@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/db/migrations/20260802_000001_custom_endpoint_host_labels.d.ts

@@ -0,0 +1,6 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+/** Put back the generic label on every custom endpoint that currently carries
+ *  exactly its own host, which is the set `up` could have produced. */
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260802_000001_custom_endpoint_host_labels.d.ts.map

package/dist/db/migrations/20260802_000001_custom_endpoint_host_labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260802_000001_custom_endpoint_host_labels.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260802_000001_custom_endpoint_host_labels.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAgBtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAS/B;AAED;uEACuE;AACvE,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAQjC"}

package/dist/db/migrations/20260802_000001_custom_endpoint_host_labels.js

@@ -0,0 +1,52 @@
+// Migration: rename legacy 'Custom' endpoint labels to their host (#704)
+// Created: 2026-08-02
+//
+// DOWN: reversible (see below)
+//
+// Custom endpoints registered before #705 all took the literal label 'Custom',
+// so every panel that identifies a key by its label alone — analytics,
+// cooldowns, quota signals, the models list — showed a column of identical
+// rows once more than one relay was configured. New endpoints now default to
+// the endpoint's host, but that only helped installs starting from scratch:
+// an upgrade kept the indistinguishable labels already on record.
+//
+// Only rows still holding the exact default are touched. A label the operator
+// typed (including one they deliberately typed as 'Custom' — indistinguishable
+// from the default, and renaming it to the host is the same outcome they would
+// get by re-adding the endpoint) is the only ambiguity; anything else they
+// named stays untouched.
+//
+// Data only — no schema change.
+/** The host of an endpoint URL, or null when there is nothing usable to
+ *  rename to. Mirrors defaultCustomEndpointLabel in services/custom-endpoint,
+ *  inlined so this migration keeps working if that helper later changes. */
+function hostOf(baseUrl) {
+    if (!baseUrl)
+        return null;
+    try {
+        return new URL(baseUrl).host || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function up(db) {
+    const rows = db.prepare("SELECT id, base_url FROM api_keys WHERE platform = 'custom' AND label = 'Custom'").all();
+    const update = db.prepare('UPDATE api_keys SET label = ? WHERE id = ?');
+    for (const row of rows) {
+        const host = hostOf(row.base_url);
+        if (host)
+            update.run(host, row.id);
+    }
+}
+/** Put back the generic label on every custom endpoint that currently carries
+ *  exactly its own host, which is the set `up` could have produced. */
+export function down(db) {
+    const rows = db.prepare("SELECT id, label, base_url FROM api_keys WHERE platform = 'custom'").all();
+    const update = db.prepare("UPDATE api_keys SET label = 'Custom' WHERE id = ?");
+    for (const row of rows) {
+        if (row.label && row.label === hostOf(row.base_url))
+            update.run(row.id);
+    }
+}
+//# sourceMappingURL=20260802_000001_custom_endpoint_host_labels.js.map

package/dist/db/migrations/20260802_000001_custom_endpoint_host_labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260802_000001_custom_endpoint_host_labels.js","sourceRoot":"","sources":["../../../src/db/migrations/20260802_000001_custom_endpoint_host_labels.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sBAAsB;AACtB,EAAE;AACF,+BAA+B;AAC/B,EAAE;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,yBAAyB;AACzB,EAAE;AACF,gCAAgC;AAMhC;;4EAE4E;AAC5E,SAAS,MAAM,CAAC,OAAsB;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,kFAAkF,CACnF,CAAC,GAAG,EAAc,CAAC;IACpB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,oEAAoE,CACrE,CAAC,GAAG,EAA2C,CAAC;IACjD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC/E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260805_000001_key_model_scope.d.ts

@@ -0,0 +1,6 @@
+import type { Db } from '../types.js';
+/** Optional per-key model scope (#657): a JSON array of model_id strings the
+ *  key may serve. NULL = the key serves every model of its platform. */
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260805_000001_key_model_scope.d.ts.map

package/dist/db/migrations/20260805_000001_key_model_scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260805_000001_key_model_scope.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260805_000001_key_model_scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC;wEACwE;AACxE,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAI/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAIjC"}

package/dist/db/migrations/20260805_000001_key_model_scope.js

@@ -0,0 +1,17 @@
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+/** Optional per-key model scope (#657): a JSON array of model_id strings the
+ *  key may serve. NULL = the key serves every model of its platform. */
+export function up(db) {
+    if (!hasColumn(db, 'api_keys', 'model_scope_json')) {
+        db.prepare('ALTER TABLE api_keys ADD COLUMN model_scope_json TEXT').run();
+    }
+}
+export function down(db) {
+    if (hasColumn(db, 'api_keys', 'model_scope_json')) {
+        db.prepare('ALTER TABLE api_keys DROP COLUMN model_scope_json').run();
+    }
+}
+//# sourceMappingURL=20260805_000001_key_model_scope.js.map

package/dist/db/migrations/20260805_000001_key_model_scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260805_000001_key_model_scope.js","sourceRoot":"","sources":["../../../src/db/migrations/20260805_000001_key_model_scope.ts"],"names":[],"mappings":"AAEA,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,IAAI,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAClD,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,EAAE,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260805_000002_client_profiles.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260805_000002_client_profiles.d.ts.map

package/dist/db/migrations/20260805_000002_client_profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260805_000002_client_profiles.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260805_000002_client_profiles.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAe/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAEjC"}

package/dist/db/migrations/20260805_000002_client_profiles.js

@@ -0,0 +1,33 @@
+// Migration: per-client API keys with server-enforced system prompts (#411)
+// Created: 2026-08-05
+//
+// DOWN: reversible
+//
+// One row per downstream client/product. Auth lookups go through token_hash
+// (SHA-256 of the full `sk-cp-...` key) so the plaintext credential is never
+// queried; encrypted_key/iv/auth_tag hold an AES-256-GCM copy (same crypto
+// layer as api_keys — lib/crypto.ts) used only to render the masked key in
+// the dashboard. system_prompt is the prompt the proxy prepends server-side
+// for requests authenticated with this profile's key; NULL/empty means the
+// key authenticates without injecting anything. Disabled rows are rejected
+// at auth exactly like unknown keys.
+export function up(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS client_profiles (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      name TEXT NOT NULL,
+      token_hash TEXT NOT NULL UNIQUE,
+      encrypted_key TEXT NOT NULL,
+      iv TEXT NOT NULL,
+      auth_tag TEXT NOT NULL,
+      system_prompt TEXT,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `);
+}
+export function down(db) {
+    db.exec('DROP TABLE IF EXISTS client_profiles;');
+}
+//# sourceMappingURL=20260805_000002_client_profiles.js.map

package/dist/db/migrations/20260805_000002_client_profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260805_000002_client_profiles.js","sourceRoot":"","sources":["../../../src/db/migrations/20260805_000002_client_profiles.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,qCAAqC;AAIrC,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;GAaP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;AACnD,CAAC"}

package/dist/db/migrations/20260810_000001_api_key_proxy.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260810_000001_api_key_proxy.d.ts.map

package/dist/db/migrations/20260810_000001_api_key_proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260810_000001_api_key_proxy.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260810_000001_api_key_proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAsBtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAM/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAMjC"}

package/dist/db/migrations/20260810_000001_api_key_proxy.js

@@ -0,0 +1,33 @@
+/**
+ * Per-key proxy override (#590): a key can carry its own proxy URL
+ * (http/https/socks4/socks4a/socks5/socks5h) so the same provider can be
+ * reached from different exit IPs while the global proxy stays the default.
+ *
+ * The URL is stored ENCRYPTED, not as plain text: a proxy URL routinely
+ * embeds `user:pass@` credentials, which are exactly as sensitive as the API
+ * key sitting in the same row — storing them in the clear next to an
+ * AES-encrypted key would hand anyone who copied the DB a working set of
+ * proxy credentials. So it mirrors the key's own storage: ciphertext + iv +
+ * auth tag from lib/crypto.ts (AES-256-GCM). All three columns NULL = no
+ * per-key override (the API surface spells that as '').
+ */
+const COLUMNS = ['proxy_encrypted', 'proxy_iv', 'proxy_auth_tag'];
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+export function up(db) {
+    for (const column of COLUMNS) {
+        if (!hasColumn(db, 'api_keys', column)) {
+            db.prepare(`ALTER TABLE api_keys ADD COLUMN ${column} TEXT`).run();
+        }
+    }
+}
+export function down(db) {
+    for (const column of COLUMNS) {
+        if (hasColumn(db, 'api_keys', column)) {
+            db.prepare(`ALTER TABLE api_keys DROP COLUMN ${column}`).run();
+        }
+    }
+}
+//# sourceMappingURL=20260810_000001_api_key_proxy.js.map

package/dist/db/migrations/20260810_000001_api_key_proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260810_000001_api_key_proxy.js","sourceRoot":"","sources":["../../../src/db/migrations/20260810_000001_api_key_proxy.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,GAAG,CAAC,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,CAAU,CAAC;AAE3E,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,EAAE,CAAC,OAAO,CAAC,mCAAmC,MAAM,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YACtC,EAAE,CAAC,OAAO,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260819_000001_custom_model_tombstones.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260819_000001_custom_model_tombstones.d.ts.map

package/dist/db/migrations/20260819_000001_custom_model_tombstones.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819_000001_custom_model_tombstones.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260819_000001_custom_model_tombstones.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAS/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAEjC"}

package/dist/db/migrations/20260819_000001_custom_model_tombstones.js

@@ -0,0 +1,19 @@
+// Migration: keep user-deleted custom models deleted across the scheduled sync
+// Created: 2026-08-19
+//
+// DOWN: reversible — the added table is dropped, which simply means deleted
+// custom models can be re-added by the next sync pass again (#926).
+export function up(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS custom_model_tombstones (
+      endpoint_scope TEXT NOT NULL,
+      model_id TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      PRIMARY KEY (endpoint_scope, model_id)
+    );
+  `);
+}
+export function down(db) {
+    db.exec('DROP TABLE IF EXISTS custom_model_tombstones;');
+}
+//# sourceMappingURL=20260819_000001_custom_model_tombstones.js.map

package/dist/db/migrations/20260819_000001_custom_model_tombstones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819_000001_custom_model_tombstones.js","sourceRoot":"","sources":["../../../src/db/migrations/20260819_000001_custom_model_tombstones.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,sBAAsB;AACtB,EAAE;AACF,4EAA4E;AAC5E,oEAAoE;AAIpE,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;GAOP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;AAC3D,CAAC"}

package/dist/db/migrations/20260820_000001_playground_conversations.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260820_000001_playground_conversations.d.ts.map

package/dist/db/migrations/20260820_000001_playground_conversations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260820_000001_playground_conversations.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260820_000001_playground_conversations.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAgB/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAKjC"}

package/dist/db/migrations/20260820_000001_playground_conversations.js

@@ -0,0 +1,47 @@
+// Migration: persistent Playground conversations
+// Created: 2026-08-20
+//
+// DOWN: reversible
+//
+// The Playground transcript used to live only in React state: a reload, a
+// navigation away, or the "Clear" button threw the whole conversation away.
+// This table gives it a home. One row per conversation, no user scoping —
+// this is a single-user dashboard, and the existing `sessions` table is the
+// dashboard LOGIN session (token_hash -> user), nothing to do with chats.
+//
+// messages_json holds the entire ChatMessage[] the page renders, `meta`
+// routing info and `reasoning` included, so a restored transcript looks
+// exactly like the live one rather than a lossy replay. It is deliberately a
+// single opaque blob: the dashboard is the only reader, the shape is the
+// client's, and normalising turns into rows would buy nothing but joins.
+// The router caps writes well below any practical SQLite limit.
+//
+// model is the picker selection at the time of the conversation ('auto',
+// 'fusion', or a canonical model id) and system_prompt its optional system
+// message, so switching conversations restores the whole setup, not just the
+// text. Timestamps are epoch milliseconds (like sessions.expires_at_ms)
+// because the sidebar renders them as relative times in the browser's clock.
+export function up(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS playground_conversations (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      title TEXT NOT NULL DEFAULT '',
+      messages_json TEXT NOT NULL DEFAULT '[]',
+      model TEXT,
+      system_prompt TEXT,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL
+    );
+
+    -- The sidebar's only query: most recently touched first.
+    CREATE INDEX IF NOT EXISTS idx_playground_conversations_updated
+      ON playground_conversations(updated_at_ms DESC);
+  `);
+}
+export function down(db) {
+    db.exec(`
+    DROP INDEX IF EXISTS idx_playground_conversations_updated;
+    DROP TABLE IF EXISTS playground_conversations;
+  `);
+}
+//# sourceMappingURL=20260820_000001_playground_conversations.js.map

package/dist/db/migrations/20260820_000001_playground_conversations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260820_000001_playground_conversations.js","sourceRoot":"","sources":["../../../src/db/migrations/20260820_000001_playground_conversations.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,6EAA6E;AAI7E,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;GAcP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,IAAI,CAAC;;;GAGP,CAAC,CAAC;AACL,CAAC"}

package/dist/db/migrations/20260823_000001_server_logs.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260823_000001_server_logs.d.ts.map

package/dist/db/migrations/20260823_000001_server_logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000001_server_logs.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000001_server_logs.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAiB/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAKjC"}

package/dist/db/migrations/20260823_000001_server_logs.js

@@ -0,0 +1,53 @@
+// Migration: durable server_logs for the dashboard log viewer
+// Created: 2026-08-23
+//
+// DOWN: reversible
+//
+// The log viewer reads a 1000-entry in-memory ring, which is the right store
+// for a live tail and the wrong one for the question operators actually ask:
+// "what went wrong while I was asleep / before this restart?". A ring answers
+// that with an empty panel.
+//
+// So warn and error — and only those — are ALSO written here. Info and debug
+// are the volume (a busy gateway prints several lines per request) and the part
+// nobody goes looking for after the fact; persisting them would turn a
+// diagnostic aid into the database's largest table. The CHECK constraint states
+// that policy in the schema rather than leaving it to the writer.
+//
+// `id` is assigned by the application, NOT by AUTOINCREMENT, because the ring
+// and this table share one id space: the client polls with a `sinceId` cursor
+// and that cursor has to mean the same thing for a line that only ever lived in
+// memory and for one preloaded from here. lib/server-logs.ts seeds its counter
+// from MAX(id) at init, which is what keeps ids increasing across restarts.
+//
+// created_at_ms is epoch milliseconds (like playground_conversations and
+// sessions.expires_at_ms): the viewer renders relative times in the browser's
+// clock, and sub-second ordering matters when a failure prints five lines at
+// once. The index is (created_at_ms, id) — the retention prune's cutoff scan
+// and the boot preload's "most recent N" both read exactly that order, with id
+// as the tiebreak for lines sharing a millisecond.
+export function up(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS server_logs (
+      id INTEGER PRIMARY KEY,
+      level TEXT CHECK(level IN ('warn','error')),
+      source TEXT,
+      provider TEXT,
+      model TEXT,
+      event TEXT,
+      request_id TEXT,
+      message TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_server_logs_created
+      ON server_logs(created_at_ms, id);
+  `);
+}
+export function down(db) {
+    db.exec(`
+    DROP INDEX IF EXISTS idx_server_logs_created;
+    DROP TABLE IF EXISTS server_logs;
+  `);
+}
+//# sourceMappingURL=20260823_000001_server_logs.js.map

package/dist/db/migrations/20260823_000001_server_logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000001_server_logs.js","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000001_server_logs.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,4BAA4B;AAC5B,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,mDAAmD;AAInD,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;GAeP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,IAAI,CAAC;;;GAGP,CAAC,CAAC;AACL,CAAC"}

package/dist/db/migrations/20260823_000002_backups_table.d.ts

@@ -0,0 +1,8 @@
+import type { Db } from '../types.js';
+/** Metadata index for the data-backup feature. Backup payloads live on disk
+ *  next to the database; this table is the paginated index. `filepath` records
+ *  the absolute location so download and restore survive a later change to the
+ *  configured backup directory. */
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260823_000002_backups_table.d.ts.map

package/dist/db/migrations/20260823_000002_backups_table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000002_backups_table.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000002_backups_table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC;;;mCAGmC;AACnC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAa/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAEjC"}

package/dist/db/migrations/20260823_000002_backups_table.js

@@ -0,0 +1,22 @@
+/** Metadata index for the data-backup feature. Backup payloads live on disk
+ *  next to the database; this table is the paginated index. `filepath` records
+ *  the absolute location so download and restore survive a later change to the
+ *  configured backup directory. */
+export function up(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS backups (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      filename TEXT NOT NULL,
+      filepath TEXT,
+      filesize INTEGER NOT NULL,
+      is_full INTEGER NOT NULL DEFAULT 1,
+      source TEXT NOT NULL DEFAULT 'manual',
+      created_at TEXT NOT NULL,
+      tables_json TEXT NOT NULL DEFAULT '[]'
+    )
+  `);
+}
+export function down(db) {
+    db.exec('DROP TABLE IF EXISTS backups');
+}
+//# sourceMappingURL=20260823_000002_backups_table.js.map

package/dist/db/migrations/20260823_000002_backups_table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000002_backups_table.js","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000002_backups_table.ts"],"names":[],"mappings":"AAEA;;;mCAGmC;AACnC,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;GAWP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;AAC1C,CAAC"}

package/dist/db/migrations/20260823_000003_attempt_key_label.d.ts

@@ -0,0 +1,19 @@
+import type { Db } from '../types.js';
+/**
+ * Migration: request_attempts.key_label — the operator-facing key identifier
+ * for the failover ladder (#869).
+ *
+ * The ladder shows key1/key2 (key_ordinal), which tells you WHICH position in
+ * the request's own rotation was tried but not WHICH key row that was — with
+ * several keys per provider, "key2" is meaningless once the list is reordered.
+ * This nullable column stores the api_keys.label at attempt time (NULL when the
+ * key had no label, or for pre-existing rows where it is unknown).
+ *
+ * NOT the internal key id, and NOT the encrypted key: a stable, user-assigned
+ * label is what the dashboard can show in a tooltip without leaking the id or
+ * the credential. The label is a snapshot — if the operator renames the key
+ * later, historical attempts keep the label they actually used.
+ */
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260823_000003_attempt_key_label.d.ts.map

package/dist/db/migrations/20260823_000003_attempt_key_label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000003_attempt_key_label.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000003_attempt_key_label.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAK/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAKjC"}

package/dist/db/migrations/20260823_000003_attempt_key_label.js

@@ -0,0 +1,28 @@
+/**
+ * Migration: request_attempts.key_label — the operator-facing key identifier
+ * for the failover ladder (#869).
+ *
+ * The ladder shows key1/key2 (key_ordinal), which tells you WHICH position in
+ * the request's own rotation was tried but not WHICH key row that was — with
+ * several keys per provider, "key2" is meaningless once the list is reordered.
+ * This nullable column stores the api_keys.label at attempt time (NULL when the
+ * key had no label, or for pre-existing rows where it is unknown).
+ *
+ * NOT the internal key id, and NOT the encrypted key: a stable, user-assigned
+ * label is what the dashboard can show in a tooltip without leaking the id or
+ * the credential. The label is a snapshot — if the operator renames the key
+ * later, historical attempts keep the label they actually used.
+ */
+export function up(db) {
+    const columns = db.prepare(`PRAGMA table_info(request_attempts)`).all();
+    if (!columns.some((c) => c.name === 'key_label')) {
+        db.prepare('ALTER TABLE request_attempts ADD COLUMN key_label TEXT').run();
+    }
+}
+export function down(db) {
+    const columns = db.prepare(`PRAGMA table_info(request_attempts)`).all();
+    if (columns.some((c) => c.name === 'key_label')) {
+        db.prepare('ALTER TABLE request_attempts DROP COLUMN key_label').run();
+    }
+}
+//# sourceMappingURL=20260823_000003_attempt_key_label.js.map

package/dist/db/migrations/20260823_000003_attempt_key_label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000003_attempt_key_label.js","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000003_attempt_key_label.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,EAAwB,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;QACjD,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,EAAwB,CAAC;IAC9F,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;QAChD,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,EAAE,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260823_000004_profile_auto_include.d.ts

@@ -0,0 +1,14 @@
+import type { Db } from '../types.js';
+/** Per-chain opt-out from the catalog-sync backfill (#895).
+ *
+ *  Every profile used to be a copy of the whole catalog, and `ensureAllModelsInProfiles`
+ *  put each newly synced model into every profile. That is right for a chain
+ *  the user never pruned, and wrong for one they curated by hand: the next
+ *  catalog sync silently pushed a dozen models back into it.
+ *
+ *  1 (the default, and what every existing chain gets) keeps the old behaviour.
+ *  A chain created with `empty: true` starts at 0, so it only ever holds what
+ *  the user put in it. */
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260823_000004_profile_auto_include.d.ts.map

package/dist/db/migrations/20260823_000004_profile_auto_include.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000004_profile_auto_include.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000004_profile_auto_include.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOtC;;;;;;;;;0BAS0B;AAC1B,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAI/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAIjC"}

package/dist/db/migrations/20260823_000004_profile_auto_include.js

@@ -0,0 +1,25 @@
+function hasColumn(db, table, column) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    return columns.some((candidate) => candidate.name === column);
+}
+/** Per-chain opt-out from the catalog-sync backfill (#895).
+ *
+ *  Every profile used to be a copy of the whole catalog, and `ensureAllModelsInProfiles`
+ *  put each newly synced model into every profile. That is right for a chain
+ *  the user never pruned, and wrong for one they curated by hand: the next
+ *  catalog sync silently pushed a dozen models back into it.
+ *
+ *  1 (the default, and what every existing chain gets) keeps the old behaviour.
+ *  A chain created with `empty: true` starts at 0, so it only ever holds what
+ *  the user put in it. */
+export function up(db) {
+    if (!hasColumn(db, 'profiles', 'auto_include_new_models')) {
+        db.prepare('ALTER TABLE profiles ADD COLUMN auto_include_new_models INTEGER NOT NULL DEFAULT 1').run();
+    }
+}
+export function down(db) {
+    if (hasColumn(db, 'profiles', 'auto_include_new_models')) {
+        db.prepare('ALTER TABLE profiles DROP COLUMN auto_include_new_models').run();
+    }
+}
+//# sourceMappingURL=20260823_000004_profile_auto_include.js.map

package/dist/db/migrations/20260823_000004_profile_auto_include.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260823_000004_profile_auto_include.js","sourceRoot":"","sources":["../../../src/db/migrations/20260823_000004_profile_auto_include.ts"],"names":[],"mappings":"AAEA,SAAS,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAwB,CAAC;IACtF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;0BAS0B;AAC1B,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC1D,EAAE,CAAC,OAAO,CAAC,oFAAoF,CAAC,CAAC,GAAG,EAAE,CAAC;IACzG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,IAAI,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACzD,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC"}

package/dist/db/migrations/20260901_000001_idempotency_claims.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260901_000001_idempotency_claims.d.ts.map

package/dist/db/migrations/20260901_000001_idempotency_claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260901_000001_idempotency_claims.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260901_000001_idempotency_claims.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAiB/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAKjC"}

package/dist/db/migrations/20260901_000001_idempotency_claims.js

@@ -0,0 +1,46 @@
+// Migration: idempotency claims for HTTP Idempotency-Key support
+// Created: 2026-09-01
+//
+// DOWN: reversible
+//
+// Free-tier quota is a scarce asset: a client that times out and retries the
+// same non-streaming chat request currently burns a second free-tier slot for
+// an answer it already got. This table lets callers opt in to idempotent
+// retries via the `Idempotency-Key` header (see services/idempotency.ts):
+//
+//   - Only a SHA-256 hash of the caller's key is stored — never the raw key,
+//     mirroring how the runtime treats admin/runtime tokens.
+//   - request_fingerprint is a canonical SHA-256 of the (model, messages,
+//     sampling params) that produced the response, so the same key reused
+//     with different content is a conflict (409), not a silent wrong answer.
+//   - On success the original HTTP status + body are persisted for replay
+//     within the configured window (IDEMPOTENCY_TTL_MS, default 24h). Expired
+//     rows are deleted lazily on the next lookup for the same key hash.
+//
+// Single-user runtime: no user scoping needed. One row per key hash; a new
+// claim with the same hash after the previous one completed replaces it.
+export function up(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS idempotency_claims (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      key_hash TEXT NOT NULL UNIQUE,
+      request_fingerprint TEXT NOT NULL,
+      response_status INTEGER NOT NULL,
+      response_body TEXT NOT NULL,
+      execution_id TEXT,
+      created_at_ms INTEGER NOT NULL,
+      expires_at_ms INTEGER NOT NULL
+    );
+
+    -- The only lookup is by key hash; expiry sweeps scan expires_at.
+    CREATE INDEX IF NOT EXISTS idx_idempotency_claims_expires
+      ON idempotency_claims(expires_at_ms);
+  `);
+}
+export function down(db) {
+    db.exec(`
+    DROP INDEX IF EXISTS idx_idempotency_claims_expires;
+    DROP TABLE IF EXISTS idempotency_claims;
+  `);
+}
+//# sourceMappingURL=20260901_000001_idempotency_claims.js.map

package/dist/db/migrations/20260901_000001_idempotency_claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260901_000001_idempotency_claims.js","sourceRoot":"","sources":["../../../src/db/migrations/20260901_000001_idempotency_claims.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,6DAA6D;AAC7D,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AAIzE,MAAM,UAAU,EAAE,CAAC,EAAM;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;GAeP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAM;IACzB,EAAE,CAAC,IAAI,CAAC;;;GAGP,CAAC,CAAC;AACL,CAAC"}

package/dist/db/migrations/20260901_000002_quota_observation_lookup.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from '../types.js';
+export declare function up(db: Db): void;
+export declare function down(db: Db): void;
+//# sourceMappingURL=20260901_000002_quota_observation_lookup.d.ts.map

package/dist/db/migrations/20260901_000002_quota_observation_lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260901_000002_quota_observation_lookup.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/20260901_000002_quota_observation_lookup.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAQ/B;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAKjC"}