cartethyia 2.7.9 → 2.8.1

package/src/console/quota/account-quota-tenant.ts

@@ -29,7 +29,7 @@ import {
   type QuotaRefreshFailureCode,
 } from "../../providers/quota/refresh";
 import { selectAccountTestEgress } from "./account-test-egress";
-import type { ValidatedFetch } from "../../network/outbound-fetch";
+import type { ValidatedFetch } from "../../network/egress/fetch";
 import type { ProviderId } from "../../providers/provider-contracts";
 import {
   DAILY_CHECKIN_PROVIDER_IDS,
@@ -43,7 +43,7 @@ import {
   fetchDailyCheckin,
   type BuddyActivityReportResult,
   type DailyCheckinResult,
-} from "../../providers/integrations/buddy/buddy-checkin";
+} from "../../providers/integrations/buddy/lifecycle";
 import {
   fetchQoderDailyCheckin,
   isQoderCheckinProvider,
@@ -72,9 +72,8 @@ import {
   toQuotaView,
 } from "./quota-view";
 import {
-  ACCOUNT_STATUSES,
+  resolveNextAccountStatus,
   type AccountQuotaRoutesDeps,
-  type AccountStatus,
 } from "./account-quota-shared";
 import {
   DAILY_GROWTH_LEG_TIMEOUT_MS,
@@ -195,7 +194,7 @@ async function runDailyGrowthForAccount(
   // The buddy-oauth-shared graph is lazy-loaded: the uid decoder is only
   // needed for buddy accounts' report leg (B-02).
   const { buddyAccountUid } = await import(
-    "../../providers/integrations/buddy/buddy-oauth-shared"
+    "../../providers/integrations/buddy/account"
   );
   const userId = buddyAccountUid(credential);
   let report: { ok: boolean; message: string };
@@ -428,7 +427,7 @@ export function registerAccountQuotaTenantRoutes(
       // The buddy-usage-store graph is lazy-loaded: it is only needed when the
       // page actually renders buddy accounts (B-02).
       const { readBuddyUsageSnapshots } = await import(
-        "../../providers/integrations/buddy/buddy-usage-store"
+        "../../providers/integrations/buddy/account"
       );
       const usageByAccount = await readBuddyUsageSnapshots(
         db,
@@ -745,23 +744,12 @@ export function registerAccountQuotaTenantRoutes(
       },
       async ({ request, params, body, set }) => {
         const access = requireTenantScope(accessResolver(request), "dashboard:write");
-        if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
-          set.status = 400;
-          return {
-            error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
-            code: "invalid_status",
-          };
-        }
-        const nextStatus: AccountStatus | undefined =
-          body.active !== undefined
-            ? body.active
-              ? "active"
-              : "disabled"
-            : (body.status as AccountStatus | undefined);
-        if (!nextStatus) {
-          set.status = 400;
-          return { error: "active or status is required", code: "invalid_request" };
+        const resolved = resolveNextAccountStatus(body);
+        if (!resolved.ok) {
+          set.status = resolved.status;
+          return resolved.body;
         }
+        const nextStatus = resolved.nextStatus;
         const updated = await db
           .update(providerAccounts)
           .set({ status: nextStatus })
@@ -1262,7 +1250,7 @@ export function registerAccountQuotaTenantRoutes(
         // The buddy-oauth-shared graph is lazy-loaded: the uid decoder is only
         // needed on this buddy-only surface (B-02).
         const { buddyAccountUid } = await import(
-          "../../providers/integrations/buddy/buddy-oauth-shared"
+          "../../providers/integrations/buddy/account"
         );
         const userId = buddyAccountUid(credential);
         if (!userId) {

package/src/console/quota/account-test-egress.ts

@@ -11,8 +11,8 @@ import { networkPools, poolRoutingSettings, providerRoutingSettings } from "../.
 import { resolveTenantOverride } from "../../persistence/tenant-scope";
 import { GatewayError } from "../../protocol/gateway-error";
 import type { NetworkPoolSelector, PoolRotation } from "../../network/pool/selector";
-import type { ValidatedFetch } from "../../network/outbound-fetch";
-import type { ValidatedNetworkBindingFactory } from "../../network/pool/resolver";
+import type { ValidatedFetch } from "../../network/egress/fetch";
+import type { ValidatedNetworkBindingFactory } from "../../network/egress/factory";
 import { DEFAULT_PROXY_SKIP_PROVIDER_IDS } from "../../providers/provider-metadata";
 import type { FetchLike } from "../../providers/quota/quota-contracts";
 

package/src/console/quota/daily-growth-job.ts

@@ -31,7 +31,7 @@ import { randomUUID } from "node:crypto";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import type { RedisClient } from "../../persistence/redis";
 import { checkinAttemptedToday } from "../../workers/daily-checkin";
-import type { ValidatedFetch } from "../../network/outbound-fetch";
+import type { ValidatedFetch } from "../../network/egress/fetch";
 
 /** Lifecycle states of a daily-growth job. */
 export type DailyGrowthJobState = "queued" | "running" | "done" | "failed";

package/src/console/quota/quota-view.ts

@@ -13,7 +13,14 @@ import {
 /** Shape returned for quota data on dashboard account responses. */
 interface QuotaRefreshView {
   readonly source: string;
-  readonly status: "ready" | "error" | "refreshing";
+  /**
+   * `ready` = a usable quota reading exists (successful fetch, cached or
+   * snapshot). `error` = the collector returned an error with no usable
+   * reading. `refreshing` = a background fill is in flight. `unknown` = no
+   * quota evidence at all (no collector surface, or an empty successful read
+   * with no timestamp) — the canonical wire representation for unknown quota.
+   */
+  readonly status: "ready" | "error" | "refreshing" | "unknown";
   readonly plan: string | null;
   readonly windows: ProviderQuotaResult["windows"];
   readonly fetchedAt: string | null;
@@ -94,7 +101,7 @@ export function toQuotaView(
     lastAttemptAt?: string | null;
     lastSuccessAt?: string | null;
     refreshError?: string | null;
-    status?: "ready" | "error" | "refreshing";
+    status?: "ready" | "error" | "refreshing" | "unknown";
   } = {},
 ): QuotaRefreshView {
   const fetchedAt = timestamps.fetchedAt ?? account.lastSuccessAt?.toISOString() ?? null;
@@ -112,9 +119,18 @@ export function toQuotaView(
   // that the last attempt failed; only `quota.error` — no usable reading at
   // all — makes the card an error.
   const error = quota.error ?? null;
+  // Unknown quota: a successful read that carries no windows AND no timestamp
+  // is not evidence of anything — the canonical "no quota evidence" state.
+  // (A provider with a real zero-balance still reports windows/timestamps.)
+  const derivedStatus =
+    error !== null
+      ? ("error" as const)
+      : quota.windows.length === 0 && fetchedAt === null
+        ? ("unknown" as const)
+        : ("ready" as const);
   return {
     source: quota.source,
-    status: timestamps.status ?? (error !== null ? "error" : "ready"),
+    status: timestamps.status ?? derivedStatus,
     plan: quota.plan ?? null,
     windows: quota.windows,
     fetchedAt,

package/src/console/routing/pools/contracts.ts

@@ -10,7 +10,7 @@ import { isAddressAllowed } from "../../../network/ssrf";
 import { TRANSPORT_KINDS, type TransportKind } from "../../../network/pool/agent";
 import type { SsrfPolicy } from "../../../config/network";
 import type { NetworkPoolSelector } from "../../../network/pool/selector";
-import type { PoolHealthEvent } from "../../../network/pool-health-machine";
+import type { PoolHealthEvent } from "../../../network/pool/health";
 
 export interface CreateNetworkPoolRequest {
   kind: TransportKind;

package/src/console/routing/pools/operations.ts

@@ -4,7 +4,7 @@
 import { ConsoleDomainError, requireTenantScope } from "../../shared/errors";
 import { providerRateLimitIsIpScoped } from "../../../providers/provider-metadata";
 import { resolvePoolProviderRateLimitCooldownMs } from "../../../config/cooldowns";
-import type { PoolHealthEvent } from "../../../network/pool-health-machine";
+import type { PoolHealthEvent } from "../../../network/pool/health";
 import type { AccessDecision } from "../../../security/access-control";
 import {
   deployRelay as deployRelayWorker,
@@ -45,35 +45,40 @@ function isBlockedEntry(entry: { readonly blocked?: boolean }): boolean {
 }
 
 export function createNetworkPoolOperations(config: NetworkPoolConfig) {
+  /**
+   * The read-only enrichment projection shared by the pool list and the pool
+   * detail page: live inflight (falling back to the stored row counter when no
+   * selector is configured), the derived available/utilization figures, and the
+   * active provider cooldowns (omitted entirely when there are none).
+   */
+  async function enrichPoolResponse(res: NetworkPoolResponse, poolId: string): Promise<NetworkPoolResponse> {
+    const cooldowns = await config.poolSelector?.getPoolCooldowns(poolId);
+    const inflight = config.poolSelector
+      ? await config.poolSelector.getInflightAuthoritative(poolId)
+      : res.inflight;
+    return {
+      ...res,
+      inflight,
+      available: Math.max(0, res.maxInflight - inflight),
+      utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
+      ...(cooldowns && cooldowns.length > 0
+        ? {
+            providerCooldowns: cooldowns.map((c) => ({
+              providerId: c.providerId,
+              until: new Date(c.until).toISOString(),
+              reason: c.reason,
+              blocked: isBlockedEntry(c),
+            })),
+          }
+        : {}),
+    };
+  }
+
   const operations = {
     async listPools(access: AccessDecision | undefined): Promise<NetworkPoolResponse[]> {
         const a = requireTenantScope(access, "dashboard:read");
         const rawPools = await config.store.list(a.tenantId);
-        return Promise.all(
-          rawPools.map(async (r) => {
-            const res = sanitizePoolResponse(r);
-            const cooldowns = await config.poolSelector?.getPoolCooldowns(r.id);
-            const inflight = config.poolSelector
-              ? await config.poolSelector.getInflightAuthoritative(r.id)
-              : res.inflight;
-            return {
-              ...res,
-              inflight,
-              available: Math.max(0, res.maxInflight - inflight),
-              utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
-              ...(cooldowns && cooldowns.length > 0
-                ? {
-                    providerCooldowns: cooldowns.map((c) => ({
-                      providerId: c.providerId,
-                      until: new Date(c.until).toISOString(),
-                      reason: c.reason,
-                      blocked: isBlockedEntry(c),
-                    })),
-                  }
-                : {}),
-            };
-          }),
-        );
+        return Promise.all(rawPools.map(async (r) => enrichPoolResponse(sanitizePoolResponse(r), r.id)));
       },
     async getPoolDetail(
         access: AccessDecision | undefined,
@@ -82,27 +87,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
         const a = requireTenantScope(access, "dashboard:read");
         const rec = await config.store.get(a.tenantId, poolId);
         if (!rec) throw new ConsoleDomainError("pool_not_found", 404, `Pool ${poolId} not found`);
-        const res = sanitizePoolResponse(rec);
-        const cooldowns = await config.poolSelector?.getPoolCooldowns(poolId);
-        const inflight = config.poolSelector
-          ? await config.poolSelector.getInflightAuthoritative(poolId)
-          : res.inflight;
-        return {
-          ...res,
-          inflight,
-          available: Math.max(0, res.maxInflight - inflight),
-          utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
-          ...(cooldowns && cooldowns.length > 0
-            ? {
-                providerCooldowns: cooldowns.map((c) => ({
-                  providerId: c.providerId,
-                  until: new Date(c.until).toISOString(),
-                  reason: c.reason,
-                  blocked: isBlockedEntry(c),
-                })),
-              }
-            : {}),
-        };
+        return enrichPoolResponse(sanitizePoolResponse(rec), poolId);
       },
     async clearPoolCooldown(
         access: AccessDecision | undefined,

package/src/console/routing/pools/probe-verdict.ts

@@ -17,13 +17,13 @@
  * pool for good.
  *
  * The 403-free-tier and 429 verdicts are the probe's reading of the same facts
- * `classifyEgressFailure` (in `network/rate-limit-verdict`) reads on the
+ * `classifyEgressFailure` (in `network/verdict`) reads on the
  * dispatch path — for the probe they arrive as an HTTP status + body instead of
  * a `GatewayError`, so the shared free-tier regex is borrowed from there to
  * keep the two classifiers' boundaries honest.
  */
 
-import { FREE_TIER_REFUSAL } from "../../../network/rate-limit-verdict";
+import { FREE_TIER_REFUSAL } from "../../../network/verdict";
 
 export type ProbeVerdict = "allowed" | "blocked" | "throttled" | "unreachable";
 

package/src/console/routing/pools/relay-deploy.ts

@@ -5,7 +5,7 @@
  * Cartethyia already knows how to *use* a hosted relay: a pool whose endpoint
  * host is `*.workers.dev` / `*.vercel.app` / `*.deno.dev` is classified as an
  * application relay and dialed with `x-relay-target` / `x-relay-path` headers
- * (see `network/pool/agent.ts` and `network/outbound-fetch.ts`). This module
+ * (see `network/pool/agent.ts` and `network/egress/fetch.ts`). This module
  * supplies the other half — the operator does not have to write and deploy the
  * worker by hand.
  *

package/src/console/routing/pools/store.ts

@@ -16,7 +16,7 @@ import {
 } from "./contracts";
 import { classifyPoolConnectError, classifyPoolProbeResponse, parseEgressIp } from "./probe-result";
 import { encryptCredential } from "../../../security/crypto";
-import { createValidatedFetch } from "../../../network/outbound-fetch";
+import { createValidatedFetch } from "../../../network/egress/fetch";
 import { classifyProviderProbeAnswer } from "./probe-verdict";
 import { buildProviderProbeRequest } from "../../../providers/provider-probe";
 import type { StoredProviderProbe } from "./contracts";
@@ -34,9 +34,9 @@ import {
   disablePoolForProxyHttpStatus,
   listNetworkPoolHealthEvents,
   recoverNetworkPool,
-} from "../../../network/pool-health-machine";
-import { drainPoolByteDelta, recordPoolBytes } from "../../../network/pool/byte-accounting";
-import * as poolCooldownStore from "../../../network/pool-cooldown-store";
+} from "../../../network/pool/health";
+import { drainPoolByteDelta, recordPoolBytes } from "../../../network/pool/accounting";
+import * as poolCooldownStore from "../../../network/pool/cooldown-store";
 // Cloudflare's trace endpoint answers with plain `key=value` lines including
 // `ip=`, the address the request egressed from. Dialing it THROUGH the pool
 // therefore reports the pool's public address — which is what an operator

package/src/console/shared/errors.ts

@@ -1,7 +1,7 @@
 import { ValidationError } from "elysia";
 import type { AccessDecision, AccessScope } from "../../security/access-control";
 import { isRecord } from "../../protocol/codecs";
-import { formatPublicErrorMessage } from "../../protocol/gateway-error";
+import { formatPublicErrorMessage, GatewayError } from "../../protocol/gateway-error";
 
 // Single console error/access contract. Every domain throws ConsoleDomainError
 // (or the storage-layer BackupError, same code/status/message shape) and
@@ -24,8 +24,27 @@ export class ConsoleDomainError extends Error {
   }
 }
 
-function asDomainError(error: unknown): { code: string; status: number; message: string; details?: unknown } | undefined {
+interface ShapedDomainError {
+  readonly code: string;
+  readonly status: number;
+  readonly message: string;
+  readonly details?: unknown;
+  /** Upstream/network origin, preserved so the dashboard can tell a provider
+   * rejection from a console-session expiry (see `maybeSignalSessionTransition`). */
+  readonly origin?: string;
+}
+
+function asDomainError(error: unknown): ShapedDomainError | undefined {
   if (error instanceof ConsoleDomainError) return error;
+  if (error instanceof GatewayError) {
+    return {
+      code: error.code,
+      status: error.status,
+      message: error.message,
+      details: error.details,
+      ...(error.origin === "cartethyia" ? {} : { origin: error.origin }),
+    };
+  }
   if (
     typeof error === "object" &&
     error !== null &&
@@ -33,8 +52,14 @@ function asDomainError(error: unknown): { code: string; status: number; message:
     typeof (error as { status?: unknown }).status === "number" &&
     typeof (error as { message?: unknown }).message === "string"
   ) {
-    const shaped = error as { code: string; status: number; message: string; details?: unknown };
-    return { code: shaped.code, status: shaped.status, message: shaped.message, details: shaped.details };
+    const shaped = error as { code: string; status: number; message: string; details?: unknown; origin?: unknown };
+    return {
+      code: shaped.code,
+      status: shaped.status,
+      message: shaped.message,
+      details: shaped.details,
+      ...(typeof shaped.origin === "string" && shaped.origin !== "cartethyia" ? { origin: shaped.origin } : {}),
+    };
   }
   return undefined;
 }
@@ -47,6 +72,7 @@ export function errorResponse(
 ): {
   error: string;
   code: string;
+  origin?: string;
   details?: Record<string, unknown>;
 } {
   const shaped = asDomainError(error);
@@ -63,16 +89,17 @@ export function errorResponse(
     const body: Record<string, unknown> = {
       error: message,
       code: shaped.code,
+      ...(shaped.origin === undefined ? {} : { origin: shaped.origin }),
     };
     if (includeDetails) body.details = details;
-    return body as { error: string; code: string; details?: Record<string, unknown> };
+    return body as { error: string; code: string; origin?: string; details?: Record<string, unknown> };
   }
   set.status = 500;
   const body: Record<string, unknown> = {
     error: formatPublicErrorMessage("internal_error", fallbackMessage),
     code: "internal_error",
   };
-  return body as { error: string; code: string; details?: Record<string, unknown> };
+  return body as { error: string; code: string; origin?: string; details?: Record<string, unknown> };
 }
 
 export function requireScope(

package/src/main.ts

@@ -3,6 +3,7 @@
 import "./boot/elysia-typebox-bridge";
 import { createGatewayApp, createGatewayShell } from "./boot/app";
 import { bootstrap } from "./boot/lifecycle";
+import { flushAllBuffers } from "./boot/flush";
 import type { CartethyiaBoot } from "./boot/lifecycle";
 import {
   resolveDrainToken,
@@ -90,9 +91,7 @@ const app = boot
         // for the queues, minus the stop.
         flushBuffers: {
           flush: async () => {
-            await boot.deps.telemetryBuffer.flush();
-            await boot.deps.usageFlush.flush();
-            await boot.deps.healthEventFlush.flush();
+            await flushAllBuffers(boot.deps);
           },
         },
       },

package/src/network/client.ts

@@ -0,0 +1,67 @@
+/**
+ * Unified network egress client.
+ *
+ * One entry point for every outbound transport the gateway can dial:
+ *
+ * - `fetch(poolId?, tenantId?)` — validated HTTP fetch (SSRF-guarded), with
+ *   optional TLS ClientHello profile support (`options.tlsProfile`).
+ * - `bidi(poolId?, tenantId?)` — validated bidirectional HTTP/2 stream
+ *   (Connect-RPC-style request/response over one long-lived stream).
+ * - `webSocket(poolId?, tenantId?)` — validated WSS session.
+ * - `resolve(hostname, signal, port?)` — one-shot DNS resolution + SSRF
+ *   validation, pinned so a rebind cannot retarget the socket.
+ *
+ * All four bind to the same selected network pool (when one is given) or to
+ * validated direct egress. Provider adapters call this and never dial a
+ * socket themselves.
+ */
+import { ValidatedNetworkBindingFactory } from "./egress/factory";
+import type { ValidatedOutboundHttp2Bidi } from "./bidi";
+import type { ValidatedOutboundWebSocket } from "../providers/provider-contracts";
+import type { ValidatedDestination } from "./ssrf";
+import type { SsrfPolicy } from "../config/network";
+import type { TlsProfile } from "./egress/tls-profile";
+import type { ValidatedFetch } from "./egress/fetch";
+import type { PoolAgentResolver } from "./pool/resolver";
+
+export interface NetworkClientOptions {
+  /** SSRF policy applied to every dial. Defaults to the empty (block-all-loopback) policy. */
+  readonly policy?: SsrfPolicy;
+  /** Injected fetch for offline tests/recordings. */
+  readonly fetchFn?: typeof fetch;
+  /** Optional pool-agent resolver; without it every dial is direct. */
+  readonly poolResolver?: PoolAgentResolver;
+  /**
+   * Default TLS ClientHello profile for direct https dials. `"default"` keeps
+   * the runtime's own TLS; a named profile (see `tls-profile.ts`) dials with
+   * that profile's OpenSSL options so the wire fingerprint matches the
+   * impersonated client.
+   */
+  readonly tlsProfile?: TlsProfile;
+}
+
+export interface NetworkClient {
+  /** Validated HTTP fetch bound to a pool slot (or direct when omitted). */
+  readonly fetch: (poolId?: string, tenantId?: string) => ValidatedFetch;
+  /** Validated bidirectional HTTP/2 stream. */
+  readonly bidi: (poolId?: string, tenantId?: string) => ValidatedOutboundHttp2Bidi;
+  /** Validated WSS session. */
+  readonly webSocket: (poolId?: string, tenantId?: string) => ValidatedOutboundWebSocket;
+  /** One-shot DNS resolution + SSRF validation for direct egress targets. */
+  readonly resolve: (hostname: string, signal: AbortSignal, port?: number) => Promise<ValidatedDestination>;
+}
+
+export function createNetworkClient(options: NetworkClientOptions = {}): NetworkClient {
+  const factory = new ValidatedNetworkBindingFactory(
+    options.policy,
+    options.fetchFn,
+    options.poolResolver,
+    options.tlsProfile,
+  );
+  return {
+    fetch: (poolId, tenantId) => factory.fetch(poolId, tenantId),
+    bidi: (poolId, tenantId) => factory.http2Bidi(poolId, tenantId),
+    webSocket: (poolId, tenantId) => factory.webSocket(poolId, tenantId),
+    resolve: (hostname, signal, port) => factory.resolve(hostname, signal, port),
+  };
+}