cartethyia 2.8.0 → 2.8.1

package/src/console/providers/detail/routes.ts

@@ -163,6 +163,7 @@ const updateRoutingBody = t.Object({
   usageFloor: t.Optional(t.Nullable(t.Integer({ minimum: 0, maximum: 1_000_000 }))),
   usageFloorUnit: t.Optional(t.Union([t.Literal("credit"), t.Literal("percent")])),
   skipProxy: t.Optional(t.Boolean()),
+  deviceFlowProxy: t.Optional(t.Union([t.Literal("random"), t.Literal("direct")])),
   userAgent: t.Optional(t.String({ minLength: 0, maxLength: 4096 })),
   customUserAgent: t.Optional(t.Nullable(t.String({ minLength: 0, maxLength: 4096 }))),
 });

package/src/console/providers/detail/store.ts

@@ -40,6 +40,7 @@ function mapRow(row: typeof providerRoutingSettings.$inferSelect): ProviderRouti
     usageFloorUnit: row.usageFloorUnit === "credit" ? "credit" : "percent",
     enabled: row.enabled,
     skipProxy: row.skipProxy,
+    deviceFlowProxy: row.deviceFlowProxy === "direct" ? "direct" : "random",
     userAgent: row.userAgent,
     customUserAgent: row.customUserAgent,
   };
@@ -94,6 +95,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
       usageFloorUnit: "percent",
       enabled: false,
       skipProxy: defaultSkipProxy(providerId),
+      deviceFlowProxy: "random",
       userAgent: buildClaudeCliUserAgent(),
       customUserAgent: null,
     };
@@ -117,6 +119,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
       usageFloorUnit: patch.usageFloorUnit ?? "percent",
       enabled: patch.enabled ?? false,
       skipProxy: patch.skipProxy ?? defaultSkipProxy(providerId),
+      deviceFlowProxy: patch.deviceFlowProxy ?? "random",
       userAgent: patch.userAgent ?? buildClaudeCliUserAgent(),
       customUserAgent: patch.customUserAgent ?? null,
     };
@@ -130,6 +133,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
     if (patch.usageFloorUnit !== undefined) setClause.usageFloorUnit = patch.usageFloorUnit;
     if (patch.enabled !== undefined) setClause.enabled = patch.enabled;
     if (patch.skipProxy !== undefined) setClause.skipProxy = patch.skipProxy;
+    if (patch.deviceFlowProxy !== undefined) setClause.deviceFlowProxy = patch.deviceFlowProxy;
     if (patch.userAgent !== undefined) setClause.userAgent = patch.userAgent;
     if (patch.customUserAgent !== undefined) setClause.customUserAgent = patch.customUserAgent;
     const upserted = await this.db

package/src/console/providers/oauth/callback-listener.ts

@@ -158,14 +158,14 @@ export class OAuthCallbackListener {
   /**
    * The paths one login may deliver its callback on. Kiro's portal is observed
    * (unpacked IDE 1.4.62) to redirect to both `/oauth/callback` and
-   * `/signin/callback`; binding only the advertised path left a redirect to the
-   * other one hitting a 404 and the login hanging. Other providers neither
-   * register nor expect `/signin/callback`, so adding it is harmless.
+   * `/signin/callback`; DeepAI's desktop flow lands on `/auth-callback`.
+   * Binding only the advertised path left a redirect to the other one hitting
+   * a 404 and the login hanging. Other providers neither register nor expect
+   * these, so adding them is harmless.
    */
   #callbackPaths(advertised: string): readonly string[] {
-    return advertised === "/signin/callback"
-      ? [advertised]
-      : [advertised, "/signin/callback"];
+    const extras = advertised === "/signin/callback" ? [] : ["/signin/callback", "/auth-callback"];
+    return [advertised, ...extras];
   }
 
   /** Drops a flow and frees its port when nothing else is waiting on it. */
@@ -235,13 +235,32 @@ export class OAuthCallbackListener {
     listener.flows.set(state, { providerId, paths, timer, inFlight: false });
   }
 
-  #forget(port: number, listener: PortListener, state: string): void {
+  #forget(
+    port: number,
+    listener: PortListener,
+    state: string,
+    options: { readonly deferStop?: boolean } = {},
+  ): void {
     const flow = listener.flows.get(state);
     if (flow !== undefined) clearTimeout(flow.timer);
     listener.flows.delete(state);
     if (listener.flows.size > 0) return;
     this.#ports.delete(port);
-    for (const server of listener.servers) void server.stop(true);
+    const stopServers = () => {
+      for (const server of listener.servers) void server.stop(true);
+    };
+    if (options.deferStop === true) {
+      // The stop is called from inside a callback handler that is about to
+      // return its Response. `stop(true)` closes active connections, so
+      // stopping synchronously here kills the very response the browser is
+      // waiting for — the login "succeeds" server-side while the callback tab
+      // sees a connection reset (observed live: HTTP 000, and more reliably on
+      // deployed/docker hosts). Defer the stop one tick so the response is
+      // flushed first; the port is freed a moment later.
+      setTimeout(stopServers, 50);
+    } else {
+      stopServers();
+    }
     log.info(`[oauth] callback listener released on 127.0.0.1:${port}`);
   }
 
@@ -311,7 +330,7 @@ export class OAuthCallbackListener {
     if (error !== null) {
       // A denial carries the state only when the server echoes one; clear it
       // when present so a retry starts a fresh flow.
-      if (state.length > 0) this.#forget(endpoint.port, listener, state);
+      if (state.length > 0) this.#forget(endpoint.port, listener, state, { deferStop: true });
       return new Response(
         `<!doctype html><html><body><p>OAuth login failed: ${escapeHtml(error)}</p></body></html>`,
         { status: 400, headers: { "content-type": "text/html; charset=utf-8" } },
@@ -374,7 +393,7 @@ export class OAuthCallbackListener {
         Object.keys(callbackParams).length > 0 ? callbackParams : undefined,
       );
     } catch (failure) {
-      if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
+      if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState, { deferStop: true });
       const message = failure instanceof Error ? failure.message : "OAuth login failed";
       log.error(`[oauth] callback completion failed for ${matched.providerId}: ${message}`);
       return new Response(
@@ -393,7 +412,7 @@ export class OAuthCallbackListener {
         headers: { location: result.redirectUrl },
       });
     }
-    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
+    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState, { deferStop: true });
     if (!result.ok) {
       return new Response(
         `<!doctype html><html><body><p>OAuth login failed: ${escapeHtml(result.message)}</p></body></html>`,

package/src/console/providers/oauth/device-egress.ts

@@ -0,0 +1,123 @@
+// Device-flow OAuth egress resolution.
+//
+// Device-code flows (start + poll) previously always dialed from the
+// gateway's own egress, so every code minted on one host appeared to come
+// from a single IP — which let Cursor/Grok/other device-code providers flag
+// "multiple codes from one IP". The `device_flow_proxy` routing setting says
+// whether to route these requests through one of the tenant's active network
+// pools ("random", the default) or direct ("direct").
+//
+// The resolved fetch is a validated fetch bound to either a pool or the
+// gateway's direct egress, and is injected into the OAuth flow context so the
+// provider client uses it for its device-authorization and token-poll calls.
+
+import { eq, and, isNull } from "drizzle-orm";
+import type { DeviceFlowProxyMode } from "../../../persistence/schema";
+import { networkPools, providerRoutingSettings } from "../../../persistence/schema";
+import type { CartethyiaDatabase } from "../../../persistence/db-handle";
+import type { NetworkPoolSelector } from "../../../network/pool/selector";
+import type { ValidatedNetworkBindingFactory } from "../../../network/egress/factory";
+import type { FetchLike } from "../../../providers/authentication/oauth-flow-store";
+
+/** A resolved device-flow egress: the fetch to use, plus its release hook. */
+export interface DeviceEgress {
+  readonly fetch: FetchLike;
+  /** Release an acquired pool slot (no-op for direct egress). */
+  readonly release: () => void;
+  /** The pool selected, when one was (for correlation/persistence). */
+  readonly networkPoolId?: string;
+}
+
+/** Dependencies the device-egress resolver needs. */
+export interface DeviceEgressDeps {
+  readonly db: CartethyiaDatabase;
+  readonly poolSelector: NetworkPoolSelector;
+  readonly networkBindingFactory: ValidatedNetworkBindingFactory;
+}
+
+/** Reads the provider's `device_flow_proxy` mode; absent rows default to `random`. */
+async function resolveDeviceFlowProxyMode(
+  db: CartethyiaDatabase,
+  providerId: string,
+  tenantId: string | null,
+): Promise<DeviceFlowProxyMode> {
+  if (tenantId !== null) {
+    const tenantRow = await db
+      .select({ mode: providerRoutingSettings.deviceFlowProxy })
+      .from(providerRoutingSettings)
+      .where(
+        and(
+          eq(providerRoutingSettings.providerId, providerId),
+          eq(providerRoutingSettings.tenantId, tenantId),
+        ),
+      )
+      .limit(1);
+    if (tenantRow[0]) return tenantRow[0].mode === "direct" ? "direct" : "random";
+  }
+  const globalRow = await db
+    .select({ mode: providerRoutingSettings.deviceFlowProxy })
+    .from(providerRoutingSettings)
+    .where(
+      and(
+        eq(providerRoutingSettings.providerId, providerId),
+        isNull(providerRoutingSettings.tenantId),
+      ),
+    )
+    .limit(1);
+  return globalRow[0]?.mode === "direct" ? "direct" : "random";
+}
+
+/**
+ * Resolves the egress for one device-code flow. `random` selects an active
+ * network pool (weighted, cooldown-aware) when one is available and falls
+ * back to direct egress when the tenant has no usable pool; `direct` always
+ * dials direct. The returned fetch is what the provider client must use for
+ * its device-authorization and token-poll requests.
+ */
+export async function resolveDeviceEgress(
+  deps: DeviceEgressDeps,
+  providerId: string,
+  tenantId: string | null,
+): Promise<DeviceEgress> {
+  const mode = await resolveDeviceFlowProxyMode(deps.db, providerId, tenantId);
+  const direct = (): DeviceEgress => ({
+    fetch: deps.networkBindingFactory.fetch(undefined, tenantId ?? undefined),
+    release: () => undefined,
+  });
+
+  if (mode === "direct" || tenantId === null) return direct();
+
+  const poolRows = await deps.db
+    .select({
+      id: networkPools.id,
+      maxInflight: networkPools.maxInflight,
+      weight: networkPools.weight,
+    })
+    .from(networkPools)
+    .where(and(eq(networkPools.tenantId, tenantId), eq(networkPools.status, "active")));
+
+  if (poolRows.length > 0) {
+    const limits: Record<string, number> = {};
+    const weights: Record<string, number> = {};
+    for (const pool of poolRows) {
+      limits[pool.id] = pool.maxInflight ?? 10;
+      weights[pool.id] = pool.weight ?? 100;
+    }
+    const slot = await deps.poolSelector.tryAcquireAvailablePool(
+      poolRows.map((pool) => pool.id),
+      providerId,
+      limits,
+      weights,
+    );
+    if (slot) {
+      return {
+        fetch: deps.networkBindingFactory.fetch(slot.poolId, tenantId ?? undefined),
+        release: slot.release,
+        networkPoolId: slot.poolId,
+      };
+    }
+  }
+
+  // No active/usable pool: direct is the safe fallback (never block a login).
+  return direct();
+}

package/src/console/providers/oauth/routes.ts

@@ -2,11 +2,17 @@ import { providerAccounts, providerOauthStates } from "../../../persistence/sche
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { encryptCredential, hashSecret } from "../../../security/crypto";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
-import type { OAuthExchangeResult, OAuthLoginClient } from "../../../providers/authentication/oauth-flow-store";
+import type {
+  OAuthDeviceStartResult,
+  OAuthExchangeResult,
+  OAuthLoginClient,
+} from "../../../providers/authentication/oauth-flow-store";
+import { oauthAccountIdentity } from "../../../providers/authentication/oauth-flow-store";
 import type { OAuthDevicePollResponse } from "../catalog/contracts";
 import { providerJwtVerification } from "../../../providers/provider-metadata";
 import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { browserAuthorizeRedirectUri } from "../../../config/providers";
+import { resolveDeviceEgress, type DeviceEgressDeps } from "./device-egress";
 import { log } from "../../../observability/logger";
 import { GatewayError } from "../../../protocol/gateway-error";
 import { Elysia, t, type AnyElysia } from "elysia";
@@ -41,11 +47,53 @@ export function oauthIdentityFingerprint(input: {
   readonly label: string;
   readonly providerId: string;
 } & OAuthExchangeResult): string {
+  const identity = input.accountEmail?.trim() ?? input.accountName?.trim();
+  if (identity !== undefined && identity.length > 0) return hashSecret(identity);
   const label = input.label.trim();
-  const resolved = label.length > 0 && label.toLowerCase() !== input.providerId.trim().toLowerCase();
+  const resolved =
+    label.length > 0 &&
+    label.toLowerCase() !== input.providerId.trim().toLowerCase() &&
+    !isGeneratedOAuthLabel(label, input.providerId);
   return hashSecret(resolved ? label : input.refresh);
 }
 
+/** First unused `<providerId>-N` label for an OAuth account with no upstream identity. */
+export function nextGeneratedOAuthAccountLabel(
+  providerId: string,
+  existingLabels: readonly string[],
+): string {
+  const taken = new Set(existingLabels.map((label) => label.trim().toLowerCase()));
+  for (let n = 1; ; n += 1) {
+    const candidate = `${providerId}-${n}`;
+    if (!taken.has(candidate.toLowerCase())) return candidate;
+  }
+}
+
+/** Generated labels are display-only and must never become re-login identity. */
+export function isGeneratedOAuthLabel(label: string, providerId: string): boolean {
+  const value = label.trim().toLowerCase();
+  const prefix = `${providerId.trim().toLowerCase()}-`;
+  return value === providerId.trim().toLowerCase() || (value.startsWith(prefix) && /^\d+$/.test(value.slice(prefix.length)));
+}
+
+/** Merges provider-reported identity with the operator label without inventing data. */
+function resolvedOAuthIdentity(
+  input: { readonly label: string } & OAuthExchangeResult,
+  providerId: string,
+): { readonly label: string; readonly accountEmail?: string; readonly accountName?: string } {
+  const tokenIdentity = oauthAccountIdentity(input);
+  const accountEmail = input.accountEmail?.trim() ?? tokenIdentity.accountEmail;
+  const accountName = input.accountName?.trim() ?? tokenIdentity.accountName;
+  const existing = input.label.trim();
+  const unresolved = existing.length === 0 || isGeneratedOAuthLabel(existing, providerId);
+  const label = unresolved ? (accountEmail ?? accountName ?? existing) : existing;
+  return {
+    label,
+    ...(accountEmail === undefined ? {} : { accountEmail }),
+    ...(accountName === undefined ? {} : { accountName }),
+  };
+}
+
 export class DrizzleOAuthAccountStore implements OAuthAccountStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
@@ -54,7 +102,8 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
     providerId: string,
     input: { readonly label: string } & OAuthExchangeResult,
   ): Promise<PersistedOAuthAccount> {
-    const credentialFingerprint = oauthIdentityFingerprint({ ...input, providerId });
+    const identity = resolvedOAuthIdentity(input, providerId);
+    const credentialFingerprint = oauthIdentityFingerprint({ ...input, ...identity, providerId });
     const sameAccount = and(
       eq(providerAccounts.providerId, providerId),
       // The identity index coalesces a null tenant to a sentinel, so "same
@@ -68,6 +117,20 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
     const refreshCiphertext = encryptCredential(input.refresh);
     const clientSecretCiphertext =
       input.client_secret === undefined ? undefined : encryptCredential(input.client_secret);
+    const identityColumns = {
+      ...(input.auth_state === undefined && identity.accountName === undefined
+        ? {}
+        : {
+          authState: {
+            ...(input.auth_state ?? {}),
+            ...(identity.accountName === undefined ? {} : { accountName: identity.accountName }),
+          },
+        }),
+      ...(identity.accountEmail === undefined ? {} : { accountEmail: identity.accountEmail }),
+      ...(identity.accountEmail !== undefined || identity.accountName !== undefined
+        ? { identityCheckedAt: new Date() }
+        : {}),
+    };
     try {
       return await this.db.transaction(async (tx) => {
         const existing = await tx
@@ -76,6 +139,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
           .where(sameAccount)
           .limit(1);
         const existingId = existing[0]?.id;
+        const label = isGeneratedOAuthLabel(input.label, providerId) ? identity.label : input.label;
         if (existingId !== undefined) {
           // A re-login replaces the account it belongs to rather than adding a
           // second row: the same email is the same account, and the newer
@@ -90,7 +154,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
               // the learned label — but never over an operator's custom rename.
               // The CASE keeps the read and the write in one statement, so a
               // concurrent rename cannot lose to the login.
-              label: sql`CASE WHEN lower(trim(${providerAccounts.label})) = lower(trim(${providerAccounts.providerId})) THEN ${input.label} ELSE ${providerAccounts.label} END`,
+              label: sql`CASE WHEN lower(trim(${providerAccounts.label})) = lower(trim(${providerAccounts.providerId})) OR lower(trim(${providerAccounts.label})) = lower(trim(${label})) THEN ${label} ELSE ${providerAccounts.label} END`,
               credentialCiphertext,
               credentialKind: "oauth",
               status: "active",
@@ -106,7 +170,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
               staticToken: false,
               // Only what this login reported: a flow that learned no profile or
               // region leaves the stored configuration alone rather than blanking it.
-              ...(input.auth_state === undefined ? {} : { authState: input.auth_state }),
+              ...identityColumns,
             })
             .where(eq(providerAccounts.id, existingId));
           await tx
@@ -119,17 +183,34 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
             .where(eq(providerOauthStates.providerAccountId, existingId));
           return { accountId: existingId };
         }
+        const existingLabels = await tx
+          .select({ label: providerAccounts.label })
+          .from(providerAccounts)
+          .where(
+            and(
+              eq(providerAccounts.providerId, providerId),
+              tenantId === null
+                ? isNull(providerAccounts.tenantId)
+                : eq(providerAccounts.tenantId, tenantId),
+            ),
+          );
+        const generatedLabel = isGeneratedOAuthLabel(label, providerId)
+          ? nextGeneratedOAuthAccountLabel(
+              providerId,
+              existingLabels.map((row) => row.label).filter((value): value is string => typeof value === "string"),
+            )
+          : label;
         const rows = await tx
           .insert(providerAccounts)
           .values({
             providerId,
             tenantId,
-            label: input.label,
+            label: generatedLabel,
             credentialKind: "oauth",
             credentialCiphertext,
             credentialFingerprint,
             status: "active",
-            ...(input.auth_state === undefined ? {} : { authState: input.auth_state }),
+            ...identityColumns,
           })
           .returning({ id: providerAccounts.id });
         const row = rows[0];
@@ -194,6 +275,8 @@ export interface OAuthLoginConfig {
    * itself instead of waiting for the operator to paste the URL back.
    */
   readonly callbackListener: OAuthCallbackListener;
+  /** Resolves device-flow OAuth egress per the `device_flow_proxy` setting. */
+  readonly deviceEgress: DeviceEgressDeps;
 }
 
 async function requireClient(
@@ -290,7 +373,7 @@ export async function completeLogin(
       );
     }
     await config.accountStore.persistAccount(flow.tenantId, providerId, {
-      label: result.accountLabel ?? flow.accountLabel,
+      label: result.accountLabel ?? (flow.accountLabel.trim().toLowerCase() === providerId.trim().toLowerCase() ? "" : flow.accountLabel),
       ...result,
     });
     // The exchange succeeded and the account is persisted; now the flow is
@@ -442,7 +525,7 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
             { providerId },
           );
         }
-        const state = generateOAuthState();
+        const state = client.generateState?.() ?? generateOAuthState();
         const { codeVerifier, codeChallenge } = generatePkcePair();
         /**
          * A client whose authorize URL depends on an upstream discovery runs it
@@ -547,12 +630,25 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
             `Provider ${providerId} does not support device-code login`,
             { providerId },
           );
-        const started = await client.startDeviceAuth({
+        const egress = await resolveDeviceEgress(
+          config.deviceEgress,
           providerId,
-          tenantId: a.tenantId,
-          accountLabel,
-          ...(parameters === undefined ? {} : { parameters }),
-        });
+          a.tenantId,
+        );
+        let started: OAuthDeviceStartResult;
+        try {
+          started = await client.startDeviceAuth({
+            providerId,
+            tenantId: a.tenantId,
+            accountLabel,
+            fetchFn: egress.fetch,
+            ...(parameters === undefined ? {} : { parameters }),
+          });
+        } finally {
+          // The flow has been started; the pool slot is only needed for the
+          // start request. Polls re-resolve their own egress.
+          egress.release();
+        }
         const { providerState, ...publicStarted } = started;
         await config.oauthFlowStore.saveDevice(started.deviceAuthId, {
           providerId,
@@ -585,15 +681,22 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
             409,
             "Provider does not support device-code login",
           );
+        const egress = await resolveDeviceEgress(
+          config.deviceEgress,
+          providerId,
+          a.tenantId,
+        );
         const polled = await client.pollDeviceAuth(deviceAuthId, {
           providerId,
           tenantId: a.tenantId,
           accountLabel: correlation.accountLabel,
+          fetchFn: egress.fetch,
           ...(correlation.providerState === undefined
             ? {}
             : { providerState: correlation.providerState }),
           ...(correlation.parameters === undefined ? {} : { parameters: correlation.parameters }),
         });
+        egress.release();
         if (polled.status === "pending")
           return {
             status: "pending",
@@ -634,7 +737,11 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
           correlation.tenantId,
           providerId,
           {
-            label: polled.result.accountLabel ?? correlation.accountLabel,
+            label:
+              polled.result.accountLabel ??
+              (correlation.accountLabel.trim().toLowerCase() === providerId.trim().toLowerCase()
+                ? ""
+                : correlation.accountLabel),
             ...polled.result,
           },
         );
@@ -675,7 +782,7 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
           );
         }
         const persisted = await config.accountStore.persistAccount(a.tenantId, providerId, {
-          label: result.accountLabel ?? accountLabel,
+          label: result.accountLabel ?? (accountLabel.trim().toLowerCase() === providerId.trim().toLowerCase() ? "" : accountLabel),
           ...result,
         });
         await config.snapshotInvalidator?.invalidate();

package/src/console/quota/account-quota-tenant.ts

@@ -29,7 +29,7 @@ import {
   type QuotaRefreshFailureCode,
 } from "../../providers/quota/refresh";
 import { selectAccountTestEgress } from "./account-test-egress";
-import type { ValidatedFetch } from "../../network/outbound-fetch";
+import type { ValidatedFetch } from "../../network/egress/fetch";
 import type { ProviderId } from "../../providers/provider-contracts";
 import {
   DAILY_CHECKIN_PROVIDER_IDS,
@@ -43,7 +43,7 @@ import {
   fetchDailyCheckin,
   type BuddyActivityReportResult,
   type DailyCheckinResult,
-} from "../../providers/integrations/buddy/buddy-checkin";
+} from "../../providers/integrations/buddy/lifecycle";
 import {
   fetchQoderDailyCheckin,
   isQoderCheckinProvider,
@@ -194,7 +194,7 @@ async function runDailyGrowthForAccount(
   // The buddy-oauth-shared graph is lazy-loaded: the uid decoder is only
   // needed for buddy accounts' report leg (B-02).
   const { buddyAccountUid } = await import(
-    "../../providers/integrations/buddy/buddy-oauth-shared"
+    "../../providers/integrations/buddy/account"
   );
   const userId = buddyAccountUid(credential);
   let report: { ok: boolean; message: string };
@@ -427,7 +427,7 @@ export function registerAccountQuotaTenantRoutes(
       // The buddy-usage-store graph is lazy-loaded: it is only needed when the
       // page actually renders buddy accounts (B-02).
       const { readBuddyUsageSnapshots } = await import(
-        "../../providers/integrations/buddy/buddy-usage-store"
+        "../../providers/integrations/buddy/account"
       );
       const usageByAccount = await readBuddyUsageSnapshots(
         db,
@@ -1250,7 +1250,7 @@ export function registerAccountQuotaTenantRoutes(
         // The buddy-oauth-shared graph is lazy-loaded: the uid decoder is only
         // needed on this buddy-only surface (B-02).
         const { buddyAccountUid } = await import(
-          "../../providers/integrations/buddy/buddy-oauth-shared"
+          "../../providers/integrations/buddy/account"
         );
         const userId = buddyAccountUid(credential);
         if (!userId) {

package/src/console/quota/account-test-egress.ts

@@ -11,8 +11,8 @@ import { networkPools, poolRoutingSettings, providerRoutingSettings } from "../.
 import { resolveTenantOverride } from "../../persistence/tenant-scope";
 import { GatewayError } from "../../protocol/gateway-error";
 import type { NetworkPoolSelector, PoolRotation } from "../../network/pool/selector";
-import type { ValidatedFetch } from "../../network/outbound-fetch";
-import type { ValidatedNetworkBindingFactory } from "../../network/pool/resolver";
+import type { ValidatedFetch } from "../../network/egress/fetch";
+import type { ValidatedNetworkBindingFactory } from "../../network/egress/factory";
 import { DEFAULT_PROXY_SKIP_PROVIDER_IDS } from "../../providers/provider-metadata";
 import type { FetchLike } from "../../providers/quota/quota-contracts";
 

package/src/console/quota/daily-growth-job.ts

@@ -31,7 +31,7 @@ import { randomUUID } from "node:crypto";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import type { RedisClient } from "../../persistence/redis";
 import { checkinAttemptedToday } from "../../workers/daily-checkin";
-import type { ValidatedFetch } from "../../network/outbound-fetch";
+import type { ValidatedFetch } from "../../network/egress/fetch";
 
 /** Lifecycle states of a daily-growth job. */
 export type DailyGrowthJobState = "queued" | "running" | "done" | "failed";

package/src/console/routing/pools/contracts.ts

@@ -10,7 +10,7 @@ import { isAddressAllowed } from "../../../network/ssrf";
 import { TRANSPORT_KINDS, type TransportKind } from "../../../network/pool/agent";
 import type { SsrfPolicy } from "../../../config/network";
 import type { NetworkPoolSelector } from "../../../network/pool/selector";
-import type { PoolHealthEvent } from "../../../network/pool-health-machine";
+import type { PoolHealthEvent } from "../../../network/pool/health";
 
 export interface CreateNetworkPoolRequest {
   kind: TransportKind;

package/src/console/routing/pools/operations.ts

@@ -4,7 +4,7 @@
 import { ConsoleDomainError, requireTenantScope } from "../../shared/errors";
 import { providerRateLimitIsIpScoped } from "../../../providers/provider-metadata";
 import { resolvePoolProviderRateLimitCooldownMs } from "../../../config/cooldowns";
-import type { PoolHealthEvent } from "../../../network/pool-health-machine";
+import type { PoolHealthEvent } from "../../../network/pool/health";
 import type { AccessDecision } from "../../../security/access-control";
 import {
   deployRelay as deployRelayWorker,

package/src/console/routing/pools/probe-verdict.ts

@@ -17,13 +17,13 @@
  * pool for good.
  *
  * The 403-free-tier and 429 verdicts are the probe's reading of the same facts
- * `classifyEgressFailure` (in `network/rate-limit-verdict`) reads on the
+ * `classifyEgressFailure` (in `network/verdict`) reads on the
  * dispatch path — for the probe they arrive as an HTTP status + body instead of
  * a `GatewayError`, so the shared free-tier regex is borrowed from there to
  * keep the two classifiers' boundaries honest.
  */
 
-import { FREE_TIER_REFUSAL } from "../../../network/rate-limit-verdict";
+import { FREE_TIER_REFUSAL } from "../../../network/verdict";
 
 export type ProbeVerdict = "allowed" | "blocked" | "throttled" | "unreachable";
 

package/src/console/routing/pools/relay-deploy.ts

@@ -5,7 +5,7 @@
  * Cartethyia already knows how to *use* a hosted relay: a pool whose endpoint
  * host is `*.workers.dev` / `*.vercel.app` / `*.deno.dev` is classified as an
  * application relay and dialed with `x-relay-target` / `x-relay-path` headers
- * (see `network/pool/agent.ts` and `network/outbound-fetch.ts`). This module
+ * (see `network/pool/agent.ts` and `network/egress/fetch.ts`). This module
  * supplies the other half — the operator does not have to write and deploy the
  * worker by hand.
  *

package/src/console/routing/pools/store.ts

@@ -16,7 +16,7 @@ import {
 } from "./contracts";
 import { classifyPoolConnectError, classifyPoolProbeResponse, parseEgressIp } from "./probe-result";
 import { encryptCredential } from "../../../security/crypto";
-import { createValidatedFetch } from "../../../network/outbound-fetch";
+import { createValidatedFetch } from "../../../network/egress/fetch";
 import { classifyProviderProbeAnswer } from "./probe-verdict";
 import { buildProviderProbeRequest } from "../../../providers/provider-probe";
 import type { StoredProviderProbe } from "./contracts";
@@ -34,9 +34,9 @@ import {
   disablePoolForProxyHttpStatus,
   listNetworkPoolHealthEvents,
   recoverNetworkPool,
-} from "../../../network/pool-health-machine";
-import { drainPoolByteDelta, recordPoolBytes } from "../../../network/pool/byte-accounting";
-import * as poolCooldownStore from "../../../network/pool-cooldown-store";
+} from "../../../network/pool/health";
+import { drainPoolByteDelta, recordPoolBytes } from "../../../network/pool/accounting";
+import * as poolCooldownStore from "../../../network/pool/cooldown-store";
 // Cloudflare's trace endpoint answers with plain `key=value` lines including
 // `ip=`, the address the request egressed from. Dialing it THROUGH the pool
 // therefore reports the pool's public address — which is what an operator