cartethyia 2.7.2 → 2.7.3

package/dist/dashboard/precompressed-assets.json

@@ -1,120 +1,122 @@
 {
-  "count": 115,
+  "count": 117,
   "assets": [
-    "assets\\AccountCooldown-Bjo92Qat.js",
-    "assets\\BannedPage-XaUmiBrC.js",
-    "assets\\CliToolDetailPage-CqD7QiLM.js",
-    "assets\\CliToolsPage-0XUo4UMn.js",
-    "assets\\CombosPage-CXGS_Ct-.js",
-    "assets\\ConsoleLogPage-DGnGNYnM.js",
-    "assets\\CustomizationPage-DAG5J9EY.js",
-    "assets\\HealthEventsModal-BKtAPYVF.js",
-    "assets\\LoginPage-BdmRLnq2.js",
-    "assets\\ModelPicker-BH8Tehdi.js",
-    "assets\\OverviewPage-CqMxibJB.js",
-    "assets\\ProviderDetailPage-CqMh2NRX.js",
-    "assets\\ProviderIcon-FB6yS4v1.js",
-    "assets\\ProvidersPage-B9uWu4Nz.js",
-    "assets\\ProxyPage-BoWOhpDO.js",
-    "assets\\QuotaPage-7P2n--Fv.js",
-    "assets\\SettingsPage-CxZ1fTkN.js",
-    "assets\\SetupPage-Co12Zzaw.js",
-    "assets\\SortableList-Dqf4zpS-.js",
-    "assets\\StudioPage-Byj2lAEm.js",
-    "assets\\ToolIcon-K1ckcDKg.js",
-    "assets\\UsagePage-CTkLAuRc.js",
-    "assets\\api-keys-CUi6UXsR.js",
-    "assets\\app-BaWd0puM.js",
-    "assets\\app-KvsUJUMF.css",
-    "assets\\arrow-left-CpBxkoxI.js",
-    "assets\\arrow-right-Dl5yKnp8.js",
-    "assets\\assert-67xXH5rf.js",
-    "assets\\backup-file-gdKIlg8U.js",
-    "assets\\badge-DC2L43Mj.js",
-    "assets\\banner-BBVcb0J3.js",
-    "assets\\brain-Cwed_72z.js",
-    "assets\\card-Cca1XC6G.js",
-    "assets\\chevron-right-BXIy5l3h.js",
-    "assets\\circle-alert-CntYHV5v.js",
-    "assets\\circle-check-BU3v_mFW.js",
-    "assets\\cli-tools-KvsWa1Jl.js",
-    "assets\\clipboard-button-DUzEbynq.js",
-    "assets\\concurrency-BDF0ok7y.js",
-    "assets\\database-Dz9N3zGd.js",
-    "assets\\dialog-DFvWhwTa.js",
-    "assets\\dialog-actions-B1axpEg7.js",
-    "assets\\download-dRFo5_Wu.js",
-    "assets\\drawer-CFM2sMX1.js",
-    "assets\\entry-Bqy8RFvM.js",
-    "assets\\entry-ClCMCWWQ.js",
-    "assets\\entry-_xHo5x6r.js",
-    "assets\\eye-C_hawfH4.js",
-    "assets\\eye-off-Bk5g2luF.js",
-    "assets\\formatters-CWWZ-uCZ.js",
-    "assets\\gauge-BbIMy7MB.js",
-    "assets\\github-badge-C9e8Ts7e.js",
-    "assets\\image-BPaouViG.js",
-    "assets\\index-DFVFrnWW.js",
-    "assets\\inline-BFUcvllj.js",
-    "assets\\input-C_ILAvBb.js",
-    "assets\\jsx-runtime-CXUMngI_.js",
-    "assets\\key-round-UkavsGxp.js",
-    "assets\\layers-2-glBbjl.js",
-    "assets\\layout-CBIyT6Rt.js",
-    "assets\\list-row-ebJ_-Nsb.js",
-    "assets\\live-D0mm--ME.js",
-    "assets\\log-in-BmRjy60c.js",
-    "assets\\message-circle-CCxGwRvv.js",
-    "assets\\minimize-2-D-MN8W8a.js",
-    "assets\\mutation-sMD965oO.js",
-    "assets\\numbers-BO9dKaFr.js",
-    "assets\\pencil-768ysRAr.js",
-    "assets\\plus-DIdX_g-x.js",
-    "assets\\power-off-Yjw9GMJh.js",
-    "assets\\privacy-mode-GM8bej85.js",
-    "assets\\providers\\agentrouter.svg",
-    "assets\\providers\\aihubmix.svg",
-    "assets\\providers\\alibaba-coding-plan.svg",
-    "assets\\providers\\alibaba.svg",
-    "assets\\providers\\antigravity.svg",
-    "assets\\providers\\bai.svg",
-    "assets\\providers\\blackbox.svg",
-    "assets\\providers\\claude-code.svg",
-    "assets\\providers\\exa.svg",
-    "assets\\providers\\gmi-cloud.svg",
-    "assets\\providers\\inception.svg",
-    "assets\\providers\\inferhub.svg",
-    "assets\\providers\\muse.svg",
-    "assets\\providers\\nous-research.svg",
-    "assets\\providers\\openai-light.svg",
-    "assets\\providers\\parallel.svg",
-    "assets\\providers\\tokenharbor.svg",
-    "assets\\providers\\zai-coding-plan.svg",
-    "assets\\query-keys-CfL_Zdoh.js",
-    "assets\\quota-DZGyp0N5.js",
-    "assets\\refresh-cw-BqJFk4sU.js",
-    "assets\\rotate-ccw-CufcqITi.js",
-    "assets\\route-CNSNj9Zm.js",
-    "assets\\routing-BnIpi1IJ.js",
-    "assets\\scaling-nWE4Cx8f.js",
-    "assets\\search-JOKus9rb.js",
-    "assets\\select-DBNVLdUu.js",
-    "assets\\settings-BAFhDgX8.js",
-    "assets\\shield-check-DVS0Foqh.js",
-    "assets\\stack-EMrOMt4I.js",
-    "assets\\state-CWoo7ty5.js",
-    "assets\\stream-retry-5QnVuSSo.js",
-    "assets\\switch-CCjT6IkF.js",
-    "assets\\terminal-0_IjPWTk.js",
-    "assets\\tokens-COzario9.js",
-    "assets\\trash-Cppn5c3R.js",
-    "assets\\use-clipboard-B0Sy03fE.js",
-    "assets\\use-modal-focus-By7oJoGd.js",
-    "assets\\use-reduced-motion-C4B0R6Sz.js",
-    "assets\\use-timeout-BwcBBRrT.js",
-    "assets\\useMutation-DjkLHUcE.js",
-    "assets\\wrench-B6E1oEuY.js",
-    "assets\\zap-C4EeVW4q.js",
+    "assets/AccountCooldown-Bjo92Qat.js",
+    "assets/BannedPage-2TJD37Hb.js",
+    "assets/CliToolDetailPage-xefJNRmJ.js",
+    "assets/CliToolsPage-Rj9iHQ3F.js",
+    "assets/CombosPage-JEbYJFxw.js",
+    "assets/ConsoleLogPage-C3xx_inM.js",
+    "assets/CustomizationPage-Dw306gJU.js",
+    "assets/HealthEventsModal-jaBo1TWV.js",
+    "assets/LoginPage-C4w7vea-.js",
+    "assets/ModelPicker-BtPcAfot.js",
+    "assets/OverviewPage-CGC5gNs1.js",
+    "assets/ProviderDetailPage-DQcthNGt.js",
+    "assets/ProviderIcon-FB6yS4v1.js",
+    "assets/ProvidersPage-0OsXRGXe.js",
+    "assets/ProxyPage-DdPc8slb.js",
+    "assets/QuotaPage-Ci5O4BnH.js",
+    "assets/SettingsPage-CDZjTt87.js",
+    "assets/SetupPage-BQS0Rx_u.js",
+    "assets/SortableList-BAL5npBC.js",
+    "assets/StudioPage-TP7voAQ0.js",
+    "assets/ToolIcon-K1ckcDKg.js",
+    "assets/UsagePage-Cj_fEzhg.js",
+    "assets/api-keys-MbI7e7rt.js",
+    "assets/app-B2vyPoII.css",
+    "assets/app-wvwCi4Eh.js",
+    "assets/arrow-left-CpBxkoxI.js",
+    "assets/arrow-right-Dl5yKnp8.js",
+    "assets/arrow-up-59ms1iiT.js",
+    "assets/assert-C0YYuZJ4.js",
+    "assets/backup-file-gdKIlg8U.js",
+    "assets/badge-B_DMpMJN.js",
+    "assets/banner-DMrMPmth.js",
+    "assets/brain-Cwed_72z.js",
+    "assets/card-Be5Uzamx.js",
+    "assets/chevron-right-BXIy5l3h.js",
+    "assets/circle-alert-CntYHV5v.js",
+    "assets/circle-check-BU3v_mFW.js",
+    "assets/cli-tools-muFRphDu.js",
+    "assets/clipboard-button-DOfrVmsi.js",
+    "assets/database-Dz9N3zGd.js",
+    "assets/dialog-C9omdjQt.js",
+    "assets/dialog-actions-B1axpEg7.js",
+    "assets/download-dRFo5_Wu.js",
+    "assets/drawer-Bm8WKaGY.js",
+    "assets/entry-DS90gUks.js",
+    "assets/entry-j40LJotO.js",
+    "assets/entry-q5HwZ8nN.js",
+    "assets/eye-C_hawfH4.js",
+    "assets/eye-off-Bk5g2luF.js",
+    "assets/fingerprint-pattern-BWuHtbW4.js",
+    "assets/formatters-BTScrQpe.js",
+    "assets/gauge-BbIMy7MB.js",
+    "assets/github-badge-Orjuzemr.js",
+    "assets/image-BPaouViG.js",
+    "assets/index-cPrX5vn6.js",
+    "assets/inline-Dvux8w-0.js",
+    "assets/input-CU1Rgf3p.js",
+    "assets/jsx-runtime-CXUMngI_.js",
+    "assets/key-round-UkavsGxp.js",
+    "assets/layers-2-glBbjl.js",
+    "assets/layout-C_7A6H55.js",
+    "assets/list-row-CzFvogbj.js",
+    "assets/live-KaG15HLQ.js",
+    "assets/log-in-BmRjy60c.js",
+    "assets/message-circle-CCxGwRvv.js",
+    "assets/minimize-2-D-MN8W8a.js",
+    "assets/mutation-JJGQm8TD.js",
+    "assets/numbers-BNDZnsUE.js",
+    "assets/pencil-768ysRAr.js",
+    "assets/plus-DIdX_g-x.js",
+    "assets/power-off-Yjw9GMJh.js",
+    "assets/privacy-mode-GM8bej85.js",
+    "assets/providers/agentrouter.svg",
+    "assets/providers/aihubmix.svg",
+    "assets/providers/alibaba-coding-plan.svg",
+    "assets/providers/alibaba.svg",
+    "assets/providers/antigravity.svg",
+    "assets/providers/bai.svg",
+    "assets/providers/blackbox.svg",
+    "assets/providers/claude-code.svg",
+    "assets/providers/exa.svg",
+    "assets/providers/gmi-cloud.svg",
+    "assets/providers/inception.svg",
+    "assets/providers/inferhub.svg",
+    "assets/providers/muse.svg",
+    "assets/providers/nous-research.svg",
+    "assets/providers/openai-light.svg",
+    "assets/providers/parallel.svg",
+    "assets/providers/tokenharbor.svg",
+    "assets/providers/zai-coding-plan.svg",
+    "assets/query-keys-CLaNz8Xz.js",
+    "assets/quota-DZGyp0N5.js",
+    "assets/refresh-cw-BqJFk4sU.js",
+    "assets/rotate-ccw-CufcqITi.js",
+    "assets/route-CNSNj9Zm.js",
+    "assets/routing-BEH32QOC.js",
+    "assets/scaling-nWE4Cx8f.js",
+    "assets/search-JOKus9rb.js",
+    "assets/select-B3iTetHN.js",
+    "assets/settings-2-Ds9DQp0t.js",
+    "assets/settings-Dt3Eqbnq.js",
+    "assets/shield-check-DVS0Foqh.js",
+    "assets/stack-KrOrm7JZ.js",
+    "assets/state-DLS7IDMy.js",
+    "assets/stream-retry-5QnVuSSo.js",
+    "assets/switch-42ItvbAs.js",
+    "assets/terminal-0_IjPWTk.js",
+    "assets/tokens-COzario9.js",
+    "assets/trash-Cppn5c3R.js",
+    "assets/use-clipboard-B0Sy03fE.js",
+    "assets/use-modal-focus-By7oJoGd.js",
+    "assets/use-reduced-motion-C4B0R6Sz.js",
+    "assets/use-timeout-BwcBBRrT.js",
+    "assets/useMutation-Dmnfh1Ue.js",
+    "assets/wrench-B6E1oEuY.js",
+    "assets/zap-C4EeVW4q.js",
     "index.html"
   ]
 }

package/migrations/full-postgres/0026_add_qoder_native_identity.sql

@@ -0,0 +1,20 @@
+-- Qoder native machine identity (UMID) bound to one account.
+--
+-- The daily 100-credit check-in campaign appears only when the request
+-- carries a genuine, non-VM device identity. That identity is a
+-- deterministic function of a seed file (`~/.config/.locale_cfg`): the
+-- `runtime-info` bridge derives machineToken/machineType/machineCode from the
+-- seed. Each account gets its own minted seed, so it looks like its own
+-- device to the server.
+--
+-- The identity is not a credential (it travels in plaintext `cosy-machine*`
+-- headers), so it lives unsealed as a JSON object. The partial unique index
+-- on the extracted `machineToken` enforces "one device per account" at the
+-- database level: two accounts sharing a token would claim as the same
+-- device and the second would lose the grant for the day.
+ALTER TABLE "provider_accounts"
+  ADD COLUMN "native_identity" jsonb;
+
+CREATE UNIQUE INDEX "provider_accounts_native_identity_token_uidx"
+  ON "provider_accounts" ((native_identity ->> 'machineToken'))
+  WHERE native_identity IS NOT NULL;

package/migrations/full-postgres/0027_qoder_identity_genuine_seed.sql

@@ -0,0 +1,22 @@
+-- Qoder native identity: genuine SG identity + per-account seed replay.
+--
+-- Research (2026-10-30, see documentation/research/qoder-identity-gate-
+-- postmortem.md and qoder-umid-reverse.md) established that the daily-credit
+-- campaign gates its CREDITS grant on a *genuine* Alibaba SG-produced
+-- identity: generated/deterministic tokens do not reveal the grant on a
+-- fresh account, while the `runtime-info` bridge (SG-signed) does.
+--
+-- Migration 0026 already added `native_identity` (the token triple + optional
+-- seed) with a partial unique index on the extracted machineToken — the
+-- "one device per account" invariant. This migration does not change that
+-- schema; it only documents the contract change on the same column:
+--
+--   `seed` is now REQUIRED for a claim-capable identity (the seed is the
+--   device material; the token can be re-derived from it, never the reverse).
+--   Rows minted by the retired generated path carry `seed = ""` — they stay
+--   valid records but must be re-minted through the bridge before the next
+--   claim; the store treats a missing/empty seed as "not replay-capable".
+--
+-- No DDL is needed: the JSON shape already carries everything. Kept as an
+-- empty migration so the migration numbering records the policy change.
+SELECT 1;

package/migrations/full-postgres/0028_add_family_template_key_telemetry.sql

@@ -0,0 +1,40 @@
+-- Denormalizes the share-template family onto every telemetry event.
+--
+-- The share page's family rollup used to scope by an `EXISTS` against
+-- `api_keys` (the template plus every child it issued). That made history
+-- depend on the key row surviving: revoking/removing a key silently dropped
+-- its events out of the family totals. This column pins the template on the
+-- event at write time, so usage outlives the key.
+--
+-- Backfill is idempotent: it only fills NULL rows (the column is new, so
+-- every existing row is NULL) and never overwrites a value. Events whose key
+-- was already hard-deleted before this migration cannot be attributed and stay
+-- NULL; the soft-delete change shipped alongside this prevents future loss.
+
+ALTER TABLE "telemetry_events" ADD COLUMN IF NOT EXISTS "family_template_key_id" uuid;
+
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_family_created_id_idx"
+  ON "telemetry_events" ("tenant_id", "family_template_key_id", "created_at" DESC, "id" DESC);
+
+ALTER TABLE "telemetry_usage_totals" ADD COLUMN IF NOT EXISTS "family_template_key_id" uuid;
+
+CREATE INDEX IF NOT EXISTS "telemetry_usage_totals_tenant_family_idx"
+  ON "telemetry_usage_totals" ("tenant_id", "family_template_key_id");
+
+UPDATE "telemetry_events" AS e
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = e."api_key_id"
+)
+WHERE e."family_template_key_id" IS NULL AND e."api_key_id" IS NOT NULL;
+
+UPDATE "telemetry_usage_totals" AS t
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = t."entity_id"
+)
+WHERE t."family_template_key_id" IS NULL
+  AND t."identity_type" = 'api_key'
+  AND t."entity_id" IS NOT NULL;

package/migrations/full-postgres/0029_null_share_child_policy_columns.sql

@@ -0,0 +1,38 @@
+-- One-time row-data optimization for share children.
+--
+-- Every minted share child used to copy the template's policy columns
+-- (notes, limits, model_list, denylist, …). Auth never reads those from the
+-- child — it resolves `policy = parent ?? row` — so the copies were pure
+-- write-amplification. This UPDATE nulls the 11 nullable policy columns on
+-- every child (`parent_key_id IS NOT NULL`). `scopes` stays (NOT NULL, and
+-- required by backup restore); `model_access_mode` stays (NOT NULL default
+-- 'whitelist'). Schema shape is unchanged — no DROP COLUMN — so backup/
+-- restore remains compatible both directions.
+--
+-- Idempotent: the OR-of-IS-NOT-NULL predicate matches nothing on a re-run,
+-- and the migration ledger skips the file after the first apply.
+--
+-- Keep in sync with `normalizeShareChildPolicy` in
+-- `src/console/backup/store.ts` (post-restore re-applies the same null-out
+-- for a tenant, because restore does not re-run numbered migrations).
+
+UPDATE "api_keys"
+SET "notes_title" = NULL,
+    "notes_subtitle" = NULL,
+    "notes_body" = NULL,
+    "requests_per_minute" = NULL,
+    "daily_token_limit" = NULL,
+    "monthly_token_limit" = NULL,
+    "lifetime_token_budget" = NULL,
+    "max_concurrent_requests" = NULL,
+    "model_prefix" = NULL,
+    "model_list" = NULL,
+    "client_router_denylist" = NULL
+WHERE "parent_key_id" IS NOT NULL
+  AND ( "notes_title" IS NOT NULL OR "notes_subtitle" IS NOT NULL
+        OR "notes_body" IS NOT NULL OR "requests_per_minute" IS NOT NULL
+        OR "daily_token_limit" IS NOT NULL OR "monthly_token_limit" IS NOT NULL
+        OR "lifetime_token_budget" IS NOT NULL
+        OR "max_concurrent_requests" IS NOT NULL OR "model_prefix" IS NOT NULL
+        OR "model_list" IS NOT NULL
+        OR "client_router_denylist" IS NOT NULL );

package/migrations/full-postgres/0030_add_api_key_max_children.sql

@@ -0,0 +1,10 @@
+-- Add a share-template child slot cap.
+--
+-- Share enrollment links are public, and an attacker minting child rows is
+-- only bounded by the per-IP dedupe, which IP rotation (CDN edges, cloud
+-- egress, residential proxies) defeats. `max_children` lets an operator cap
+-- how many concurrently-active child keys a template may mint; NULL keeps the
+-- legacy unlimited behavior. Enforced at mint time (not a database
+-- constraint) so the error path is a clean 429/409.
+
+ALTER TABLE "api_keys" ADD COLUMN "max_children" integer;

package/migrations/full-postgres/0031_tenant_system_prompts.sql

@@ -0,0 +1,16 @@
+-- Tenant-scoped system prompt injection (append/override).
+--
+-- Resolution is most-specific-wins: model > provider > global. A provider
+-- either follows the tenant's global prompt (`providers` entry
+-- followGlobal = true, its own setting is ignored) or carries a custom one.
+-- Text is capped at 5 MB per scope in the console route; the dispatch-path
+-- reader is revision-keyed cached, so a mutation converges within the
+-- settings-revision bump. `global` NULL means never configured — distinct
+-- from an explicit `{"enabled": false}` row.
+CREATE TABLE IF NOT EXISTS "tenant_system_prompts" (
+  "tenant_id"  uuid PRIMARY KEY REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "global"     jsonb,
+  "providers"  jsonb NOT NULL DEFAULT '{}',
+  "models"     jsonb NOT NULL DEFAULT '{}',
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);

package/migrations/lite-sqlite3/0026_add_qoder_native_identity.sql

@@ -0,0 +1,15 @@
+-- Qoder native machine identity (UMID) bound to one account.
+--
+-- SQLite mirror of `full-postgres/0026_add_qoder_native_identity.sql`:
+-- the column is `text` (the SQLite representation of jsonb) and the unique
+-- index extracts the `machineToken` the same way the application reads it.
+--
+-- The partial unique index enforces "one device per account" at the database
+-- level. SQLite supports expression indexes (3.38+); a bound identity is a
+-- non-null JSON object whose `$.machineToken` is the device key.
+ALTER TABLE "provider_accounts"
+  ADD COLUMN "native_identity" text;
+
+CREATE UNIQUE INDEX "provider_accounts_native_identity_token_uidx"
+  ON "provider_accounts" (json_extract(native_identity, '$.machineToken'))
+  WHERE native_identity IS NOT NULL;

package/migrations/lite-sqlite3/0027_qoder_identity_genuine_seed.sql

@@ -0,0 +1,22 @@
+-- Qoder native identity: genuine SG identity + per-account seed replay.
+--
+-- Research (2026-10-30, see documentation/research/qoder-identity-gate-
+-- postmortem.md and qoder-umid-reverse.md) established that the daily-credit
+-- campaign gates its CREDITS grant on a *genuine* Alibaba SG-produced
+-- identity: generated/deterministic tokens do not reveal the grant on a
+-- fresh account, while the `runtime-info` bridge (SG-signed) does.
+--
+-- Migration 0026 already added `native_identity` (the token triple + optional
+-- seed) with a partial unique index on the extracted machineToken — the
+-- "one device per account" invariant. This migration does not change that
+-- schema; it only documents the contract change on the same column:
+--
+--   `seed` is now REQUIRED for a claim-capable identity (the seed is the
+--   device material; the token can be re-derived from it, never the reverse).
+--   Rows minted by the retired generated path carry `seed = ""` — they stay
+--   valid records but must be re-minted through the bridge before the next
+--   claim; the store treats a missing/empty seed as "not replay-capable".
+--
+-- No DDL is needed: the JSON shape already carries everything. Kept as an
+-- empty migration so the migration numbering records the policy change.
+SELECT 1;

package/migrations/lite-sqlite3/0028_add_family_template_key_telemetry.sql

@@ -0,0 +1,40 @@
+-- Denormalizes the share-template family onto every telemetry event.
+--
+-- The share page's family rollup used to scope by an `EXISTS` against
+-- `api_keys` (the template plus every child it issued). That made history
+-- depend on the key row surviving: revoking/removing a key silently dropped
+-- its events out of the family totals. This column pins the template on the
+-- event at write time, so usage outlives the key.
+--
+-- Backfill is idempotent: it only fills NULL rows (the column is new, so
+-- every existing row is NULL) and never overwrites a value. Events whose key
+-- was already hard-deleted before this migration cannot be attributed and stay
+-- NULL; the soft-delete change shipped alongside this prevents future loss.
+
+ALTER TABLE "telemetry_events" ADD COLUMN "family_template_key_id" text;
+
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_family_created_id_idx"
+  ON "telemetry_events" ("tenant_id", "family_template_key_id", "created_at" DESC, "id" DESC);
+
+ALTER TABLE "telemetry_usage_totals" ADD COLUMN "family_template_key_id" text;
+
+CREATE INDEX IF NOT EXISTS "telemetry_usage_totals_tenant_family_idx"
+  ON "telemetry_usage_totals" ("tenant_id", "family_template_key_id");
+
+UPDATE "telemetry_events" AS e
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = e."api_key_id"
+)
+WHERE e."family_template_key_id" IS NULL AND e."api_key_id" IS NOT NULL;
+
+UPDATE "telemetry_usage_totals" AS t
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = t."entity_id"
+)
+WHERE t."family_template_key_id" IS NULL
+  AND t."identity_type" = 'api_key'
+  AND t."entity_id" IS NOT NULL;

package/migrations/lite-sqlite3/0029_null_share_child_policy_columns.sql

@@ -0,0 +1,38 @@
+-- One-time row-data optimization for share children.
+--
+-- Every minted share child used to copy the template's policy columns
+-- (notes, limits, model_list, denylist, …). Auth never reads those from the
+-- child — it resolves `policy = parent ?? row` — so the copies were pure
+-- write-amplification. This UPDATE nulls the 11 nullable policy columns on
+-- every child (`parent_key_id IS NOT NULL`). `scopes` stays (NOT NULL, and
+-- required by backup restore); `model_access_mode` stays (NOT NULL default
+-- 'whitelist'). Schema shape is unchanged — no DROP COLUMN — so backup/
+-- restore remains compatible both directions.
+--
+-- Idempotent: the OR-of-IS-NOT-NULL predicate matches nothing on a re-run,
+-- and the migration ledger skips the file after the first apply.
+--
+-- Keep in sync with `normalizeShareChildPolicy` in
+-- `src/console/backup/store.ts` (post-restore re-applies the same null-out
+-- for a tenant, because restore does not re-run numbered migrations).
+
+UPDATE "api_keys"
+SET "notes_title" = NULL,
+    "notes_subtitle" = NULL,
+    "notes_body" = NULL,
+    "requests_per_minute" = NULL,
+    "daily_token_limit" = NULL,
+    "monthly_token_limit" = NULL,
+    "lifetime_token_budget" = NULL,
+    "max_concurrent_requests" = NULL,
+    "model_prefix" = NULL,
+    "model_list" = NULL,
+    "client_router_denylist" = NULL
+WHERE "parent_key_id" IS NOT NULL
+  AND ( "notes_title" IS NOT NULL OR "notes_subtitle" IS NOT NULL
+        OR "notes_body" IS NOT NULL OR "requests_per_minute" IS NOT NULL
+        OR "daily_token_limit" IS NOT NULL OR "monthly_token_limit" IS NOT NULL
+        OR "lifetime_token_budget" IS NOT NULL
+        OR "max_concurrent_requests" IS NOT NULL OR "model_prefix" IS NOT NULL
+        OR "model_list" IS NOT NULL
+        OR "client_router_denylist" IS NOT NULL );

package/migrations/lite-sqlite3/0030_add_api_key_max_children.sql

@@ -0,0 +1,10 @@
+-- Add a share-template child slot cap.
+--
+-- Share enrollment links are public, and an attacker minting child rows is
+-- only bounded by the per-IP dedupe, which IP rotation (CDN edges, cloud
+-- egress, residential proxies) defeats. `max_children` lets an operator cap
+-- how many concurrently-active child keys a template may mint; NULL keeps the
+-- legacy unlimited behavior. Enforced at mint time (not a database
+-- constraint) so the error path is a clean 429/409.
+
+ALTER TABLE "api_keys" ADD COLUMN "max_children" integer;

package/migrations/lite-sqlite3/0031_tenant_system_prompts.sql

@@ -0,0 +1,10 @@
+-- Tenant-scoped system prompt injection (append/override).
+--
+-- Mirror of the Postgres migration; see that file for rationale.
+CREATE TABLE IF NOT EXISTS "tenant_system_prompts" (
+  "tenant_id"  TEXT PRIMARY KEY REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "global"     TEXT,
+  "providers"  TEXT NOT NULL DEFAULT '{}',
+  "models"     TEXT NOT NULL DEFAULT '{}',
+  "updated_at" TEXT NOT NULL DEFAULT (datetime('now'))
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.7.2",
+  "version": "2.7.3",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",

package/src/config/network.ts

@@ -116,5 +116,5 @@ export const DEFAULT_BOUNDS = {
    * matters because the gateway is designed to run several processes behind
    * `reusePort` — see `assertPoolFitsServerCapacity`.
    */
-  maxPostgresPoolSize: 20,
+  maxPostgresPoolSize: 8,
 } as const;

package/src/console/api-keys/bucket-spend.ts

@@ -20,7 +20,12 @@ import { utcDayStart, utcMonthStart } from "../shared/day";
  *
  * A share template's recipients admit under the parent id, and their spend is
  * attributed to their own child row, so the family is summed — otherwise
- * seeding a template would miss everything its recipients already used.
+ * seeding a template would miss everything its recipients already used. The
+ * family is passed to the reader as the template's id, which the query
+ * resolves with an `EXISTS` against `api_keys`: a family that has minted tens
+ * of thousands of children must not expand them into bind parameters on the
+ * key-creation path, which is where an old id-list version crashed the
+ * process.
  */
 export async function familyBucketSpend(
   db: CartethyiaDatabase,
@@ -36,15 +41,10 @@ export async function familyBucketSpend(
     .limit(1);
   const tenantId = parent?.tenantId;
   if (tenantId === undefined) return { daily: 0, monthly: 0 };
-  const children = await db
-    .select({ id: apiKeys.id })
-    .from(apiKeys)
-    .where(eq(apiKeys.parentKeyId, keyId));
-  const keyIds = [keyId, ...children.map((child) => child.id)];
   // Two SQL sums instead of reading every event of the family: the bucket
   // spend only needs a total, and this runs on the key-creation path.
   const spentSince = async (start: Date): Promise<number> =>
-    sumTelemetryTokens(db, tenantId, { apiKeyIds: keyIds, since: start });
+    sumTelemetryTokens(db, tenantId, { familyKeyId: keyId, since: start });
   const [daily, monthly] = await Promise.all([
     spentSince(utcDayStart(now)),
     spentSince(utcMonthStart(now)),