cartethyia 2.7.9 → 2.8.0

package/src/console/backup/export-endpoint.ts

@@ -22,7 +22,7 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { GatewayError } from "../../protocol/gateway-error";
-import { isLoopbackPeer, tokenMatches } from "../../transport/drain-endpoint";
+import { requireLoopbackAdmin } from "../../transport/drain-endpoint";
 import { tablesForSection } from "./contracts";
 import { compressBackupStream, exportBackupStream } from "./store";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
@@ -52,10 +52,12 @@ export function createBackupExportHandler(
     // both: neither refusal is about the body. The first is where the request
     // came from, the second is the credential it carried — and `invalid_request`
     // told an operator to fix a body that was never the problem.
-    if (!isLoopbackPeer(deps.resolvePeerAddress(request)))
-      throw new GatewayError("policy_rejected", 403, "backup export is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂");
-    if (!tokenMatches(request.headers.get("x-drain-token"), deps.token))
-      throw new GatewayError("authentication_failed", 401, "invalid export token (request {requestId}). Wrong key, right door — check the token 🔑");
+    requireLoopbackAdmin(request, {
+      peer: deps.resolvePeerAddress(request),
+      token: deps.token,
+      policyRejectedMessage: "backup export is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂",
+      authenticationFailedMessage: "invalid export token (request {requestId}). Wrong key, right door — check the token 🔑",
+    });
 
     const directory =
       body !== null && typeof body === "object" && "directory" in body

package/src/console/cli-tools/service.ts

@@ -8,7 +8,6 @@ import type {
   CliMappingSettings,
   DownloadResult,
   ToolDef,
-  ToolInjector,
   ToolStatus,
 } from "./contracts";
 import { TOOL_IDS, TOOL_REGISTRY, type ToolId, type ToolRegistryEntry } from "./contracts";
@@ -47,11 +46,6 @@ function toToolRegistryEntry(def: ToolDef): ToolRegistryEntry {
   };
 }
 
-function injectorFor(toolId: string): ToolInjector | null {
-  const injector = INJECTORS[toolId as ToolId];
-  return injector ?? null;
-}
-
 /** Operator-facing summary of what an apply actually did. */
 function applyMessage(outcome: ApplyOutcome, toolId: string, fileMessage: string): string {
   switch (outcome) {
@@ -139,8 +133,8 @@ export class CliToolService {
   }
 
   async getStatus(toolId: string): Promise<ToolStatus | null> {
-    const injector = injectorFor(toolId);
-    if (injector === null) return null;
+    const injector = INJECTORS[toolId as ToolId];
+    if (injector === undefined) return null;
     return injector.getStatus();
   }
 
@@ -249,8 +243,8 @@ export class CliToolService {
   }
 
   async downloadConfig(toolId: string, input: ApplyInput): Promise<DownloadResult | null> {
-    const injector = injectorFor(toolId);
-    if (injector === null) return null;
+    const injector = INJECTORS[toolId as ToolId];
+    if (injector === undefined) return null;
     if (!input.endpoint || !input.apiKey) return null;
     try {
       return await injector.download(input);
@@ -281,8 +275,8 @@ export class CliToolService {
     apiKeyId: string,
     input: ApplyInput & { mode?: "file" | "remote" | "both" },
   ): Promise<ApplyConfigResult | null> {
-    const injector = injectorFor(toolId);
-    if (injector === null) return null;
+    const injector = INJECTORS[toolId as ToolId];
+    if (injector === undefined) return null;
     const mode = input.mode ?? "both";
     const wantsFile = mode === "file" || mode === "both";
     const wantsRemote = mode === "remote" || mode === "both";

package/src/console/console-router-guards.ts

@@ -11,6 +11,27 @@ import { GatewayError } from "../protocol/gateway-error";
 import { fastPathname } from "../transport/pathname";
 import { parseCookieValue, SESSION_COOKIE_NAME, isCsrfValid } from "../security/csrf";
 
+/**
+ * Console auth routes are excluded from CSRF and mutation-rate limiting: they
+ * run before a session exists or are the very requests that mint the session,
+ * so they must not require a CSRF token or count against the session's budget.
+ */
+const AUTH_ROUTE_SUFFIXES = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"] as const;
+
+/**
+ * Whether `request` is a protected console mutation: a `/console/api/*` route
+ * in an unsafe method, excluding the auth-route suffixes. Shared by the CSRF
+ * and mutation-limiter guards so a change to the protected set lands in both.
+ */
+function isProtectedConsoleMutation(request: Request): boolean {
+  const path = fastPathname(request.url);
+  return (
+    path.startsWith("/console/api/") &&
+    ["POST", "PUT", "PATCH", "DELETE"].includes(request.method) &&
+    !AUTH_ROUTE_SUFFIXES.some((suffix) => path.endsWith(suffix))
+  );
+}
+
 /**
  * Stateless double-submit CSRF guard for unsafe `/console/api/*` mutations.
  * Compares the `x-csrf-token` header against the readable `csrf_token`
@@ -19,16 +40,9 @@ import { parseCookieValue, SESSION_COOKIE_NAME, isCsrfValid } from "../security/
  * store whose outage could masquerade as an auth failure.
  */
 export function createConsoleCsrfMiddleware(): Elysia {
-  const excluded = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"];
   return new Elysia()
     .beforeHandle(async ({ request }) => {
-      const path = fastPathname(request.url);
-      if (
-        !path.startsWith("/console/api/") ||
-        !["POST", "PUT", "PATCH", "DELETE"].includes(request.method) ||
-        excluded.some((suffix) => path.endsWith(suffix))
-      )
-        return;
+      if (!isProtectedConsoleMutation(request)) return;
       const token = parseCookieValue(request, SESSION_COOKIE_NAME);
       // No session cookie means no ambient authority to forge: logout and
       // other mutations without a session fail authentication downstream.
@@ -75,16 +89,9 @@ function pruneConsoleMutationHits(now: number): void {
 }
 
 export function createConsoleMutationLimiterMiddleware(): Elysia {
-  const excluded = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"];
   return new Elysia()
     .beforeHandle(async ({ request, set }) => {
-      const path = fastPathname(request.url);
-      if (
-        !path.startsWith("/console/api/") ||
-        !["POST", "PUT", "PATCH", "DELETE"].includes(request.method) ||
-        excluded.some((suffix) => path.endsWith(suffix))
-      )
-        return;
+      if (!isProtectedConsoleMutation(request)) return;
       const key = consoleMutationKey(request);
       // No session cookie means no ambient authority to abuse: the request
       // fails authentication downstream. Only tracked sessions are throttled.

package/src/console/domain-registration.ts

@@ -38,7 +38,6 @@ import { createAuditRoutes } from "./audit/routes";
 import { DrizzleAuditReadStore } from "./audit/store";
 import { createIpBanRoutes } from "./ip-bans/routes";
 import type { IpAbuseStore } from "../security/abuse";
-import { createPerformanceRoutes } from "./observability/performance";
 import { createUpdateRoutes } from "./updates/routes";
 import { createRemoteSupportRoutes } from "./remote-support/routes";
 import { createRemoteSupportService } from "./remote-support/service";
@@ -278,7 +277,6 @@ export function registerConsoleDomains(
     ...(ctx.stateStore ? { stateStore: ctx.stateStore } : {}),
   }));
   console.use(createLogRoutes({ accessResolver: ctx.accessResolver, auditSink: ctx.auditRecorder }));
-  console.use(createPerformanceRoutes({ accessResolver: ctx.accessResolver }));
   console.use(createUpdateRoutes({
     accessResolver: ctx.accessResolver,
     observabilityStore,

package/src/console/inferhub/normalize.ts

@@ -35,19 +35,12 @@ const FAMILY_STATES: readonly FamilyState[] = [
   "low_traffic",
 ];
 
-/** Reads a finite number, or null. Never coerces a missing metric to zero. */
-function num(value: unknown): number | null {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  // Catalog and budgets carry decimal strings; market carries numbers. Both
-  // are read here so one helper covers the wire's own inconsistency.
-  if (typeof value === "string" && value.trim().length > 0) {
-    const parsed = Number(value);
-    if (Number.isFinite(parsed)) return parsed;
-  }
-  return null;
-}
-
-/** Reads a finite number, or null. Never coerces a missing metric to zero. */
+/**
+ * Reads a finite number, or null. Never coerces a missing metric to zero.
+ *
+ * Catalog and budgets carry decimal strings; market carries numbers. Both
+ * are read here so one helper covers the wire's own inconsistency.
+ */
 export function numOrNull(value: unknown): number | null {
   if (typeof value === "number" && Number.isFinite(value)) return value;
   if (typeof value === "string" && value.trim().length > 0) {
@@ -122,8 +115,8 @@ function pricePointsToTiers(
   const seen = new Map<number, Tier>();
   for (const point of points) {
     if (!Array.isArray(point) || point.length < 2) continue;
-    const price = num(point[0]);
-    const avail = num(point[1]);
+    const price = numOrNull(point[0]);
+    const avail = numOrNull(point[1]);
     if (price === null || avail === null) continue;
     const count = Math.max(0, Math.trunc(avail));
     const key = Math.round(price * 10 ** PRICE_PRECISION) / 10 ** PRICE_PRECISION;
@@ -208,8 +201,8 @@ export function normalizeCatalogModel(
   const prefix = str(upstream.prefix) ?? "";
   if (modelSlug === null || prefix.length === 0) return null;
   const id = `${prefix}/${modelSlug}`;
-  const officialIn = num(raw.officialIn);
-  const officialOut = num(raw.officialOut);
+  const officialIn = numOrNull(raw.officialIn);
+  const officialOut = numOrNull(raw.officialOut);
   const tiersIn = pricePointsToTiers(raw.pricePointsIn, officialIn);
   const tiersOut = pricePointsToTiers(raw.pricePointsOut, officialOut);
   // Live providers is the capacity behind the cheapest tier, not a row count:
@@ -234,10 +227,13 @@ export function normalizeCatalogModel(
     minAskOut: tiersOut[0]?.price ?? null,
     maxAskIn: tiersIn.at(-1)?.price ?? null,
     maxAskOut: tiersOut.at(-1)?.price ?? null,
+    // Computed by the route layer before sending; starts null in internal models.
+    capacityPriceIn: null,
+    capacityPriceOut: null,
     providersLive,
     // Not carried by the catalog; merged from `/api/market` by the store.
     lastRate: null,
-    cacheHitRate: num(raw.cacheHitRate),
+    cacheHitRate: numOrNull(raw.cacheHitRate),
     health: {
       successRatePct: null,
       avgTtftMs: null,
@@ -245,8 +241,8 @@ export function normalizeCatalogModel(
       familyState: null,
     },
     capabilities: {
-      contextWindow: num(raw.contextWindow),
-      maxOutputTokens: num(raw.maxOutputTokens),
+      contextWindow: numOrNull(raw.contextWindow),
+      maxOutputTokens: numOrNull(raw.maxOutputTokens),
       modalities: stringArray(raw.modalities),
       outputModality:
         outputModality === "image" || outputModality === "video" ? outputModality : "text",
@@ -274,13 +270,13 @@ export function mergeMarketPrices(
     if (entry === undefined) return model;
     return {
       ...model,
-      lastRate: num(entry.lastRate),
+      lastRate: numOrNull(entry.lastRate),
       // Market is the cheaper source for the extremes, but the catalog's tier
       // grouping is what gives them capacity, so only the nulls are filled.
-      minAskIn: model.minAskIn ?? num(entry.minAskIn),
-      minAskOut: model.minAskOut ?? num(entry.minAskOut),
-      maxAskIn: model.maxAskIn ?? num(entry.maxAskIn),
-      maxAskOut: model.maxAskOut ?? num(entry.maxAskOut),
+      minAskIn: model.minAskIn ?? numOrNull(entry.minAskIn),
+      minAskOut: model.minAskOut ?? numOrNull(entry.minAskOut),
+      maxAskIn: model.maxAskIn ?? numOrNull(entry.maxAskIn),
+      maxAskOut: model.maxAskOut ?? numOrNull(entry.maxAskOut),
     };
   });
 }
@@ -306,9 +302,9 @@ export function mergeModelHealth(
       ...model,
       health: {
         ...model.health,
-        successRatePct: num(entry.successRatePct),
-        avgTtftMs: num(entry.avgTtftMs),
-        avgTps: num(entry.avgTps),
+        successRatePct: numOrNull(entry.successRatePct),
+        avgTtftMs: numOrNull(entry.avgTtftMs),
+        avgTps: numOrNull(entry.avgTps),
       },
     };
   });

package/src/console/inferhub/types.ts

@@ -61,6 +61,9 @@ export interface ModelMarket {
   readonly minAskOut: number | null;
   readonly maxAskIn: number | null;
   readonly maxAskOut: number | null;
+  /** Capacity-weighted price computed by the route layer; null when no tiers. */
+  readonly capacityPriceIn: number | null;
+  readonly capacityPriceOut: number | null;
   /** Zero means no live provider — listed, but never routed to. */
   readonly providersLive: number;
   readonly lastRate: number | null;

package/src/console/ip-bans/routes.ts

@@ -10,6 +10,7 @@ import { Elysia, t, type AnyElysia } from "elysia";
 import { errorResponse, requireGlobalAdmin } from "../shared/errors";
 import type { IpAbuseStore } from "../../security/abuse";
 import type { ConsoleAccessResolver } from "../auth/access";
+import { BAN_DURATION_CHOICES } from "../api-keys/ban-constants";
 
 /** One active IP ban, as the console returns it. */
 export interface IpBanResponse {
@@ -26,17 +27,8 @@ export interface IpBanRoutesConfig {
   readonly store: IpAbuseStore;
 }
 
-const BAN_DURATION_CHOICES: readonly { readonly minutes: number | null; readonly label: string }[] = [
-  { minutes: 60, label: "1 hour" },
-  { minutes: 6 * 60, label: "6 hours" },
-  { minutes: 12 * 60, label: "12 hours" },
-  { minutes: 24 * 60, label: "1 day" },
-  { minutes: 7 * 24 * 60, label: "7 days" },
-  { minutes: null, label: "Permanent" },
-] as const;
-
-/** Parses a duration choice into minutes; null = permanent. */
-export function parseBanDuration(value: unknown): number | null | undefined {
+/** Parses a duration choice into minutes; null = permanent; undefined = invalid. */
+function parseBanDuration(value: unknown): number | null | undefined {
   if (value === null || value === undefined) return value === null ? null : undefined;
   const minutes = Number(value);
   if (!Number.isFinite(minutes) || minutes <= 0) return undefined;
@@ -68,8 +60,10 @@ export function createIpBanRoutes(config: IpBanRoutesConfig): AnyElysia {
           const ip = body.ip.trim();
           if (ip.length === 0)
             return errorResponse(new Error("ip is required"), set, "Invalid IP ban request");
-          const minutes = body.minutes === undefined || body.minutes === null ? null : Math.round(body.minutes);
-          if (minutes !== null && (!Number.isFinite(minutes) || minutes <= 0))
+          // Absent is permanent (the default), exactly like an explicit null;
+          // parseBanDuration maps those to null and rejects anything else.
+          const minutes = body.minutes === undefined ? null : parseBanDuration(body.minutes);
+          if (minutes === undefined)
             return errorResponse(new Error("minutes must be a positive integer or null"), set, "Invalid IP ban request");
           await store.ban(ip, minutes === null ? 0 : minutes * 60_000);
           return {

package/src/console/observability/store.ts

@@ -196,59 +196,6 @@ const TOP_N = 50;
  */
 const USAGE_READ_THROUGH_TTL_SECONDS = 30;
 
-/**
- * Nearest-rank percentile over a sorted array — kept for the JS-side
- * `summarizeUsagePerformance` (still used by callers that already hold a
- * bounded event list). The usage endpoints read percentiles from SQL via
- * `summarizeUsagePerformanceSql`, which is what the dashboard polls.
- */
-function percentile(sorted: readonly number[], fraction: number): number {
-  if (sorted.length === 0) return 0;
-  const index = Math.min(sorted.length - 1, Math.max(0, Math.ceil(fraction * sorted.length) - 1));
-  return Math.round(sorted[index] ?? 0);
-}
-
-interface UsagePerformanceSummary {
-  avgResolveMs: number;
-  avgDurationMs: number;
-  latencyP50Ms: number;
-  latencyP95Ms: number;
-  latencyP99Ms: number;
-  /** Events each series was computed from; see `UsageSummaryTotals`. */
-  latencySampleCount: number;
-  resolveSampleCount: number;
-}
-
-/** Summarizes routing delay and request latency for an already-filtered period. */
-export function summarizeUsagePerformance(
-  events: readonly Pick<TelemetryEventRecord, "latencyMs" | "resolveMs">[],
-): UsagePerformanceSummary {
-  const latencies: number[] = [];
-  let latencySum = 0;
-  let resolveSum = 0;
-  let resolveCount = 0;
-  for (const event of events) {
-    if (event.latencyMs !== null) {
-      latencies.push(event.latencyMs);
-      latencySum += event.latencyMs;
-    }
-    if (event.resolveMs !== null) {
-      resolveSum += event.resolveMs;
-      resolveCount += 1;
-    }
-  }
-  latencies.sort((a, b) => a - b);
-  return {
-    avgResolveMs: resolveCount > 0 ? resolveSum / resolveCount : 0,
-    avgDurationMs: latencies.length > 0 ? latencySum / latencies.length : 0,
-    latencyP50Ms: percentile(latencies, 0.5),
-    latencyP95Ms: percentile(latencies, 0.95),
-    latencyP99Ms: percentile(latencies, 0.99),
-    latencySampleCount: latencies.length,
-    resolveSampleCount: resolveCount,
-  };
-}
-
 /**
  * The console dimension as the SQL reader's grouping key.
  *

package/src/console/providers/catalog/contracts.ts

@@ -83,8 +83,8 @@ export interface ProviderAccountBulkActionResult {
   readonly globalSkipped: number;
 }
 
-/** Cap on one discovery-commit request (D29). */
-export const DISCOVER_MODEL_COMMIT_MAX = 100;
+/** Cap on one discovery-commit request (D29). Kept pure (no `node:*`) so the dashboard can import it. */
+export { DISCOVER_MODEL_COMMIT_MAX } from "./discover-constants";
 
 /**
  * One model the provider's own listing advertised, projected for the Add-Model

package/src/console/providers/catalog/discover-constants.ts

@@ -0,0 +1,6 @@
+/**
+ * Pure discovery constants, kept free of any `node:*` imports so the
+ * dashboard can import them without dragging Node crypto into the browser
+ * bundle — the same reason `ban-constants.ts` and `usage-dimensions.ts` exist.
+ */
+export const DISCOVER_MODEL_COMMIT_MAX = 100;

package/src/console/providers/catalog/routes.ts

@@ -44,6 +44,7 @@ const compatibilityProfileSchema = t.Object({
       }),
     ),
   ),
+  service_kinds: t.Optional(t.Array(literalUnion(SERVICE_KINDS))),
   streaming_usage_mode: t.Optional(t.Union([t.Literal("include_usage"), t.Literal("none")])),
   structured_output: t.Optional(
     t.Object({

package/src/console/providers/catalog/store.ts

@@ -1,6 +1,6 @@
 // Drizzle-backed provider, account, model, routing, and API-key repositories.
-import { and, asc, eq, gte, inArray, isNull, or, sql, type SQL } from "drizzle-orm";
-import { isSqliteDatabase } from "../../../persistence/dialect";
+import { and, asc, eq, gte, inArray, isNull, ne, or, sql, type SQL } from "drizzle-orm";
+import { liveModelCooldownExistsSql } from "../../../persistence/dialect";
 import { ConsoleDomainError } from "../../shared/errors";
 import { parseCustomProviderId, isBundledProviderId } from "../../../providers/provider-contracts";
 import { providerRateLimitIsIpScoped } from "../../../providers/provider-metadata";
@@ -1697,7 +1697,9 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
    * is evaluated in SQL, so the whole provider is handled in one statement
    * without reading rows into the process. `cooldown_until` and
    * `model_cooldowns` are left untouched: they are the evidence the operator
-   * sees on a disabled row until an explicit Recover clears them.
+   * sees on a disabled row until an explicit Recover clears them. A row that
+   * is already `disabled` is not a target — those columns surviving the
+   * status change would otherwise keep matching the predicate forever.
    *
    * Pool-as-account rows live in `provider_pool_accounts`, not this table, so
    * they are excluded by construction. Shared (`tenant_id IS NULL`) rows are
@@ -1790,21 +1792,24 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
   }
 
   /**
-   * `status='cooldown' OR cooldown_until > now OR model_cooldowns` carries a
-   * live entry. The JSON check is dialect-specific: PostgreSQL uses
-   * `jsonb_each_text` (with a shape guard), SQLite `json_each` on its `text`
-   * column. Only entries whose ISO deadline is still in the future count, mirroring
-   * `liveModelCooldowns`. Timestamps are stored as ISO strings on both backends,
-   * so the lexical comparison against `nowIso` is stable.
+   * Not already disabled, and either `status='cooldown'`, `cooldown_until` is
+   * still in the future, or `model_cooldowns` carries a live entry. Scoped to
+   * the caller's own rows (the tenant path never touches `tenant_id IS NULL`
+   * rows). The shared JSON subquery lives in the dialect module; only the
+   * surrounding scoping is the store's.
+   *
+   * The disabled exclusion is load-bearing. Disable preserves the deadline
+   * columns as evidence, so without it a row this action just wrote matches
+   * the predicate again and the operator's count never drops to zero.
    */
   private liveCooldownPredicate(nowIso: string): SQL {
-    const liveModelCooldown = isSqliteDatabase(this.db)
-      ? sql`EXISTS (SELECT 1 FROM json_each(${providerAccounts.modelCooldowns}) AS entry WHERE json_valid(${providerAccounts.modelCooldowns}) AND json_type(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`
-      : sql`EXISTS (SELECT 1 FROM jsonb_each_text(${providerAccounts.modelCooldowns}) AS entry WHERE jsonb_typeof(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`;
-    return or(
-      eq(providerAccounts.status, "cooldown"),
-      sql`${providerAccounts.cooldownUntil} > ${nowIso}`,
-      liveModelCooldown,
+    return and(
+      ne(providerAccounts.status, "disabled"),
+      or(
+        eq(providerAccounts.status, "cooldown"),
+        sql`${providerAccounts.cooldownUntil} > ${nowIso}`,
+        liveModelCooldownExistsSql(this.db, nowIso),
+      ),
     ) as SQL;
   }
 

package/src/console/quota/account-quota-global.ts

@@ -1,7 +1,7 @@
 import { t } from "elysia";
 import type { Elysia } from "elysia";
 import { and, eq, inArray, isNull, sql } from "drizzle-orm";
-import { isSqliteDatabase } from "../../persistence/dialect";
+import { liveModelCooldownExistsSql } from "../../persistence/dialect";
 import { adminAuditLog, providerAccounts } from "../../persistence/schema";
 import { requireGlobalAdmin } from "../shared/errors";
 import {
@@ -23,9 +23,8 @@ import {
 } from "../../providers/quota/refresh";
 import { sanitizeGlobalAccount } from "./quota-view";
 import {
-  ACCOUNT_STATUSES,
+  resolveNextAccountStatus,
   type AccountQuotaRoutesDeps,
-  type AccountStatus,
 } from "./account-quota-shared";
 import type { ProviderAccountBulkActionResult } from "../providers/catalog/contracts";
 
@@ -33,16 +32,18 @@ import type { ProviderAccountBulkActionResult } from "../providers/catalog/contr
  * The same live-cooldown predicate as the tenant-scoped store, evaluated in
  * SQL so one statement covers the whole shared-account set. `status='cooldown'`
  * counts even when its deadline elapsed; a live `model_cooldowns` entry counts
- * even while `status` is still `active` (D07).
+ * even while `status` is still `active` (D07). A row already `disabled` does
+ * not: disable keeps the deadline columns as evidence, and counting them would
+ * make a second pass look like it still has work. Scoped strictly to shared
+ * rows (`tenant_id IS NULL`); the shared JSON subquery lives in the dialect
+ * module.
  */
 function globalLiveCooldownPredicate(database: unknown): ReturnType<typeof and> {
   const nowIso = new Date().toISOString();
-  const liveModelCooldown = isSqliteDatabase(database)
-    ? sql`EXISTS (SELECT 1 FROM json_each(${providerAccounts.modelCooldowns}) AS entry WHERE json_valid(${providerAccounts.modelCooldowns}) AND json_type(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`
-    : sql`EXISTS (SELECT 1 FROM jsonb_each_text(${providerAccounts.modelCooldowns}) AS entry WHERE jsonb_typeof(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`;
   return and(
     isNull(providerAccounts.tenantId),
-    sql`${providerAccounts.status} = 'cooldown' OR ${providerAccounts.cooldownUntil} > ${nowIso} OR ${liveModelCooldown}`,
+    sql`${providerAccounts.status} <> 'disabled'`,
+    sql`${providerAccounts.status} = 'cooldown' OR ${providerAccounts.cooldownUntil} > ${nowIso} OR ${liveModelCooldownExistsSql(database, nowIso)}`,
   )!;
 }
 
@@ -117,23 +118,12 @@ export function registerAccountQuotaGlobalRoutes(
       },
       async ({ request, params, body, set }) => {
         const access = requireGlobalAdmin(accessResolver(request));
-        if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
-          set.status = 400;
-          return {
-            error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
-            code: "invalid_status",
-          };
-        }
-        const nextStatus: AccountStatus | undefined =
-          body.active !== undefined
-            ? body.active
-              ? "active"
-              : "disabled"
-            : (body.status as AccountStatus | undefined);
-        if (!nextStatus) {
-          set.status = 400;
-          return { error: "active or status is required", code: "invalid_request" };
+        const resolved = resolveNextAccountStatus(body);
+        if (!resolved.ok) {
+          set.status = resolved.status;
+          return resolved.body;
         }
+        const nextStatus = resolved.nextStatus;
         const updated = await db
           .update(providerAccounts)
           .set({ status: nextStatus })

package/src/console/quota/account-quota-shared.ts

@@ -20,6 +20,55 @@ export interface AccountQuotaRoutesDeps extends QuotaRefreshDeps {
 export const ACCOUNT_STATUSES = ["active", "cooldown", "disabled"] as const;
 export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
 
+/**
+ * The merged result of interpreting a PATCH account-status body. On success it
+ * carries the resolved `AccountStatus`; on failure it carries the exact 400
+ * response the tenant and global routes both return.
+ */
+export type ResolveNextAccountStatusResult =
+  | { readonly ok: true; readonly nextStatus: AccountStatus }
+  | {
+      readonly ok: false;
+      readonly status: 400;
+      readonly body: { readonly error: string; readonly code: string };
+    };
+
+/**
+ * Resolves the next account status from a PATCH body: an explicit `active`
+ * boolean wins over `status`, and a missing `status` (or an invalid one) is
+ * rejected with the shared 400 shape. Both account PATCH handlers interpret
+ * the same input contract, so it lives here once.
+ */
+export function resolveNextAccountStatus(body: {
+  readonly active?: boolean;
+  readonly status?: string;
+}): ResolveNextAccountStatusResult {
+  if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
+    return {
+      ok: false,
+      status: 400,
+      body: {
+        error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
+        code: "invalid_status",
+      },
+    };
+  }
+  const nextStatus: AccountStatus | undefined =
+    body.active !== undefined
+      ? body.active
+        ? "active"
+        : "disabled"
+      : (body.status as AccountStatus | undefined);
+  if (nextStatus === undefined) {
+    return {
+      ok: false,
+      status: 400,
+      body: { error: "active or status is required", code: "invalid_request" },
+    };
+  }
+  return { ok: true, nextStatus };
+}
+
 /**
  * Wraps a stored api_key credential in the envelope its collector expects.
  *

package/src/console/quota/account-quota-tenant.ts

@@ -72,9 +72,8 @@ import {
   toQuotaView,
 } from "./quota-view";
 import {
-  ACCOUNT_STATUSES,
+  resolveNextAccountStatus,
   type AccountQuotaRoutesDeps,
-  type AccountStatus,
 } from "./account-quota-shared";
 import {
   DAILY_GROWTH_LEG_TIMEOUT_MS,
@@ -745,23 +744,12 @@ export function registerAccountQuotaTenantRoutes(
       },
       async ({ request, params, body, set }) => {
         const access = requireTenantScope(accessResolver(request), "dashboard:write");
-        if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
-          set.status = 400;
-          return {
-            error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
-            code: "invalid_status",
-          };
-        }
-        const nextStatus: AccountStatus | undefined =
-          body.active !== undefined
-            ? body.active
-              ? "active"
-              : "disabled"
-            : (body.status as AccountStatus | undefined);
-        if (!nextStatus) {
-          set.status = 400;
-          return { error: "active or status is required", code: "invalid_request" };
+        const resolved = resolveNextAccountStatus(body);
+        if (!resolved.ok) {
+          set.status = resolved.status;
+          return resolved.body;
         }
+        const nextStatus = resolved.nextStatus;
         const updated = await db
           .update(providerAccounts)
           .set({ status: nextStatus })