
+      const access = requireGlobalAdmin(accessResolver(request));
+      const { ok, updated, globalSkipped } = await runGlobalBulk("disable");
+      await db.insert(adminAuditLog).values({
+        actor: access.admissionIdentity,
+        action: "provider_account.bulk_disabled_cooldowns",
+        target: "global",
+        detail: { updated, globalSkipped },
+      });
+      return { ok, updated, globalSkipped };
+    })
+    .post("/global/accounts/actions/delete-banned", async ({ request }) => {
+      const access = requireGlobalAdmin(accessResolver(request));
+      const { ok, updated, deleted, missing, globalSkipped } = await runGlobalBulk("delete");
+      await db.insert(adminAuditLog).values({
+        actor: access.admissionIdentity,
+        action: "provider_account.bulk_deleted_banned",
+        target: "global",
+        detail: { deleted: deleted ?? [], missing: missing ?? [], globalSkipped },
+      });
+      return { ok, updated, deleted: deleted ?? [], missing: missing ?? [], globalSkipped };
+    })
     .post("/global/accounts/:id/quota/refresh", async ({ request, params, set }) => {
       const access = requireGlobalAdmin(accessResolver(request));
       const target = await loadQuotaTarget(db, params.id, null);

package/src/console/quota/account-quota-shared.ts

@@ -20,6 +20,55 @@ export interface AccountQuotaRoutesDeps extends QuotaRefreshDeps {
 export const ACCOUNT_STATUSES = ["active", "cooldown", "disabled"] as const;
 export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
 
+/**
+ * The merged result of interpreting a PATCH account-status body. On success it
+ * carries the resolved `AccountStatus`; on failure it carries the exact 400
+ * response the tenant and global routes both return.
+ */
+export type ResolveNextAccountStatusResult =
+  | { readonly ok: true; readonly nextStatus: AccountStatus }
+  | {
+      readonly ok: false;
+      readonly status: 400;
+      readonly body: { readonly error: string; readonly code: string };
+    };
+
+/**
+ * Resolves the next account status from a PATCH body: an explicit `active`
+ * boolean wins over `status`, and a missing `status` (or an invalid one) is
+ * rejected with the shared 400 shape. Both account PATCH handlers interpret
+ * the same input contract, so it lives here once.
+ */
+export function resolveNextAccountStatus(body: {
+  readonly active?: boolean;
+  readonly status?: string;
+}): ResolveNextAccountStatusResult {
+  if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
+    return {
+      ok: false,
+      status: 400,
+      body: {
+        error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
+        code: "invalid_status",
+      },
+    };
+  }
+  const nextStatus: AccountStatus | undefined =
+    body.active !== undefined
+      ? body.active
+        ? "active"
+        : "disabled"
+      : (body.status as AccountStatus | undefined);
+  if (nextStatus === undefined) {
+    return {
+      ok: false,
+      status: 400,
+      body: { error: "active or status is required", code: "invalid_request" },
+    };
+  }
+  return { ok: true, nextStatus };
+}
+
 /**
  * Wraps a stored api_key credential in the envelope its collector expects.
  *

package/src/console/quota/account-quota-tenant.ts

@@ -72,9 +72,8 @@ import {
   toQuotaView,
 } from "./quota-view";
 import {
-  ACCOUNT_STATUSES,
+  resolveNextAccountStatus,
   type AccountQuotaRoutesDeps,
-  type AccountStatus,
 } from "./account-quota-shared";
 import {
   DAILY_GROWTH_LEG_TIMEOUT_MS,
@@ -745,23 +744,12 @@ export function registerAccountQuotaTenantRoutes(
       },
       async ({ request, params, body, set }) => {
         const access = requireTenantScope(accessResolver(request), "dashboard:write");
-        if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
-          set.status = 400;
-          return {
-            error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
-            code: "invalid_status",
-          };
-        }
-        const nextStatus: AccountStatus | undefined =
-          body.active !== undefined
-            ? body.active
-              ? "active"
-              : "disabled"
-            : (body.status as AccountStatus | undefined);
-        if (!nextStatus) {
-          set.status = 400;
-          return { error: "active or status is required", code: "invalid_request" };
+        const resolved = resolveNextAccountStatus(body);
+        if (!resolved.ok) {
+          set.status = resolved.status;
+          return resolved.body;
         }
+        const nextStatus = resolved.nextStatus;
         const updated = await db
           .update(providerAccounts)
           .set({ status: nextStatus })

package/src/console/quota/native-identity.ts

@@ -16,6 +16,7 @@ import {
   DrizzleQoderNativeIdentityStore,
   type QoderNativeIdentityStore,
 } from "../../providers/integrations/qoder/qoder-native-identity-store";
+import { qoderRealmForProvider } from "../../providers/integrations/qoder/qoder-realm";
 import { ConsoleDomainError, requireGlobalAdmin, requireTenantScope } from "../shared/errors";
 import type { ConsoleAccessResolver } from "../auth/access";
 
@@ -38,6 +39,7 @@ export type NativeIdentityAllocator = (args: {
 function defaultAllocator(store: QoderNativeIdentityStore): NativeIdentityAllocator {
   return ({ providerId, accountId, avoidToken }) =>
     allocateQoderNativeIdentity(store, providerId, accountId, {
+      realm: qoderRealmForProvider(providerId),
       ...(avoidToken !== undefined ? { avoidToken } : {}),
     });
 }