blackriver-gateway 3.8.46

package/src/lib/db/migrations/068_free_proxies.sql

@@ -0,0 +1,52 @@
+-- 068_free_proxies.sql
+-- Cria tabela de staging/catálogo para proxies gratuitos de múltiplas fontes.
+-- Os proxies "promovidos" ao pool real ficam em proxy_registry; free_proxies
+-- só rastreia o catálogo + quais foram promovidos (in_pool=1, pool_proxy_id=FK).
+
+CREATE TABLE IF NOT EXISTS free_proxies (
+  id TEXT PRIMARY KEY,
+  source TEXT NOT NULL,          -- '1proxy' | 'proxifly' | 'iplocate'
+  host TEXT NOT NULL,
+  port INTEGER NOT NULL,
+  type TEXT NOT NULL DEFAULT 'http',
+  country_code TEXT,
+  quality_score INTEGER,
+  latency_ms INTEGER,
+  anonymity TEXT,
+  last_validated TEXT,
+  in_pool INTEGER DEFAULT 0,     -- 0 = not in registry, 1 = promoted to proxy_registry
+  pool_proxy_id TEXT,            -- FK para proxy_registry.id se in_pool=1
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE(source, host, port)
+);
+
+CREATE INDEX IF NOT EXISTS idx_free_proxies_source ON free_proxies(source);
+CREATE INDEX IF NOT EXISTS idx_free_proxies_quality ON free_proxies(quality_score DESC);
+CREATE INDEX IF NOT EXISTS idx_free_proxies_in_pool ON free_proxies(in_pool);
+
+-- Migrar dados existentes do proxy_registry (source='oneproxy') para free_proxies.
+-- O proxy permanece em proxy_registry (não o removemos), mas o free_proxies o
+-- referencia como já "in_pool".
+INSERT OR IGNORE INTO free_proxies (
+  id, source, host, port, type, country_code,
+  quality_score, latency_ms, anonymity, last_validated,
+  in_pool, pool_proxy_id, created_at, updated_at
+)
+SELECT
+  id,
+  '1proxy',
+  host,
+  port,
+  type,
+  country_code,
+  quality_score,
+  latency_ms,
+  anonymity,
+  last_validated,
+  1,    -- já está no registry
+  id,   -- pool_proxy_id = próprio id (mesmo registro)
+  created_at,
+  updated_at
+FROM proxy_registry
+WHERE source = 'oneproxy';

package/src/lib/db/migrations/069_webhook_deliveries.sql

@@ -0,0 +1,15 @@
+-- Migration 069: Webhook delivery history
+CREATE TABLE IF NOT EXISTS webhook_deliveries (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  webhook_id TEXT NOT NULL,
+  event_type TEXT NOT NULL,
+  status TEXT NOT NULL,
+  http_status INTEGER,
+  latency_ms INTEGER,
+  error TEXT,
+  payload_snapshot TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  FOREIGN KEY (webhook_id) REFERENCES webhooks(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_webhook_created
+  ON webhook_deliveries(webhook_id, created_at DESC);

package/src/lib/db/migrations/070_webhooks_kind_metadata.sql

@@ -0,0 +1,3 @@
+-- Migration 070: Add kind and encrypted metadata to webhooks
+ALTER TABLE webhooks ADD COLUMN kind TEXT NOT NULL DEFAULT 'custom';
+ALTER TABLE webhooks ADD COLUMN metadata_encrypted BLOB;

package/src/lib/db/migrations/071_services.sql

@@ -0,0 +1,19 @@
+-- Migration 071: Extend version_manager for embedded services (9router + CLIProxyAPI)
+--
+-- Adds 3 columns to support the embedded-services feature (v3.8.4):
+--   logs_buffer_path  — path to ring-buffer log file on disk (optional)
+--   provider_expose   — 1 = expose service models in routing (9router), 0 = fallback-only (CLIProxyAPI)
+--   last_sync_at      — ISO timestamp of last model-list sync from the service
+--
+-- Seeds the 9router row with defaults. CLIProxyAPI row is seeded by T-11.
+-- ALTER TABLE "duplicate column name" errors are caught by the migration runner
+-- and treated as already-applied (idempotent).
+
+ALTER TABLE version_manager ADD COLUMN logs_buffer_path TEXT;
+ALTER TABLE version_manager ADD COLUMN provider_expose INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE version_manager ADD COLUMN last_sync_at TEXT;
+
+INSERT OR IGNORE INTO version_manager
+  (tool, status, port, auto_start, auto_update, provider_expose)
+VALUES
+  ('9router', 'not_installed', 20130, 0, 1, 1);

package/src/lib/db/migrations/072_free_proxies_fk.sql

@@ -0,0 +1,27 @@
+-- Migration 072: enforce free_proxies.pool_proxy_id integrity via trigger
+--
+-- 068_free_proxies.sql declared `pool_proxy_id TEXT` with a comment claiming it
+-- was a foreign key to proxy_registry.id, but the constraint was never emitted
+-- and the OmniRoute build does not run with PRAGMA foreign_keys=ON (existing
+-- test suites rely on attaching arbitrary string pool IDs without a registry
+-- row). To get the operational guarantee that the FK was meant to provide
+-- (delete-cascading nulls out dangling references) without breaking those
+-- callers, we install a single trigger that fires on proxy_registry DELETE
+-- and clears the matching pool_proxy_id rows.
+--
+-- This intentionally does NOT enforce inserts — application code is now the
+-- single writer for the promotion path (`promoteFreeProxyToPool` in db/freeProxies.ts)
+-- which inserts both rows in the same SQLite transaction.
+
+DROP TRIGGER IF EXISTS trg_free_proxies_clear_pool_proxy_id;
+
+CREATE TRIGGER trg_free_proxies_clear_pool_proxy_id
+AFTER DELETE ON proxy_registry
+FOR EACH ROW
+BEGIN
+  UPDATE free_proxies
+  SET pool_proxy_id = NULL,
+      in_pool = 0,
+      updated_at = datetime('now')
+  WHERE pool_proxy_id = OLD.id;
+END;

package/src/lib/db/migrations/073_per_model_token_limits.sql

@@ -0,0 +1,61 @@
+-- Migration 073: per-API-key token limits (scoped to model and/or provider)
+--
+-- Adds enforcement-grade token budgets attachable to an API key and scoped to a
+-- specific model, a specific provider, or globally (all traffic for the key).
+-- When a key exceeds its configured token budget within the active reset window,
+-- requests are rejected with HTTP 429. This complements (does not replace) the
+-- USD cost budgets in `domain_budgets` / src/domain/costRules.ts. Token usage is
+-- already captured per request in usage_history; these tables provide the
+-- authoritative rolling-window counters used for pre-flight enforcement.
+--
+-- Three tables:
+--   api_key_token_limits           - the limit definitions (one per scope per key)
+--   api_key_token_counters         - rolling-window usage counters (implicit rollover)
+--   api_key_token_limit_reset_logs - audit trail of window resets
+--
+-- Plus a composite index on usage_history to make the cold-start seed-on-miss
+-- SUM (api_key_id, provider, model, timestamp) an index scan rather than a table
+-- scan. The build does NOT run with PRAGMA foreign_keys=ON, so the FK clause is
+-- declarative only (matches existing repo convention; application code is the
+-- single writer and prunes counters via ON DELETE CASCADE semantics best-effort).
+
+CREATE TABLE IF NOT EXISTS api_key_token_limits (
+  id              TEXT PRIMARY KEY,
+  api_key_id      TEXT NOT NULL,
+  scope_type      TEXT NOT NULL CHECK (scope_type IN ('model', 'provider', 'global')),
+  scope_value     TEXT NOT NULL DEFAULT '',
+  token_limit     INTEGER NOT NULL CHECK (token_limit > 0),
+  reset_interval  TEXT NOT NULL DEFAULT 'monthly' CHECK (reset_interval IN ('daily', 'weekly', 'monthly')),
+  reset_time      TEXT,
+  enabled         INTEGER NOT NULL DEFAULT 1,
+  created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE (api_key_id, scope_type, scope_value)
+);
+
+CREATE INDEX IF NOT EXISTS idx_aktl_api_key_id
+  ON api_key_token_limits (api_key_id);
+
+CREATE TABLE IF NOT EXISTS api_key_token_counters (
+  limit_id      TEXT NOT NULL,
+  window_start  TEXT NOT NULL,
+  tokens_used   INTEGER NOT NULL DEFAULT 0,
+  updated_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (limit_id, window_start),
+  FOREIGN KEY (limit_id) REFERENCES api_key_token_limits (id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS api_key_token_limit_reset_logs (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  limit_id      TEXT NOT NULL,
+  reset_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  prev_tokens   INTEGER NOT NULL DEFAULT 0,
+  window_start  TEXT NOT NULL,
+  FOREIGN KEY (limit_id) REFERENCES api_key_token_limits (id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_aktlrl_limit_id
+  ON api_key_token_limit_reset_logs (limit_id);
+
+CREATE INDEX IF NOT EXISTS idx_uh_key_provider_model_ts
+  ON usage_history (api_key_id, provider, model, timestamp);

package/src/lib/db/migrations/074_discovery_results.sql

@@ -0,0 +1,20 @@
+-- Discovery results table for automated provider discovery
+CREATE TABLE IF NOT EXISTS discovery_results (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  provider_id TEXT NOT NULL,
+  method TEXT NOT NULL CHECK(method IN ('free_tier', 'web_cookie', 'auto_register', 'trial', 'public_api')),
+  endpoint TEXT,
+  auth_type TEXT CHECK(auth_type IN ('none', 'cookie', 'api_key', 'oauth')),
+  models TEXT, -- JSON array
+  rate_limit TEXT,
+  feasibility INTEGER CHECK(feasibility BETWEEN 1 AND 5),
+  risk_level TEXT CHECK(risk_level IN ('none', 'low', 'medium', 'high', 'critical')),
+  status TEXT DEFAULT 'pending' CHECK(status IN ('pending', 'testing', 'verified', 'rejected')),
+  notes TEXT,
+  discovered_at TEXT DEFAULT (datetime('now')),
+  verified_at TEXT,
+  UNIQUE(provider_id, method, endpoint)
+);
+
+CREATE INDEX IF NOT EXISTS idx_discovery_results_provider ON discovery_results(provider_id);
+CREATE INDEX IF NOT EXISTS idx_discovery_results_status ON discovery_results(status);

package/src/lib/db/migrations/075_api_key_self_service_usage_scopes.sql

@@ -0,0 +1,51 @@
+-- Migration 075: backfill self-service own-usage visibility for existing API keys.
+--
+-- This is intentionally a one-time compatibility update. After it has run,
+-- operators may remove "self:usage" from a key and the absence of the scope
+-- means self-service usage visibility is disabled.
+
+CREATE TABLE IF NOT EXISTS key_value (
+  namespace TEXT NOT NULL,
+  key TEXT NOT NULL,
+  value TEXT NOT NULL,
+  PRIMARY KEY (namespace, key)
+);
+
+UPDATE api_keys
+SET scopes = json_array('self:usage')
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM key_value
+    WHERE namespace = 'apiKeySelfService'
+      AND key = 'usageScopesBackfilled'
+  )
+  AND (
+    scopes IS NULL
+    OR trim(scopes) = ''
+    OR json_valid(scopes) = 0
+    OR CASE
+      WHEN json_valid(scopes) = 1 THEN json_type(scopes) != 'array'
+      ELSE 0
+    END
+  );
+
+UPDATE api_keys
+SET scopes = json_insert(scopes, '$[#]', 'self:usage')
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM key_value
+    WHERE namespace = 'apiKeySelfService'
+      AND key = 'usageScopesBackfilled'
+  )
+  AND scopes IS NOT NULL
+  AND trim(scopes) != ''
+  AND json_valid(scopes) = 1
+  AND json_type(scopes) = 'array'
+  AND NOT EXISTS (
+    SELECT 1
+    FROM json_each(api_keys.scopes)
+    WHERE value = 'self:usage'
+  );
+
+INSERT OR IGNORE INTO key_value (namespace, key, value)
+VALUES ('apiKeySelfService', 'usageScopesBackfilled', datetime('now'));

package/src/lib/db/migrations/076_create_plugins.sql

@@ -0,0 +1,31 @@
+-- 059: Plugin system tables
+-- WordPress-style plugin management with lifecycle tracking
+
+CREATE TABLE IF NOT EXISTS plugins (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL UNIQUE,
+  version TEXT NOT NULL DEFAULT '1.0.0',
+  description TEXT,
+  author TEXT,
+  license TEXT DEFAULT 'MIT',
+  main TEXT NOT NULL DEFAULT 'index.js',
+  source TEXT NOT NULL DEFAULT 'local',
+  tags TEXT DEFAULT '[]',
+  status TEXT NOT NULL DEFAULT 'installed'
+    CHECK (status IN ('installed', 'active', 'inactive', 'error')),
+  enabled INTEGER NOT NULL DEFAULT 0,
+  manifest TEXT NOT NULL,
+  config TEXT DEFAULT '{}',
+  config_schema TEXT DEFAULT '{}',
+  hooks TEXT DEFAULT '[]',
+  permissions TEXT DEFAULT '[]',
+  plugin_dir TEXT NOT NULL,
+  error_message TEXT,
+  installed_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  activated_at TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_plugins_status ON plugins(status);
+CREATE INDEX IF NOT EXISTS idx_plugins_enabled ON plugins(enabled);
+CREATE INDEX IF NOT EXISTS idx_plugins_name ON plugins(name);

package/src/lib/db/migrations/077_api_key_stream_default_mode.sql

@@ -0,0 +1,3 @@
+-- 077: Per-API-key default for omitted chat completion stream flags.
+
+ALTER TABLE api_keys ADD COLUMN stream_default_mode TEXT NOT NULL DEFAULT 'legacy';

package/src/lib/db/migrations/078_quota_consumption.sql

@@ -0,0 +1,24 @@
+-- Migration 074: quota_consumption — Sliding Window Counter storage
+--
+-- Stores per-(api_key_id, dimension_key) consumption using 2-bucket sliding
+-- window counters. dimension_key format: "<poolId>:<unit>:<window>".
+-- bucket_index = floor(now_ms / window_ms). consumed and updated_at are
+-- updated atomically via UPSERT (INSERT ... ON CONFLICT DO UPDATE).
+-- Idempotent: safe to run more than once.
+--
+-- Part of: Group B — Quota Sharing Engine (plan 22, frente F2).
+
+CREATE TABLE IF NOT EXISTS quota_consumption (
+  api_key_id TEXT NOT NULL,
+  dimension_key TEXT NOT NULL,
+  bucket_index INTEGER NOT NULL,
+  consumed REAL NOT NULL DEFAULT 0,
+  updated_at INTEGER NOT NULL,            -- epoch ms
+  PRIMARY KEY (api_key_id, dimension_key, bucket_index)
+);
+
+CREATE INDEX IF NOT EXISTS idx_quota_consumption_dim_bucket
+  ON quota_consumption(dimension_key, bucket_index);
+
+CREATE INDEX IF NOT EXISTS idx_quota_consumption_updated_at
+  ON quota_consumption(updated_at);

package/src/lib/db/migrations/079_provider_plans.sql

@@ -0,0 +1,19 @@
+-- Migration 075: provider_plans — per-connection quota plan overrides
+--
+-- Stores manual or auto-detected quota plans for a specific provider
+-- connection. dimensions_json holds a JSON array of QuotaDimension objects
+-- ({ unit, window, limit }). source distinguishes auto-detected plans from
+-- operator-configured overrides. Idempotent: safe to run more than once.
+--
+-- Part of: Group B — Quota Sharing Engine (plan 22, frente F2).
+
+CREATE TABLE IF NOT EXISTS provider_plans (
+  connection_id TEXT PRIMARY KEY,           -- 1:1 with provider_connections; NULL not allowed since it is PK
+  provider TEXT NOT NULL,
+  dimensions_json TEXT NOT NULL,            -- JSON array of QuotaDimension
+  source TEXT NOT NULL CHECK (source IN ('auto','manual')) DEFAULT 'manual',
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_provider_plans_provider
+  ON provider_plans(provider);

package/src/lib/db/migrations/080_agent_bridge.sql

@@ -0,0 +1,24 @@
+CREATE TABLE IF NOT EXISTS agent_bridge_state (
+  agent_id TEXT PRIMARY KEY,
+  dns_enabled INTEGER NOT NULL DEFAULT 0,
+  cert_trusted INTEGER NOT NULL DEFAULT 0,
+  setup_completed INTEGER NOT NULL DEFAULT 0,
+  last_started_at TEXT,
+  last_error TEXT
+);
+
+CREATE TABLE IF NOT EXISTS agent_bridge_mappings (
+  agent_id TEXT NOT NULL,
+  source_model TEXT NOT NULL,
+  target_model TEXT NOT NULL,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (agent_id, source_model)
+);
+
+CREATE TABLE IF NOT EXISTS agent_bridge_bypass (
+  pattern TEXT PRIMARY KEY,
+  source TEXT NOT NULL CHECK (source IN ('default','user')),
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_agent_bridge_mappings_agent ON agent_bridge_mappings(agent_id);

package/src/lib/db/migrations/081_inspector_custom_hosts.sql

@@ -0,0 +1,11 @@
+CREATE TABLE IF NOT EXISTS inspector_custom_hosts (
+  host TEXT PRIMARY KEY,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  label TEXT,
+  kind TEXT NOT NULL DEFAULT 'custom' CHECK (kind IN ('llm','app','custom')),
+  added_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  last_seen_at TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_inspector_custom_hosts_enabled
+  ON inspector_custom_hosts(enabled);

package/src/lib/db/migrations/082_inspector_sessions.sql

@@ -0,0 +1,18 @@
+CREATE TABLE IF NOT EXISTS inspector_sessions (
+  id TEXT PRIMARY KEY,
+  name TEXT,
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  request_count INTEGER NOT NULL DEFAULT 0,
+  profile TEXT CHECK (profile IN ('llm','custom','all'))
+);
+
+CREATE TABLE IF NOT EXISTS inspector_session_requests (
+  session_id TEXT NOT NULL REFERENCES inspector_sessions(id) ON DELETE CASCADE,
+  seq INTEGER NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (session_id, seq)
+);
+
+CREATE INDEX IF NOT EXISTS idx_inspector_session_requests_sid
+  ON inspector_session_requests(session_id);

package/src/lib/db/migrations/083_memory_vec.sql

@@ -0,0 +1,26 @@
+-- 073_memory_vec.sql
+-- Memory Engine Redesign (plan 21): metadata table for sqlite-vec.
+-- The actual virtual table `vec_memories(memory_id INTEGER, embedding float[N])`
+-- is created in runtime by src/lib/memory/vectorStore.ts because N depends on
+-- the active embedding model (which can change at any time via UI).
+
+CREATE TABLE IF NOT EXISTS memory_vec_meta (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  active_dim INTEGER,
+  embedding_signature TEXT,
+  last_reset_at TEXT,
+  vec_loaded INTEGER NOT NULL DEFAULT 0
+);
+
+INSERT OR IGNORE INTO memory_vec_meta (id, active_dim, embedding_signature, last_reset_at, vec_loaded)
+VALUES (1, NULL, NULL, NULL, 0);
+
+-- Add needs_reindex column to memories (idempotent via separate ALTER guarded by PRAGMA).
+-- The PRAGMA-guard pattern is handled in the migration runner; here we just ensure the
+-- column shape. If the column already exists, the ALTER fails silently and the runner
+-- treats the migration as a no-op for that ALTER step.
+ALTER TABLE memories ADD COLUMN needs_reindex INTEGER NOT NULL DEFAULT 0;
+
+CREATE INDEX IF NOT EXISTS idx_memories_needs_reindex
+  ON memories(needs_reindex)
+  WHERE needs_reindex = 1;

package/src/lib/db/migrations/084_playground_presets.sql

@@ -0,0 +1,15 @@
+CREATE TABLE IF NOT EXISTS playground_presets (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  endpoint TEXT NOT NULL,
+  model TEXT NOT NULL,
+  system TEXT,
+  params_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_playground_presets_name
+  ON playground_presets(name);
+
+CREATE INDEX IF NOT EXISTS idx_playground_presets_endpoint
+  ON playground_presets(endpoint);

package/src/lib/db/migrations/085_quota_pools.sql

@@ -0,0 +1,39 @@
+-- Migration 085: quota_pools + quota_allocations
+--
+-- Renumbered from 077 → 085 (#2900 sibling fix): 077 collided with
+-- 077_api_key_stream_default_mode.sql, which made getMigrationFiles() throw a
+-- version-collision error and blocked getDbInstance() at startup. quota_pools
+-- has no dependents (no other migration references these tables) and is fully
+-- idempotent, so it can safely move to the next free number. DBs that already
+-- applied it under the old 077 number are guarded in isSchemaAlreadyApplied
+-- (case "085").
+--
+-- Creates the two tables that persist quota-sharing pools and per-API-key
+-- allocations within each pool. Idempotent: safe to run more than once.
+-- Foreign key ON DELETE CASCADE ensures allocations are removed when a pool
+-- is deleted. Weight is stored as REAL (0-100 %).
+--
+-- Part of: Group B — Quota Sharing Engine (plan 22, frente F2).
+
+CREATE TABLE IF NOT EXISTS quota_pools (
+  id TEXT PRIMARY KEY,
+  connection_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_quota_pools_connection
+  ON quota_pools(connection_id);
+
+CREATE TABLE IF NOT EXISTS quota_allocations (
+  pool_id TEXT NOT NULL REFERENCES quota_pools(id) ON DELETE CASCADE,
+  api_key_id TEXT NOT NULL,
+  weight REAL NOT NULL CHECK (weight >= 0 AND weight <= 100),
+  cap_value REAL,
+  cap_unit TEXT CHECK (cap_unit IN ('percent','requests','tokens','usd')),
+  policy TEXT NOT NULL CHECK (policy IN ('hard','soft','burst')) DEFAULT 'hard',
+  PRIMARY KEY (pool_id, api_key_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_quota_allocations_apikey
+  ON quota_allocations(api_key_id);

package/src/lib/db/migrations/086_api_key_allowed_quotas.sql

@@ -0,0 +1,8 @@
+-- 085: Per-API-key quota-pool allow-list (Phase A1 — Quota Share redesign).
+--
+-- Adds `allowed_quotas` as a JSON TEXT array of quota-pool IDs. Empty array
+-- means no quota-pool restriction (all pools accessible). Non-empty array
+-- limits the key to the listed pool IDs only (enforcement added in Phase A2).
+-- Idempotent via ADD COLUMN; safe to run more than once on older schemas.
+
+ALTER TABLE api_keys ADD COLUMN allowed_quotas TEXT NOT NULL DEFAULT '[]';

package/src/lib/db/migrations/087_quota_pool_connections.sql

@@ -0,0 +1,21 @@
+-- 086: Multi-provider quota pools — quota_pool_connections join table (Phase D1).
+--
+-- A quota pool can now span N provider connections (multi-provider). The legacy
+-- quota_pools.connection_id column stays as the "primary" connection for
+-- backwards compatibility. This table is the authoritative membership list.
+-- Idempotent via CREATE TABLE/INDEX IF NOT EXISTS + INSERT OR IGNORE.
+
+CREATE TABLE IF NOT EXISTS quota_pool_connections (
+  pool_id       TEXT NOT NULL,
+  connection_id TEXT NOT NULL,
+  created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (pool_id, connection_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_quota_pool_connections_pool
+  ON quota_pool_connections(pool_id);
+
+-- Backfill: every existing pool's single connection_id becomes its first member.
+INSERT OR IGNORE INTO quota_pool_connections (pool_id, connection_id)
+  SELECT id, connection_id FROM quota_pools
+  WHERE connection_id IS NOT NULL AND connection_id <> '';

package/src/lib/db/migrations/088_quota_groups.sql

@@ -0,0 +1,28 @@
+-- 087: Quota pool groups — quota_groups table + quota_pools.group_id (Part B1).
+--
+-- Introduces a first-class Group entity that organises quota pools.
+-- A key allocated to any pool of a group sees and may use every model
+-- of every pool in that group (scope/enforce wired in subsequent tasks).
+-- Idempotent via CREATE TABLE/INSERT OR IGNORE (new table) + the migration
+-- runner's "duplicate column name" catch (ALTER TABLE ADD COLUMN).
+-- The UPDATE backfill is a safe no-op after the first run (group_id is
+-- already non-NULL for all rows).
+
+CREATE TABLE IF NOT EXISTS quota_groups (
+  id         TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Seed a default group so the UI always has at least one to select.
+-- Stable id ensures this INSERT is idempotent on any subsequent run.
+INSERT OR IGNORE INTO quota_groups (id, name) VALUES ('group-demo', 'GroupDemo');
+
+-- Add group_id to pools (nullable; backfilled below).
+-- Re-run safety: the migration runner catches "duplicate column name" and
+-- marks the migration as applied without re-executing the rest of the file,
+-- so the UPDATE below only runs on the first application.
+ALTER TABLE quota_pools ADD COLUMN group_id TEXT;
+
+-- Backfill: assign every existing pool with no group to the default group.
+UPDATE quota_pools SET group_id = 'group-demo' WHERE group_id IS NULL OR group_id = '';

package/src/lib/db/migrations/089_add_disable_non_public_to_api_keys.sql

@@ -0,0 +1,3 @@
+-- Migration: Add disable_non_public_models to api_keys
+-- Description: Adds a flag to restrict API keys to discovered and public models.
+ALTER TABLE api_keys ADD COLUMN disable_non_public_models INTEGER NOT NULL DEFAULT 0;

package/src/lib/db/migrations/090_plugin_metrics.sql

@@ -0,0 +1,9 @@
+CREATE TABLE IF NOT EXISTS plugin_metrics (
+  plugin_name TEXT NOT NULL,
+  event TEXT NOT NULL,
+  calls INTEGER NOT NULL DEFAULT 0,
+  errors INTEGER NOT NULL DEFAULT 0,
+  total_duration_ms REAL NOT NULL DEFAULT 0,
+  last_called_at TEXT,
+  PRIMARY KEY (plugin_name, event)
+);

package/src/lib/db/migrations/091_plugin_analytics.sql

@@ -0,0 +1,23 @@
+-- Migration 091: plugin_analytics — per-execution records for plugin hooks.
+--
+-- PR #2913 (plugin framework). The original PR shipped this table only as a
+-- non-canonical stray under db/migrations/079_plugin_analytics.sql (a path the
+-- migration runner does not read) and its tests created the table inline, so
+-- recordPluginExecution()/getPluginAnalytics() in src/lib/db/plugins.ts would
+-- fail at runtime in production ("no such table: plugin_analytics"). This
+-- canonical migration creates it. Idempotent: safe to run more than once.
+--
+-- Schema matches src/lib/db/plugins.ts (INSERT/SELECT columns) exactly.
+
+CREATE TABLE IF NOT EXISTS plugin_analytics (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  plugin_name TEXT NOT NULL,
+  hook TEXT NOT NULL,
+  duration_ms INTEGER NOT NULL DEFAULT 0,
+  success INTEGER NOT NULL DEFAULT 1,
+  error_message TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_analytics_name ON plugin_analytics(plugin_name);
+CREATE INDEX IF NOT EXISTS idx_plugin_analytics_created ON plugin_analytics(created_at);

package/src/lib/db/migrations/092_api_key_context_sources.sql

@@ -0,0 +1,13 @@
+-- Per-API-key context source configuration (Obsidian, Notion, etc.)
+CREATE TABLE IF NOT EXISTS api_key_context_sources (
+  api_key_id TEXT NOT NULL,
+  source_type TEXT NOT NULL,
+  token TEXT,
+  base_url TEXT,
+  vault_path TEXT,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (api_key_id, source_type),
+  FOREIGN KEY (api_key_id) REFERENCES api_keys(id) ON DELETE CASCADE
+);

package/src/lib/db/migrations/093_proxy_enable_toggles.sql

@@ -0,0 +1,17 @@
+-- 062_proxy_enable_toggles.sql
+-- Add per-connection proxy enable/disable toggle to support the
+-- proxy enable/disable feature with auto-selection fallback.
+--
+-- New column:
+--   proxy_enabled — 1=proxy enabled for this connection, 0=disabled (default 1 for backward compat)
+--
+-- The global proxy on/off toggle lives in the settings namespace (key: proxyEnabled).
+-- This per-connection column provides finer-grained control at the provider level.
+
+ALTER TABLE provider_connections ADD COLUMN proxy_enabled INTEGER NOT NULL DEFAULT 1;
+
+-- Set proxy_enabled=1 for all existing rows to preserve backward compatibility.
+-- Before this migration, proxy was implicitly enabled (no toggle existed).
+-- This UPDATE runs on the initial migration apply; on re-runs the ALTER TABLE
+-- above fails with "duplicate column" and the migration runner skips the rest.
+UPDATE provider_connections SET proxy_enabled = 1 WHERE proxy_enabled = 0;

package/src/lib/db/migrations/094_per_key_proxy_toggles.sql

@@ -0,0 +1,12 @@
+-- 063_per_key_proxy_toggles.sql
+-- Add per-connection toggle for per-key proxy assignment.
+-- When enabled, each API key under this connection can use its own proxy
+-- (from api_keys.proxy_id) instead of the connection-level proxy.
+--
+-- New column:
+--   per_key_proxy_enabled — 1=allow per-key proxy assignment, 0=disabled (default)
+--
+-- The global per-key proxy toggle lives in the settings namespace
+-- (key: perKeyProxyEnabled).
+
+ALTER TABLE provider_connections ADD COLUMN per_key_proxy_enabled INTEGER NOT NULL DEFAULT 0;

package/src/lib/db/migrations/095_provider_node_custom_headers.sql

@@ -0,0 +1,5 @@
+-- Add custom_headers_json column to provider_nodes
+-- Stores JSON object of custom HTTP headers to send with requests to this provider
+-- NULL = no custom headers (backward compatible)
+-- Column uses _json suffix so rowToCamel auto-parses it
+ALTER TABLE provider_nodes ADD COLUMN custom_headers_json TEXT;

package/src/lib/db/migrations/096_sync_context_cache_protection.sql

@@ -0,0 +1,9 @@
+-- 096_sync_context_cache_protection.sql
+-- Sync the context_cache_protection column with the JSON blob for existing combos.
+-- Before this migration, the column was never written by the API, so existing rows
+-- have 0 (from ADD COLUMN DEFAULT 0) even when the JSON blob has it set to true.
+-- This migration brings them in sync so the column becomes the authoritative source.
+UPDATE combos
+SET context_cache_protection = 1
+WHERE json_extract(data, '$.context_cache_protection') = 1
+  AND (context_cache_protection IS NULL OR context_cache_protection = 0);