@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/lib/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/lib/content.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,CAAsC,CAAC;YACrD,qEAAqE;YACrE,sEAAsE;YACtE,iEAAiE;YACjE,yBAAyB;YACzB,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC3F,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,QAAuB,EAAE,KAA0B;IACrF,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1F,OAAO,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,MAAM,UAAU,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,aAAa,GAAG,UAAU,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAuB;IAC3D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,GAAG,CAAC;QACJ,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;KACpC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,wEAAwE;AACxE,+EAA+E;AAC/E,mCAAmC;AACnC,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAI,KAA2B,EAAE,IAAI,CAAC;QAChD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,QAAuB;IAC7D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,IAAI,GAAI,KAA2B,EAAE,IAAI,CAAC;YAChD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4EAA4E;AAC5E,4EAA4E;AAC5E,qCAAqC;AACrC,SAAS,qBAAqB,CAAC,OAAoB;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,qEAAqE;AACrE,6EAA6E;AAC7E,0EAA0E;AAC1E,+BAA+B;AAC/B,SAAS,mBAAmB,CAAC,OAAoB,EAAE,MAAc;IAC/D,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ;QACvC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAuB,EACvB,SAAiB,uBAAuB;IAExC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,IAAI,MAAM;QAAE,OAAO,QAAQ,CAAC;IAErC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,YAAY,CAAC;IACxB,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,4EAA4E;IAC5E,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,GAAG,MAAM,GAAG,MAAM;YAAE,MAAM;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,MAAM,CAAC;IACjB,CAAC;IACD,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,2EAA2E;AAC3E,kFAAkF;AAClF,6EAA6E;AAC7E,qEAAqE;AACrE,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAI,OAAU;IAC5C,MAAM,CAAC,GAAG,OAAiD,CAAC;IAC5D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,SAAS;YACpD,MAAM,CAAC,GAAG,MAA2G,CAAC;YACtH,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;gBAAE,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1D,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7G,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;QACvG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,oEAAoE;AACpE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAI,OAAU;IACpD,MAAM,OAAO,GAAI,OAAiC,EAAE,OAAO,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAI,MAA4C,EAAE,KAAK,CAAC;QACnE,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAI,MAA8C,EAAE,OAAO,CAAC;QACzE,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/credential.d.ts

@@ -0,0 +1,11 @@
+/** The sentinel the Keys page stores for key-optional platforms and auth-off
+ * custom endpoints (routes/keys.ts keeps `no-key`), plus the empty string a
+ * caller can hand a provider when no credential exists. Anything else is a
+ * real key (#1331). */
+export declare const NO_KEY_SENTINEL = "no-key";
+export declare function isAnonymousCredential(apiKey: string | null | undefined): boolean;
+/** `Authorization: Bearer <key>` for a real key, nothing for the sentinel:
+ * upstreams read `Bearer no-key` as an invalid key, so anonymous calls must
+ * omit the header entirely (#1331). */
+export declare function bearerAuthHeader(apiKey: string | null | undefined): Record<string, string>;
+//# sourceMappingURL=credential.d.ts.map

package/dist/lib/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/lib/credential.ts"],"names":[],"mappings":"AAAA;;;uBAGuB;AACvB,eAAO,MAAM,eAAe,WAAW,CAAC;AAExC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGhF;AAED;;uCAEuC;AACvC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAG1F"}

package/dist/lib/credential.js

@@ -0,0 +1,18 @@
+/** The sentinel the Keys page stores for key-optional platforms and auth-off
+ * custom endpoints (routes/keys.ts keeps `no-key`), plus the empty string a
+ * caller can hand a provider when no credential exists. Anything else is a
+ * real key (#1331). */
+export const NO_KEY_SENTINEL = 'no-key';
+export function isAnonymousCredential(apiKey) {
+    const v = apiKey?.trim() ?? '';
+    return v === '' || v === NO_KEY_SENTINEL;
+}
+/** `Authorization: Bearer <key>` for a real key, nothing for the sentinel:
+ * upstreams read `Bearer no-key` as an invalid key, so anonymous calls must
+ * omit the header entirely (#1331). */
+export function bearerAuthHeader(apiKey) {
+    if (isAnonymousCredential(apiKey))
+        return {};
+    return { Authorization: `Bearer ${apiKey.trim()}` };
+}
+//# sourceMappingURL=credential.js.map

package/dist/lib/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../src/lib/credential.ts"],"names":[],"mappings":"AAAA;;;uBAGuB;AACvB,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC,MAAM,UAAU,qBAAqB,CAAC,MAAiC;IACrE,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,eAAe,CAAC;AAC3C,CAAC;AAED;;uCAEuC;AACvC,MAAM,UAAU,gBAAgB,CAAC,MAAiC;IAChE,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO,EAAE,aAAa,EAAE,UAAU,MAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;AACvD,CAAC"}

package/dist/lib/crypto.d.ts

@@ -0,0 +1,31 @@
+import type { Db } from '../db/types.js';
+/**
+ * Initialize encryption key from env or an explicit local-dev fallback.
+ * Must be called after DB is initialized.
+ *
+ * Precedence (dev fallback): ENCRYPTION_KEY env > existing key file next to the
+ * DB > legacy `settings` table row (migrated to the file, then deleted) >
+ * freshly generated key written to the file.
+ */
+export declare function initEncryptionKey(db: Db): void;
+/**
+ * A short, non-reversible identifier for the key currently in use.
+ *
+ * Database dumps record it in their header so a restore can tell, before it
+ * touches a row, whether the api_keys ciphertext in the file was written under
+ * this key. sha256 truncated to 64 bits: enough to catch a different key,
+ * nowhere near enough to help recover the key itself, and safe to show in an
+ * error message or write to a file an operator emails around.
+ *
+ * Returns null before initEncryptionKey() has run.
+ */
+export declare function encryptionKeyFingerprint(): string | null;
+export declare function isEncryptionKeyInitialized(): boolean;
+export declare function encrypt(text: string): {
+    encrypted: string;
+    iv: string;
+    authTag: string;
+};
+export declare function decrypt(encrypted: string, iv: string, authTag: string): string;
+export declare function maskKey(key: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/lib/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAiFzC;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CA2D9C;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAGxD;AAED,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAcxF;AAQD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ9E;AAeD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI3C"}

package/dist/lib/crypto.js

@@ -0,0 +1,206 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import { restrictToOwner } from './file-permissions.js';
+const ALGORITHM = 'aes-256-gcm';
+let cachedKey = null;
+/**
+ * AES-256-GCM uses a 32-byte key, hex-encoded as 64 chars.
+ * A typo'd ENCRYPTION_KEY (e.g. "abc") would historically fall through
+ * the placeholder check, get truncated to 1.5 bytes, and only fail at
+ * the first encrypt() call with a cryptic node:crypto error. Validate
+ * the length up front and fail fast with an actionable message.
+ */
+const KEY_BYTES = 32;
+const KEY_HEX_LEN = KEY_BYTES * 2;
+const PLACEHOLDER_KEY = 'your-64-char-hex-key-here';
+// The dev-fallback key lives in a file next to the DB, NOT in the DB itself.
+// Storing it beside the ciphertext it protects (the old `settings` row) meant
+// encryption-at-rest protected nothing for a default install: whoever copied
+// the DB also copied the key. The file sits in the same directory but is a
+// separate artifact, and is chmod 0600 so it isn't world-readable.
+const KEY_FILE_NAME = '.encryption-key';
+function parseHexKey(value, source) {
+    if (value.length !== KEY_HEX_LEN || !/^[0-9a-fA-F]+$/.test(value)) {
+        throw new Error(`Invalid ENCRYPTION_KEY (${source}): expected ${KEY_HEX_LEN} hex chars (32 bytes), got ${value.length} chars. ` +
+            `Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+    }
+    return Buffer.from(value, 'hex');
+}
+// Outside production we auto-generate and persist a key so a fresh clone
+// (`npm run dev`) boots without manual setup — the placeholder ENCRYPTION_KEY
+// in .env.example would otherwise crash the server on boot, which surfaces in
+// the client as "Can't reach the server". Production still requires an explicit
+// env key: a generated key lives only on the local disk and silently losing it
+// would make every stored API key undecryptable.
+function isDevFallbackAllowed() {
+    return process.env.NODE_ENV !== 'production';
+}
+function missingKeyError() {
+    return new Error('ENCRYPTION_KEY is required in production for API key encryption. ' +
+        `Set a ${KEY_HEX_LEN}-char hex key (generate one with: ` +
+        `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"). ` +
+        'Outside production a local key file is auto-generated next to the database.');
+}
+// The directory that holds the DB is the only place we can keep the key file
+// next to (but not inside) the database. In-memory and anonymous databases have
+// no such directory (db.memory is true, db.name is ":memory:" or ""), and Db
+// backings without file metadata (memory undefined) have none either, so those
+// callers fall back to the legacy settings-table behavior.
+function keyFilePathFor(db) {
+    if (db.memory !== false)
+        return null;
+    const dbPath = db.name;
+    if (!dbPath || dbPath === ':memory:')
+        return null;
+    return path.join(path.dirname(dbPath), KEY_FILE_NAME);
+}
+// Write the hex key with a temp-file-and-rename so a crash never leaves a
+// half-written key, and restrict it to the owner so it isn't readable by other
+// local users. The temp file is restricted BEFORE the rename so the key is
+// never briefly world-readable under its final name; a rename carries the DACL
+// with it, and the second call is idempotent belt-and-braces.
+function writeKeyFileAtomic(keyFile, hex) {
+    const dir = path.dirname(keyFile);
+    const tmp = path.join(dir, `${KEY_FILE_NAME}.tmp-${crypto.randomBytes(6).toString('hex')}`);
+    fs.writeFileSync(tmp, hex, { mode: 0o600 });
+    restrictToOwner(tmp);
+    fs.renameSync(tmp, keyFile);
+    if (!restrictToOwner(keyFile)) {
+        console.warn(`[crypto] could not restrict permissions on ${KEY_FILE_NAME} — it may be readable by other local accounts`);
+    }
+}
+/**
+ * Initialize encryption key from env or an explicit local-dev fallback.
+ * Must be called after DB is initialized.
+ *
+ * Precedence (dev fallback): ENCRYPTION_KEY env > existing key file next to the
+ * DB > legacy `settings` table row (migrated to the file, then deleted) >
+ * freshly generated key written to the file.
+ */
+export function initEncryptionKey(db) {
+    // 1. Explicit env key always wins.
+    const envKey = process.env.ENCRYPTION_KEY;
+    if (envKey && envKey !== PLACEHOLDER_KEY) {
+        cachedKey = parseHexKey(envKey, 'env');
+        return;
+    }
+    if (!isDevFallbackAllowed()) {
+        throw missingKeyError();
+    }
+    const keyFile = keyFilePathFor(db);
+    // In-memory / anonymous DBs have no directory to hold a key file, so keep the
+    // legacy settings-table behavior for them (ephemeral runs, most tests).
+    if (!keyFile) {
+        const row = db.prepare("SELECT value FROM settings WHERE key = 'encryption_key'").get();
+        if (row) {
+            cachedKey = parseHexKey(row.value, 'db');
+            console.warn('[crypto] No ENCRYPTION_KEY set — using an auto-generated in-memory key (dev only).');
+            return;
+        }
+        cachedKey = crypto.randomBytes(KEY_BYTES);
+        db.prepare("INSERT INTO settings (key, value) VALUES ('encryption_key', ?)").run(cachedKey.toString('hex'));
+        console.warn('[crypto] No ENCRYPTION_KEY set — generated an in-memory dev key. Set ENCRYPTION_KEY for production.');
+        return;
+    }
+    // 2. An existing key file next to the DB.
+    if (fs.existsSync(keyFile)) {
+        const value = fs.readFileSync(keyFile, 'utf8').trim();
+        cachedKey = parseHexKey(value, 'file');
+        console.warn(`[crypto] No ENCRYPTION_KEY set — using the auto-generated key at ${keyFile} (dev only). Set ENCRYPTION_KEY for production.`);
+        return;
+    }
+    // 3. A legacy key still sitting in the settings table (older dev installs).
+    //    Migrate it to the key file so the DB stops storing the key that protects
+    //    it, confirm a decrypt round-trip with the migrated key, then drop the row.
+    const legacy = db.prepare("SELECT value FROM settings WHERE key = 'encryption_key'").get();
+    if (legacy) {
+        const migrated = parseHexKey(legacy.value, 'db');
+        writeKeyFileAtomic(keyFile, migrated.toString('hex'));
+        cachedKey = migrated;
+        const probe = encrypt('roundtrip');
+        if (decrypt(probe.encrypted, probe.iv, probe.authTag) !== 'roundtrip') {
+            cachedKey = null;
+            throw new Error('[crypto] Failed to migrate the DB-stored key to a key file: round-trip check failed.');
+        }
+        db.prepare("DELETE FROM settings WHERE key = 'encryption_key'").run();
+        console.warn(`[crypto] Migrated the legacy DB-stored key to ${keyFile} and removed it from the database (dev only). Set ENCRYPTION_KEY for production.`);
+        return;
+    }
+    // 4. Generate a fresh key and persist it to the file.
+    cachedKey = crypto.randomBytes(KEY_BYTES);
+    writeKeyFileAtomic(keyFile, cachedKey.toString('hex'));
+    console.warn(`[crypto] No ENCRYPTION_KEY set — generated a local dev key at ${keyFile}. Set ENCRYPTION_KEY for production.`);
+}
+function getEncryptionKey() {
+    if (!cachedKey) {
+        throw new Error('Encryption key not initialized. Call initEncryptionKey() first.');
+    }
+    return cachedKey;
+}
+/**
+ * A short, non-reversible identifier for the key currently in use.
+ *
+ * Database dumps record it in their header so a restore can tell, before it
+ * touches a row, whether the api_keys ciphertext in the file was written under
+ * this key. sha256 truncated to 64 bits: enough to catch a different key,
+ * nowhere near enough to help recover the key itself, and safe to show in an
+ * error message or write to a file an operator emails around.
+ *
+ * Returns null before initEncryptionKey() has run.
+ */
+export function encryptionKeyFingerprint() {
+    if (!cachedKey)
+        return null;
+    return `sha256:${crypto.createHash('sha256').update(cachedKey).digest('hex').slice(0, 16)}`;
+}
+export function isEncryptionKeyInitialized() {
+    return cachedKey !== null;
+}
+export function encrypt(text) {
+    const key = getEncryptionKey();
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return {
+        encrypted,
+        iv: iv.toString('hex'),
+        authTag,
+    };
+}
+// AUTH_TAG_BYTES pins the GCM tag length to 16 bytes. Without this option Node
+// will accept any tag of length 4–16 bytes (RFC 5116 §3.2), which lets anyone
+// who can rewrite a row in `api_keys` swap in a 4-byte tag and start brute-
+// forcing forgeries at 2^32 attempts. Pinning closes that truncation path.
+const AUTH_TAG_BYTES = 16;
+export function decrypt(encrypted, iv, authTag) {
+    const key = getEncryptionKey();
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, Buffer.from(iv, 'hex'), { authTagLength: AUTH_TAG_BYTES });
+    decipher.setAuthTag(Buffer.from(authTag, 'hex'));
+    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+// A masked key is display-only — it feeds the `maskedKey` field every key,
+// media, embedding and client-profile route hands to the dashboard — so it must
+// never be enough to reconstruct the secret. The old short-key branch was
+// `'****' + key.slice(-4)`, and slice(-4) keeps the last four characters no
+// matter how short the input is: a 4-character key was echoed back IN FULL, and
+// a 5-character key gave away 4 of its 5 characters. Short keys are not
+// hypothetical — proxy credentials, self-hosted Ollama tokens and local dev
+// keys all land here.
+//
+// So reveal nothing at all below 5 characters, and at most the last TWO up to
+// 8: enough tail to tell two rows apart in the UI, not enough to be a
+// meaningful share of the secret. Long keys keep the familiar prefix+suffix
+// form, where 8 revealed characters out of 20+ is a fixed, small fraction.
+export function maskKey(key) {
+    if (key.length < 5)
+        return '****';
+    if (key.length <= 8)
+        return '****' + key.slice(-2);
+    return key.slice(0, 4) + '...' + key.slice(-4);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/lib/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,IAAI,SAAS,GAAkB,IAAI,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,SAAS,GAAG,CAAC,CAAC;AAClC,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,mEAAmE;AACnE,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,SAAS,WAAW,CAAC,KAAa,EAAE,MAA6B;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,eAAe,WAAW,8BAA8B,KAAK,CAAC,MAAM,UAAU;YAC/G,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,iDAAiD;AACjD,SAAS,oBAAoB;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CACd,mEAAmE;QACnE,SAAS,WAAW,oCAAoC;QACxD,6EAA6E;QAC7E,6EAA6E,CAC9E,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,2DAA2D;AAC3D,SAAS,cAAc,CAAC,EAAM;IAC5B,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;AACxD,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,8DAA8D;AAC9D,SAAS,kBAAkB,CAAC,OAAe,EAAE,GAAW;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,QAAQ,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5F,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,eAAe,CAAC,GAAG,CAAC,CAAC;IACrB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,8CAA8C,aAAa,+CAA+C,CAAC,CAAC;IAC3H,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAM;IACtC,mCAAmC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,MAAM,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QACzC,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5B,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAEnC,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAAmC,CAAC;QACzH,IAAI,GAAG,EAAE,CAAC;YACR,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1C,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,qGAAqG,CAAC,CAAC;QACpH,OAAO;IACT,CAAC;IAED,0CAA0C;IAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,oEAAoE,OAAO,iDAAiD,CAAC,CAAC;QAC3I,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAAmC,CAAC;IAC5H,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,SAAS,GAAG,QAAQ,CAAC;QACrB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC;YACtE,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC1G,CAAC;QACD,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,EAAE,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,iDAAiD,OAAO,kFAAkF,CAAC,CAAC;QACzJ,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,iEAAiE,OAAO,sCAAsC,CAAC,CAAC;AAC/H,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,UAAU,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,SAAS,KAAK,IAAI,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO;QACL,SAAS;QACT,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,EAAU,EAAE,OAAe;IACpE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IACpH,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjD,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,gFAAgF;AAChF,0EAA0E;AAC1E,4EAA4E;AAC5E,gFAAgF;AAChF,wEAAwE;AACxE,4EAA4E;AAC5E,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,sEAAsE;AACtE,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/lib/custom-provider-cleanup.d.ts

@@ -0,0 +1,13 @@
+import type { Db } from '../db/types.js';
+/**
+ * Drop the api_keys row(s) of a custom endpoint that nothing is registered
+ * against any more, called after a custom model is deleted.
+ *
+ * The unit of "unused" is the ENDPOINT, not the single key. An endpoint holds a
+ * pool of credentials (#619) and each model binds to just one of them, so a key
+ * with nothing bound to it is usually a spare the operator added for rotation,
+ * not dead weight. Reaping on the key's own count deleted such a spare as soon
+ * as the model it happened to arrive with was removed (#702).
+ */
+export declare function deleteUnusedCustomEndpointKey(db: Db, keyId: number | null | undefined): void;
+//# sourceMappingURL=custom-provider-cleanup.d.ts.map

package/dist/lib/custom-provider-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider-cleanup.d.ts","sourceRoot":"","sources":["../../src/lib/custom-provider-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAoBzC;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,QAgBrF"}

package/dist/lib/custom-provider-cleanup.js

@@ -0,0 +1,43 @@
+function boundModelCount(db, keyId) {
+    const chat = db.prepare("SELECT COUNT(*) AS n FROM models WHERE platform = 'custom' AND key_id = ?").get(keyId);
+    const embeddings = db.prepare("SELECT COUNT(*) AS n FROM embedding_models WHERE platform = 'custom' AND key_id = ?").get(keyId);
+    const media = db.prepare("SELECT COUNT(*) AS n FROM media_models WHERE platform = 'custom' AND key_id = ?").get(keyId);
+    return chat.n + embeddings.n + media.n;
+}
+/** Everything still registered against an endpoint, across every key of its pool. */
+function endpointModelCount(db, baseUrl) {
+    const count = (table) => db.prepare(`
+    SELECT COUNT(*) AS n
+      FROM ${table} m
+      JOIN api_keys k ON k.id = m.key_id
+     WHERE m.platform = 'custom' AND k.platform = 'custom' AND k.base_url = ?
+  `).get(baseUrl).n;
+    return count('models') + count('embedding_models') + count('media_models');
+}
+/**
+ * Drop the api_keys row(s) of a custom endpoint that nothing is registered
+ * against any more, called after a custom model is deleted.
+ *
+ * The unit of "unused" is the ENDPOINT, not the single key. An endpoint holds a
+ * pool of credentials (#619) and each model binds to just one of them, so a key
+ * with nothing bound to it is usually a spare the operator added for rotation,
+ * not dead weight. Reaping on the key's own count deleted such a spare as soon
+ * as the model it happened to arrive with was removed (#702).
+ */
+export function deleteUnusedCustomEndpointKey(db, keyId) {
+    if (keyId == null)
+        return;
+    const row = db.prepare("SELECT base_url FROM api_keys WHERE id = ? AND platform = 'custom'")
+        .get(keyId);
+    // No base_url means no pool to belong to, so the key answers for itself.
+    if (!row?.base_url) {
+        if (boundModelCount(db, keyId) > 0)
+            return;
+        db.prepare("DELETE FROM api_keys WHERE id = ? AND platform = 'custom'").run(keyId);
+        return;
+    }
+    if (endpointModelCount(db, row.base_url) > 0)
+        return;
+    db.prepare("DELETE FROM api_keys WHERE platform = 'custom' AND base_url = ?").run(row.base_url);
+}
+//# sourceMappingURL=custom-provider-cleanup.js.map

package/dist/lib/custom-provider-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider-cleanup.js","sourceRoot":"","sources":["../../src/lib/custom-provider-cleanup.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,EAAM,EAAE,KAAa;IAC5C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAC,GAAG,CAAC,KAAK,CAAkB,CAAC;IACjI,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,qFAAqF,CAAC,CAAC,GAAG,CAAC,KAAK,CAAkB,CAAC;IACjJ,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC,GAAG,CAAC,KAAK,CAAkB,CAAC;IACxI,OAAO,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,qFAAqF;AACrF,SAAS,kBAAkB,CAAC,EAAM,EAAE,OAAe;IACjD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAE,EAAE,CAAC,OAAO,CAAC;;aAElC,KAAK;;;GAGf,CAAC,CAAC,GAAG,CAAC,OAAO,CAAmB,CAAC,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAM,EAAE,KAAgC;IACpF,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO;IAE1B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;SACzF,GAAG,CAAC,KAAK,CAA4C,CAAC;IAEzD,yEAAyE;IACzE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnB,IAAI,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO;QAC3C,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,IAAI,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO;IAErD,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAClG,CAAC"}

package/dist/lib/db-backup.d.ts

@@ -0,0 +1,31 @@
+import type { Db } from '../db/types.js';
+import type { Scheduler } from './scheduler.js';
+export interface DbBackupResult {
+    ok: boolean;
+    target?: string;
+    bytes?: number;
+    restored?: boolean;
+    skipped?: string;
+}
+export declare function isDbBackupConfigured(): boolean;
+/**
+ * Split a Hugging Face `/resolve/` download URL into the pieces the commit API
+ * needs, or null for anything else.
+ *
+ * A HF repo serves downloads at `/{type}/{ns}/{repo}/resolve/{rev}/{path}`, but
+ * that route is read-only: a PUT to it is answered 404/405 and the blob never
+ * lands. Writes go through the commit API instead. Both halves are derived from
+ * the one URL the operator configures, so SROUTER_DB_BACKUP_TARGET stays the
+ * plain download URL they can paste into a browser.
+ *
+ * Models are the type with no prefix segment (`/{ns}/{repo}/resolve/...`);
+ * datasets and spaces name themselves. The API path pluralizes the type.
+ */
+export declare function parseHuggingFaceTarget(target: string): {
+    commitUrl: string;
+    filePath: string;
+} | null;
+export declare function restoreDbBackupIfNeeded(dbPath?: string): Promise<DbBackupResult>;
+export declare function backupDbNow(db: Db, dbPath?: string): Promise<DbBackupResult>;
+export declare function startDbBackupPump(db: Db, scheduler: Scheduler, dbPath?: string): (() => void) | null;
+//# sourceMappingURL=db-backup.d.ts.map

package/dist/lib/db-backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-backup.d.ts","sourceRoot":"","sources":["../../src/lib/db-backup.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAShD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAWD,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AA8CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBrG;AAmGD,wBAAsB,uBAAuB,CAAC,MAAM,SAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CA2BlG;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,SAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB9F;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAqB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAShH"}