fix(operations): throttle the public exportTraces endpoint

exportTraces was the only export operation that enqueued an email export
without passing through enforceExportRequestRateLimit, so an API caller
could enqueue unbounded CSV export jobs and emails per (org, project,
recipient) while exportSignals and exportDatasetRows were both capped at
10/hour in production.

Adds the same throttle its siblings use and documents the resulting 429
in the OpenAPI contract, which required swapping typedResponses (success
status only, by design) for the explicit responses object both siblings
already use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: 2 people

apps/api/openapi.json

@@ -14674,6 +14674,16 @@
                 }
               }
             }
+          },
+          "429": {
+            "description": "Export rate limit exceeded",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           }
         }
       }

packages/operations/src/operations/traces.ts

@@ -7,6 +7,7 @@ import { BadRequestError, cuidSchema, OrganizationId, ProjectId, SessionId, Span
 import { getTraceAnalyticsUseCase, SpanRepository, TraceRepository } from "@domain/spans"
 import { createRoute, z } from "@hono/zod-openapi"
 import { AIEmbedLive, withAi } from "@platform/ai"
+import { enforceExportRequestRateLimit } from "@platform/cache-redis"
 import { MemoryRepositoryLive, SpanRepositoryLive, TraceRepositoryLive, withClickHouse } from "@platform/db-clickhouse"
 import {
   MembershipRepositoryLive,
@@ -39,7 +40,9 @@ import {
 import { TraceAnalyticsResponseSchema, toTraceAnalyticsResponse } from "../openapi/entities/trace-analytics.ts"
 import { Paginated, PaginatedQueryParamsSchema } from "../openapi/pagination.ts"
 import {
+  errorResponse,
   jsonBody,
+  jsonResponse,
   PROTECTED_SECURITY,
   ProjectParamsSchema,
   spanIdSchema,
@@ -558,7 +561,13 @@ const exportTraces = traceEndpoint({
       params: ProjectParamsSchema,
       body: jsonBody(ExportBodySchema),
     },
-    responses: typedResponses({ status: 202, schema: ExportResponseSchema, description: "Export enqueued" }),
+    responses: {
+      202: jsonResponse(ExportResponseSchema, "Export enqueued"),
+      400: errorResponse("Validation error"),
+      401: errorResponse("Unauthorized"),
+      404: errorResponse("Not found"),
+      429: errorResponse("Export rate limit exceeded"),
+    },
   }),
   access: "write",
   rateLimitTier: "ultra",
@@ -578,6 +587,17 @@ const exportTraces = traceEndpoint({
         })
       }
 
+      yield* Effect.tryPromise({
+        try: () =>
+          enforceExportRequestRateLimit({
+            redis: ctx.redis,
+            organizationId: ctx.organization.id as string,
+            projectId: project.id as string,
+            recipientEmail: body.recipient,
+          }),
+        catch: (cause) => cause,
+      })
+
       yield* ctx.queuePublisher.publish("exports", "generate", {
         kind: "traces",
         organizationId: ctx.organization.id as string,