cartethyia 2.7.2 → 2.7.4

package/src/persistence/readiness.ts

@@ -89,12 +89,15 @@ async function runReadinessChecks(
 
   // 1. Check database connectivity via simple query
   let dbOk = false;
+  let dbTimedOut = false;
   try {
     const result = await withTimeoutCheck(
       () => db.execute(sql`SELECT 1`),
       "Database connectivity check",
     );
-    if (result !== "timeout") {
+    if (result === "timeout") {
+      dbTimedOut = true;
+    } else {
       dbOk = true;
     }
   } catch {
@@ -107,7 +110,10 @@ async function runReadinessChecks(
       db: "disconnected",
       migrations: "pending",
       redis: "disconnected",
-      reason: "database not connected",
+      // A timed-out probe under load is not evidence the database is down —
+      // it is the probe itself failing to get a backend in time. The guard
+      // reads this to call it overload rather than a dependency failure.
+      reason: dbTimedOut ? "database probe timed out" : "database not connected",
     };
   }
 
@@ -115,13 +121,16 @@ async function runReadinessChecks(
   // Readiness requires every discovered migration to have a ledger row; a
   // reachable ledger alone is not proof the upgrade finished.
   let migrationsApplied = false;
+  let migrationsTimedOut = false;
   try {
     const result = await withTimeoutCheck(
       () => readMigrationLedgerStatus(db),
       "Migrations check",
     );
 
-    if (result !== "timeout") {
+    if (result === "timeout") {
+      migrationsTimedOut = true;
+    } else {
       migrationsApplied = result.applied;
     }
   } catch {
@@ -134,18 +143,21 @@ async function runReadinessChecks(
       db: "connected",
       migrations: "pending",
       redis: "disconnected",
-      reason: "migrations not yet applied",
+      reason: migrationsTimedOut ? "migrations probe timed out" : "migrations not yet applied",
     };
   }
 
   // 3. Check Redis. The memory backend is healthy by construction — there is
   // no connection to probe — so it passes without a round trip.
   let redisOk = redisBackend === "memory";
+  let redisTimedOut = false;
 
   if (redisBackend === "redis" && redis) {
     try {
       const result = await withTimeoutCheck(() => redis.ping(), "Redis connectivity check");
-      if (result !== "timeout" && result === "PONG") {
+      if (result === "timeout") {
+        redisTimedOut = true;
+      } else if (result === "PONG") {
         redisOk = true;
       }
     } catch {
@@ -159,7 +171,7 @@ async function runReadinessChecks(
       db: "connected",
       migrations: "applied",
       redis: "disconnected",
-      reason: "redis not connected",
+      reason: redisTimedOut ? "redis probe timed out" : "redis not connected",
     };
   }
 

package/src/persistence/schema.ts

@@ -2,7 +2,7 @@
 import { desc, sql } from "drizzle-orm";
 import {
   bigint, boolean, check, customType, index, integer, jsonb, numeric, pgEnum, pgTable,
-  primaryKey, text, timestamp, uniqueIndex, uuid, type AnyPgColumn,
+  primaryKey, text, timestamp, unique, uniqueIndex, uuid, type AnyPgColumn,
 } from "drizzle-orm/pg-core";
 
 export const TENANT_STATUSES = ["active", "suspended", "deleted"] as const;
@@ -183,6 +183,32 @@ export const providers = pgTable(
 // tenant-owned/BYOK. The concurrency ceiling lives in provider routing
 // (`provider_routing_settings.max_inflight`) and network pools
 // (`network_pools.max_inflight`); there is no per-account override.
+/**
+ * A Qoder native machine identity (UMID) bound to one account.
+ *
+ * The device identity is a deterministic function of a seed file
+ * (`~/.config/.locale_cfg`): the `runtime-info` bridge reads that seed and
+ * derives `machineToken`/`machineType`/`machineCode`. The daily 100-credit
+ * campaign does not gate grants on this identity. A persisted seed allows the
+ * vendor bridge to replay the same native identity where another Qoder surface
+ * requires it.
+ *
+ * `seed` is the exact seed-file content the identity was minted from, stored
+ * so the same device identity can be replayed (restore seed → bridge → same
+ * token). It is not a credential, but it is per-account device material and
+ * should not be shared between accounts. Campaign grant eligibility is
+ * independent of `machineToken`.
+ */
+export interface NativeIdentityRecord {
+  readonly machineToken: string;
+  readonly machineType: string;
+  readonly machineCode: string;
+  /** The seed-file content this identity was minted from, if captured. */
+  readonly seed?: string;
+  /** How this identity was produced: the genuine SG bridge or the fallback. */
+  readonly source?: "runtime-info" | "generated";
+}
+
 export const providerAccounts = pgTable("provider_accounts", {
   id: uuid("id").primaryKey().defaultRandom(),
   providerId: text("provider_id")
@@ -270,6 +296,18 @@ export const providerAccounts = pgTable("provider_accounts", {
    */
   quotaPlan: text("quota_plan"),
 
+  /**
+   * Qoder native machine identity bound to this account, as one JSON object
+   * (see {@link NativeIdentityRecord}). `null` means the account has no bound
+   * identity: the check-in mints one on first use.
+   *
+   * Deliberately a dedicated column, not a key inside `auth_state`: the
+   * device token is queryable ("which device is taken by whom") and enforced
+   * unique by the partial index below, and it must survive backup/restore
+   * like any other non-secret column.
+   */
+  nativeIdentity: jsonb("native_identity").$type<NativeIdentityRecord | null>(),
+
   },
   (table) => [
     uniqueIndex("provider_accounts_identity_uidx").on(
@@ -290,6 +328,17 @@ export const providerAccounts = pgTable("provider_accounts", {
     // predicate that does not constrain `provider_id`. This one matches the
     // hot listing path.
     index("provider_accounts_tenant_id_idx").on(table.tenantId),
+    // One Qoder device identity per account: the partial unique index on the
+    // extracted `machineToken` guarantees two accounts never share a device,
+    // which is what makes the daily 100-credit grant reusable per account
+    // instead of colliding on a device identity. `NULL` rows (unbound
+    // accounts) are excluded so the uniqueness only applies to bound
+    // identities. The Postgres migration spells the expression
+    // `(native_identity ->> 'machineToken')`; the SQLite migration spells it
+    // `json_extract(native_identity, '$.machineToken')`.
+    uniqueIndex("provider_accounts_native_identity_token_uidx")
+      .on(sql`(${table.nativeIdentity} ->> 'machineToken')`)
+      .where(sql`${table.nativeIdentity} IS NOT NULL`),
   ],
 );
 
@@ -521,6 +570,49 @@ export const networkPools = pgTable("network_pools", {
   ],
 );
 
+/**
+ * A pool's account-equivalent routing entity for ip-scoped, credential-less
+ * providers (OpenCode Free today).
+ *
+ * These providers own no `provider_accounts` rows — the rate limit belongs to
+ * the egress address, not to a credential. Materializing one row per (pool,
+ * ip-scoped provider) lets the account health machine, routing eligibility, and
+ * the provider-detail accounts UI treat each egress like an account: the row
+ * carries the same health state machine and cooldown columns, so a spent egress
+ * is excluded from the plan the same way a cooling account is, and the operator
+ * sees it in the provider's Accounts card with a "Pool" badge.
+ *
+ * The row is an *account-equivalent*, not an account: it resolves no credential
+ * (`credential_kind` is fixed to `none`-style egress), is skipped by the quota
+ * refresh and identity sweeps (they filter on real credential kinds), and is
+ * owned by its pool — deleting the pool cascades the row.
+ */
+export const providerPoolAccounts = pgTable(
+  "provider_pool_accounts",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    tenantId: tenantRefRequired(),
+    networkPoolId: uuid("network_pool_id")
+      .notNull()
+      .references(() => networkPools.id, { onDelete: "cascade" }),
+    providerId: text("provider_id").notNull(),
+    label: text("label").notNull(),
+    ...healthColumns(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    unique("provider_pool_accounts_pool_provider_uidx").on(
+      table.networkPoolId,
+      table.providerId,
+      table.tenantId,
+    ),
+    index("provider_pool_accounts_tenant_status_idx").on(table.tenantId, table.status),
+    index("provider_pool_accounts_provider_status_idx").on(table.providerId, table.status),
+  ],
+);
+export type ProviderPoolAccount = typeof providerPoolAccounts.$inferSelect;
+
 
 // Account and network-pool health events share one table. The entity kind
 // selects exactly one owner FK, and the CHECK constraint below preserves
@@ -766,6 +858,13 @@ export const apiKeys = pgTable(
       .notNull()
       .default(0),
     maxConcurrentRequests: integer("max_concurrent_requests"),
+    /**
+     * Slot cap for a share template: the maximum number of concurrently
+     * active child keys it may mint. `null` = unlimited (legacy behavior).
+     * Enforced at mint time in `issueSharedApiKey`; the console exposes it as
+     * the template's "slots".
+     */
+    maxChildren: integer("max_children"),
     /**
      * `whitelist` = only the names in `modelList` may be used (empty = all);
      * `blacklist` = the names in `modelList` are refused (empty = none). One
@@ -790,6 +889,21 @@ export const apiKeys = pgTable(
     createdAt: createdAtColumn(),
     enabled: boolean("enabled").notNull().default(true),
     revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    /**
+     * Ban state. A ban is distinct from a revoke: it records the operator's
+     * reason (`banReason`) so the console can show it, and it is fully
+     * reversible — unban clears both columns, leaving no metadata behind.
+     * Banned keys are rejected by the auth path exactly like revoked keys.
+     */
+    bannedAt: timestamp("banned_at", { withTimezone: true }),
+    banReason: text("ban_reason"),
+    /**
+     * When the ban lifts on its own, if it is not permanent. `null` means the
+     * ban does not lapse (until an operator unbans it). The auth path treats a
+     * key as banned only while `banned_at` is set and `banned_until` is either
+     * null or in the future — so a timed ban expires without SQL.
+     */
+    bannedUntil: timestamp("banned_until", { withTimezone: true }),
     /**
      * The tenant's mandatory gateway key. Seeded at first boot whether or not
      * `CARTETHYIA_API_KEY` was configured, and the one key the console refuses
@@ -1126,6 +1240,26 @@ export const consoleSettings = pgTable("console_settings", {
   updatedAt: updatedAtColumn(),
 });
 
+// Tenant-scoped system prompt injection (append/override). One row per
+// tenant; `global` NULL means never configured, distinct from an explicit
+// disabled setting. Providers/models are JSON object maps keyed by
+// providerId and `providerId::modelId` respectively — see
+// `src/console/system-prompt/contracts.ts` for the value shapes and the
+// resolution rules implemented by the dispatch-path transform.
+export const tenantSystemPrompts = pgTable("tenant_system_prompts", {
+  tenantId: tenantRefPrimaryKey(),
+  global: jsonb("global").$type<import("../console/system-prompt/contracts").PromptSetting | null>(),
+  providers: jsonb("providers")
+    .notNull()
+    .default({})
+    .$type<Record<string, import("../console/system-prompt/contracts").ProviderPromptEntry>>(),
+  models: jsonb("models")
+    .notNull()
+    .default({})
+    .$type<Record<string, import("../console/system-prompt/contracts").PromptSetting>>(),
+  updatedAt: updatedAtColumn(),
+});
+
 // InferHub `config_read` key. One row for the whole deployment.
 //
 // Deliberately NOT `provider_accounts.auth_state`: that field is documented as
@@ -1229,6 +1363,14 @@ export const telemetryEvents = pgTable(
     networkPoolId: uuid("network_pool_id"),
     endpoint: text("endpoint"),
     apiKeyId: uuid("api_key_id"),
+    /**
+     * The share-template key this event belongs to (the template itself, or
+     * the parent of the child key that carried the request). Denormalized at
+     * write time so family rollups survive the key row being deleted — an
+     * `EXISTS` join against `api_keys` tied history to key lifetime. NULL for
+     * requests that ran under no share template.
+     */
+    familyTemplateKeyId: uuid("family_template_key_id"),
     userAgent: text("user_agent"),
     clientIp: text("client_ip"),
     latencyMs: integer("latency_ms"),
@@ -1317,6 +1459,14 @@ export const telemetryEvents = pgTable(
       desc(table.createdAt),
       desc(table.id),
     ),
+    // Share-family rollup: equality on the denormalized template, keyset
+    // range+order. Backs both the family totals and the hourly chart reads.
+    index("telemetry_events_tenant_family_created_id_idx").on(
+      table.tenantId,
+      table.familyTemplateKeyId,
+      desc(table.createdAt),
+      desc(table.id),
+    ),
     index("telemetry_events_request_id_idx").on(table.requestId),
     index("telemetry_events_tenant_account_created_idx").on(
       table.tenantId,
@@ -1373,6 +1523,13 @@ export const telemetryUsageTotals = pgTable(
     tenantId: tenantRefRequired(),
     identityType: text("identity_type").$type<TelemetryUsageIdentityType>().notNull(),
     entityId: uuid("entity_id").notNull(),
+    /**
+     * For `api_key` identities, the share-template key this key belongs to
+     * (the template itself, or the parent of a minted child). Denormalized so
+     * family reads do not depend on the key row surviving; NULL for `account`
+     * identities and for keys outside a share family.
+     */
+    familyTemplateKeyId: uuid("family_template_key_id"),
     requests: bigint("requests", { mode: "number" }).notNull().default(0),
     errors: bigint("errors", { mode: "number" }).notNull().default(0),
     inputTokens: bigint("input_tokens", { mode: "number" }).notNull().default(0),
@@ -1389,6 +1546,10 @@ export const telemetryUsageTotals = pgTable(
       "telemetry_usage_totals_identity_type_check",
       sql`${table.identityType} IN ('account', 'api_key')`,
     ),
+    index("telemetry_usage_totals_tenant_family_idx").on(
+      table.tenantId,
+      table.familyTemplateKeyId,
+    ),
   ],
 );