cartethyia 2.7.2 → 2.7.4

package/dist/dashboard/precompressed-assets.json

@@ -1,120 +1,123 @@
 {
-  "count": 115,
+  "count": 118,
   "assets": [
-    "assets\\AccountCooldown-Bjo92Qat.js",
-    "assets\\BannedPage-XaUmiBrC.js",
-    "assets\\CliToolDetailPage-CqD7QiLM.js",
-    "assets\\CliToolsPage-0XUo4UMn.js",
-    "assets\\CombosPage-CXGS_Ct-.js",
-    "assets\\ConsoleLogPage-DGnGNYnM.js",
-    "assets\\CustomizationPage-DAG5J9EY.js",
-    "assets\\HealthEventsModal-BKtAPYVF.js",
-    "assets\\LoginPage-BdmRLnq2.js",
-    "assets\\ModelPicker-BH8Tehdi.js",
-    "assets\\OverviewPage-CqMxibJB.js",
-    "assets\\ProviderDetailPage-CqMh2NRX.js",
-    "assets\\ProviderIcon-FB6yS4v1.js",
-    "assets\\ProvidersPage-B9uWu4Nz.js",
-    "assets\\ProxyPage-BoWOhpDO.js",
-    "assets\\QuotaPage-7P2n--Fv.js",
-    "assets\\SettingsPage-CxZ1fTkN.js",
-    "assets\\SetupPage-Co12Zzaw.js",
-    "assets\\SortableList-Dqf4zpS-.js",
-    "assets\\StudioPage-Byj2lAEm.js",
-    "assets\\ToolIcon-K1ckcDKg.js",
-    "assets\\UsagePage-CTkLAuRc.js",
-    "assets\\api-keys-CUi6UXsR.js",
-    "assets\\app-BaWd0puM.js",
-    "assets\\app-KvsUJUMF.css",
-    "assets\\arrow-left-CpBxkoxI.js",
-    "assets\\arrow-right-Dl5yKnp8.js",
-    "assets\\assert-67xXH5rf.js",
-    "assets\\backup-file-gdKIlg8U.js",
-    "assets\\badge-DC2L43Mj.js",
-    "assets\\banner-BBVcb0J3.js",
-    "assets\\brain-Cwed_72z.js",
-    "assets\\card-Cca1XC6G.js",
-    "assets\\chevron-right-BXIy5l3h.js",
-    "assets\\circle-alert-CntYHV5v.js",
-    "assets\\circle-check-BU3v_mFW.js",
-    "assets\\cli-tools-KvsWa1Jl.js",
-    "assets\\clipboard-button-DUzEbynq.js",
-    "assets\\concurrency-BDF0ok7y.js",
-    "assets\\database-Dz9N3zGd.js",
-    "assets\\dialog-DFvWhwTa.js",
-    "assets\\dialog-actions-B1axpEg7.js",
-    "assets\\download-dRFo5_Wu.js",
-    "assets\\drawer-CFM2sMX1.js",
-    "assets\\entry-Bqy8RFvM.js",
-    "assets\\entry-ClCMCWWQ.js",
-    "assets\\entry-_xHo5x6r.js",
-    "assets\\eye-C_hawfH4.js",
-    "assets\\eye-off-Bk5g2luF.js",
-    "assets\\formatters-CWWZ-uCZ.js",
-    "assets\\gauge-BbIMy7MB.js",
-    "assets\\github-badge-C9e8Ts7e.js",
-    "assets\\image-BPaouViG.js",
-    "assets\\index-DFVFrnWW.js",
-    "assets\\inline-BFUcvllj.js",
-    "assets\\input-C_ILAvBb.js",
-    "assets\\jsx-runtime-CXUMngI_.js",
-    "assets\\key-round-UkavsGxp.js",
-    "assets\\layers-2-glBbjl.js",
-    "assets\\layout-CBIyT6Rt.js",
-    "assets\\list-row-ebJ_-Nsb.js",
-    "assets\\live-D0mm--ME.js",
-    "assets\\log-in-BmRjy60c.js",
-    "assets\\message-circle-CCxGwRvv.js",
-    "assets\\minimize-2-D-MN8W8a.js",
-    "assets\\mutation-sMD965oO.js",
-    "assets\\numbers-BO9dKaFr.js",
-    "assets\\pencil-768ysRAr.js",
-    "assets\\plus-DIdX_g-x.js",
-    "assets\\power-off-Yjw9GMJh.js",
-    "assets\\privacy-mode-GM8bej85.js",
-    "assets\\providers\\agentrouter.svg",
-    "assets\\providers\\aihubmix.svg",
-    "assets\\providers\\alibaba-coding-plan.svg",
-    "assets\\providers\\alibaba.svg",
-    "assets\\providers\\antigravity.svg",
-    "assets\\providers\\bai.svg",
-    "assets\\providers\\blackbox.svg",
-    "assets\\providers\\claude-code.svg",
-    "assets\\providers\\exa.svg",
-    "assets\\providers\\gmi-cloud.svg",
-    "assets\\providers\\inception.svg",
-    "assets\\providers\\inferhub.svg",
-    "assets\\providers\\muse.svg",
-    "assets\\providers\\nous-research.svg",
-    "assets\\providers\\openai-light.svg",
-    "assets\\providers\\parallel.svg",
-    "assets\\providers\\tokenharbor.svg",
-    "assets\\providers\\zai-coding-plan.svg",
-    "assets\\query-keys-CfL_Zdoh.js",
-    "assets\\quota-DZGyp0N5.js",
-    "assets\\refresh-cw-BqJFk4sU.js",
-    "assets\\rotate-ccw-CufcqITi.js",
-    "assets\\route-CNSNj9Zm.js",
-    "assets\\routing-BnIpi1IJ.js",
-    "assets\\scaling-nWE4Cx8f.js",
-    "assets\\search-JOKus9rb.js",
-    "assets\\select-DBNVLdUu.js",
-    "assets\\settings-BAFhDgX8.js",
-    "assets\\shield-check-DVS0Foqh.js",
-    "assets\\stack-EMrOMt4I.js",
-    "assets\\state-CWoo7ty5.js",
-    "assets\\stream-retry-5QnVuSSo.js",
-    "assets\\switch-CCjT6IkF.js",
-    "assets\\terminal-0_IjPWTk.js",
-    "assets\\tokens-COzario9.js",
-    "assets\\trash-Cppn5c3R.js",
-    "assets\\use-clipboard-B0Sy03fE.js",
-    "assets\\use-modal-focus-By7oJoGd.js",
-    "assets\\use-reduced-motion-C4B0R6Sz.js",
-    "assets\\use-timeout-BwcBBRrT.js",
-    "assets\\useMutation-DjkLHUcE.js",
-    "assets\\wrench-B6E1oEuY.js",
-    "assets\\zap-C4EeVW4q.js",
+    "assets/AccountCooldown-Bjo92Qat.js",
+    "assets/BannedPage-ChG5svFb.js",
+    "assets/CliToolDetailPage-BIcWQun7.js",
+    "assets/CliToolsPage-Bf2VelDe.js",
+    "assets/CombosPage-DCgm5g6g.js",
+    "assets/ConsoleLogPage-a8mD0QF1.js",
+    "assets/CustomizationPage-ggeMSjte.js",
+    "assets/HealthEventsModal-DzSWzE_j.js",
+    "assets/LoginPage-U6AKaJcF.js",
+    "assets/ModelPicker-BMS2t8BA.js",
+    "assets/OverviewPage-D2D4IiHl.js",
+    "assets/ProviderDetailPage-CrNf7j_X.js",
+    "assets/ProviderIcon-FB6yS4v1.js",
+    "assets/ProvidersPage-BSDbquc1.js",
+    "assets/ProxyPage-lsrx7NYg.js",
+    "assets/QuotaPage-L0skzML8.js",
+    "assets/SettingsPage-CmAbjRHW.js",
+    "assets/SetupPage-f0DE1h0-.js",
+    "assets/SortableList-ClzpwyET.js",
+    "assets/StudioPage-Cq5tW7hW.js",
+    "assets/ToolIcon-K1ckcDKg.js",
+    "assets/UsagePage-Dfc9rWQn.js",
+    "assets/api-keys-C38iXoO4.js",
+    "assets/app-BayTTy01.js",
+    "assets/app-a159k0ub.css",
+    "assets/arrow-left-CpBxkoxI.js",
+    "assets/arrow-right-Dl5yKnp8.js",
+    "assets/arrow-up-59ms1iiT.js",
+    "assets/assert-DbRA8EG2.js",
+    "assets/backup-file-gdKIlg8U.js",
+    "assets/badge-D9CS6dZk.js",
+    "assets/banner-DympBNq4.js",
+    "assets/brain-Cwed_72z.js",
+    "assets/card-ibRWU_uT.js",
+    "assets/chevron-right-BXIy5l3h.js",
+    "assets/circle-alert-CntYHV5v.js",
+    "assets/circle-check-BU3v_mFW.js",
+    "assets/cli-tools-63qBGaRw.js",
+    "assets/clipboard-button-DJm-9pz7.js",
+    "assets/database-Dz9N3zGd.js",
+    "assets/dialog-8fiE6tec.js",
+    "assets/dialog-actions-B1axpEg7.js",
+    "assets/download-dRFo5_Wu.js",
+    "assets/drawer-CqGYeOrd.js",
+    "assets/entry-BSAsYsmV.js",
+    "assets/entry-CiIQULZD.js",
+    "assets/entry-Daz0lJ-W.js",
+    "assets/eye-C_hawfH4.js",
+    "assets/eye-off-Bk5g2luF.js",
+    "assets/fingerprint-pattern-BWuHtbW4.js",
+    "assets/formatters-D-MTJxMr.js",
+    "assets/gauge-BbIMy7MB.js",
+    "assets/github-badge-CPK47xQx.js",
+    "assets/image-BPaouViG.js",
+    "assets/index-DBNPOfhV.js",
+    "assets/inline-BT0zntEr.js",
+    "assets/input-Da2ZViWg.js",
+    "assets/jsx-runtime-CXUMngI_.js",
+    "assets/key-round-UkavsGxp.js",
+    "assets/layers-2-glBbjl.js",
+    "assets/layout-BXNeLw6M.js",
+    "assets/list-row-BycOrrIV.js",
+    "assets/live-DCQNZpF7.js",
+    "assets/log-in-BmRjy60c.js",
+    "assets/message-circle-CCxGwRvv.js",
+    "assets/minimize-2-BTmMTK4o.js",
+    "assets/mutation-Rr0TIvcj.js",
+    "assets/network-9Yj2ZyLo.js",
+    "assets/numbers-CEagj6ZZ.js",
+    "assets/pencil-768ysRAr.js",
+    "assets/plus-DIdX_g-x.js",
+    "assets/power-off-Yjw9GMJh.js",
+    "assets/privacy-mode-GM8bej85.js",
+    "assets/providers/agentrouter.svg",
+    "assets/providers/aihubmix.svg",
+    "assets/providers/alibaba-coding-plan.svg",
+    "assets/providers/alibaba.svg",
+    "assets/providers/antigravity.svg",
+    "assets/providers/bai.svg",
+    "assets/providers/blackbox.svg",
+    "assets/providers/claude-code.svg",
+    "assets/providers/exa.svg",
+    "assets/providers/gmi-cloud.svg",
+    "assets/providers/inception.svg",
+    "assets/providers/inferhub.svg",
+    "assets/providers/muse.svg",
+    "assets/providers/nous-research.svg",
+    "assets/providers/openai-light.svg",
+    "assets/providers/parallel.svg",
+    "assets/providers/tokenharbor.svg",
+    "assets/providers/zai-coding-plan.svg",
+    "assets/query-keys-BloKtaXJ.js",
+    "assets/quota-Caw7wqci.js",
+    "assets/refresh-cw-BqJFk4sU.js",
+    "assets/rotate-ccw-CufcqITi.js",
+    "assets/route-CNSNj9Zm.js",
+    "assets/routing-CO9zCUus.js",
+    "assets/scaling-nWE4Cx8f.js",
+    "assets/search-JOKus9rb.js",
+    "assets/select-BIYIBkMU.js",
+    "assets/settings-2-Ds9DQp0t.js",
+    "assets/settings-jS3-PNSA.js",
+    "assets/shield-check-DVS0Foqh.js",
+    "assets/stack-DfgnFDWY.js",
+    "assets/state-CkfdYWel.js",
+    "assets/stream-retry-5QnVuSSo.js",
+    "assets/switch-SYm237HG.js",
+    "assets/terminal-0_IjPWTk.js",
+    "assets/tokens-COzario9.js",
+    "assets/trash-Cppn5c3R.js",
+    "assets/use-clipboard-B0Sy03fE.js",
+    "assets/use-modal-focus-By7oJoGd.js",
+    "assets/use-reduced-motion-C4B0R6Sz.js",
+    "assets/use-timeout-BwcBBRrT.js",
+    "assets/useMutation-BQqCRNIi.js",
+    "assets/wrench-B6E1oEuY.js",
+    "assets/zap-C4EeVW4q.js",
     "index.html"
   ]
 }

package/migrations/full-postgres/0026_add_qoder_native_identity.sql

@@ -0,0 +1,20 @@
+-- Qoder native machine identity (UMID) bound to one account.
+--
+-- The daily 100-credit check-in campaign appears only when the request
+-- carries a genuine, non-VM device identity. That identity is a
+-- deterministic function of a seed file (`~/.config/.locale_cfg`): the
+-- `runtime-info` bridge derives machineToken/machineType/machineCode from the
+-- seed. Each account gets its own minted seed, so it looks like its own
+-- device to the server.
+--
+-- The identity is not a credential (it travels in plaintext `cosy-machine*`
+-- headers), so it lives unsealed as a JSON object. The partial unique index
+-- on the extracted `machineToken` enforces "one device per account" at the
+-- database level: two accounts sharing a token would claim as the same
+-- device and the second would lose the grant for the day.
+ALTER TABLE "provider_accounts"
+  ADD COLUMN "native_identity" jsonb;
+
+CREATE UNIQUE INDEX "provider_accounts_native_identity_token_uidx"
+  ON "provider_accounts" ((native_identity ->> 'machineToken'))
+  WHERE native_identity IS NOT NULL;

package/migrations/full-postgres/0027_qoder_identity_genuine_seed.sql

@@ -0,0 +1,21 @@
+-- Qoder native identity: genuine SG identity + per-account seed replay.
+--
+-- Research (2026-10-30, see
+-- documentation/archive/research/Qoder-03-umid-and-identity-findings.md)
+-- established that machine identity does not gate the daily-credit campaign.
+-- The seed is retained for deterministic replay of a native identity on
+-- surfaces that may require one; it is not required for campaign eligibility.
+--
+-- Migration 0026 already added `native_identity` (the token triple + optional
+-- seed) with a partial unique index on the extracted machineToken — the
+-- "one device per account" invariant. This migration does not change that
+-- schema; it only documents the contract change on the same column:
+--
+--   `seed` makes a native identity replay-capable (the token can be
+--   re-derived from the seed, never the reverse). Rows minted by the
+--   generated path may have `seed = ""`; that affects native replay only,
+--   not the daily campaign claim.
+--
+-- No DDL is needed: the JSON shape already carries everything. Kept as an
+-- empty migration so the migration numbering records the policy change.
+SELECT 1;

package/migrations/full-postgres/0028_add_family_template_key_telemetry.sql

@@ -0,0 +1,40 @@
+-- Denormalizes the share-template family onto every telemetry event.
+--
+-- The share page's family rollup used to scope by an `EXISTS` against
+-- `api_keys` (the template plus every child it issued). That made history
+-- depend on the key row surviving: revoking/removing a key silently dropped
+-- its events out of the family totals. This column pins the template on the
+-- event at write time, so usage outlives the key.
+--
+-- Backfill is idempotent: it only fills NULL rows (the column is new, so
+-- every existing row is NULL) and never overwrites a value. Events whose key
+-- was already hard-deleted before this migration cannot be attributed and stay
+-- NULL; the soft-delete change shipped alongside this prevents future loss.
+
+ALTER TABLE "telemetry_events" ADD COLUMN IF NOT EXISTS "family_template_key_id" uuid;
+
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_family_created_id_idx"
+  ON "telemetry_events" ("tenant_id", "family_template_key_id", "created_at" DESC, "id" DESC);
+
+ALTER TABLE "telemetry_usage_totals" ADD COLUMN IF NOT EXISTS "family_template_key_id" uuid;
+
+CREATE INDEX IF NOT EXISTS "telemetry_usage_totals_tenant_family_idx"
+  ON "telemetry_usage_totals" ("tenant_id", "family_template_key_id");
+
+UPDATE "telemetry_events" AS e
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = e."api_key_id"
+)
+WHERE e."family_template_key_id" IS NULL AND e."api_key_id" IS NOT NULL;
+
+UPDATE "telemetry_usage_totals" AS t
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = t."entity_id"
+)
+WHERE t."family_template_key_id" IS NULL
+  AND t."identity_type" = 'api_key'
+  AND t."entity_id" IS NOT NULL;

package/migrations/full-postgres/0029_null_share_child_policy_columns.sql

@@ -0,0 +1,38 @@
+-- One-time row-data optimization for share children.
+--
+-- Every minted share child used to copy the template's policy columns
+-- (notes, limits, model_list, denylist, …). Auth never reads those from the
+-- child — it resolves `policy = parent ?? row` — so the copies were pure
+-- write-amplification. This UPDATE nulls the 11 nullable policy columns on
+-- every child (`parent_key_id IS NOT NULL`). `scopes` stays (NOT NULL, and
+-- required by backup restore); `model_access_mode` stays (NOT NULL default
+-- 'whitelist'). Schema shape is unchanged — no DROP COLUMN — so backup/
+-- restore remains compatible both directions.
+--
+-- Idempotent: the OR-of-IS-NOT-NULL predicate matches nothing on a re-run,
+-- and the migration ledger skips the file after the first apply.
+--
+-- Keep in sync with `normalizeShareChildPolicy` in
+-- `src/console/backup/store.ts` (post-restore re-applies the same null-out
+-- for a tenant, because restore does not re-run numbered migrations).
+
+UPDATE "api_keys"
+SET "notes_title" = NULL,
+    "notes_subtitle" = NULL,
+    "notes_body" = NULL,
+    "requests_per_minute" = NULL,
+    "daily_token_limit" = NULL,
+    "monthly_token_limit" = NULL,
+    "lifetime_token_budget" = NULL,
+    "max_concurrent_requests" = NULL,
+    "model_prefix" = NULL,
+    "model_list" = NULL,
+    "client_router_denylist" = NULL
+WHERE "parent_key_id" IS NOT NULL
+  AND ( "notes_title" IS NOT NULL OR "notes_subtitle" IS NOT NULL
+        OR "notes_body" IS NOT NULL OR "requests_per_minute" IS NOT NULL
+        OR "daily_token_limit" IS NOT NULL OR "monthly_token_limit" IS NOT NULL
+        OR "lifetime_token_budget" IS NOT NULL
+        OR "max_concurrent_requests" IS NOT NULL OR "model_prefix" IS NOT NULL
+        OR "model_list" IS NOT NULL
+        OR "client_router_denylist" IS NOT NULL );

package/migrations/full-postgres/0030_add_api_key_max_children.sql

@@ -0,0 +1,10 @@
+-- Add a share-template child slot cap.
+--
+-- Share enrollment links are public, and an attacker minting child rows is
+-- only bounded by the per-IP dedupe, which IP rotation (CDN edges, cloud
+-- egress, residential proxies) defeats. `max_children` lets an operator cap
+-- how many concurrently-active child keys a template may mint; NULL keeps the
+-- legacy unlimited behavior. Enforced at mint time (not a database
+-- constraint) so the error path is a clean 429/409.
+
+ALTER TABLE "api_keys" ADD COLUMN "max_children" integer;

package/migrations/full-postgres/0031_tenant_system_prompts.sql

@@ -0,0 +1,16 @@
+-- Tenant-scoped system prompt injection (append/override).
+--
+-- Resolution is most-specific-wins: model > provider > global. A provider
+-- either follows the tenant's global prompt (`providers` entry
+-- followGlobal = true, its own setting is ignored) or carries a custom one.
+-- Text is capped at 5 MB per scope in the console route; the dispatch-path
+-- reader is revision-keyed cached, so a mutation converges within the
+-- settings-revision bump. `global` NULL means never configured — distinct
+-- from an explicit `{"enabled": false}` row.
+CREATE TABLE IF NOT EXISTS "tenant_system_prompts" (
+  "tenant_id"  uuid PRIMARY KEY REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "global"     jsonb,
+  "providers"  jsonb NOT NULL DEFAULT '{}',
+  "models"     jsonb NOT NULL DEFAULT '{}',
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);

package/migrations/full-postgres/0032_add_provider_pool_accounts.sql

@@ -0,0 +1,53 @@
+-- Pool-as-account routing entities for ip-scoped, credential-less providers.
+--
+-- For providers whose rate limit follows the egress address (OpenCode Free),
+-- the pool is the resource that runs out — but it was invisible to account-level
+-- health and routing because the provider owns no `provider_accounts` rows.
+-- This table materializes one row per (pool × ip-scoped provider), carrying the
+-- same health state machine (`status`, `cooldown_until`, …) so a spent egress
+-- is excluded from routing plans exactly like a cooling account, and shows in
+-- the provider's Accounts card with a "Pool" badge.
+--
+-- The row is an account-equivalent, not an account: it resolves no credential,
+-- is skipped by quota-refresh and identity sweeps (they filter on real
+-- credential kinds), and is owned by its pool — deleting the pool cascades the
+-- row. Rows are backfilled here for every existing pool × ip-scoped provider so
+-- no operator action is needed to adopt the feature.
+CREATE TABLE IF NOT EXISTS "provider_pool_accounts" (
+  "id"            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "tenant_id"     uuid NOT NULL REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "network_pool_id" uuid NOT NULL REFERENCES "network_pools" ("id") ON DELETE CASCADE,
+  "provider_id"    text NOT NULL,
+  "label"          text NOT NULL,
+  "status"         text NOT NULL DEFAULT 'active'
+                  CHECK ("status" IN ('active', 'cooldown', 'disabled')),
+  "consecutive_failures" integer NOT NULL DEFAULT 0,
+  "last_success_at" timestamptz,
+  "last_error"      text,
+  "last_error_category" text,
+  "last_error_at"    timestamptz,
+  "cooldown_until"  timestamptz,
+  "last_recovered_at" timestamptz,
+  "created_at"      timestamptz NOT NULL DEFAULT now(),
+  "updated_at"      timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT provider_pool_accounts_pool_provider_uidx
+    UNIQUE ("network_pool_id", "provider_id", "tenant_id")
+);
+
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_tenant_status_idx
+  ON "provider_pool_accounts" ("tenant_id", "status");
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_provider_status_idx
+  ON "provider_pool_accounts" ("provider_id", "status");
+
+-- Backfill: every existing pool × ip-scoped provider gets its row. The
+-- ip-scoped set is OpenCode Free today; the provider id is spelled here so the
+-- rule stays a data fact, not a code constant.
+INSERT INTO "provider_pool_accounts"
+  ("tenant_id", "network_pool_id", "provider_id", "label")
+SELECT
+  p."tenant_id",
+  p."id",
+  'opencode',
+  'Pool ' || left(p."id"::text, 8)
+FROM "network_pools" p
+ON CONFLICT ("network_pool_id", "provider_id", "tenant_id") DO NOTHING;

package/migrations/full-postgres/0033_add_api_key_ban.sql

@@ -0,0 +1,9 @@
+-- API-key ban state.
+--
+-- A ban is distinct from revoke (terminal, tombstone-like) and disable
+-- (operator toggle, reversible): it records *why* a key was banned
+-- (`ban_reason`) for the console's "See reason" modal. Unban clears both
+-- columns entirely — no tombstone, no leftover metadata.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_at" timestamptz,
+  ADD COLUMN "ban_reason" text;

package/migrations/full-postgres/0034_add_api_key_ban_until.sql

@@ -0,0 +1,7 @@
+-- API-key ban expiry.
+--
+-- A ban may now carry an optional `banned_until`: a timed ban lifts on its
+-- own (auth checks `banned_at` against `banned_until`), while `null` keeps the
+-- earlier permanent-ban behavior. Unban clears all three ban columns.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_until" timestamptz;

package/migrations/full-postgres/0035_align_pool_account_status_enum.sql

@@ -0,0 +1,21 @@
+-- Align `provider_pool_accounts.status` with the shared `health_status` enum.
+--
+-- The table was created with a `text` column plus an inline CHECK (migration
+-- 0032), while every other health-state column uses the `health_status` enum.
+-- The Drizzle schema declares the enum, so the drift checker reported the text
+-- column and its CHECK as "produced by migrations but not in schema". This
+-- migration rewrites the column to the enum: same allowed values, one
+-- canonical type.
+--
+-- The inline CHECK from 0032 must be dropped first: PostgreSQL rewrites
+-- CHECK expressions during an ALTER TYPE, and the old `status IN ('active',
+-- ...)` expression compares the new enum column against text literals, which
+-- has no operator once the column becomes the enum.
+
+ALTER TABLE "provider_pool_accounts" DROP CONSTRAINT "provider_pool_accounts_status_check";
+
+ALTER TABLE "provider_pool_accounts"
+  ALTER COLUMN "status" DROP DEFAULT,
+  ALTER COLUMN "status" SET DATA TYPE "public"."health_status"
+    USING "status"::"public"."health_status",
+  ALTER COLUMN "status" SET DEFAULT 'active';

package/migrations/lite-sqlite3/0026_add_qoder_native_identity.sql

@@ -0,0 +1,15 @@
+-- Qoder native machine identity (UMID) bound to one account.
+--
+-- SQLite mirror of `full-postgres/0026_add_qoder_native_identity.sql`:
+-- the column is `text` (the SQLite representation of jsonb) and the unique
+-- index extracts the `machineToken` the same way the application reads it.
+--
+-- The partial unique index enforces "one device per account" at the database
+-- level. SQLite supports expression indexes (3.38+); a bound identity is a
+-- non-null JSON object whose `$.machineToken` is the device key.
+ALTER TABLE "provider_accounts"
+  ADD COLUMN "native_identity" text;
+
+CREATE UNIQUE INDEX "provider_accounts_native_identity_token_uidx"
+  ON "provider_accounts" (json_extract(native_identity, '$.machineToken'))
+  WHERE native_identity IS NOT NULL;

package/migrations/lite-sqlite3/0027_qoder_identity_genuine_seed.sql

@@ -0,0 +1,21 @@
+-- Qoder native identity: genuine SG identity + per-account seed replay.
+--
+-- Research (2026-10-30, see
+-- documentation/archive/research/Qoder-03-umid-and-identity-findings.md)
+-- established that machine identity does not gate the daily-credit campaign.
+-- The seed is retained for deterministic replay of a native identity on
+-- surfaces that may require one; it is not required for campaign eligibility.
+--
+-- Migration 0026 already added `native_identity` (the token triple + optional
+-- seed) with a partial unique index on the extracted machineToken — the
+-- "one device per account" invariant. This migration does not change that
+-- schema; it only documents the contract change on the same column:
+--
+--   `seed` makes a native identity replay-capable (the token can be
+--   re-derived from the seed, never the reverse). Rows minted by the
+--   generated path may have `seed = ""`; that affects native replay only,
+--   not the daily campaign claim.
+--
+-- No DDL is needed: the JSON shape already carries everything. Kept as an
+-- empty migration so the migration numbering records the policy change.
+SELECT 1;

package/migrations/lite-sqlite3/0028_add_family_template_key_telemetry.sql

@@ -0,0 +1,40 @@
+-- Denormalizes the share-template family onto every telemetry event.
+--
+-- The share page's family rollup used to scope by an `EXISTS` against
+-- `api_keys` (the template plus every child it issued). That made history
+-- depend on the key row surviving: revoking/removing a key silently dropped
+-- its events out of the family totals. This column pins the template on the
+-- event at write time, so usage outlives the key.
+--
+-- Backfill is idempotent: it only fills NULL rows (the column is new, so
+-- every existing row is NULL) and never overwrites a value. Events whose key
+-- was already hard-deleted before this migration cannot be attributed and stay
+-- NULL; the soft-delete change shipped alongside this prevents future loss.
+
+ALTER TABLE "telemetry_events" ADD COLUMN "family_template_key_id" text;
+
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_family_created_id_idx"
+  ON "telemetry_events" ("tenant_id", "family_template_key_id", "created_at" DESC, "id" DESC);
+
+ALTER TABLE "telemetry_usage_totals" ADD COLUMN "family_template_key_id" text;
+
+CREATE INDEX IF NOT EXISTS "telemetry_usage_totals_tenant_family_idx"
+  ON "telemetry_usage_totals" ("tenant_id", "family_template_key_id");
+
+UPDATE "telemetry_events" AS e
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = e."api_key_id"
+)
+WHERE e."family_template_key_id" IS NULL AND e."api_key_id" IS NOT NULL;
+
+UPDATE "telemetry_usage_totals" AS t
+SET "family_template_key_id" = (
+  SELECT COALESCE(k."parent_key_id", k."id")
+  FROM "api_keys" k
+  WHERE k."id" = t."entity_id"
+)
+WHERE t."family_template_key_id" IS NULL
+  AND t."identity_type" = 'api_key'
+  AND t."entity_id" IS NOT NULL;

package/migrations/lite-sqlite3/0029_null_share_child_policy_columns.sql

@@ -0,0 +1,38 @@
+-- One-time row-data optimization for share children.
+--
+-- Every minted share child used to copy the template's policy columns
+-- (notes, limits, model_list, denylist, …). Auth never reads those from the
+-- child — it resolves `policy = parent ?? row` — so the copies were pure
+-- write-amplification. This UPDATE nulls the 11 nullable policy columns on
+-- every child (`parent_key_id IS NOT NULL`). `scopes` stays (NOT NULL, and
+-- required by backup restore); `model_access_mode` stays (NOT NULL default
+-- 'whitelist'). Schema shape is unchanged — no DROP COLUMN — so backup/
+-- restore remains compatible both directions.
+--
+-- Idempotent: the OR-of-IS-NOT-NULL predicate matches nothing on a re-run,
+-- and the migration ledger skips the file after the first apply.
+--
+-- Keep in sync with `normalizeShareChildPolicy` in
+-- `src/console/backup/store.ts` (post-restore re-applies the same null-out
+-- for a tenant, because restore does not re-run numbered migrations).
+
+UPDATE "api_keys"
+SET "notes_title" = NULL,
+    "notes_subtitle" = NULL,
+    "notes_body" = NULL,
+    "requests_per_minute" = NULL,
+    "daily_token_limit" = NULL,
+    "monthly_token_limit" = NULL,
+    "lifetime_token_budget" = NULL,
+    "max_concurrent_requests" = NULL,
+    "model_prefix" = NULL,
+    "model_list" = NULL,
+    "client_router_denylist" = NULL
+WHERE "parent_key_id" IS NOT NULL
+  AND ( "notes_title" IS NOT NULL OR "notes_subtitle" IS NOT NULL
+        OR "notes_body" IS NOT NULL OR "requests_per_minute" IS NOT NULL
+        OR "daily_token_limit" IS NOT NULL OR "monthly_token_limit" IS NOT NULL
+        OR "lifetime_token_budget" IS NOT NULL
+        OR "max_concurrent_requests" IS NOT NULL OR "model_prefix" IS NOT NULL
+        OR "model_list" IS NOT NULL
+        OR "client_router_denylist" IS NOT NULL );

package/migrations/lite-sqlite3/0030_add_api_key_max_children.sql

@@ -0,0 +1,10 @@
+-- Add a share-template child slot cap.
+--
+-- Share enrollment links are public, and an attacker minting child rows is
+-- only bounded by the per-IP dedupe, which IP rotation (CDN edges, cloud
+-- egress, residential proxies) defeats. `max_children` lets an operator cap
+-- how many concurrently-active child keys a template may mint; NULL keeps the
+-- legacy unlimited behavior. Enforced at mint time (not a database
+-- constraint) so the error path is a clean 429/409.
+
+ALTER TABLE "api_keys" ADD COLUMN "max_children" integer;

package/migrations/lite-sqlite3/0031_tenant_system_prompts.sql

@@ -0,0 +1,10 @@
+-- Tenant-scoped system prompt injection (append/override).
+--
+-- Mirror of the Postgres migration; see that file for rationale.
+CREATE TABLE IF NOT EXISTS "tenant_system_prompts" (
+  "tenant_id"  TEXT PRIMARY KEY REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "global"     TEXT,
+  "providers"  TEXT NOT NULL DEFAULT '{}',
+  "models"     TEXT NOT NULL DEFAULT '{}',
+  "updated_at" TEXT NOT NULL DEFAULT (datetime('now'))
+);