cartethyia 2.5.9 → 2.6.0

package/dist/dashboard/precompressed-assets.json

@@ -2,72 +2,72 @@
   "count": 114,
   "assets": [
     "assets\\AccountCooldown-Bjo92Qat.js",
-    "assets\\BannedPage-Brvuj_Eb.js",
-    "assets\\CliToolDetailPage-CqfXtI3y.js",
-    "assets\\CliToolsPage-GQeS91bg.js",
-    "assets\\CombosPage-BDRsTXBB.js",
-    "assets\\ConsoleLogPage-zP8AFHX0.js",
-    "assets\\CustomizationPage-BmfrNZ14.js",
-    "assets\\HealthEventsModal-Dn3M6WZc.js",
-    "assets\\LoginPage-DoreIgm8.js",
-    "assets\\ModelPicker-C7pDb41R.js",
-    "assets\\OverviewPage-CvvD1Ugk.js",
-    "assets\\ProviderDetailPage-Clbn1gsW.js",
+    "assets\\BannedPage-l6XMnfr9.js",
+    "assets\\CliToolDetailPage-DwOzAW45.js",
+    "assets\\CliToolsPage-BT3Up3QA.js",
+    "assets\\CombosPage-6kYIUpzR.js",
+    "assets\\ConsoleLogPage-zRnj1mlR.js",
+    "assets\\CustomizationPage-C7m-H1Rz.js",
+    "assets\\HealthEventsModal-C8MR_BdB.js",
+    "assets\\LoginPage-CbphLvjg.js",
+    "assets\\ModelPicker-DVny4S5_.js",
+    "assets\\OverviewPage-DABu2Wgt.js",
+    "assets\\ProviderDetailPage-C15x9q13.js",
     "assets\\ProviderIcon-CmfzxpVM.js",
-    "assets\\ProvidersPage-BnoPgA7w.js",
-    "assets\\ProxyPage-Bq_TGgdb.js",
-    "assets\\QuotaPage-D9DHXvom.js",
-    "assets\\SettingsPage-7xV8WkWL.js",
-    "assets\\SetupPage-Day3mCOn.js",
-    "assets\\SortableList-DQxllnB5.js",
-    "assets\\StudioPage-uMExoWu1.js",
+    "assets\\ProvidersPage-Dfb2896L.js",
+    "assets\\ProxyPage-BaCIdAUt.js",
+    "assets\\QuotaPage-BsdoCIw1.js",
+    "assets\\SettingsPage-KVJFh3Ip.js",
+    "assets\\SetupPage-D4g6vOGc.js",
+    "assets\\SortableList-C93i14BD.js",
+    "assets\\StudioPage-SgQpymjm.js",
     "assets\\ToolIcon-K1ckcDKg.js",
-    "assets\\UsagePage-DXa1oR-4.js",
-    "assets\\api-keys-DQYLQxpW.js",
-    "assets\\app-BIt446yE.js",
-    "assets\\app-CX_Z8cMs.css",
+    "assets\\UsagePage-BFME-eba.js",
+    "assets\\api-keys-C23S9sgp.js",
+    "assets\\app-2KhtHCv9.js",
+    "assets\\app-CEeaMHOy.css",
     "assets\\arrow-left-CpBxkoxI.js",
     "assets\\arrow-right-Dl5yKnp8.js",
-    "assets\\assert-C9FD_JwJ.js",
+    "assets\\assert-DU6qrMA_.js",
     "assets\\backup-file-gdKIlg8U.js",
-    "assets\\badge-CR72dasT.js",
-    "assets\\banner-CI9_eSfO.js",
+    "assets\\badge-CKsF123d.js",
+    "assets\\banner-8j7uChA9.js",
     "assets\\brain-Cwed_72z.js",
-    "assets\\card-DS7CQEsO.js",
+    "assets\\card-CdsSlWA3.js",
     "assets\\chevron-right-BXIy5l3h.js",
     "assets\\circle-alert-CntYHV5v.js",
     "assets\\circle-check-BU3v_mFW.js",
-    "assets\\cli-tools-CNqzrfdb.js",
-    "assets\\clipboard-button-611pSsaX.js",
+    "assets\\cli-tools-BaFUuFFF.js",
+    "assets\\clipboard-button-uL5aYLfW.js",
     "assets\\cog-CdWhsajs.js",
     "assets\\concurrency-BDF0ok7y.js",
     "assets\\database-Dz9N3zGd.js",
+    "assets\\dialog-C07hr5_G.js",
     "assets\\dialog-actions-B1axpEg7.js",
-    "assets\\dialog-k37exjNt.js",
     "assets\\download-dRFo5_Wu.js",
-    "assets\\drawer-CX7N8ucR.js",
-    "assets\\entry-B9Xvtnfj.js",
-    "assets\\entry-ByMGkR3C.js",
-    "assets\\entry-CTP8AyiS.js",
+    "assets\\drawer-BPO1TcKH.js",
+    "assets\\entry-Bz_CtDfC.js",
+    "assets\\entry-CwPRKk0d.js",
+    "assets\\entry-GJRbmrpA.js",
     "assets\\eye-C_hawfH4.js",
     "assets\\eye-off-Bk5g2luF.js",
     "assets\\gauge-BbIMy7MB.js",
-    "assets\\github-badge-sltk1qUi.js",
+    "assets\\github-badge-DmQreSDd.js",
     "assets\\image-BPaouViG.js",
-    "assets\\index-z3zDOSMM.js",
-    "assets\\inline-BhY2sSnO.js",
-    "assets\\input-V1umFiBk.js",
+    "assets\\index-Bblu6erR.js",
+    "assets\\inline-C9dCYaBZ.js",
+    "assets\\input-CjCnXweJ.js",
     "assets\\jsx-runtime-CXUMngI_.js",
     "assets\\key-round-UkavsGxp.js",
     "assets\\layers-2-glBbjl.js",
-    "assets\\layout-BBOYycyS.js",
-    "assets\\list-row-1zzZYM0B.js",
-    "assets\\live-BivGfuUs.js",
+    "assets\\layout-V6y8DAkl.js",
+    "assets\\list-row-CM1AaG_y.js",
+    "assets\\live-ta6GMb-8.js",
     "assets\\log-in-BmRjy60c.js",
     "assets\\message-circle-CCxGwRvv.js",
-    "assets\\model-bans-CmffjLuG.js",
-    "assets\\mutation-46P0oWMe.js",
-    "assets\\numbers-DkfMR5Qs.js",
+    "assets\\model-bans-BmYTmbAk.js",
+    "assets\\mutation-g_fduiNw.js",
+    "assets\\numbers-BOevJzdz.js",
     "assets\\pencil-768ysRAr.js",
     "assets\\plus-DIdX_g-x.js",
     "assets\\power-off-Yjw9GMJh.js",
@@ -89,21 +89,21 @@
     "assets\\providers\\parallel.svg",
     "assets\\providers\\tokenharbor.svg",
     "assets\\providers\\zai-coding-plan.svg",
-    "assets\\query-keys-BFhGpwR1.js",
+    "assets\\query-keys-UETqfytp.js",
     "assets\\quota-DZGyp0N5.js",
     "assets\\refresh-cw-BqJFk4sU.js",
     "assets\\rotate-ccw-CufcqITi.js",
     "assets\\route-CNSNj9Zm.js",
-    "assets\\routing-CAb4F37R.js",
+    "assets\\routing-BPUo-W8d.js",
     "assets\\scaling-nWE4Cx8f.js",
     "assets\\search-JOKus9rb.js",
-    "assets\\select-C6MMiaio.js",
-    "assets\\settings-DNX9sydi.js",
+    "assets\\select-C980c4cz.js",
+    "assets\\settings--3hxSyry.js",
     "assets\\shield-check-DVS0Foqh.js",
-    "assets\\stack-BHTfXdz_.js",
-    "assets\\state-mPDRlQkl.js",
+    "assets\\stack-_gfTdLVB.js",
+    "assets\\state-2c5V4zo7.js",
     "assets\\stream-retry-5QnVuSSo.js",
-    "assets\\switch-DOmJxg7H.js",
+    "assets\\switch-Dkke7Naf.js",
     "assets\\terminal-0_IjPWTk.js",
     "assets\\tokens-COzario9.js",
     "assets\\trash-Cppn5c3R.js",
@@ -111,7 +111,7 @@
     "assets\\use-modal-focus-By7oJoGd.js",
     "assets\\use-reduced-motion-C4B0R6Sz.js",
     "assets\\use-timeout-BwcBBRrT.js",
-    "assets\\useMutation-Dem0lXQj.js",
+    "assets\\useMutation-EDFRkn1i.js",
     "assets\\wrench-B6E1oEuY.js",
     "assets\\zap-C4EeVW4q.js",
     "index.html"

package/migrations/README.md

@@ -1,52 +1,52 @@
-# Database baselines
-
-Cartethyia keeps one SQL baseline per database backend:
-
-- `full-postgres/0000_baseline.sql` defines the foundational PostgreSQL schema
-  for a new database.
-- `lite-sqlite3/0000_baseline.sql` is generated from the PostgreSQL baseline by
-  `scripts/tools/generate-sqlite.ts`; do not edit it by hand.
-
-The startup runner applies the baseline and numbered forward migrations,
-recording them in `cartethyia_schema_migrations` along with a hash marker for
-the exact baseline contents. Released baselines are immutable so existing
-installations keep matching their marker; numbered migrations bring that
-foundational schema up to the current schema. Each backend's migrations must
-have matching behavior. Startup fails with a recovery instruction for a
-database with unsupported retired migration history instead of treating it as
-current.
-
-## Recovering an existing installation
-
-1. Export a backup from the existing installation before switching it to a
-   release with unsupported migration history.
-2. Create a fresh database and point the application at it.
-3. Start the application so it creates the baseline schema.
-4. Restore the backup through the console restore flow.
-
-Restore normalizes legacy values that no longer satisfy current constraints,
-including `bypass_proxy` → `skip_proxy`, `bridge` → `https`, the retired
-provider User-Agent default, Cline's skip-proxy default, and `fusion` →
-`fallback`. Unknown or retired columns are reported and skipped according to
-the backup contract.
-
-Do not point tests or recovery steps at development or production databases.
-The startup path runs `ensureMigrated()` before provider/catalog seeding. Full
-mode uses `src/persistence/db-pg.ts` and an advisory lock; Lite uses
-`src/persistence/db-sqlite.ts`. Readiness compares the ledger to the available baseline and forward migration
-files. A failed migration aborts startup and is not recorded.
-
-Migrations are package assets, not resolved from the process working directory:
-`src/config/package-paths.ts` resolves them from the package root. `package.json`
-includes `migrations/` in the published files, and the Dockerfile copies the
-migration directories into `/app/migrations`.
-
-## Next schema change
-
-1. Update `src/persistence/schema.ts` and add matching numbered migrations to
-   both backends. Preserve released baseline files so existing baseline markers
-   remain valid.
-2. Update backup validation/mapping when old exported rows need normalization
-   or new required values.
-3. Run focused migration, restore, and typecheck tests. Validate against an
-   isolated database only.
+# Database baselines
+
+Cartethyia keeps one SQL baseline per database backend:
+
+- `full-postgres/0000_baseline.sql` defines the foundational PostgreSQL schema
+  for a new database.
+- `lite-sqlite3/0000_baseline.sql` is generated from the PostgreSQL baseline by
+  `scripts/tools/generate-sqlite.ts`; do not edit it by hand.
+
+The startup runner applies the baseline and numbered forward migrations,
+recording them in `cartethyia_schema_migrations` along with a hash marker for
+the exact baseline contents. Released baselines are immutable so existing
+installations keep matching their marker; numbered migrations bring that
+foundational schema up to the current schema. Each backend's migrations must
+have matching behavior. Startup fails with a recovery instruction for a
+database with unsupported retired migration history instead of treating it as
+current.
+
+## Recovering an existing installation
+
+1. Export a backup from the existing installation before switching it to a
+   release with unsupported migration history.
+2. Create a fresh database and point the application at it.
+3. Start the application so it creates the baseline schema.
+4. Restore the backup through the console restore flow.
+
+Restore normalizes legacy values that no longer satisfy current constraints,
+including `bypass_proxy` → `skip_proxy`, `bridge` → `https`, the retired
+provider User-Agent default, Cline's skip-proxy default, and `fusion` →
+`fallback`. Unknown or retired columns are reported and skipped according to
+the backup contract.
+
+Do not point tests or recovery steps at development or production databases.
+The startup path runs `ensureMigrated()` before provider/catalog seeding. Full
+mode uses `src/persistence/db-pg.ts` and an advisory lock; Lite uses
+`src/persistence/db-sqlite.ts`. Readiness compares the ledger to the available baseline and forward migration
+files. A failed migration aborts startup and is not recorded.
+
+Migrations are package assets, not resolved from the process working directory:
+`src/config/package-paths.ts` resolves them from the package root. `package.json`
+includes `migrations/` in the published files, and the Dockerfile copies the
+migration directories into `/app/migrations`.
+
+## Next schema change
+
+1. Update `src/persistence/schema.ts` and add matching numbered migrations to
+   both backends. Preserve released baseline files so existing baseline markers
+   remain valid.
+2. Update backup validation/mapping when old exported rows need normalization
+   or new required values.
+3. Run focused migration, restore, and typecheck tests. Validate against an
+   isolated database only.

package/migrations/full-postgres/0020_add_telemetry_event_analytics.sql

@@ -0,0 +1,77 @@
+-- Telemetry analytics: the console's read-side cutover to `telemetry_events`.
+--
+-- The durable, indexed SQL store already receives every event; the console
+-- reader ignored it and scanned the raw JSONL window instead (the regression
+-- this fixes). These changes make the SQL store the canonical analytics
+-- source:
+--
+-- - `client_name`: the canonical `clientNameFromUserAgent()` result, stamped
+--   at ingestion so client breakdowns group in SQL instead of in JavaScript
+--   over every row in the window.
+-- - `UNIQUE (tenant_id, request_id)`: the cross-process idempotency boundary.
+--   One terminal event per request; probes mint their own request UUIDs.
+--   `INSERT ... ON CONFLICT DO NOTHING` makes a retried drain or a
+--   cross-process race converge to one row and one usage charge.
+-- - Keyset pagination index `(tenant_id, created_at DESC, id DESC)`: the
+--   `(tenant_id, created_at)` index it replaces cannot break ties
+--   deterministically (created_at is second-resolution), so a cursor on
+--   created_at alone could skip or repeat rows at a boundary.
+-- - Status and api-key breakdown indexes: the Usage chart and per-key family
+--   spend filter on exactly these columns; without them each query scans the
+--   tenant's whole retained window.
+--
+-- No dimension indexes beyond these without measured query plans. No
+-- `CREATE INDEX CONCURRENTLY`: the transactional runner cannot run it, and
+-- this migration runs at startup with no traffic to serve concurrently with.
+
+ALTER TABLE "telemetry_events"
+  ADD COLUMN IF NOT EXISTS "client_name" text;
+
+-- One terminal event per (tenant, request). Existing duplicates, if any,
+-- cannot exist under the old writer (one row per request per tenant), but the
+-- index creation is guarded defensively: a pre-existing violation would fail
+-- startup loudly rather than silently double-charging.
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "telemetry_events_tenant_request_uidx"
+  ON "telemetry_events" ("tenant_id", "request_id");
+--> statement-breakpoint
+DROP INDEX IF EXISTS "telemetry_events_tenant_created_idx";
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_created_id_idx"
+  ON "telemetry_events" ("tenant_id", "created_at" DESC, "id" DESC);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_http_created_id_idx"
+  ON "telemetry_events" ("tenant_id", "http_status", "created_at" DESC, "id" DESC);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_api_key_created_id_idx"
+  ON "telemetry_events" ("tenant_id", "api_key_id", "created_at" DESC, "id" DESC);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "telemetry_reconciliation_state" (
+  "job_name" text PRIMARY KEY,
+  "lease_owner" text,
+  "lease_expires_at" timestamp with time zone,
+  "file_name" text NOT NULL DEFAULT '',
+  "byte_offset" bigint NOT NULL DEFAULT 0,
+  "files_completed" bigint DEFAULT 0,
+  "events_examined" bigint DEFAULT 0,
+  "events_inserted" bigint DEFAULT 0,
+  "conflicts" bigint DEFAULT 0,
+  "updated_at" timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT "telemetry_reconciliation_state_offset_nonneg" CHECK ("byte_offset" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_files_nonneg" CHECK ("files_completed" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_examined_nonneg" CHECK ("events_examined" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_inserted_nonneg" CHECK ("events_inserted" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_conflicts_nonneg" CHECK ("conflicts" >= 0)
+);
+
+--> statement-breakpoint
+-- Align the payload storage CHECK with the schema: the `jsonb-file` binary
+-- header shape was fully retired (nothing reads or writes it; the reader
+-- treats anything that is not a base64-gzip line as not-a-frame). The
+-- baseline's two-value constraint drifted from schema.ts's single-value
+-- constraint at the initial release and is reconciled here.
+ALTER TABLE "telemetry_payloads"
+  DROP CONSTRAINT IF EXISTS "telemetry_payloads_storage_check";
+--> statement-breakpoint
+ALTER TABLE "telemetry_payloads"
+  ADD CONSTRAINT "telemetry_payloads_storage_check" CHECK ("storage" = 'jsonl-file');

package/migrations/full-postgres/0021_add_api_key_concurrency_tolerance.sql

@@ -0,0 +1,13 @@
+-- Slack above a key's concurrency limit.
+--
+-- `max_concurrent_requests` is the number an operator chose and the number a
+-- refusal names. This is deliberate allowance above it: a run that lands a few
+-- requests over is not refused at the number it was told. The effective ceiling
+-- is `max_concurrent_requests + max_concurrent_tolerance`, and only requests
+-- past that are refused — never ones already admitted.
+--
+-- Nullable on purpose: absent means "no allowance", which keeps the existing
+-- behaviour for every key that has never seen this field. A default of 0 would
+-- be indistinguishable from unset and would need its own "is this a deliberate
+-- zero" question on every read.
+ALTER TABLE api_keys ADD COLUMN max_concurrent_tolerance integer;

package/migrations/full-postgres/0022_add_inferhub_config_key.sql

@@ -0,0 +1,17 @@
+-- InferHub `config_read` key.
+--
+-- Stored on its own row rather than in `provider_accounts.auth_state`, because
+-- `auth_state` is documented as the per-account non-secret upstream config and
+-- travels with the account through backup/restore. This value is a credential,
+-- so it lives here encrypted at rest and is reachable only through the InferHub
+-- market routes.
+--
+-- One row for the whole deployment: the key is a single operator credential,
+-- not a per-account one. `fingerprint` is a hash for change detection only —
+-- it is never used to verify the key, and the plaintext is never returned.
+CREATE TABLE IF NOT EXISTS inferhub_config_keys (
+  id text PRIMARY KEY,
+  ciphertext bytea NOT NULL,
+  fingerprint text NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT now()
+);

package/migrations/full-postgres/0023_drop_api_key_concurrency_tolerance.sql

@@ -0,0 +1,13 @@
+-- Concurrency slack is tenant-wide now, so the per-key column goes away.
+--
+-- The two used to stack: a key's own `max_concurrent_tolerance` won, and the
+-- tenant's `concurrencyTolerance` was only the answer for a key that had never
+-- been given one. One number in two places meant an operator setting the
+-- tenant-wide value could not tell why one key still refused early — the
+-- override was invisible from the Settings page that appears to own the number.
+--
+-- Dropped rather than left behind: a column nothing reads is still one an
+-- operator finds in a backup or a query and trusts. Keys that had an override
+-- now fall back to the tenant value, which is the behaviour every other key
+-- already had.
+ALTER TABLE api_keys DROP COLUMN max_concurrent_tolerance;

package/migrations/lite-sqlite3/0020_add_telemetry_event_analytics.sql

@@ -0,0 +1,69 @@
+-- Adds telemetry analytics (Lite / SQLite) — see the identically named
+-- PostgreSQL migration for why. Both backends must apply the same behavior;
+-- SQLite stores `uuid` as text and `timestamptz` as text.
+--
+-- Idempotency comes from the migration ledger, not from the statement: the
+-- runner records the file inside the same transaction, so a file that has
+-- already run is never re-executed. The baseline is generated from
+-- `0000_baseline.sql` alone and does not carry these changes.
+--
+-- NOTE: the runner already wraps each migration in a transaction, so this file
+-- must NOT issue BEGIN/COMMIT.
+ALTER TABLE "telemetry_events" ADD COLUMN "client_name" text;
+--> statement-breakpoint
+-- One terminal event per (tenant, request): the cross-process idempotency
+-- boundary. SQLite has no "IF NOT EXISTS" for indexes; the migration ledger
+-- guarantees single execution.
+CREATE UNIQUE INDEX "telemetry_events_tenant_request_uidx" ON "telemetry_events" ("tenant_id", "request_id");
+--> statement-breakpoint
+DROP INDEX "telemetry_events_tenant_created_idx";
+--> statement-breakpoint
+-- Keyset pagination: (created_at, id) DESC breaks ties deterministically.
+CREATE INDEX "telemetry_events_tenant_created_id_idx" ON "telemetry_events" ("tenant_id", "created_at" DESC, "id" DESC);
+--> statement-breakpoint
+CREATE INDEX "telemetry_events_tenant_http_created_id_idx" ON "telemetry_events" ("tenant_id", "http_status", "created_at" DESC, "id" DESC);
+--> statement-breakpoint
+CREATE INDEX "telemetry_events_tenant_api_key_created_id_idx" ON "telemetry_events" ("tenant_id", "api_key_id", "created_at" DESC, "id" DESC);
+--> statement-breakpoint
+CREATE TABLE "telemetry_reconciliation_state" (
+  "job_name" text PRIMARY KEY,
+  "lease_owner" text,
+  "lease_expires_at" text,
+  "file_name" text NOT NULL DEFAULT '',
+  "byte_offset" integer NOT NULL DEFAULT 0,
+  "files_completed" integer DEFAULT 0,
+  "events_examined" integer DEFAULT 0,
+  "events_inserted" integer DEFAULT 0,
+  "conflicts" integer DEFAULT 0,
+  "updated_at" text NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  CONSTRAINT "telemetry_reconciliation_state_offset_nonneg" CHECK ("byte_offset" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_files_nonneg" CHECK ("files_completed" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_examined_nonneg" CHECK ("events_examined" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_inserted_nonneg" CHECK ("events_inserted" >= 0),
+  CONSTRAINT "telemetry_reconciliation_state_conflicts_nonneg" CHECK ("conflicts" >= 0)
+);
+
+--> statement-breakpoint
+-- Align the payload storage CHECK with the schema (jsonb-file retired). A
+-- table's CHECK cannot be altered in place in SQLite: rebuild and copy.
+CREATE TABLE "telemetry_payloads_new" (
+  "id" text PRIMARY KEY NOT NULL,
+  "tenant_id" text NOT NULL,
+  "request_id" text,
+  "captured_at" text NOT NULL,
+  "expires_at" text NOT NULL,
+  "storage" text NOT NULL,
+  "file" text NOT NULL,
+  "offset" integer NOT NULL,
+  "length" integer NOT NULL,
+  "checksum" text NOT NULL,
+  "version" integer NOT NULL,
+  "stages" integer DEFAULT 0,
+  CONSTRAINT "telemetry_payloads_storage_check" CHECK ("storage" = 'jsonl-file')
+);
+--> statement-breakpoint
+INSERT INTO "telemetry_payloads_new" SELECT "id", "tenant_id", "request_id", "captured_at", "expires_at", "storage", "file", "offset", "length", "checksum", "version", "stages" FROM "telemetry_payloads";
+--> statement-breakpoint
+DROP TABLE "telemetry_payloads";
+--> statement-breakpoint
+ALTER TABLE "telemetry_payloads_new" RENAME TO "telemetry_payloads";

package/migrations/lite-sqlite3/0021_add_api_key_concurrency_tolerance.sql

@@ -0,0 +1,13 @@
+-- Slack above a key's concurrency limit.
+--
+-- `max_concurrent_requests` is the number an operator chose and the number a
+-- refusal names. This is deliberate allowance above it: a run that lands a few
+-- requests over is not refused at the number it was told. The effective ceiling
+-- is `max_concurrent_requests + max_concurrent_tolerance`, and only requests
+-- past that are refused — never ones already admitted.
+--
+-- Nullable on purpose: absent means "no allowance", which keeps the existing
+-- behaviour for every key that has never seen this field. A default of 0 would
+-- be indistinguishable from unset and would need its own "is this a deliberate
+-- zero" question on every read.
+ALTER TABLE api_keys ADD COLUMN max_concurrent_tolerance integer;

package/migrations/lite-sqlite3/0022_add_inferhub_config_key.sql

@@ -0,0 +1,17 @@
+-- InferHub `config_read` key.
+--
+-- Stored on its own row rather than in `provider_accounts.auth_state`, because
+-- `auth_state` is documented as the per-account non-secret upstream config and
+-- travels with the account through backup/restore. This value is a credential,
+-- so it lives here encrypted at rest and is reachable only through the InferHub
+-- market routes.
+--
+-- One row for the whole deployment: the key is a single operator credential,
+-- not a per-account one. `fingerprint` is a hash for change detection only —
+-- it is never used to verify the key, and the plaintext is never returned.
+CREATE TABLE IF NOT EXISTS inferhub_config_keys (
+  id text PRIMARY KEY,
+  ciphertext blob NOT NULL,
+  fingerprint text NOT NULL,
+  updated_at text DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')) NOT NULL
+);

package/migrations/lite-sqlite3/0023_drop_api_key_concurrency_tolerance.sql

@@ -0,0 +1,13 @@
+-- Concurrency slack is tenant-wide now, so the per-key column goes away.
+--
+-- The two used to stack: a key's own `max_concurrent_tolerance` won, and the
+-- tenant's `concurrencyTolerance` was only the answer for a key that had never
+-- been given one. One number in two places meant an operator setting the
+-- tenant-wide value could not tell why one key still refused early — the
+-- override was invisible from the Settings page that appears to own the number.
+--
+-- Dropped rather than left behind: a column nothing reads is still one an
+-- operator finds in a backup or a query and trusts. Keys that had an override
+-- now fall back to the tenant value, which is the behaviour every other key
+-- already had.
+ALTER TABLE api_keys DROP COLUMN max_concurrent_tolerance;