cartethyia 2.7.9 → 2.8.1

package/src/console/api-keys/routes.ts

@@ -78,6 +78,38 @@ function parseSharedChildrenQuery(query: URLSearchParams): SharedChildrenPageOpt
   return { limit, offset, sortBy, order, status };
 }
 
+/**
+ * Drops the auth-cache snapshot for a key family: the parent first, then
+ * every child.
+ *
+ * Parent policy is live-inherited by children at auth time, so their cached
+ * snapshots must die with the parent — otherwise a denylist / budget edit
+ * looks like a no-op for up to AUTH_CACHE_TTL_MS per child.
+ */
+function invalidateFamilyCaches(keyId: string, children: readonly ApiKeyRecord[]): void {
+  invalidateApiKeyCache(keyId);
+  for (const child of children) invalidateApiKeyCache(child.id);
+}
+
+/**
+ * Purges admission counters for a key family: the parent first, then every
+ * child.
+ *
+ * Share children admit under the parent id, so the parent's counter must die
+ * with a revoked/regenerated parent too — otherwise a family budget can be
+ * bypassed by a counter seeded under the old credential.
+ */
+async function purgeFamilyAdmission(
+  admissionService: { purgeKey(apiKeyId: string): Promise<void> },
+  keyId: string,
+  children: readonly ApiKeyRecord[],
+): Promise<void> {
+  await Promise.all([
+    admissionService.purgeKey(keyId),
+    ...children.map((child) => admissionService.purgeKey(child.id)),
+  ]);
+}
+
 export function createApiKeyOperations(config: ApiKeyConfig) {
   const operations = {
     async listKeys(access: AccessDecision | undefined, includeChildren = false): Promise<ApiKeyResponse[]> {
@@ -92,17 +124,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         const visible = includeChildren
           ? records.filter((record) => record.revokedAt === undefined)
           : topLevel;
-        // A share template's own counter is the live family accumulator now:
-        // every recipient commit adds to it (see ApiKeyAdmissionService
-        // commitUsage), so reporting it raw gives the enforced family total.
-        // No telemetry add-on is needed, and adding it here would double-count.
-        return Promise.all(
-          visible.map(async (record) => {
-            const response = sanitizeApiKeyResponse(record);
-            if (record.keyMode !== "share") return response;
-            return response;
-          }),
-      );
+        return visible.map(sanitizeApiKeyResponse);
     },
     async listActiveBannedKeys(access: AccessDecision | undefined): Promise<ApiKeyResponse[]> {
       const authorized = requireTenantScope(access, "dashboard:read");
@@ -343,11 +365,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
       });
       if (!updated) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
       const children = await config.store.listChildren(authorized.tenantId, keyId);
-      // Parent policy is live-inherited by children at auth time, so their
-      // cached snapshots must die with the parent — otherwise a denylist /
-      // budget edit looks like a no-op for up to AUTH_CACHE_TTL_MS per child.
-      invalidateApiKeyCache(keyId);
-      for (const child of children) invalidateApiKeyCache(child.id);
+      invalidateFamilyCaches(keyId, children);
       // The allow/deny list and prefix decide which models `/v1/models`
       // returns, which is a different cache from the auth snapshot: the
       // listing is cached per (tenant, key, mode, list, prefix), so editing
@@ -397,10 +415,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         // Drop stale admission counters so a newly lowered one-time/recurring
         // budget cannot be bypassed by a counter seeded under the looser limit.
         // Share children admit under the parent id, so purge the parent too.
-        await Promise.all([
-          config.admissionService.purgeKey(keyId),
-          ...children.map((child) => config.admissionService.purgeKey(child.id)),
-        ]);
+        await purgeFamilyAdmission(config.admissionService, keyId, children);
       }
       // Adding a daily/monthly ceiling to a key that already spent in the
       // current bucket must not hand it a full fresh budget: seed the counter
@@ -447,12 +462,8 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
       const children = await config.store.listChildren(authorized.tenantId, keyId);
       const removed = await config.store.remove(authorized.tenantId, keyId);
       if (!removed) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
-      invalidateApiKeyCache(keyId);
-      for (const child of children) invalidateApiKeyCache(child.id);
-      await Promise.all([
-        config.admissionService.purgeKey(keyId),
-        ...children.map((child) => config.admissionService.purgeKey(child.id)),
-      ]);
+      invalidateFamilyCaches(keyId, children);
+      await purgeFamilyAdmission(config.admissionService, keyId, children);
       await config.auditSink?.record({
         access: authorized,
         action: "api_key.deleted",
@@ -626,8 +637,9 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         keyPrefix: generated.prefix,
       });
       if (!updated) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
-      invalidateApiKeyCache(keyId);
-      await config.admissionService.purgeKey(keyId);
+      // Regeneration is personal-key only, so the family is the key itself.
+      invalidateFamilyCaches(keyId, []);
+      await purgeFamilyAdmission(config.admissionService, keyId, []);
       const shareStore = config.shareStore;
       let share: ShareKeyResponse | null = null;
       if (shareStore) {

package/src/console/auth/account-reset.ts

@@ -23,7 +23,7 @@
  * the operator to type it rather than press Enter on a menu row.
  */
 import { GatewayError } from "../../protocol/gateway-error";
-import { isLoopbackPeer, tokenMatches } from "../../transport/drain-endpoint";
+import { requireLoopbackAdmin } from "../../transport/drain-endpoint";
 
 interface ConsoleAccountResetDeps {
   /** Shared secret; the route is registered only when this is set. */
@@ -40,14 +40,12 @@ export function createConsoleAccountResetHandler(
   deps: ConsoleAccountResetDeps,
 ): (context: { request: Request; body: unknown }) => Promise<Response> {
   return async ({ request, body }) => {
-    if (!isLoopbackPeer(deps.resolvePeerAddress(request)))
-      throw new GatewayError(
-        "policy_rejected",
-        403,
-        "console account reset is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂",
-      );
-    if (!tokenMatches(request.headers.get("x-drain-token"), deps.token))
-      throw new GatewayError("authentication_failed", 401, "invalid reset token (request {requestId}). Wrong key, right door — check the token 🔑");
+    requireLoopbackAdmin(request, {
+      peer: deps.resolvePeerAddress(request),
+      token: deps.token,
+      policyRejectedMessage: "console account reset is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂",
+      authenticationFailedMessage: "invalid reset token (request {requestId}). Wrong key, right door — check the token 🔑",
+    });
     const confirm =
       body !== null && typeof body === "object" && "confirm" in body
         ? body.confirm

package/src/console/backup/contracts.ts

@@ -20,6 +20,8 @@
  * as sensitive as the database.
  */
 import { getTableColumns, getTableName, type Column, type Table } from "drizzle-orm";
+import type { BackupInspection } from "./service";
+import type { DeleteAllScope } from "./store";
 import { resolveMaxBodyBytes } from "../../config/runtime";
 import {
   apiKeys,
@@ -393,6 +395,8 @@ export type BackupSection = "config" | "telemetry";
 
 export const BACKUP_SECTIONS: readonly BackupSection[] = ["config", "telemetry"];
 
+export type { BackupInspection, DeleteAllScope };
+
 export interface BackupPayload {
   readonly app: typeof BACKUP_APP;
   readonly version: number;

package/src/console/backup/export-endpoint.ts

@@ -22,7 +22,7 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { GatewayError } from "../../protocol/gateway-error";
-import { isLoopbackPeer, tokenMatches } from "../../transport/drain-endpoint";
+import { requireLoopbackAdmin } from "../../transport/drain-endpoint";
 import { tablesForSection } from "./contracts";
 import { compressBackupStream, exportBackupStream } from "./store";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
@@ -52,10 +52,12 @@ export function createBackupExportHandler(
     // both: neither refusal is about the body. The first is where the request
     // came from, the second is the credential it carried — and `invalid_request`
     // told an operator to fix a body that was never the problem.
-    if (!isLoopbackPeer(deps.resolvePeerAddress(request)))
-      throw new GatewayError("policy_rejected", 403, "backup export is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂");
-    if (!tokenMatches(request.headers.get("x-drain-token"), deps.token))
-      throw new GatewayError("authentication_failed", 401, "invalid export token (request {requestId}). Wrong key, right door — check the token 🔑");
+    requireLoopbackAdmin(request, {
+      peer: deps.resolvePeerAddress(request),
+      token: deps.token,
+      policyRejectedMessage: "backup export is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂",
+      authenticationFailedMessage: "invalid export token (request {requestId}). Wrong key, right door — check the token 🔑",
+    });
 
     const directory =
       body !== null && typeof body === "object" && "directory" in body

package/src/console/backup/nine-router.ts

@@ -23,6 +23,7 @@ import type { BackupPayload, BackupRow } from "./contracts";
 import { BACKUP_APP, BACKUP_VERSION } from "./contracts";
 import { isRecord } from "../../protocol/codecs";
 import { hashSecret } from "../../security/crypto";
+import { resolveGithubCopilotMode, resolveGithubEnterpriseDomain } from "../../config/providers";
 import {
   AUTH_STATE_KEYS,
   COMBO_STRATEGIES,
@@ -100,6 +101,24 @@ interface ResolvedConnectionCredential {
   readonly value: string;
   readonly kind: "api_key" | "oauth";
 }
+
+/** The provider-specific rebinding a router export may need before it becomes our envelope. */
+export interface ImportedProviderCredential {
+  readonly credential: string;
+  readonly profile: "opencode-copilot" | "vscode-client-real";
+  readonly refreshToken?: string;
+  readonly expiresAt: Date;
+  readonly requiresRefresh: boolean;
+  readonly warnings: readonly string[];
+}
+
+export type ImportedProviderCredentialBinder = (
+  value: string,
+  refreshValue: string | null | undefined,
+  profile: "opencode-copilot" | "vscode-client-real",
+  domain: string,
+  expiresAt?: Date,
+) => ImportedProviderCredential;
 function credentialOf(entry: Row, provider: string): ResolvedConnectionCredential | null {
   const apiKey = text(entry.apiKey);
   const accessToken = text(entry.accessToken);
@@ -128,7 +147,7 @@ function credentialOf(entry: Row, provider: string): ResolvedConnectionCredentia
  * we have no such provider — a set entry with no provider behind it would
  * classify a row that can never import.
  */
-const OAUTH_PROVIDERS = new Set(["claude", "codex", "antigravity", "kimi", "cline"]);
+const OAUTH_PROVIDERS = new Set(["claude", "codex", "antigravity", "kimi", "cline", "github"]);
 
 /** The non-secret per-account config, as our `auth_state` bag. */
 function authStateOf(entry: Row): Record<string, unknown> {
@@ -223,7 +242,11 @@ function modelReference(
  * leaving them null would make them global, i.e. visible to every tenant, which
  * an import must never do implicitly.
  */
-export function convert9RouterBackup(input: unknown, tenantId: string): ConversionResult {
+export function convert9RouterBackup(
+  input: unknown,
+  tenantId: string,
+  importBinders: Readonly<Record<string, ImportedProviderCredentialBinder>> = {},
+): ConversionResult {
   if (typeof input !== "object" || input === null || Array.isArray(input)) {
     throw new Error("router backup must be a JSON object");
   }
@@ -273,6 +296,32 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
     }
     const accountId = crypto.randomUUID();
     const kind = credential.kind;
+    const specific = isRecord(entry.providerSpecificData) ? entry.providerSpecificData : {};
+    const importedRefresh = text(entry.refreshToken);
+    const sourceExpiry = typeof entry.expiresAt === "string" && Number.isFinite(Date.parse(entry.expiresAt))
+      ? new Date(entry.expiresAt)
+      : undefined;
+    const importBinder = provider === "github" && kind === "oauth" ? importBinders.github : undefined;
+    let githubBinding: ImportedProviderCredential | undefined;
+    if (importBinder !== undefined) {
+      try {
+        githubBinding = importBinder(
+          credential.value,
+          importedRefresh,
+          resolveGithubCopilotMode(),
+          resolveGithubEnterpriseDomain() || "github.com",
+          sourceExpiry,
+        );
+      } catch (error) {
+        // One malformed row must not take the rest of the backup down with it.
+        // The row is reported and left out; the operator can re-authenticate it.
+        skipped.push(`${label}: GitHub Copilot credential could not be bound: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+      }
+    }
+    const storedCredential = githubBinding?.credential ?? credential.value;
+    const storedRefresh = githubBinding?.refreshToken ?? importedRefresh;
+    const storedAuthState = authStateOf(entry).auth_state;
     accounts.push({
       id: accountId,
       provider_id: provider,
@@ -282,7 +331,7 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
       // `SEALED_COLUMNS`. The store re-seals it under this instance's key on the
       // way in; sealing it here would put ciphertext in a payload whose only
       // portable form is the plaintext, and the restore would drop it.
-      access_token: credential.value,
+      access_token: storedCredential,
       credential_kind: kind,
       status: bool(entry.isActive, true) ? "active" : "disabled",
       consecutive_failures: 0,
@@ -292,29 +341,41 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
       // rather than invented — a lower number means the operator wants it used
       // first, and the column means the same thing.
       sort_index: typeof entry.priority === "number" && Number.isFinite(entry.priority) ? entry.priority : 0,
-      ...(authStateOf(entry)),
+      ...(githubBinding === undefined
+        ? (storedAuthState === undefined ? {} : { auth_state: storedAuthState })
+        : {
+            auth_state: {
+              ...(isRecord(storedAuthState) ? storedAuthState : {}),
+              github_copilot_profile: githubBinding.profile,
+            },
+          }),
       ...(emailOf(entry)),
       created_at: { __date: isoDate(entry.createdAt, now) },
     });
     connectedProviders.add(provider);
     // The refresh token is a second secret on the same account, so it gets its
     // own sealed row rather than being folded into the credential.
-    const specific = isRecord(entry.providerSpecificData) ? entry.providerSpecificData : {};
-    const refresh = text(entry.refreshToken);
     const clientSecret = text(specific.clientSecret);
-    if (refresh !== null || clientSecret !== null) {
+    for (const warning of githubBinding?.warnings ?? []) {
+      warnings.push(`account "${label}": ${warning}`);
+    }
+    if (storedRefresh !== null || clientSecret !== null || githubBinding?.requiresRefresh === true) {
       // A companion secret authorizes a refresh, so on its own it has nothing to
       // authorize. It is still carried rather than dropped, and the report says
       // why it is inert — a secret lost without a word is how an operator
       // discovers the loss from a failed refresh days later.
-      if (clientSecret !== null && refresh === null) {
+      if (clientSecret !== null && storedRefresh === null) {
         warnings.push(`account "${label}": carried a client secret with no refresh token; it cannot authorize a refresh`);
       }
       oauthStates.push({
         provider_account_id: accountId,
-        ...(refresh === null ? {} : { refresh_token: refresh }),
+        ...(storedRefresh === null ? {} : { refresh_token: storedRefresh }),
         ...(clientSecret === null ? {} : { client_secret: clientSecret }),
-        ...(typeof entry.expiresAt === "string" ? { expires_at: { __date: isoDate(entry.expiresAt, now) } } : {}),
+        ...(githubBinding !== undefined
+          ? { expires_at: { __date: githubBinding.expiresAt.toISOString() } }
+          : typeof entry.expiresAt === "string"
+            ? { expires_at: { __date: isoDate(entry.expiresAt, now) } }
+            : {}),
       });
     }
   });

package/src/console/backup/service.ts

@@ -311,7 +311,14 @@ export class BackupService {
     }
 
     if (detected.kind === "nine_router") {
-      const { payload: converted, report } = convert9RouterBackup(detected.payload, tenantId);
+      // dynamic-import: lazy OAuth graph — pulling the Github OAuth client into
+      // the console boot graph would make every console route pay for it.
+      const { bindImportedGithubCredential } = await import(
+        "../../providers/integrations/github/github-oauth"
+      );
+      const { payload: converted, report } = convert9RouterBackup(detected.payload, tenantId, {
+        github: bindImportedGithubCredential,
+      });
       const result = await this.apply(converted, tenantId, selection);
       return { ...result, report, format: "nine_router" };
     }

package/src/console/cli-tools/service.ts

@@ -8,7 +8,6 @@ import type {
   CliMappingSettings,
   DownloadResult,
   ToolDef,
-  ToolInjector,
   ToolStatus,
 } from "./contracts";
 import { TOOL_IDS, TOOL_REGISTRY, type ToolId, type ToolRegistryEntry } from "./contracts";
@@ -47,11 +46,6 @@ function toToolRegistryEntry(def: ToolDef): ToolRegistryEntry {
   };
 }
 
-function injectorFor(toolId: string): ToolInjector | null {
-  const injector = INJECTORS[toolId as ToolId];
-  return injector ?? null;
-}
-
 /** Operator-facing summary of what an apply actually did. */
 function applyMessage(outcome: ApplyOutcome, toolId: string, fileMessage: string): string {
   switch (outcome) {
@@ -139,8 +133,8 @@ export class CliToolService {
   }
 
   async getStatus(toolId: string): Promise<ToolStatus | null> {
-    const injector = injectorFor(toolId);
-    if (injector === null) return null;
+    const injector = INJECTORS[toolId as ToolId];
+    if (injector === undefined) return null;
     return injector.getStatus();
   }
 
@@ -249,8 +243,8 @@ export class CliToolService {
   }
 
   async downloadConfig(toolId: string, input: ApplyInput): Promise<DownloadResult | null> {
-    const injector = injectorFor(toolId);
-    if (injector === null) return null;
+    const injector = INJECTORS[toolId as ToolId];
+    if (injector === undefined) return null;
     if (!input.endpoint || !input.apiKey) return null;
     try {
       return await injector.download(input);
@@ -281,8 +275,8 @@ export class CliToolService {
     apiKeyId: string,
     input: ApplyInput & { mode?: "file" | "remote" | "both" },
   ): Promise<ApplyConfigResult | null> {
-    const injector = injectorFor(toolId);
-    if (injector === null) return null;
+    const injector = INJECTORS[toolId as ToolId];
+    if (injector === undefined) return null;
     const mode = input.mode ?? "both";
     const wantsFile = mode === "file" || mode === "both";
     const wantsRemote = mode === "remote" || mode === "both";

package/src/console/console-router-guards.ts

@@ -11,6 +11,27 @@ import { GatewayError } from "../protocol/gateway-error";
 import { fastPathname } from "../transport/pathname";
 import { parseCookieValue, SESSION_COOKIE_NAME, isCsrfValid } from "../security/csrf";
 
+/**
+ * Console auth routes are excluded from CSRF and mutation-rate limiting: they
+ * run before a session exists or are the very requests that mint the session,
+ * so they must not require a CSRF token or count against the session's budget.
+ */
+const AUTH_ROUTE_SUFFIXES = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"] as const;
+
+/**
+ * Whether `request` is a protected console mutation: a `/console/api/*` route
+ * in an unsafe method, excluding the auth-route suffixes. Shared by the CSRF
+ * and mutation-limiter guards so a change to the protected set lands in both.
+ */
+function isProtectedConsoleMutation(request: Request): boolean {
+  const path = fastPathname(request.url);
+  return (
+    path.startsWith("/console/api/") &&
+    ["POST", "PUT", "PATCH", "DELETE"].includes(request.method) &&
+    !AUTH_ROUTE_SUFFIXES.some((suffix) => path.endsWith(suffix))
+  );
+}
+
 /**
  * Stateless double-submit CSRF guard for unsafe `/console/api/*` mutations.
  * Compares the `x-csrf-token` header against the readable `csrf_token`
@@ -19,16 +40,9 @@ import { parseCookieValue, SESSION_COOKIE_NAME, isCsrfValid } from "../security/
  * store whose outage could masquerade as an auth failure.
  */
 export function createConsoleCsrfMiddleware(): Elysia {
-  const excluded = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"];
   return new Elysia()
     .beforeHandle(async ({ request }) => {
-      const path = fastPathname(request.url);
-      if (
-        !path.startsWith("/console/api/") ||
-        !["POST", "PUT", "PATCH", "DELETE"].includes(request.method) ||
-        excluded.some((suffix) => path.endsWith(suffix))
-      )
-        return;
+      if (!isProtectedConsoleMutation(request)) return;
       const token = parseCookieValue(request, SESSION_COOKIE_NAME);
       // No session cookie means no ambient authority to forge: logout and
       // other mutations without a session fail authentication downstream.
@@ -75,16 +89,9 @@ function pruneConsoleMutationHits(now: number): void {
 }
 
 export function createConsoleMutationLimiterMiddleware(): Elysia {
-  const excluded = ["/auth/login", "/auth/setup", "/auth/setup/restore", "/auth/session"];
   return new Elysia()
     .beforeHandle(async ({ request, set }) => {
-      const path = fastPathname(request.url);
-      if (
-        !path.startsWith("/console/api/") ||
-        !["POST", "PUT", "PATCH", "DELETE"].includes(request.method) ||
-        excluded.some((suffix) => path.endsWith(suffix))
-      )
-        return;
+      if (!isProtectedConsoleMutation(request)) return;
       const key = consoleMutationKey(request);
       // No session cookie means no ambient authority to abuse: the request
       // fails authentication downstream. Only tracked sessions are throttled.

package/src/console/console-router.ts

@@ -33,7 +33,7 @@ import { DrizzleCliToolSecretSource } from "./cli-tools/secret-source";
 import type { ShareLinkStore } from "../persistence/stores/share-store";
 import type { ProviderRegistry } from "../providers/provider-registry";
 import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
-import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
+import type { ValidatedNetworkBindingFactory } from "../network/egress/factory";
 import type { TrustedProxyBoundary } from "../config/network";
 import type { IpAbuseStore } from "../security/abuse";
 import { gzipResponse } from "./response-compression";

package/src/console/domain-registration.ts

@@ -38,7 +38,6 @@ import { createAuditRoutes } from "./audit/routes";
 import { DrizzleAuditReadStore } from "./audit/store";
 import { createIpBanRoutes } from "./ip-bans/routes";
 import type { IpAbuseStore } from "../security/abuse";
-import { createPerformanceRoutes } from "./observability/performance";
 import { createUpdateRoutes } from "./updates/routes";
 import { createRemoteSupportRoutes } from "./remote-support/routes";
 import { createRemoteSupportService } from "./remote-support/service";
@@ -66,7 +65,7 @@ import {
 } from "../persistence/stores/share-store";
 import { createShareUsagePort } from "./share/share-usage";
 import { resolveSsrfPolicy } from "../config/network";
-import { createValidatedFetch } from "../network/outbound-fetch";
+import { createValidatedFetch } from "../network/egress/fetch";
 import type { AuditRecorder } from "./auth/audit-recorder";
 import type { CliToolService } from "./cli-tools/service";
 import type { NetworkPoolSelector } from "../network/pool/selector";
@@ -78,7 +77,7 @@ import { resolveRedisBackend } from "../persistence/redis";
 import type { RedisClient } from "../persistence/redis";
 import type { ProviderRegistry } from "../providers/provider-registry";
 import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
-import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
+import type { ValidatedNetworkBindingFactory } from "../network/egress/factory";
 import type { CartethyiaDatabase } from "../persistence/db-handle";
 import type { ConsoleAccessResolver } from "./auth/access";
 
@@ -278,7 +277,6 @@ export function registerConsoleDomains(
     ...(ctx.stateStore ? { stateStore: ctx.stateStore } : {}),
   }));
   console.use(createLogRoutes({ accessResolver: ctx.accessResolver, auditSink: ctx.auditRecorder }));
-  console.use(createPerformanceRoutes({ accessResolver: ctx.accessResolver }));
   console.use(createUpdateRoutes({
     accessResolver: ctx.accessResolver,
     observabilityStore,
@@ -436,6 +434,11 @@ export function registerConsoleDomains(
     accessResolver: ctx.accessResolver,
     snapshotInvalidator: ctx.routeSnapshotService,
     callbackListener: oauthCallbackListener,
+    deviceEgress: {
+      db: ctx.db,
+      poolSelector: ctx.poolSelector,
+      networkBindingFactory: ctx.networkBindingFactory,
+    },
   };
   console.use(createOAuthLoginRoutes(oauthConfig));
 }

package/src/console/inferhub/client.ts

@@ -13,7 +13,7 @@
  *   and a failure returns `undefined` — never a half-parsed object that a route
  *   would render as if it were good.
  */
-import { createValidatedFetch, type ValidatedFetch } from "../../network/outbound-fetch";
+import { createValidatedFetch, type ValidatedFetch } from "../../network/egress/fetch";
 
 export const INFERHUB_API_BASE = "https://inferhub.dev/api";
 

package/src/console/inferhub/normalize.ts

@@ -35,19 +35,12 @@ const FAMILY_STATES: readonly FamilyState[] = [
   "low_traffic",
 ];
 
-/** Reads a finite number, or null. Never coerces a missing metric to zero. */
-function num(value: unknown): number | null {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  // Catalog and budgets carry decimal strings; market carries numbers. Both
-  // are read here so one helper covers the wire's own inconsistency.
-  if (typeof value === "string" && value.trim().length > 0) {
-    const parsed = Number(value);
-    if (Number.isFinite(parsed)) return parsed;
-  }
-  return null;
-}
-
-/** Reads a finite number, or null. Never coerces a missing metric to zero. */
+/**
+ * Reads a finite number, or null. Never coerces a missing metric to zero.
+ *
+ * Catalog and budgets carry decimal strings; market carries numbers. Both
+ * are read here so one helper covers the wire's own inconsistency.
+ */
 export function numOrNull(value: unknown): number | null {
   if (typeof value === "number" && Number.isFinite(value)) return value;
   if (typeof value === "string" && value.trim().length > 0) {
@@ -122,8 +115,8 @@ function pricePointsToTiers(
   const seen = new Map<number, Tier>();
   for (const point of points) {
     if (!Array.isArray(point) || point.length < 2) continue;
-    const price = num(point[0]);
-    const avail = num(point[1]);
+    const price = numOrNull(point[0]);
+    const avail = numOrNull(point[1]);
     if (price === null || avail === null) continue;
     const count = Math.max(0, Math.trunc(avail));
     const key = Math.round(price * 10 ** PRICE_PRECISION) / 10 ** PRICE_PRECISION;
@@ -208,8 +201,8 @@ export function normalizeCatalogModel(
   const prefix = str(upstream.prefix) ?? "";
   if (modelSlug === null || prefix.length === 0) return null;
   const id = `${prefix}/${modelSlug}`;
-  const officialIn = num(raw.officialIn);
-  const officialOut = num(raw.officialOut);
+  const officialIn = numOrNull(raw.officialIn);
+  const officialOut = numOrNull(raw.officialOut);
   const tiersIn = pricePointsToTiers(raw.pricePointsIn, officialIn);
   const tiersOut = pricePointsToTiers(raw.pricePointsOut, officialOut);
   // Live providers is the capacity behind the cheapest tier, not a row count:
@@ -234,10 +227,13 @@ export function normalizeCatalogModel(
     minAskOut: tiersOut[0]?.price ?? null,
     maxAskIn: tiersIn.at(-1)?.price ?? null,
     maxAskOut: tiersOut.at(-1)?.price ?? null,
+    // Computed by the route layer before sending; starts null in internal models.
+    capacityPriceIn: null,
+    capacityPriceOut: null,
     providersLive,
     // Not carried by the catalog; merged from `/api/market` by the store.
     lastRate: null,
-    cacheHitRate: num(raw.cacheHitRate),
+    cacheHitRate: numOrNull(raw.cacheHitRate),
     health: {
       successRatePct: null,
       avgTtftMs: null,
@@ -245,8 +241,8 @@ export function normalizeCatalogModel(
       familyState: null,
     },
     capabilities: {
-      contextWindow: num(raw.contextWindow),
-      maxOutputTokens: num(raw.maxOutputTokens),
+      contextWindow: numOrNull(raw.contextWindow),
+      maxOutputTokens: numOrNull(raw.maxOutputTokens),
       modalities: stringArray(raw.modalities),
       outputModality:
         outputModality === "image" || outputModality === "video" ? outputModality : "text",
@@ -274,13 +270,13 @@ export function mergeMarketPrices(
     if (entry === undefined) return model;
     return {
       ...model,
-      lastRate: num(entry.lastRate),
+      lastRate: numOrNull(entry.lastRate),
       // Market is the cheaper source for the extremes, but the catalog's tier
       // grouping is what gives them capacity, so only the nulls are filled.
-      minAskIn: model.minAskIn ?? num(entry.minAskIn),
-      minAskOut: model.minAskOut ?? num(entry.minAskOut),
-      maxAskIn: model.maxAskIn ?? num(entry.maxAskIn),
-      maxAskOut: model.maxAskOut ?? num(entry.maxAskOut),
+      minAskIn: model.minAskIn ?? numOrNull(entry.minAskIn),
+      minAskOut: model.minAskOut ?? numOrNull(entry.minAskOut),
+      maxAskIn: model.maxAskIn ?? numOrNull(entry.maxAskIn),
+      maxAskOut: model.maxAskOut ?? numOrNull(entry.maxAskOut),
     };
   });
 }
@@ -306,9 +302,9 @@ export function mergeModelHealth(
       ...model,
       health: {
         ...model.health,
-        successRatePct: num(entry.successRatePct),
-        avgTtftMs: num(entry.avgTtftMs),
-        avgTps: num(entry.avgTps),
+        successRatePct: numOrNull(entry.successRatePct),
+        avgTtftMs: numOrNull(entry.avgTtftMs),
+        avgTps: numOrNull(entry.avgTps),
       },
     };
   });

package/src/console/inferhub/types.ts

@@ -61,6 +61,9 @@ export interface ModelMarket {
   readonly minAskOut: number | null;
   readonly maxAskIn: number | null;
   readonly maxAskOut: number | null;
+  /** Capacity-weighted price computed by the route layer; null when no tiers. */
+  readonly capacityPriceIn: number | null;
+  readonly capacityPriceOut: number | null;
   /** Zero means no live provider — listed, but never routed to. */
   readonly providersLive: number;
   readonly lastRate: number | null;