@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/db/migrations/20260726_000001_cooldown_probe_provenance.js

@@ -0,0 +1,38 @@
+// Migration: cooldown provenance for probe-based early recovery
+// Created: 2026-07-26
+//
+// DOWN: reversible
+//
+// The cooldown-probe recovery job (services/cooldown-probe.ts) may only probe
+// cooldowns that are OUR OWN guesses. A cooldown backed by an authoritative
+// retry time (explicit Retry-After, daily-quota reset) is a fact the provider
+// told us; probing those wastes validate calls and can never legitimately clear
+// them early. `source` records that provenance at setCooldown time; `set_at_ms`
+// records when the bench started, so the prober can wait out a fraction of the
+// bench before the first probe instead of probing a seconds-old cooldown.
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, 'rate_limit_cooldowns', 'source')) {
+        // Pre-existing rows default to 'heuristic' (probe-eligible): before this
+        // migration every cooldown kind was mixed together, and a spurious probe on
+        // an old authoritative row costs one cheap validate call at worst.
+        db.prepare("ALTER TABLE rate_limit_cooldowns ADD COLUMN source TEXT NOT NULL DEFAULT 'heuristic'").run();
+    }
+    if (!hasColumn(db, 'rate_limit_cooldowns', 'set_at_ms')) {
+        // Nullable: rows written before this migration have an unknown start time,
+        // which the prober treats as "old enough to probe".
+        db.prepare('ALTER TABLE rate_limit_cooldowns ADD COLUMN set_at_ms INTEGER').run();
+    }
+}
+export function down(db) {
+    if (hasColumn(db, 'rate_limit_cooldowns', 'source')) {
+        db.prepare('ALTER TABLE rate_limit_cooldowns DROP COLUMN source').run();
+    }
+    if (hasColumn(db, 'rate_limit_cooldowns', 'set_at_ms')) {
+        db.prepare('ALTER TABLE rate_limit_cooldowns DROP COLUMN set_at_ms').run();
+    }
+}
+//# sourceMappingURL=20260726_000001_cooldown_probe_provenance.js.map

package/dist/db/migrations/20260726_000001_cooldown_probe_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000001_cooldown_probe_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000001_cooldown_probe_provenance.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAI1E,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,sBAAsB,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,yEAAyE;QACzE,4EAA4E;QAC5E,mEAAmE;QACnE,EAAE,CAAC,OAAO,CAAC,sFAAsF,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,sBAAsB,EAAE,WAAW,CAAC,EAAE,CAAC;QACxD,2EAA2E;QAC3E,oDAAoD;QACpD,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,EAAE,CAAC;IACpF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,IAAI,SAAS,CAAC,EAAE,EAAE,sBAAsB,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpD,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,CAAC,EAAE,EAAE,sBAAsB,EAAE,WAAW,CAAC,EAAE,CAAC;QACvD,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260726_000002_request_attempts.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260726_000002_request_attempts.d.ts.map

package/dist/db/migrations/20260726_000002_request_attempts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000002_request_attempts.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000002_request_attempts.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAiB/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAKjC"}

package/dist/db/migrations/20260726_000002_request_attempts.js

@@ -0,0 +1,43 @@
+// Migration: per-attempt routing traces (request_attempts)
+// Created: 2026-07-26
+//
+// DOWN: reversible
+//
+// When a request walks the failover ladder (groq 429 → google timeout →
+// cerebras ok), the `requests` table records isolated rows with no linkage,
+// ordering, or per-attempt timing — the journey that explains "why was this
+// slow/failed" is invisible. `request_attempts` stores one row per dispatched
+// attempt (including the successful final one), keyed to the TERMINAL
+// `requests` row of the ladder: provider, model, per-request key ordinal
+// (never the internal key id), outcome class, start offset from the ladder's
+// start, and duration.
+//
+// ON DELETE CASCADE ties child rows to the requests retention prune
+// (services/request-retention.ts): the connection opens with
+// PRAGMA foreign_keys = ON (db/index.ts), so pruning a parent removes its
+// attempts with no extra query and no unbounded growth.
+export function up(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS request_attempts (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      request_id INTEGER NOT NULL REFERENCES requests(id) ON DELETE CASCADE,
+      ordinal INTEGER NOT NULL,
+      platform TEXT NOT NULL,
+      model_id TEXT NOT NULL,
+      key_ordinal INTEGER NOT NULL,
+      outcome TEXT NOT NULL,
+      start_offset_ms INTEGER NOT NULL DEFAULT 0,
+      duration_ms INTEGER NOT NULL DEFAULT 0
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_request_attempts_request_id
+      ON request_attempts(request_id, ordinal);
+  `);
+}
+export function down(db) {
+    db.exec(`
+    DROP INDEX IF EXISTS idx_request_attempts_request_id;
+    DROP TABLE IF EXISTS request_attempts;
+  `);
+}
+//# sourceMappingURL=20260726_000002_request_attempts.js.map

package/dist/db/migrations/20260726_000002_request_attempts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000002_request_attempts.js","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000002_request_attempts.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,sEAAsE;AACtE,yEAAyE;AACzE,6EAA6E;AAC7E,uBAAuB;AACvB,EAAE;AACF,oEAAoE;AACpE,6DAA6D;AAC7D,0EAA0E;AAC1E,wDAAwD;AAIxD,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;GAeP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,IAAI,CAAC;;;GAGP,CAAC,CAAC;AACL,CAAC"}

package/dist/db/migrations/20260726_000003_model_source_provenance.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260726_000003_model_source_provenance.d.ts.map

package/dist/db/migrations/20260726_000003_model_source_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000003_model_source_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000003_model_source_provenance.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAgD/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAIjC"}

package/dist/db/migrations/20260726_000003_model_source_provenance.js

@@ -0,0 +1,80 @@
+// Migration: models.source provenance (catalog vs user) for the sync delete guard
+// Created: 2026-07-26
+//
+// DOWN: reversible
+//
+// catalog-sync prunes chat models that the published catalog no longer lists.
+// Before this column the prune had to GUESS which rows it owned from
+// platform/key_id/size_label heuristics, so a hand-added model on a native
+// platform (declarative config's `models:` entries, admin edits) could be
+// silently deleted or clobbered on the next sync as soon as its size_label
+// stopped matching the 'User'/'Custom' convention. `source` records who
+// created the row at insert time:
+//   'catalog' — catalog sync or the bundled baseline migrations
+//   'user'    — dashboard, custom endpoints, declarative config
+//
+// The column DEFAULT is 'catalog' on purpose: the baseline migration's
+// INSERT OR IGNORE re-seeds (run on every fresh migrations table) must stay
+// catalog-owned so reapplyCachedCatalog can prune them again after boot.
+// Every user-facing write path sets 'user' explicitly.
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, 'models', 'source')) {
+        db.prepare("ALTER TABLE models ADD COLUMN source TEXT NOT NULL DEFAULT 'catalog'").run();
+    }
+    // Backfill pre-existing rows, strongest signal first: everything the old
+    // prune guard already treated as user-owned is user-owned.
+    db.prepare(`
+    UPDATE models
+       SET source = 'user'
+     WHERE platform = 'custom'
+        OR key_id IS NOT NULL
+        OR size_label IN ('User', 'Custom')
+  `).run();
+    // Then consult the currently-applied catalog (the signed document cached by
+    // catalog-sync in settings.catalog_applied_json). A surviving row that the
+    // applied catalog does not list — and that the heuristics above did not
+    // claim — can only have been added locally: sync prunes catalog-owned
+    // leftovers on every apply, so catalog rows absent from the catalog do not
+    // linger. With no applied catalog (fresh install, never synced) every
+    // remaining row came from the bundled baseline, so the 'catalog' default
+    // stands.
+    try {
+        const setting = db
+            .prepare("SELECT value FROM settings WHERE key = 'catalog_applied_json'")
+            .get();
+        if (!setting)
+            return;
+        const parsed = JSON.parse(setting.value);
+        if (!parsed || !Array.isArray(parsed.models))
+            return;
+        const inCatalog = new Set();
+        for (const m of parsed.models) {
+            if (typeof m?.platform === 'string' && typeof m?.modelId === 'string') {
+                inCatalog.add(`${m.platform}:${m.modelId}`);
+            }
+        }
+        const rows = db
+            .prepare("SELECT id, platform, model_id FROM models WHERE source = 'catalog'")
+            .all();
+        const markUser = db.prepare("UPDATE models SET source = 'user' WHERE id = ?");
+        for (const row of rows) {
+            if (!inCatalog.has(`${row.platform}:${row.model_id}`))
+                markUser.run(row.id);
+        }
+    }
+    catch {
+        // A corrupt cached catalog must not block the migration; rows keep the
+        // heuristic-based backfill above, which errs on the side the old guard
+        // already enforced.
+    }
+}
+export function down(db) {
+    if (hasColumn(db, 'models', 'source')) {
+        db.prepare('ALTER TABLE models DROP COLUMN source').run();
+    }
+}
+//# sourceMappingURL=20260726_000003_model_source_provenance.js.map

package/dist/db/migrations/20260726_000003_model_source_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000003_model_source_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000003_model_source_provenance.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,8EAA8E;AAC9E,qEAAqE;AACrE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,wEAAwE;AACxE,kCAAkC;AAClC,gEAAgE;AAChE,gEAAgE;AAChE,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,uDAAuD;AAIvD,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvC,EAAE,CAAC,OAAO,CAAC,sEAAsE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IAED,yEAAyE;IACzE,2DAA2D;IAC3D,EAAE,CAAC,OAAO,CAAC;;;;;;GAMV,CAAC,CAAC,GAAG,EAAE,CAAC;IAET,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,UAAU;IACV,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE;aACf,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EAAmC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAyB,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO;QACrD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAqD,EAAE,CAAC;YAC7E,IAAI,OAAO,CAAC,EAAE,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,EAA0D,CAAC;QACjE,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC;QAC9E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,uEAAuE;QACvE,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,IAAI,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260726_000004_media_model_meta.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260726_000004_media_model_meta.d.ts.map

package/dist/db/migrations/20260726_000004_media_model_meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000004_media_model_meta.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000004_media_model_meta.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAI/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAIjC"}

package/dist/db/migrations/20260726_000004_media_model_meta.js

@@ -0,0 +1,34 @@
+// Migration: media_models.meta_json — per-model adapter metadata from the catalog
+// Created: 2026-07-26
+//
+// DOWN: reversible
+//
+// The transcription (STT) registry moves out of code and into the published
+// catalog's `transcriptionModels` array, landing in media_models with
+// modality='transcription'. Unlike image/TTS rows, transcription rows carry
+// per-model facts the adapters need at request time:
+//   - subtitleFormats: subtitle formats the provider produces natively (vtt)
+//   - maxBytes:        provider upload ceiling in bytes
+//   - requestStyle:    adapter request flavor where one platform hosts more
+//                      than one deployment style (cloudflare 'json' = base64
+//                      JSON body, 'binary' = raw bytes)
+// These ride in one nullable JSON column rather than three sparse columns:
+// they are opaque to SQL (never filtered or joined on), only parsed by the
+// media service, and future modalities can reuse the column without another
+// migration. NULL / absent keys mean "no special capability", which is the
+// correct default for every pre-existing image/audio row.
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, 'media_models', 'meta_json')) {
+        db.prepare('ALTER TABLE media_models ADD COLUMN meta_json TEXT').run();
+    }
+}
+export function down(db) {
+    if (hasColumn(db, 'media_models', 'meta_json')) {
+        db.prepare('ALTER TABLE media_models DROP COLUMN meta_json').run();
+    }
+}
+//# sourceMappingURL=20260726_000004_media_model_meta.js.map

package/dist/db/migrations/20260726_000004_media_model_meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000004_media_model_meta.js","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000004_media_model_meta.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,qDAAqD;AACrD,6EAA6E;AAC7E,wDAAwD;AACxD,4EAA4E;AAC5E,6EAA6E;AAC7E,wDAAwD;AACxD,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,0DAA0D;AAI1D,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAChD,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,EAAE,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,IAAI,SAAS,CAAC,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/C,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260726_000005_request_served_model.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260726_000005_request_served_model.d.ts.map

package/dist/db/migrations/20260726_000005_request_served_model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000005_request_served_model.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000005_request_served_model.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAI/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAIjC"}

package/dist/db/migrations/20260726_000005_request_served_model.js

@@ -0,0 +1,31 @@
+// Migration: requests.served_model — upstream-reported model when it drifts
+// Created: 2026-07-26
+//
+// DOWN: reversible
+//
+// The proxy overwrites the upstream `model` field with the routed id before
+// the caller sees it (the gateway contract), which also destroyed the only
+// evidence when a provider silently serves a DIFFERENT model than requested
+// (#534 — verified live: kilo-auto/small serving Gemma). The served-model
+// guard (lib/served-model.ts) now captures the raw upstream value before the
+// overwrite; this column persists it — but ONLY when it genuinely differs
+// from the routed model id after cosmetic normalization (case, provider
+// prefix, ":free"-style tier suffixes). NULL means "matched (or upstream
+// reported nothing usable)", which keeps the column empty in the healthy case
+// and makes drifted rows trivially queryable:
+//   SELECT ... FROM requests WHERE served_model IS NOT NULL;
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, 'requests', 'served_model')) {
+        db.prepare('ALTER TABLE requests ADD COLUMN served_model TEXT').run();
+    }
+}
+export function down(db) {
+    if (hasColumn(db, 'requests', 'served_model')) {
+        db.prepare('ALTER TABLE requests DROP COLUMN served_model').run();
+    }
+}
+//# sourceMappingURL=20260726_000005_request_served_model.js.map

package/dist/db/migrations/20260726_000005_request_served_model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000005_request_served_model.js","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000005_request_served_model.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,8CAA8C;AAC9C,6DAA6D;AAI7D,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/C,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,EAAE,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,IAAI,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QAC9C,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,EAAE,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260726_000006_attempt_error_summary.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260726_000006_attempt_error_summary.d.ts.map

package/dist/db/migrations/20260726_000006_attempt_error_summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000006_attempt_error_summary.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000006_attempt_error_summary.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAI/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAIjC"}

package/dist/db/migrations/20260726_000006_attempt_error_summary.js

@@ -0,0 +1,29 @@
+// Migration: request_attempts.error_summary — per-hop error text for the ladder
+// Created: 2026-07-26
+//
+// DOWN: reversible
+//
+// The failover-ladder drill-down (issue #335) renders WHY each hop failed, but
+// the `outcome` class alone loses the provider's actual words ("rate limit
+// reached for llama-3.3-70b, retry in 7m12s" collapses to 'rate_limited').
+// This nullable column stores a short, REDACTED summary of the per-attempt
+// error — sanitized through lib/error-redaction.ts (same rules as the error
+// text on the parent `requests` row: keys/tokens/URLs scrubbed) and capped at
+// 200 chars at write time (lib/fallback-loop.ts). NULL for successful hops
+// ('ok'/'committed') and for every pre-existing row, where the detail is
+// simply unknown.
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, 'request_attempts', 'error_summary')) {
+        db.prepare('ALTER TABLE request_attempts ADD COLUMN error_summary TEXT').run();
+    }
+}
+export function down(db) {
+    if (hasColumn(db, 'request_attempts', 'error_summary')) {
+        db.prepare('ALTER TABLE request_attempts DROP COLUMN error_summary').run();
+    }
+}
+//# sourceMappingURL=20260726_000006_attempt_error_summary.js.map

package/dist/db/migrations/20260726_000006_attempt_error_summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260726_000006_attempt_error_summary.js","sourceRoot":"","sources":["../../../src/db/migrations/20260726_000006_attempt_error_summary.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,kBAAkB;AAIlB,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,kBAAkB,EAAE,eAAe,CAAC,EAAE,CAAC;QACxD,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,EAAE,CAAC;IACjF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,IAAI,SAAS,CAAC,EAAE,EAAE,kBAAkB,EAAE,eAAe,CAAC,EAAE,CAAC;QACvD,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260727_000001_agent_compatibility.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260727_000001_agent_compatibility.d.ts.map

package/dist/db/migrations/20260727_000001_agent_compatibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260727_000001_agent_compatibility.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260727_000001_agent_compatibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CA4B/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAcjC"}

package/dist/db/migrations/20260727_000001_agent_compatibility.js

@@ -0,0 +1,41 @@
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some(entry => entry.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, 'requests', 'client_agent')) {
+        db.prepare('ALTER TABLE requests ADD COLUMN client_agent TEXT').run();
+    }
+    db.prepare('CREATE INDEX IF NOT EXISTS idx_requests_client_agent_created ON requests(client_agent, created_at)').run();
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS url_tokens (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      token_hash TEXT NOT NULL UNIQUE,
+      label TEXT NOT NULL DEFAULT '',
+      token_prefix TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      last_used_at TEXT,
+      revoked_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_url_tokens_active
+      ON url_tokens(token_hash, revoked_at);
+  `);
+    db.prepare("INSERT INTO settings (key, value) VALUES ('ollama_emulation', 'off') ON CONFLICT(key) DO NOTHING").run();
+    db.prepare("INSERT INTO settings (key, value) VALUES ('expose_cc_discovery_aliases', '0') ON CONFLICT(key) DO NOTHING").run();
+}
+export function down(db) {
+    db.prepare('DROP TABLE IF EXISTS url_tokens').run();
+    db.prepare('DROP INDEX IF EXISTS idx_requests_client_agent_created').run();
+    if (hasColumn(db, 'requests', 'client_agent')) {
+        db.prepare('ALTER TABLE requests DROP COLUMN client_agent').run();
+    }
+    db.prepare(`
+    DELETE FROM settings
+    WHERE key IN (
+      'ollama_emulation',
+      'expose_cc_discovery_aliases',
+      'gemini_model_map'
+    )
+  `).run();
+}
+//# sourceMappingURL=20260727_000001_agent_compatibility.js.map

package/dist/db/migrations/20260727_000001_agent_compatibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260727_000001_agent_compatibility.js","sourceRoot":"","sources":["../../../src/db/migrations/20260727_000001_agent_compatibility.ts"],"names":[],"mappings":"AAEA,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/C,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,EAAE,CAAC;IACxE,CAAC;IACD,EAAE,CAAC,OAAO,CACR,oGAAoG,CACrG,CAAC,GAAG,EAAE,CAAC;IAER,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;GAYP,CAAC,CAAC;IAEH,EAAE,CAAC,OAAO,CACR,kGAAkG,CACnG,CAAC,GAAG,EAAE,CAAC;IACR,EAAE,CAAC,OAAO,CACR,2GAA2G,CAC5G,CAAC,GAAG,EAAE,CAAC;AACV,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpD,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3E,IAAI,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QAC9C,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,EAAE,CAAC;IACpE,CAAC;IACD,EAAE,CAAC,OAAO,CAAC;;;;;;;GAOV,CAAC,CAAC,GAAG,EAAE,CAAC;AACX,CAAC"}

package/dist/db/migrations/20260728_000001_tombstone_provenance.d.ts

@@ -0,0 +1,12 @@
+import type { Db } from '../types.js';
+/**
+ * Tombstones used to mean exactly one thing: "the user deleted this catalog
+ * model, keep it deleted across syncs". Issue #634 adds a second, machine-made
+ * kind — "the provider retired this model upstream (410 / end of life)" — which
+ * disables the row instead of deleting it and carries the upstream wording so
+ * the dashboard can say why. `source` keeps the two apart ('user' is the
+ * backfill for every pre-existing row); `reason` is the redacted provider text.
+ */
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260728_000001_tombstone_provenance.d.ts.map

package/dist/db/migrations/20260728_000001_tombstone_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260728_000001_tombstone_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260728_000001_tombstone_provenance.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC;;;;;;;GAOG;AACH,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAO/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAUjC"}

package/dist/db/migrations/20260728_000001_tombstone_provenance.js

@@ -0,0 +1,37 @@
+// Migration: record WHY a catalog model was tombstoned
+// Created: 2026-07-28
+//
+// DOWN: reversible — drops the two added columns (every existing tombstone is
+// a user deletion, which is the default the columns backfill to).
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+/**
+ * Tombstones used to mean exactly one thing: "the user deleted this catalog
+ * model, keep it deleted across syncs". Issue #634 adds a second, machine-made
+ * kind — "the provider retired this model upstream (410 / end of life)" — which
+ * disables the row instead of deleting it and carries the upstream wording so
+ * the dashboard can say why. `source` keeps the two apart ('user' is the
+ * backfill for every pre-existing row); `reason` is the redacted provider text.
+ */
+export function up(db) {
+    if (!hasColumn(db, 'catalog_model_tombstones', 'source')) {
+        db.prepare("ALTER TABLE catalog_model_tombstones ADD COLUMN source TEXT NOT NULL DEFAULT 'user'").run();
+    }
+    if (!hasColumn(db, 'catalog_model_tombstones', 'reason')) {
+        db.prepare('ALTER TABLE catalog_model_tombstones ADD COLUMN reason TEXT').run();
+    }
+}
+export function down(db) {
+    // Upstream-retirement tombstones have no meaning without their source column,
+    // and leaving them behind would silently delete live models on the next sync.
+    db.prepare("DELETE FROM catalog_model_tombstones WHERE source = 'upstream_eol'").run();
+    if (hasColumn(db, 'catalog_model_tombstones', 'reason')) {
+        db.prepare('ALTER TABLE catalog_model_tombstones DROP COLUMN reason').run();
+    }
+    if (hasColumn(db, 'catalog_model_tombstones', 'source')) {
+        db.prepare('ALTER TABLE catalog_model_tombstones DROP COLUMN source').run();
+    }
+}
+//# sourceMappingURL=20260728_000001_tombstone_provenance.js.map

package/dist/db/migrations/20260728_000001_tombstone_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260728_000001_tombstone_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/20260728_000001_tombstone_provenance.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,kEAAkE;AAIlE,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,0BAA0B,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzD,EAAE,CAAC,OAAO,CAAC,qFAAqF,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,0BAA0B,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzD,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,8EAA8E;IAC9E,8EAA8E;IAC9E,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,EAAE,CAAC;IACvF,IAAI,SAAS,CAAC,EAAE,EAAE,0BAA0B,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxD,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,CAAC,EAAE,EAAE,0BAA0B,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxD,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260729_000001_custom_model_endpoint_identity.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260729_000001_custom_model_endpoint_identity.d.ts.map

package/dist/db/migrations/20260729_000001_custom_model_endpoint_identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260729_000001_custom_model_endpoint_identity.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260729_000001_custom_model_endpoint_identity.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AA0FtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CA0B/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAkBjC"}

package/dist/db/migrations/20260729_000001_custom_model_endpoint_identity.js

@@ -0,0 +1,145 @@
+// Migration: per-endpoint identity for custom relay models (#651)
+// Created: 2026-07-29
+//
+// DOWN: reversible (throws when duplicates exist — see below)
+//
+// `models` was unique on (platform, model_id). Every custom relay is stored
+// under platform = 'custom', so two relays offering the same model id could not
+// coexist: the second registration silently rebound the first one's row. One
+// enabled flag, one set of ranks, one stats bucket — turning the model off
+// because relay A was broken turned it off for relay B as well (#619).
+//
+// This adds `endpoint_scope` (the endpoint's normalized base_url, '' for every
+// catalog platform) and moves uniqueness to (platform, model_id,
+// endpoint_scope). Catalog rows all share the '' scope, so their constraint is
+// bit-for-bit the old one; only custom rows gain room for a sibling.
+//
+// SQLite cannot drop a table-level UNIQUE, so `models` is rebuilt. Two details
+// make that safe on a live DB:
+//   - row ids are copied verbatim, so fallback_config / profile_models /
+//     saved fusion configs keep pointing at the same models;
+//   - `PRAGMA foreign_keys` is a no-op inside a transaction and the migration
+//     runner wraps up() in one, so the child rows are parked in temp tables
+//     across the DROP and restored after the rename. Renaming `models` itself
+//     is avoided on purpose: with foreign keys on, a rename rewrites the
+//     REFERENCES clauses of every child table to the new name.
+//
+// Schema only — no catalog data.
+// The models table as of this migration, plus the new column. Written out in
+// full rather than derived, so the rebuilt schema is auditable here and
+// identical on every run.
+const MODELS_COLUMNS = `
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      platform TEXT NOT NULL,
+      model_id TEXT NOT NULL,
+      display_name TEXT NOT NULL,
+      intelligence_rank INTEGER NOT NULL,
+      speed_rank INTEGER NOT NULL,
+      size_label TEXT NOT NULL DEFAULT '',
+      rpm_limit INTEGER,
+      rpd_limit INTEGER,
+      tpm_limit INTEGER,
+      tpd_limit INTEGER,
+      monthly_token_budget TEXT NOT NULL DEFAULT '',
+      context_window INTEGER,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      supports_vision INTEGER NOT NULL DEFAULT 0,
+      key_id INTEGER,
+      supports_tools INTEGER NOT NULL DEFAULT 0,
+      paid_input_per_m REAL,
+      paid_output_per_m REAL,
+      source TEXT NOT NULL DEFAULT 'catalog'`;
+const CARRIED_COLUMNS = [
+    'id', 'platform', 'model_id', 'display_name', 'intelligence_rank', 'speed_rank',
+    'size_label', 'rpm_limit', 'rpd_limit', 'tpm_limit', 'tpd_limit',
+    'monthly_token_budget', 'context_window', 'enabled', 'supports_vision', 'key_id',
+    'supports_tools', 'paid_input_per_m', 'paid_output_per_m', 'source',
+].join(', ');
+// Tables whose rows must survive the DROP. Discovered from the schema rather
+// than hard-coded, so a table added later that references models is carried too.
+function childTablesOfModels(db) {
+    const tables = db.prepare(`
+    SELECT name FROM sqlite_master
+     WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name <> 'models'
+     ORDER BY name
+  `).all();
+    return tables
+        .filter(t => db.prepare(`PRAGMA foreign_key_list("${t.name}")`).all()
+        .some(fk => fk.table === 'models'))
+        .map(t => t.name);
+}
+function rebuildModels(db, extraColumns, copiedColumns, unique) {
+    const children = childTablesOfModels(db);
+    // AUTOINCREMENT's high-water mark. DROP TABLE takes the sqlite_sequence row
+    // with it, and copying rows back only pushes the counter to the highest id
+    // PRESENT — so a table whose top rows were deleted (catalog sync prunes
+    // models routinely) would start handing out ids it has already used. Stale
+    // fallback_config / profile_models rows pointing at a deleted model would
+    // then silently adopt an unrelated new one.
+    const seqRow = db.prepare("SELECT seq FROM sqlite_sequence WHERE name = 'models'")
+        .get();
+    for (const child of children) {
+        db.exec(`CREATE TEMP TABLE "_endpoint_identity_${child}" AS SELECT * FROM "${child}"`);
+        db.exec(`DELETE FROM "${child}"`);
+    }
+    db.exec(`
+    CREATE TABLE models_endpoint_identity (${MODELS_COLUMNS}${extraColumns},
+      ${unique}
+    );
+    INSERT INTO models_endpoint_identity (${copiedColumns})
+      SELECT ${copiedColumns} FROM models;
+    DROP TABLE models;
+    ALTER TABLE models_endpoint_identity RENAME TO models;
+  `);
+    if (seqRow) {
+        // sqlite_sequence has no unique index, so no upsert: update the row the
+        // rename carried over, or re-create it if the table was empty.
+        const restored = db.prepare("UPDATE sqlite_sequence SET seq = ? WHERE name = 'models' AND seq < ?")
+            .run(seqRow.seq, seqRow.seq);
+        if (restored.changes === 0
+            && !db.prepare("SELECT 1 FROM sqlite_sequence WHERE name = 'models'").get()) {
+            db.prepare("INSERT INTO sqlite_sequence (name, seq) VALUES ('models', ?)").run(seqRow.seq);
+        }
+    }
+    for (const child of children) {
+        db.exec(`INSERT INTO "${child}" SELECT * FROM "_endpoint_identity_${child}"`);
+        db.exec(`DROP TABLE "_endpoint_identity_${child}"`);
+    }
+}
+export function up(db) {
+    rebuildModels(db, `,\n      endpoint_scope TEXT NOT NULL DEFAULT ''`, CARRIED_COLUMNS, 'UNIQUE(platform, model_id, endpoint_scope)');
+    // Backfill: a custom row's scope is the base_url of the key it is bound to.
+    // Rows whose key is gone (or that predate per-endpoint binding) keep '' —
+    // exactly the identity they have today, so nothing about them changes.
+    const bound = db.prepare(`
+    SELECT m.id AS id, k.base_url AS base_url
+      FROM models m
+      JOIN api_keys k ON k.id = m.key_id AND k.platform = 'custom'
+     WHERE m.platform = 'custom' AND k.base_url IS NOT NULL AND k.base_url <> ''
+  `).all();
+    const setScope = db.prepare('UPDATE models SET endpoint_scope = ? WHERE id = ?');
+    for (const row of bound) {
+        setScope.run(row.base_url.trim().replace(/\/+$/, ''), row.id);
+    }
+    db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_models_endpoint_scope
+      ON models(endpoint_scope) WHERE endpoint_scope <> '';
+  `);
+}
+export function down(db) {
+    // Going back means two relays' copies of one model id would have to share a
+    // row again, and there is no honest way to pick which endpoint's settings
+    // survive. Refuse rather than silently discard one.
+    const collisions = db.prepare(`
+    SELECT platform, model_id, COUNT(*) AS n
+      FROM models GROUP BY platform, model_id HAVING COUNT(*) > 1
+  `).all();
+    if (collisions.length > 0) {
+        const sample = collisions.slice(0, 3).map(c => `${c.platform}/${c.model_id} (${c.n})`).join(', ');
+        throw new Error(`Cannot revert per-endpoint model identity: ${collisions.length} model id(s) exist on more than one endpoint — ${sample}. ` +
+            'Delete the duplicate rows (or the extra endpoint) first.');
+    }
+    db.exec('DROP INDEX IF EXISTS idx_models_endpoint_scope;');
+    rebuildModels(db, '', CARRIED_COLUMNS, 'UNIQUE(platform, model_id)');
+}
+//# sourceMappingURL=20260729_000001_custom_model_endpoint_identity.js.map

package/dist/db/migrations/20260729_000001_custom_model_endpoint_identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260729_000001_custom_model_endpoint_identity.js","sourceRoot":"","sources":["../../../src/db/migrations/20260729_000001_custom_model_endpoint_identity.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,sBAAsB;AACtB,EAAE;AACF,8DAA8D;AAC9D,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,iEAAiE;AACjE,+EAA+E;AAC/E,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,+BAA+B;AAC/B,yEAAyE;AACzE,6DAA6D;AAC7D,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,iCAAiC;AAIjC,6EAA6E;AAC7E,wEAAwE;AACxE,0BAA0B;AAC1B,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;6CAoBsB,CAAC;AAE9C,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY;IAC/E,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAChE,sBAAsB,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ;IAChF,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,QAAQ;CACpE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,6EAA6E;AAC7E,iFAAiF;AACjF,SAAS,mBAAmB,CAAC,EAAM;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;;GAIzB,CAAC,CAAC,GAAG,EAAwB,CAAC;IAC/B,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAA0B;SAC3F,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,EAAM,EAAE,YAAoB,EAAE,aAAqB,EAAE,MAAc;IACxF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACzC,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC;SAC/E,GAAG,EAAiC,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,EAAE,CAAC,IAAI,CAAC,yCAAyC,KAAK,uBAAuB,KAAK,GAAG,CAAC,CAAC;QACvF,EAAE,CAAC,IAAI,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,EAAE,CAAC,IAAI,CAAC;6CACmC,cAAc,GAAG,YAAY;QAClE,MAAM;;4CAE8B,aAAa;eAC1C,aAAa;;;GAGzB,CAAC,CAAC;IAEH,IAAI,MAAM,EAAE,CAAC;QACX,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,sEAAsE,CAAC;aAChG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC;eACrB,CAAC,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9E,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,EAAE,CAAC,IAAI,CAAC,gBAAgB,KAAK,uCAAuC,KAAK,GAAG,CAAC,CAAC;QAC9E,EAAE,CAAC,IAAI,CAAC,kCAAkC,KAAK,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,aAAa,CACX,EAAE,EACF,kDAAkD,EAClD,eAAe,EACf,4CAA4C,CAC7C,CAAC;IAEF,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;GAKxB,CAAC,CAAC,GAAG,EAAwC,CAAC;IAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IACjF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,EAAE,CAAC,IAAI,CAAC;;;GAGP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,4EAA4E;IAC5E,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAG7B,CAAC,CAAC,GAAG,EAAyD,CAAC;IAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClG,MAAM,IAAI,KAAK,CACb,8CAA8C,UAAU,CAAC,MAAM,kDAAkD,MAAM,IAAI;YAC3H,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;AACvE,CAAC"}