@bytesbrains/cruise-worker 0.0.0-stage → 0.12.0

package/migrations/0049_openai_and_gemini.sql

@@ -0,0 +1,239 @@
+-- OpenAI and Google AI Studio: the two largest labs Cruise has been one account
+-- away from since 0007 seeded their upstream rows.
+--
+-- [`upstreams.md`](../docs/upstreams.md) calls this tier 1 and says the whole of
+-- it is **a key, a migration and a conformance run**. This is the migration. It
+-- touches no request-path code, and that is the claim being tested: commit
+-- 68d55b1 added the keyed-host catalogue in a migration and a test, and if this
+-- one needs more than that, the "one URL shape" story in `src/chat.ts` is wrong
+-- somewhere.
+--
+-- Both upstreams are `kind = 'compat'` and enabled already (0007), so the
+-- gateway's unified `/compat/chat/completions` reaches them with no adapter and
+-- no branch. `PROVIDER_KEY_OPENAI` and `PROVIDER_KEY_GOOGLE_AI_STUDIO` are both
+-- declared in `src/env.d.ts`; neither is *set*, and until they are these rows are
+-- a catalogue of models this Worker cannot call. That is the intended order —
+-- inserting is not admitting (0025), and a secret is `wrangler secret put`
+-- rather than anything that belongs in a migration.
+--
+-- **Nothing here is routable and nothing joins a lane.** `measured_at` is NULL on
+-- every row and conformance is its only writer (#2, #10). 0029's rule holds: a
+-- model enters a lane once it is routable in production, which is a later act by
+-- a person looking at a measurement, not this file.
+--
+-- ## Where the numbers came from
+--
+-- Every figure below was fetched from the host's own page on **2026-09-02 UTC**,
+-- and the wall clock that wrote this read 18:02 on the 2nd — same date in both,
+-- so 0020 and 0021's trap does not apply here.
+--
+-- The model board (2026-08-27 pass) was read first and did its job exactly as
+-- #79 and #122 intend: it named where to look, and it was
+-- **already behind on Google** — it lists 3.7 Flash as the current Flash and
+-- Google now prints `gemini-3.8-flash` at the same rate. Every number here is
+-- quoted from the host, not the board, and the board's own OpenAI note ("long
+-- context threshold undocumented") is the thing this migration had to go and
+-- resolve rather than inherit.
+
+-- ── OpenAI ────────────────────────────────────────────────────────────────────
+-- Limits and the long-context rule: each model's own page,
+-- https://developers.openai.com/api/docs/models/gpt-5.6-<variant>.
+-- All three state a 1,050,000-token context window and a 128,000-token maximum
+-- output — a stated maximum, so `max_output` is a fetched number rather than one
+-- `checkLimits` derives from the window (0023).
+--
+-- The three 5.6 rows are the whole of what is added, and the exclusions are
+-- deliberate. The pricing page lists thirty-odd ids down to `babbage-002`; the
+-- older generations are a conformance bill every Thursday for models a
+-- price-first lane would never pick over `gpt-5.6-luna`, and the `-pro` variants
+-- print no cached-input rate at all. 0025's rule again: the current chat
+-- catalogue, minus what is retiring, unpriced, or not a chat model.
+
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  -- `gpt-5.6-sol` is also served under the bare alias `gpt-5.6`. The dated id is
+  -- pinned for 0020's reason: an alias moving is a rate change with no signal,
+  -- and sol and luna are twenty times apart on output.
+  ('openai/gpt-5.6-sol',   'openai', 'gpt-5.6-sol',   1050000, 128000,
+   'retained', 'https://developers.openai.com/api/docs/guides/your-data', '2026-09-02'),
+  ('openai/gpt-5.6-terra', 'openai', 'gpt-5.6-terra', 1050000, 128000,
+   'retained', 'https://developers.openai.com/api/docs/guides/your-data', '2026-09-02'),
+  ('openai/gpt-5.6-luna',  'openai', 'gpt-5.6-luna',  1050000, 128000,
+   'retained', 'https://developers.openai.com/api/docs/guides/your-data', '2026-09-02');
+
+-- `retained`, not `none` and not `trains`. The host says both halves plainly:
+-- *"data sent to the OpenAI API is not used to train or improve OpenAI models
+-- (unless you explicitly opt in to share data with us)"*, and abuse-monitoring
+-- logs are *"retained for up to 30 days"*. Retention with no training right is
+-- exactly what the middle value means, and it is unconditional on the API —
+-- there is no free tier here whose terms differ, which is the distinction that
+-- makes the Google rows below read differently.
+
+-- ── The 272K tier ─────────────────────────────────────────────────────────────
+-- The pricing page prints "Short context" and "Long context" columns and
+-- **never defines the boundary** — the board flagged the same gap. Each model
+-- page does state it: *"Prompts with >272K input tokens are priced at 2x input
+-- and 1.5x output for the full request."*
+--
+-- That sentence was checked against the printed table rather than trusted, and
+-- the two agree on all nine numbers: input and cached input double, output is
+-- 1.5x, for each of sol, terra and luna. A rule that reproduces the table is a
+-- rule that was read correctly.
+--
+-- **`prompt_tokens_from` is 272001, not 272000.** The column means "at least this
+-- long" (`src/pricing.ts`), the page says *">272K"*, so a prompt of exactly
+-- 272,000 tokens is billed at the base rate and the tier starts one token later.
+--
+-- One ambiguity left standing, because it cannot be resolved from the page: "272K"
+-- is read as 272,000 rather than 278,528. OpenAI writes the window as "1.05M" for
+-- a stated 1,050,000, which is decimal K throughout, so 272,000 is the reading the
+-- rest of the page supports. If it is wrong it is wrong by 6,528 tokens in the
+-- **over**-counting direction — requests in that band billed at 2x when the host
+-- charges 1x — which is the safe way round and visible in the ledger rather than
+-- silent. 0011 and 0020 were both errors the other way.
+
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-09-02 00:00:00', 'openai/gpt-5.6-sol',   '2026-09-02',      0, '',
+    4000000, 20000000,  400000, 'https://developers.openai.com/api/docs/pricing',
+    'First observation: OpenAI added to the catalogue (0049).'),
+  ('2026-09-02 00:00:00', 'openai/gpt-5.6-sol',   '2026-09-02', 272001, '',
+    8000000, 30000000,  800000, 'https://developers.openai.com/api/docs/models/gpt-5.6-sol',
+    'Long-context tier: >272K input tokens, 2x input and 1.5x output for the whole request.'),
+  ('2026-09-02 00:00:00', 'openai/gpt-5.6-terra', '2026-09-02',      0, '',
+    2000000, 12000000,  200000, 'https://developers.openai.com/api/docs/pricing',
+    'First observation: OpenAI added to the catalogue (0049).'),
+  ('2026-09-02 00:00:00', 'openai/gpt-5.6-terra', '2026-09-02', 272001, '',
+    4000000, 18000000,  400000, 'https://developers.openai.com/api/docs/models/gpt-5.6-terra',
+    'Long-context tier: >272K input tokens, 2x input and 1.5x output for the whole request.'),
+  ('2026-09-02 00:00:00', 'openai/gpt-5.6-luna',  '2026-09-02',      0, '',
+     200000,  1200000,   20000, 'https://developers.openai.com/api/docs/pricing',
+    'First observation: OpenAI added to the catalogue (0049).'),
+  ('2026-09-02 00:00:00', 'openai/gpt-5.6-luna',  '2026-09-02', 272001, '',
+     400000,  1800000,   40000, 'https://developers.openai.com/api/docs/models/gpt-5.6-luna',
+    'Long-context tier: >272K input tokens, 2x input and 1.5x output for the whole request.');
+
+-- `gpt-5.6-sol` carries a promotional note — *"GPT-5.6 Sol's promotional pricing
+-- is available at least through November 21, 2026"* — and **no successor rate is
+-- published**, so there is no dated row to write. This is 0040's situation
+-- exactly: a member that could win a lane today and stop on a known date with no
+-- announcement. The date is recorded here rather than in anyone's head, and the
+-- Thursday board pass is where it should be caught.
+
+-- ── Google AI Studio ──────────────────────────────────────────────────────────
+-- Prices: https://ai.google.dev/gemini-api/docs/pricing, standard paid tier.
+-- Limits: each model's page at
+-- https://ai.google.dev/gemini-api/docs/models/<id>, all four stating a
+-- 1,048,576-token input limit and a 65,536-token output limit.
+--
+-- Batch, Flex and Priority tiers are all priced separately on that page and none
+-- of them is recorded. Cruise sends standard requests, and a table holding four
+-- rates per model with nothing selecting between them is four chances to bill
+-- the wrong one.
+--
+-- Excluded, and why: **3.7 and 3.6 Flash** are priced identically to 3.8 Flash to
+-- the cent, so they would cost a weekly conformance run each to give a
+-- price-first lane a choice that is not a choice. **2.5 Flash, 2.5 Flash-Lite and
+-- 3.1 Flash-Lite** price audio input above text — $1.00 against $0.30 on 2.5
+-- Flash — and this ledger has one input rate per row. Recording the text rate
+-- under-counts an audio request, which is the direction 0011 exists to prevent;
+-- recording the audio rate misprices every text request, which is nearly all of
+-- them. Neither is a number worth writing, so those rows wait for the per-modality
+-- rate #5 already owns. The four below print a single input rate each.
+
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output) VALUES
+  ('google-ai-studio/gemini-3.8-flash',       'google-ai-studio', 'gemini-3.8-flash',       1048576, 65536),
+  ('google-ai-studio/gemini-3.5-flash',       'google-ai-studio', 'gemini-3.5-flash',       1048576, 65536),
+  ('google-ai-studio/gemini-3.5-flash-lite',  'google-ai-studio', 'gemini-3.5-flash-lite',  1048576, 65536),
+  -- Preview on the host's own label, like `mistral/zai-glm-5-2` in 0025. Kept
+  -- because it is the only Gemini Pro-class row that prices cleanly, and a
+  -- catalogue of Flash models gives `bb/deep-reasoning` nothing.
+  ('google-ai-studio/gemini-3.1-pro-preview', 'google-ai-studio', 'gemini-3.1-pro-preview', 1048576, 65536);
+
+-- **`data_retention` is NULL on all four, and that is the answer rather than a
+-- gap.** This is the one place where Google differs from every host in this
+-- catalogue: the terms are a property of the *account tier*, not the model.
+--
+--   unpaid   "Google uses the content you submit to the Services and any
+--            generated responses to provide, improve, and develop Google
+--            products and services", and human reviewers may read it  →  trains
+--   paid     "Google doesn't use your prompts or responses to improve our
+--            products"                                                →  retained
+--
+-- (https://ai.google.dev/gemini-api/terms, read 2026-09-02.)
+--
+-- The tier is decided by the key, and no key is set. Writing `retained` would be
+-- guessing that whoever creates the account bills it, and the failure is silent
+-- and severe: 0030's `no-training-on-data` requirement would pass, and a lane
+-- would route end-user content to a free-tier endpoint that trains on it. That is
+-- precisely the exposure `auto-mode.md` names when it says a router optimising on
+-- price will otherwise send content to whoever is cheapest that week — free being
+-- the cheapest there is.
+--
+-- NULL fails closed **where anything asks**: `no-training-on-data` is an
+-- allow-list of `none` and `retained` (`src/lanes.ts`), so a lane carrying that
+-- requirement refuses these rows. Say plainly what that does not cover — **a
+-- lane that does not carry the requirement is not protected by it**, and once
+-- conformance measures these models a price-first allocation will pick a Gemini
+-- row on cost alone without any privacy gate having been consulted.
+--
+-- That is not a hazard this migration introduces. `data_retention` has been a
+-- column since 0007 and **no migration has ever written it** — all 38 rows
+-- before these are NULL, so 0030 built a hard gate and nothing has ever put
+-- data behind it. The same shape as `max_output` in 0023: a live gate with no
+-- data, which is why the three OpenAI rows above are the first populated values
+-- in the table's history. #195 owns closing it properly.
+--
+-- **The step that resolves it here is not a migration.** Whoever sets
+-- `PROVIDER_KEY_GOOGLE_AI_STUDIO` reads which tier that key bills on and writes
+-- the value they read, with its date — the same act as fetching a price, and it
+-- cannot be done before the account exists.
+
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  -- Gemini 3.8 Flash, both rates. The page states the successor itself —
+  -- "$0.75 through December 31, 2026. $1.50 starting January 1, 2027" — so
+  -- unlike sol's promotion above there is a published number and a published
+  -- date, and `effective_from` is the mechanism that already exists for it:
+  -- `resolvePrice` takes max(effective_from) <= the request's day, so the rise
+  -- happens on its own at midnight UTC on 2027-01-01 with nobody remembering.
+  --
+  -- This is worth doing rather than deferring. 0040 recorded a promotion ending
+  -- on a known date and had no rate to write; here the rate exists, and leaving
+  -- it out would mean lanes ranking Gemini at half price for the whole of
+  -- January until somebody noticed the invoice.
+  ('2026-09-02 00:00:00', 'google-ai-studio/gemini-3.8-flash',      '2026-09-02', 0, '',
+    750000,  3750000,  75000, 'https://ai.google.dev/gemini-api/docs/pricing',
+   'First observation: Google AI Studio added to the catalogue (0049). Introductory rate, stated to hold through 2026-12-31.'),
+  ('2026-09-02 00:00:00', 'google-ai-studio/gemini-3.8-flash',      '2027-01-01', 0, '',
+   1500000,  7500000, 150000, 'https://ai.google.dev/gemini-api/docs/pricing',
+   'The post-introductory rate, printed on the same page as the introductory one and dated by it. Not a forecast.'),
+
+  ('2026-09-02 00:00:00', 'google-ai-studio/gemini-3.5-flash',      '2026-09-02', 0, '',
+   1500000,  9000000, 150000, 'https://ai.google.dev/gemini-api/docs/pricing',
+   'First observation: Google AI Studio added to the catalogue (0049).'),
+  ('2026-09-02 00:00:00', 'google-ai-studio/gemini-3.5-flash-lite', '2026-09-02', 0, '',
+    300000,  2500000,  30000, 'https://ai.google.dev/gemini-api/docs/pricing',
+   'First observation: Google AI Studio added to the catalogue (0049).'),
+
+  -- The 200K tier 0024 anticipated by name, now that the model exists here.
+  --
+  -- 0024's comment says "at or above 200,000"; the page says "prompts <= 200k
+  -- tokens" for the base rate and "> 200k" for the higher, so the boundary token
+  -- itself is billed at the base rate and the tier starts at 200,001 — the same
+  -- off-by-one reasoning as OpenAI's 272001 above, from the same column
+  -- semantics.
+  --
+  -- Input doubles and output is 1.5x, which is the same shape as OpenAI's rule
+  -- and not the same rule: Google prints the numbers and states no multiplier,
+  -- so these are quoted, not derived.
+  ('2026-09-02 00:00:00', 'google-ai-studio/gemini-3.1-pro-preview', '2026-09-02',      0, '',
+   2000000, 12000000, 200000, 'https://ai.google.dev/gemini-api/docs/pricing',
+   'First observation: Google AI Studio added to the catalogue (0049).'),
+  ('2026-09-02 00:00:00', 'google-ai-studio/gemini-3.1-pro-preview', '2026-09-02', 200001, '',
+   4000000, 18000000, 400000, 'https://ai.google.dev/gemini-api/docs/pricing',
+   'Long-prompt tier: the page prices prompts above 200k tokens separately.');

package/migrations/0050_meta_direct_upstream.sql

@@ -0,0 +1,127 @@
+-- Meta, and the first upstream Cruise reaches without Cloudflare in the path (#194).
+--
+-- Every upstream so far is one AI Gateway carries, so `src/chat.ts` has built
+-- exactly one URL since v0 and needed no branch. Meta is not on the gateway —
+-- not on the unified `/compat` endpoint, and not among the 24 providers it
+-- supports in any form, checked 2026-09-02. There is no BYO-upstream option to
+-- fall back on.
+--
+-- **So this is the migration that stops "one URL shape" from being true**, and
+-- it is worth being clear that is a real cost being paid for a reason rather
+-- than a tidy-up. The reason is in [`upstreams.md`](../docs/upstreams.md): we
+-- buy from the lab that made the model, because 0033's markup is defensible
+-- only while our cost basis is that lab's list price. OpenRouter carries these
+-- models and is refused on exactly that ground — Meta sells to us directly, so
+-- the reseller exception does not apply at any markup.
+--
+-- ## Two facts, two columns — and no rebuild
+--
+-- The first shape of this migration added a third `kind`, `direct`, beside
+-- `compat` and `provider`. It was wrong twice over.
+--
+-- **It could not be applied.** Widening a CHECK means rebuilding the table, and
+-- **D1 enforces foreign keys where SQLite does not** — so `DROP TABLE upstreams`
+-- fails outright while `models.upstream_id` references it, and
+-- `PRAGMA defer_foreign_keys` does not survive, because each statement lands in
+-- its own transaction. 0028's answer is to rebuild the child too; here that
+-- child is `models`, which `lane_members` and `fallback_chains` both reference,
+-- so a constraint change would have rewritten three tables. `npm test` caught
+-- all of this, which is the argument for running the real migrations.
+--
+-- **And it was the wrong model anyway.** There are genuinely two independent
+-- facts here, not one:
+--
+--   kind = 'provider'   this upstream is not on the gateway's unified endpoint
+--   base_url IS NOT NULL   ...and we have built our own path to it
+--
+-- Those come apart, which is exactly why one column cannot hold both.
+-- OpenRouter is `provider` with **no** base URL: off the unified endpoint and
+-- with no path of any kind, which is #15 and is still refused. Meta is
+-- `provider` **with** one: off the unified endpoint, and reached by the Worker
+-- itself. A single `kind` would have had to call those the same thing or
+-- invent a value that hid the difference.
+--
+-- So `kind` keeps the meaning it has had since 0007 and gains no value, and the
+-- new column answers the new question. `ALTER TABLE ... ADD COLUMN` is a
+-- one-line change that no foreign key notices.
+
+ALTER TABLE upstreams ADD COLUMN base_url TEXT;
+
+-- Where the Worker sends the request, for an upstream we reach ourselves. No
+-- trailing slash; `src/chat.ts` appends `/chat/completions`.
+--
+-- In the table rather than in `env` because it is a property of the upstream,
+-- like its id, and because the e2e stack can then point one at an emulator by
+-- seeding a row rather than adding a test seam to production config.
+INSERT INTO upstreams (id, name, kind, base_url) VALUES
+  ('meta', 'Meta', 'provider', 'https://api.meta.ai/v1');
+
+-- ── The models ────────────────────────────────────────────────────────────────
+-- Prices and terms: https://dev.meta.ai/docs/pricing-rate-limits, fetched
+-- 2026-09-02 UTC. Limits: https://dev.meta.ai/docs/models, same date.
+--
+-- **The dates are UTC and the wall clock that wrote this read 00:28 on the 3rd**,
+-- in IST. Every date here is the 2nd, because that is the day in UTC and
+-- `pricesInForce` resolves against `date('now')`, which is UTC. Dated the 3rd,
+-- these rows would have been priced in the future and every Meta request would
+-- have read as unpriced — charged its whole reservation — for five and a half
+-- hours. That is 0020 and 0021 exactly, and it was caught here by the
+-- catalogue test rather than by a bill.
+--
+-- Both state a 1,048,576-token context window. **Neither states a maximum
+-- output**, so `max_output` is NULL and `checkLimits` derives a bound from the
+-- window (0023) — the rule from 0011 and 0020 holds, never write a number you
+-- did not fetch.
+--
+-- No `prompt_tokens_from` rows and no `peak_utc` rows, and that is quoted
+-- rather than assumed: *"There is no long-context premium: you pay the same
+-- rate whether your context window is mostly empty or almost full."* Simpler
+-- than 0049's OpenAI rows, which needed a 272K tier.
+--
+-- `muse-image-1.0` and `muse-voice-transcribe-1.0` are not chat models.
+-- `muse-glimmer` is open weights and self-hosted, so it is not something this
+-- key reaches; if Cloudflare ever serves it on Workers AI it arrives that way
+-- and needs no key at all (#188).
+
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  ('meta/muse-spark-1.1', 'meta', 'muse-spark-1.1', 1048576, NULL,
+   'retained', 'https://dev.meta.ai/docs/pricing-rate-limits', '2026-09-02'),
+  ('meta/muse-spark-1.2', 'meta', 'muse-spark-1.2', 1048576, NULL,
+   'retained', 'https://dev.meta.ai/docs/pricing-rate-limits', '2026-09-02');
+
+-- `retained` on the host's own words: on the standard tier *"your prompts and
+-- completions are not used to train Meta models"*. Only the second value these
+-- columns have ever held — 0049's three OpenAI rows were the first, and every
+-- other row in the catalogue is still NULL (#195).
+
+-- ## `muse-spark-1.2-contributor` is deliberately not here
+--
+-- It is the same model as `muse-spark-1.2` at **one twelfth the input price and
+-- one twenty-first the output price** — $0.10 against $1.25, $0.20 against
+-- $4.25 — and Meta is explicit about what buys the discount: *"permission to
+-- use your prompts and completions to train future Meta models"*.
+--
+-- That makes it the cheapest row in this entire catalogue by a wide margin, and
+-- allocation is price-first, so **it would win every request in any lane it
+-- joined**. `no-training-on-data` would refuse it — but #195 is the finding
+-- that this gate only fires for a lane that carries the requirement, and most
+-- do not. Inserting it today would arm exactly the failure `auto-mode.md`
+-- describes: end-user content routed to a training endpoint because it was
+-- cheapest, with no gate consulted.
+--
+-- So it waits for #195, which is a decision about allocation rather than a row.
+-- Recorded here rather than dropped silently, because the next person reading
+-- Meta's price list will notice the cheap row is missing and should find out
+-- why before adding it.
+
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-09-02 00:00:00', 'meta/muse-spark-1.1', '2026-09-02', 0, '',
+   1250000, 4250000, 150000, 'https://dev.meta.ai/docs/pricing-rate-limits',
+   'First observation: Meta added to the catalogue (0050).'),
+  ('2026-09-02 00:00:00', 'meta/muse-spark-1.2', '2026-09-02', 0, '',
+   1250000, 4250000, 150000, 'https://dev.meta.ai/docs/pricing-rate-limits',
+   'First observation: Meta added to the catalogue (0050).');

package/migrations/0051_upstream_credential_and_operator.sql

@@ -0,0 +1,74 @@
+-- What an upstream needs from us, and whose business that is (#196).
+--
+-- An upstream we hold no key for and an upstream nobody has measured look
+-- identical from the API: both report `blocked_by: unmeasured` on
+-- `/admin/models`, which is true of the models and is not the cause. So the
+-- operator's question — *which labs can we actually serve today?* — is
+-- answerable only by running `wrangler secret list` against production, or by
+-- trusting the table in `docs/upstreams.md`, which is a hand-maintained list of
+-- exactly the kind this repo's own rule says to generate rather than edit.
+--
+-- `GET /admin/upstreams` answers it. The credential half needs nothing here:
+-- `providerKeyFor` derives `PROVIDER_KEY_<UPSTREAM>` from the upstream id, so
+-- presence is a binding lookup on `env` and stays in step with the request path
+-- by construction. The two facts it *cannot* derive are below.
+--
+-- ## `credential_required` — an absent key is not always a problem
+--
+-- Workers AI bills to the Cloudflare account and needs no key of ours, so the
+-- absence of `PROVIDER_KEY_WORKERS_AI` is correct rather than a blocker.
+-- Reported as `missing` it would sit on the same line as OpenAI-without-a-key
+-- and read as an outage; folded into `held` it would claim a credential that
+-- does not exist. Neither is true, which is why the state the route publishes
+-- is three-valued — and this column is what makes the third value answerable.
+--
+-- A column rather than `if (id === 'workers-ai')` in the handler, for the
+-- reason `tenants-validate.ts` already gives about upstream ids: a list written
+-- in code goes stale the first time the table changes, and the next
+-- account-billed upstream — a Cloudflare-hosted open-weights model is the
+-- obvious candidate (#188) — should arrive as a row and nothing else.
+--
+-- Default 1, so an upstream added without anyone thinking about this reads
+-- `missing` until someone says otherwise. That is the fail-closed direction: an
+-- upstream wrongly reported as needing a key gets investigated, one wrongly
+-- reported as needing none does not.
+--
+-- ## `operator` — a role is not a tenant
+--
+-- Which labs BytesBrains holds accounts with is commercial posture — which
+-- suppliers we buy from, and which we are mid-negotiation on — and #196 is
+-- explicit that it must not reach a customer. A role check alone does not
+-- achieve that: a customer who is `owner` of their own workspace passes it, and
+-- the issue's own acceptance asks for exactly that caller to be refused.
+--
+-- Every other `/admin` route is scoped to the caller's tenant and answers about
+-- that tenant's own rows. This one answers about the platform, so the scope it
+-- needs is *the tenant that operates the platform*, and no column said which
+-- that is. `billable` is the nearest thing and means something else entirely
+-- (0031): today no tenant is billable, so reading "not billed" as "runs the
+-- platform" would hand this to the first customer provisioned.
+--
+-- **Not a fourth role.** `tiers.ts` argues against inventing a platform-operator
+-- role to carry a single caller and that argument stands: this is a property of
+-- a tenant, read in the query that already reads `billable`, and it grants
+-- nothing by itself — the existing owner/admin check still applies on top of it.
+--
+-- Default 0, so a provisioned tenant is never the operator by accident, and a
+-- database with no operator row refuses everyone rather than admitting anyone.
+
+ALTER TABLE upstreams ADD COLUMN credential_required INTEGER NOT NULL DEFAULT 1
+  CHECK (credential_required IN (0, 1));
+
+-- The only upstream in the table that is billed to the account rather than to a
+-- key. Every other row keeps the default, including the three that have a key
+-- today and the two that do not — that is the state the route exists to report,
+-- not something to encode here.
+UPDATE upstreams SET credential_required = 0 WHERE id = 'workers-ai';
+
+ALTER TABLE tenants ADD COLUMN operator INTEGER NOT NULL DEFAULT 0
+  CHECK (operator IN (0, 1));
+
+-- Ours, seeded by 0002. Written as an id because there is exactly one and it is
+-- already an id in that migration; if a second environment ever operates its own
+-- Cruise, it sets its own row and this one changes nothing for it.
+UPDATE tenants SET operator = 1 WHERE id = 'bytesbrains';

package/migrations/0052_muse_spark_1_3.sql

@@ -0,0 +1,71 @@
+-- Muse Spark 1.3, which the catalogue was already a generation behind on.
+--
+-- Numbered 0052 rather than 0051: PR #198 took 0051 for the upstream-credential
+-- columns while this was being written. Two migrations cannot share a number —
+-- the runner applies them in filename order and D1 records what it applied, so a
+-- duplicate is an environment that silently skips one.
+--
+-- 0050 added 1.1 and 1.2 from Meta's models page, read 2026-09-02. **Their API
+-- serves 1.3 and the page did not mention it** — found by asking
+-- `GET https://api.meta.ai/v1/models` with our own key once the secret was set,
+-- which returned six ids where the documentation described five:
+--
+--   muse-spark-1.3   muse-spark-1.3-contributor
+--   muse-spark-1.2   muse-spark-1.2-contributor
+--   muse-spark-1.1   muse-voice-transcribe-1.0
+--
+-- That is worth more than one row. **The host's own list endpoint is ahead of
+-- the host's own documentation**, so a catalogue built by reading docs is behind
+-- by however long a lab takes to write them up. `docs/upstreams.md` says a model
+-- arrives by being fetched and measured, and this is a third source that belongs
+-- in that loop: the API says what exists, the pricing page says what it costs,
+-- and conformance says what it does.
+--
+-- The same call also showed `muse-image-1.0` **documented but not served to this
+-- key** — an entitlement, not a routing fault, and the shape 0046 taught us to
+-- name rather than debug. It is not a chat model, so nothing here changes.
+--
+-- Prices: https://dev.meta.ai/docs/pricing-rate-limits, fetched 2026-09-02 UTC.
+-- 1.3 is priced identically to 1.2 — $1.25 in, $0.15 cached, $4.25 out — with no
+-- prompt-size tier, no time-of-day tier and no promotional end date. Limits:
+-- https://dev.meta.ai/docs/models, same date: a 1,048,576-token window, and **no
+-- maximum output stated**, so `max_output` stays NULL and `checkLimits` derives a
+-- bound from the window (0023).
+--
+-- Identical pricing to 1.2 is the reason to add it rather than a reason not to.
+-- 0050 excluded Gemini 3.7 and 3.6 Flash for being priced the same as 3.8, but
+-- those were *older* siblings of a row already held. This is the newer one, and
+-- a price-first lane holding only the older generation at the same money is
+-- leaving quality on the table for nothing. Both stay: 1.2 is the measured
+-- fallback while 1.3 is unproven, which is what a fallback chain is for.
+
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  ('meta/muse-spark-1.3', 'meta', 'muse-spark-1.3', 1048576, NULL,
+   'retained', 'https://dev.meta.ai/docs/pricing-rate-limits', '2026-09-02');
+
+-- `retained` on the standard tier's own words, unchanged from 0050: *"your
+-- prompts and completions are not used to train Meta models"*.
+--
+-- **`muse-spark-1.3-contributor` is left out for the same reason as 1.2's.** The
+-- API confirms it is live and available to this key, and it is the same model at
+-- $0.10 in / $0.20 out against $1.25 / $4.25 — bought with permission to train
+-- on prompts. Allocation is price-first, so it would win every request in any
+-- lane it joined, and #195 is the finding that `no-training-on-data` only fires
+-- for a lane that carries the requirement. Two cheap training-tier rows now wait
+-- on that decision rather than one.
+--
+-- One caveat recorded because it is a capability claim we are not measuring:
+-- Meta's page says audio understanding in 1.3 "is currently not fully supported,
+-- and response quality for requests including audio content may be degraded".
+-- Conformance measures vision, tools, JSON schema and streaming, and has no
+-- audio check — so this is a known gap in what the flags can tell you, not
+-- something the routing table will catch.
+
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-09-02 00:00:00', 'meta/muse-spark-1.3', '2026-09-02', 0, '',
+   1250000, 4250000, 150000, 'https://dev.meta.ai/docs/pricing-rate-limits',
+   'First observation: muse-spark-1.3, found on Meta''s /v1/models before it reached their docs (0052).');