cartethyia 2.7.3 → 2.7.5

package/dist/dashboard/precompressed-assets.json

@@ -1,74 +1,76 @@
 {
-  "count": 117,
+  "count": 119,
   "assets": [
-    "assets/AccountCooldown-Bjo92Qat.js",
-    "assets/BannedPage-2TJD37Hb.js",
-    "assets/CliToolDetailPage-xefJNRmJ.js",
-    "assets/CliToolsPage-Rj9iHQ3F.js",
-    "assets/CombosPage-JEbYJFxw.js",
-    "assets/ConsoleLogPage-C3xx_inM.js",
-    "assets/CustomizationPage-Dw306gJU.js",
-    "assets/HealthEventsModal-jaBo1TWV.js",
-    "assets/LoginPage-C4w7vea-.js",
-    "assets/ModelPicker-BtPcAfot.js",
-    "assets/OverviewPage-CGC5gNs1.js",
-    "assets/ProviderDetailPage-DQcthNGt.js",
-    "assets/ProviderIcon-FB6yS4v1.js",
-    "assets/ProvidersPage-0OsXRGXe.js",
-    "assets/ProxyPage-DdPc8slb.js",
-    "assets/QuotaPage-Ci5O4BnH.js",
-    "assets/SettingsPage-CDZjTt87.js",
-    "assets/SetupPage-BQS0Rx_u.js",
-    "assets/SortableList-BAL5npBC.js",
-    "assets/StudioPage-TP7voAQ0.js",
+    "assets/BannedPage-Cj15GsMp.js",
+    "assets/ClaimGiftsButton-D83pBJ6J.js",
+    "assets/CliToolDetailPage-DZKmVuJN.js",
+    "assets/CliToolsPage-BIccZmeL.js",
+    "assets/CombosPage-DEEKkYD-.js",
+    "assets/ConsoleLogPage-D5rol2j2.js",
+    "assets/CustomizationPage-BKj_r0rp.js",
+    "assets/InjectSystemPromptPanel-B5nZvmf0.js",
+    "assets/LoginPage-DkXb6dx-.js",
+    "assets/ModelPicker-DnQPSIA8.js",
+    "assets/OverviewPage-Ci2wQKUz.js",
+    "assets/ProviderDetailPage-odlgYrOg.js",
+    "assets/ProviderIcon-EfeloBn4.js",
+    "assets/ProvidersPage-CqFBQEB8.js",
+    "assets/ProxyPage-5SnUSy3j.js",
+    "assets/QuotaPage-CmnMDzhP.js",
+    "assets/SettingsPage-BJtRZ4qD.js",
+    "assets/SetupPage-WTa0sktC.js",
+    "assets/StudioPage-BfAb5-o_.js",
     "assets/ToolIcon-K1ckcDKg.js",
-    "assets/UsagePage-Cj_fEzhg.js",
-    "assets/api-keys-MbI7e7rt.js",
-    "assets/app-B2vyPoII.css",
-    "assets/app-wvwCi4Eh.js",
+    "assets/UsagePage-BNzeZ2Vk.js",
+    "assets/api-keys-l29JROPv.js",
+    "assets/app--PJWq8_C.css",
+    "assets/app-Bgd3zANQ.js",
     "assets/arrow-left-CpBxkoxI.js",
     "assets/arrow-right-Dl5yKnp8.js",
     "assets/arrow-up-59ms1iiT.js",
-    "assets/assert-C0YYuZJ4.js",
+    "assets/assert-C0K-c4eo.js",
     "assets/backup-file-gdKIlg8U.js",
-    "assets/badge-B_DMpMJN.js",
-    "assets/banner-DMrMPmth.js",
+    "assets/badge-DfbhQU4k.js",
+    "assets/banner-BllT4LcF.js",
     "assets/brain-Cwed_72z.js",
-    "assets/card-Be5Uzamx.js",
+    "assets/card-CtkX66Wd.js",
+    "assets/chevron-left-Bf6CaTSJ.js",
     "assets/chevron-right-BXIy5l3h.js",
     "assets/circle-alert-CntYHV5v.js",
     "assets/circle-check-BU3v_mFW.js",
-    "assets/cli-tools-muFRphDu.js",
-    "assets/clipboard-button-DOfrVmsi.js",
+    "assets/cli-tools-CQXVMn4P.js",
+    "assets/clipboard-button-BQqBQd2n.js",
     "assets/database-Dz9N3zGd.js",
-    "assets/dialog-C9omdjQt.js",
+    "assets/dialog-BEK7KP0H.js",
     "assets/dialog-actions-B1axpEg7.js",
     "assets/download-dRFo5_Wu.js",
-    "assets/drawer-Bm8WKaGY.js",
-    "assets/entry-DS90gUks.js",
-    "assets/entry-j40LJotO.js",
-    "assets/entry-q5HwZ8nN.js",
+    "assets/drawer-BrTEZ8zu.js",
+    "assets/entry-CHWxbS56.js",
+    "assets/entry-EBHJ3DrE.js",
+    "assets/entry-LCS85hiq.js",
     "assets/eye-C_hawfH4.js",
     "assets/eye-off-Bk5g2luF.js",
     "assets/fingerprint-pattern-BWuHtbW4.js",
-    "assets/formatters-BTScrQpe.js",
+    "assets/formatters-BAACA727.js",
     "assets/gauge-BbIMy7MB.js",
-    "assets/github-badge-Orjuzemr.js",
+    "assets/github-badge-YSCE4UC2.js",
     "assets/image-BPaouViG.js",
-    "assets/index-cPrX5vn6.js",
-    "assets/inline-Dvux8w-0.js",
-    "assets/input-CU1Rgf3p.js",
+    "assets/index-FQlj0HUT.js",
+    "assets/inline-C4gU5iOL.js",
+    "assets/input-BHHX_Tmm.js",
     "assets/jsx-runtime-CXUMngI_.js",
     "assets/key-round-UkavsGxp.js",
     "assets/layers-2-glBbjl.js",
-    "assets/layout-C_7A6H55.js",
-    "assets/list-row-CzFvogbj.js",
-    "assets/live-KaG15HLQ.js",
+    "assets/layout-CajrYUnD.js",
+    "assets/list-row-Bx2I7XUe.js",
+    "assets/live-DNNqRbj2.js",
     "assets/log-in-BmRjy60c.js",
     "assets/message-circle-CCxGwRvv.js",
-    "assets/minimize-2-D-MN8W8a.js",
-    "assets/mutation-JJGQm8TD.js",
-    "assets/numbers-BNDZnsUE.js",
+    "assets/minimize-2-BTmMTK4o.js",
+    "assets/mutation-Rr0TIvcj.js",
+    "assets/network-C5UBACrJ.js",
+    "assets/numbers-CUWAZK4J.js",
+    "assets/pagination-Xsi9Qx04.js",
     "assets/pencil-768ysRAr.js",
     "assets/plus-DIdX_g-x.js",
     "assets/power-off-Yjw9GMJh.js",
@@ -91,22 +93,22 @@
     "assets/providers/parallel.svg",
     "assets/providers/tokenharbor.svg",
     "assets/providers/zai-coding-plan.svg",
-    "assets/query-keys-CLaNz8Xz.js",
-    "assets/quota-DZGyp0N5.js",
+    "assets/query-keys-BloKtaXJ.js",
+    "assets/quota-DvQbD_sr.js",
     "assets/refresh-cw-BqJFk4sU.js",
     "assets/rotate-ccw-CufcqITi.js",
     "assets/route-CNSNj9Zm.js",
-    "assets/routing-BEH32QOC.js",
+    "assets/routing-in0f_IfK.js",
     "assets/scaling-nWE4Cx8f.js",
     "assets/search-JOKus9rb.js",
-    "assets/select-B3iTetHN.js",
+    "assets/select-BLULNqTp.js",
     "assets/settings-2-Ds9DQp0t.js",
-    "assets/settings-Dt3Eqbnq.js",
+    "assets/settings-CcGczj6I.js",
+    "assets/shield-BMQNxORh.js",
     "assets/shield-check-DVS0Foqh.js",
-    "assets/stack-KrOrm7JZ.js",
-    "assets/state-DLS7IDMy.js",
-    "assets/stream-retry-5QnVuSSo.js",
-    "assets/switch-42ItvbAs.js",
+    "assets/stack-D2lIR0tg.js",
+    "assets/state-DTARjfiW.js",
+    "assets/switch-c0oPSnqW.js",
     "assets/terminal-0_IjPWTk.js",
     "assets/tokens-COzario9.js",
     "assets/trash-Cppn5c3R.js",
@@ -114,7 +116,7 @@
     "assets/use-modal-focus-By7oJoGd.js",
     "assets/use-reduced-motion-C4B0R6Sz.js",
     "assets/use-timeout-BwcBBRrT.js",
-    "assets/useMutation-Dmnfh1Ue.js",
+    "assets/useMutation-m8WGNPrz.js",
     "assets/wrench-B6E1oEuY.js",
     "assets/zap-C4EeVW4q.js",
     "index.html"

package/migrations/full-postgres/0027_qoder_identity_genuine_seed.sql

@@ -1,21 +1,20 @@
 -- Qoder native identity: genuine SG identity + per-account seed replay.
 --
--- Research (2026-10-30, see documentation/research/qoder-identity-gate-
--- postmortem.md and qoder-umid-reverse.md) established that the daily-credit
--- campaign gates its CREDITS grant on a *genuine* Alibaba SG-produced
--- identity: generated/deterministic tokens do not reveal the grant on a
--- fresh account, while the `runtime-info` bridge (SG-signed) does.
+-- Research (2026-10-30, see
+-- documentation/archive/research/Qoder-03-umid-and-identity-findings.md)
+-- established that machine identity does not gate the daily-credit campaign.
+-- The seed is retained for deterministic replay of a native identity on
+-- surfaces that may require one; it is not required for campaign eligibility.
 --
 -- Migration 0026 already added `native_identity` (the token triple + optional
 -- seed) with a partial unique index on the extracted machineToken — the
 -- "one device per account" invariant. This migration does not change that
 -- schema; it only documents the contract change on the same column:
 --
---   `seed` is now REQUIRED for a claim-capable identity (the seed is the
---   device material; the token can be re-derived from it, never the reverse).
---   Rows minted by the retired generated path carry `seed = ""` — they stay
---   valid records but must be re-minted through the bridge before the next
---   claim; the store treats a missing/empty seed as "not replay-capable".
+--   `seed` makes a native identity replay-capable (the token can be
+--   re-derived from the seed, never the reverse). Rows minted by the
+--   generated path may have `seed = ""`; that affects native replay only,
+--   not the daily campaign claim.
 --
 -- No DDL is needed: the JSON shape already carries everything. Kept as an
 -- empty migration so the migration numbering records the policy change.

package/migrations/full-postgres/0032_add_provider_pool_accounts.sql

@@ -0,0 +1,53 @@
+-- Pool-as-account routing entities for ip-scoped, credential-less providers.
+--
+-- For providers whose rate limit follows the egress address (OpenCode Free),
+-- the pool is the resource that runs out — but it was invisible to account-level
+-- health and routing because the provider owns no `provider_accounts` rows.
+-- This table materializes one row per (pool × ip-scoped provider), carrying the
+-- same health state machine (`status`, `cooldown_until`, …) so a spent egress
+-- is excluded from routing plans exactly like a cooling account, and shows in
+-- the provider's Accounts card with a "Pool" badge.
+--
+-- The row is an account-equivalent, not an account: it resolves no credential,
+-- is skipped by quota-refresh and identity sweeps (they filter on real
+-- credential kinds), and is owned by its pool — deleting the pool cascades the
+-- row. Rows are backfilled here for every existing pool × ip-scoped provider so
+-- no operator action is needed to adopt the feature.
+CREATE TABLE IF NOT EXISTS "provider_pool_accounts" (
+  "id"            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "tenant_id"     uuid NOT NULL REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "network_pool_id" uuid NOT NULL REFERENCES "network_pools" ("id") ON DELETE CASCADE,
+  "provider_id"    text NOT NULL,
+  "label"          text NOT NULL,
+  "status"         text NOT NULL DEFAULT 'active'
+                  CHECK ("status" IN ('active', 'cooldown', 'disabled')),
+  "consecutive_failures" integer NOT NULL DEFAULT 0,
+  "last_success_at" timestamptz,
+  "last_error"      text,
+  "last_error_category" text,
+  "last_error_at"    timestamptz,
+  "cooldown_until"  timestamptz,
+  "last_recovered_at" timestamptz,
+  "created_at"      timestamptz NOT NULL DEFAULT now(),
+  "updated_at"      timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT provider_pool_accounts_pool_provider_uidx
+    UNIQUE ("network_pool_id", "provider_id", "tenant_id")
+);
+
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_tenant_status_idx
+  ON "provider_pool_accounts" ("tenant_id", "status");
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_provider_status_idx
+  ON "provider_pool_accounts" ("provider_id", "status");
+
+-- Backfill: every existing pool × ip-scoped provider gets its row. The
+-- ip-scoped set is OpenCode Free today; the provider id is spelled here so the
+-- rule stays a data fact, not a code constant.
+INSERT INTO "provider_pool_accounts"
+  ("tenant_id", "network_pool_id", "provider_id", "label")
+SELECT
+  p."tenant_id",
+  p."id",
+  'opencode',
+  'Pool ' || left(p."id"::text, 8)
+FROM "network_pools" p
+ON CONFLICT ("network_pool_id", "provider_id", "tenant_id") DO NOTHING;

package/migrations/full-postgres/0033_add_api_key_ban.sql

@@ -0,0 +1,9 @@
+-- API-key ban state.
+--
+-- A ban is distinct from revoke (terminal, tombstone-like) and disable
+-- (operator toggle, reversible): it records *why* a key was banned
+-- (`ban_reason`) for the console's "See reason" modal. Unban clears both
+-- columns entirely — no tombstone, no leftover metadata.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_at" timestamptz,
+  ADD COLUMN "ban_reason" text;

package/migrations/full-postgres/0034_add_api_key_ban_until.sql

@@ -0,0 +1,7 @@
+-- API-key ban expiry.
+--
+-- A ban may now carry an optional `banned_until`: a timed ban lifts on its
+-- own (auth checks `banned_at` against `banned_until`), while `null` keeps the
+-- earlier permanent-ban behavior. Unban clears all three ban columns.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_until" timestamptz;

package/migrations/full-postgres/0035_align_pool_account_status_enum.sql

@@ -0,0 +1,21 @@
+-- Align `provider_pool_accounts.status` with the shared `health_status` enum.
+--
+-- The table was created with a `text` column plus an inline CHECK (migration
+-- 0032), while every other health-state column uses the `health_status` enum.
+-- The Drizzle schema declares the enum, so the drift checker reported the text
+-- column and its CHECK as "produced by migrations but not in schema". This
+-- migration rewrites the column to the enum: same allowed values, one
+-- canonical type.
+--
+-- The inline CHECK from 0032 must be dropped first: PostgreSQL rewrites
+-- CHECK expressions during an ALTER TYPE, and the old `status IN ('active',
+-- ...)` expression compares the new enum column against text literals, which
+-- has no operator once the column becomes the enum.
+
+ALTER TABLE "provider_pool_accounts" DROP CONSTRAINT "provider_pool_accounts_status_check";
+
+ALTER TABLE "provider_pool_accounts"
+  ALTER COLUMN "status" DROP DEFAULT,
+  ALTER COLUMN "status" SET DATA TYPE "public"."health_status"
+    USING "status"::"public"."health_status",
+  ALTER COLUMN "status" SET DEFAULT 'active';

package/migrations/full-postgres/0036_system_prompt_presets_refs.sql

@@ -0,0 +1,10 @@
+-- Tenant system-prompt injection: presets + combo/alias scopes + scope refs.
+--
+-- Legacy shape: `providers` (followGlobal + optional inline setting), `models`
+-- (providerId::modelId -> setting). New shape: every scope map stores a
+-- reference, and a named preset collection is introduced. Legacy rows remain
+-- readable (the store's defensive reader normalizes them); this migration only
+-- adds the new columns so the new shapes can be written.
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "presets" jsonb NOT NULL DEFAULT '{}';
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "combos" jsonb NOT NULL DEFAULT '{}';
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "aliases" jsonb NOT NULL DEFAULT '{}';

package/migrations/full-postgres/0037_share_concurrency_scope.sql

@@ -0,0 +1,3 @@
+-- Share-template concurrency scope: family (one cap for all recipients, the
+-- default) vs per_key (each recipient key carries its own cap and counter).
+ALTER TABLE "api_keys" ADD COLUMN "concurrency_scope" text NOT NULL DEFAULT 'family';

package/migrations/full-postgres/0038_add_accounts_quota_snapshot.sql

@@ -0,0 +1,7 @@
+-- Last successful quota read, persisted as JSON so an account's balance
+-- survives a process restart (the in-process quota cache does not).
+--
+-- Only a successful read is stored; a failed fetch leaves the previous
+-- snapshot in place, mirroring `quota_plan`.
+ALTER TABLE "provider_accounts"
+  ADD COLUMN IF NOT EXISTS "quota_snapshot" jsonb;

package/migrations/full-postgres/0039_add_telemetry_provider_model_indexes.sql

@@ -0,0 +1,13 @@
+-- Indexes for the console's per-provider and per-model telemetry aggregates.
+--
+-- The provider usage matrix and `breakdownTelemetry("provider")` filter on
+-- `tenant_id` + `provider_id` and aggregate over `created_at`; the top-model
+-- breakdown does the same for `requested_model`. These queries used the
+-- tenant-range index, which scanned every event in the window for one
+-- provider/model card. Each new index turns the card into an index-only range
+-- scan.
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_provider_created_idx"
+  ON "telemetry_events" USING btree ("tenant_id", "provider_id", "created_at");
+
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_model_created_idx"
+  ON "telemetry_events" USING btree ("tenant_id", "requested_model", "created_at");

package/migrations/full-postgres/0040_add_models_dialect.sql

@@ -0,0 +1,3 @@
+-- Explicit wire dialect per model row (nullable; absent = resolver fallback).
+-- See documentation/features/09-wire-dialects.md.
+ALTER TABLE "models" ADD COLUMN "dialect" TEXT;

package/migrations/full-postgres/0041_add_daily_checkin_ledger_account_fk.sql

@@ -0,0 +1,7 @@
+-- `daily_checkin_ledger.account_id` referenced `provider_accounts.id` only by
+-- convention; deleting an account left orphan ledger rows behind. This adds the
+-- missing FK with `ON DELETE CASCADE` so a deleted account's daily check-in
+-- markers go with it.
+ALTER TABLE "daily_checkin_ledger"
+  ADD CONSTRAINT "daily_checkin_ledger_account_id_provider_accounts_id_fk"
+  FOREIGN KEY ("account_id") REFERENCES "provider_accounts" ("id") ON DELETE CASCADE;

package/migrations/lite-sqlite3/0027_qoder_identity_genuine_seed.sql

@@ -1,21 +1,20 @@
 -- Qoder native identity: genuine SG identity + per-account seed replay.
 --
--- Research (2026-10-30, see documentation/research/qoder-identity-gate-
--- postmortem.md and qoder-umid-reverse.md) established that the daily-credit
--- campaign gates its CREDITS grant on a *genuine* Alibaba SG-produced
--- identity: generated/deterministic tokens do not reveal the grant on a
--- fresh account, while the `runtime-info` bridge (SG-signed) does.
+-- Research (2026-10-30, see
+-- documentation/archive/research/Qoder-03-umid-and-identity-findings.md)
+-- established that machine identity does not gate the daily-credit campaign.
+-- The seed is retained for deterministic replay of a native identity on
+-- surfaces that may require one; it is not required for campaign eligibility.
 --
 -- Migration 0026 already added `native_identity` (the token triple + optional
 -- seed) with a partial unique index on the extracted machineToken — the
 -- "one device per account" invariant. This migration does not change that
 -- schema; it only documents the contract change on the same column:
 --
---   `seed` is now REQUIRED for a claim-capable identity (the seed is the
---   device material; the token can be re-derived from it, never the reverse).
---   Rows minted by the retired generated path carry `seed = ""` — they stay
---   valid records but must be re-minted through the bridge before the next
---   claim; the store treats a missing/empty seed as "not replay-capable".
+--   `seed` makes a native identity replay-capable (the token can be
+--   re-derived from the seed, never the reverse). Rows minted by the
+--   generated path may have `seed = ""`; that affects native replay only,
+--   not the daily campaign claim.
 --
 -- No DDL is needed: the JSON shape already carries everything. Kept as an
 -- empty migration so the migration numbering records the policy change.

package/migrations/lite-sqlite3/0032_add_provider_pool_accounts.sql

@@ -0,0 +1,44 @@
+-- Pool-as-account routing entities for ip-scoped, credential-less providers.
+--
+-- Mirror of `full-postgres/0032_add_provider_pool_accounts.sql`; see that file
+-- for the rationale. SQLite representation: `id`/`tenant_id`/`network_pool_id`
+-- are text (uuid), `status` is text with a CHECK, timestamps are text.
+CREATE TABLE IF NOT EXISTS "provider_pool_accounts" (
+  "id"            text PRIMARY KEY,
+  "tenant_id"     text NOT NULL REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "network_pool_id" text NOT NULL REFERENCES "network_pools" ("id") ON DELETE CASCADE,
+  "provider_id"    text NOT NULL,
+  "label"          text NOT NULL,
+  "status"         text NOT NULL DEFAULT 'active'
+                  CHECK ("status" IN ('active', 'cooldown', 'disabled')),
+  "consecutive_failures" integer NOT NULL DEFAULT 0,
+  "last_success_at" text,
+  "last_error"      text,
+  "last_error_category" text,
+  "last_error_at"    text,
+  "cooldown_until"  text,
+  "last_recovered_at" text,
+  "created_at"      text NOT NULL DEFAULT (datetime('now')),
+  "updated_at"      text NOT NULL DEFAULT (datetime('now')),
+  CONSTRAINT provider_pool_accounts_pool_provider_uidx
+    UNIQUE ("network_pool_id", "provider_id", "tenant_id")
+);
+
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_tenant_status_idx
+  ON "provider_pool_accounts" ("tenant_id", "status");
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_provider_status_idx
+  ON "provider_pool_accounts" ("provider_id", "status");
+
+-- Backfill: every existing pool × ip-scoped provider gets its row. The
+-- ip-scoped set is OpenCode Free today; the provider id is spelled here so the
+-- rule stays a data fact, not a code constant. SQLite's bun driver rejects the
+-- newer `ON CONFLICT DO NOTHING` on an INSERT…SELECT, so the equivalent
+-- `INSERT OR IGNORE` form is used here (Postgres version keeps the standard one).
+INSERT OR IGNORE INTO "provider_pool_accounts"
+  ("tenant_id", "network_pool_id", "provider_id", "label")
+SELECT
+  p."tenant_id",
+  p."id",
+  'opencode',
+  'Pool ' || substr(p."id", 1, 8)
+FROM "network_pools" p;

package/migrations/lite-sqlite3/0033_add_api_key_ban.sql

@@ -0,0 +1,8 @@
+-- API-key ban state. Mirror of `full-postgres/0033_add_api_key_ban.sql`;
+-- SQLite stores timestamps as text (ISO), and each `ALTER TABLE ... ADD COLUMN`
+-- may carry exactly one column.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_at" text;
+
+ALTER TABLE "api_keys"
+  ADD COLUMN "ban_reason" text;

package/migrations/lite-sqlite3/0034_add_api_key_ban_until.sql

@@ -0,0 +1,5 @@
+-- API-key ban expiry. Mirror of `full-postgres/0034_add_api_key_ban_until.sql`;
+-- SQLite stores timestamps as text (ISO), and each `ALTER TABLE ... ADD COLUMN`
+-- may carry exactly one column.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_until" text;

package/migrations/lite-sqlite3/0035_align_pool_account_status_enum.sql

@@ -0,0 +1,6 @@
+-- SQLite mirror of `full-postgres/0035_align_pool_account_status_enum.sql`.
+--
+-- SQLite has no enum type: `provider_pool_accounts.status` is a `text`
+-- column with a CHECK constraint already (migration 0032), which matches the
+-- shared schema's semantics. Nothing to change here; the file exists so both
+-- backends carry the same numbered migration set.

package/migrations/lite-sqlite3/0036_system_prompt_presets_refs.sql

@@ -0,0 +1,14 @@
+-- Tenant system-prompt injection: presets + combo/alias scopes + scope refs.
+--
+-- Legacy shape: `providers` (followGlobal + optional inline setting), `models`
+-- (providerId::modelId -> setting). New shape: every scope map stores a
+-- reference, and a named preset collection is introduced. Legacy rows remain
+-- readable (the store's defensive reader normalizes them); this migration only
+-- adds the new columns so the new shapes can be written.
+--
+-- SQLite stores JSON as TEXT, so the new maps are TEXT columns with an
+-- empty-object default, mirroring the existing `providers`/`models` TEXT
+-- columns.
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "presets" TEXT NOT NULL DEFAULT '{}';
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "combos" TEXT NOT NULL DEFAULT '{}';
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "aliases" TEXT NOT NULL DEFAULT '{}';

package/migrations/lite-sqlite3/0037_share_concurrency_scope.sql

@@ -0,0 +1,3 @@
+-- Share-template concurrency scope: family (one cap for all recipients, the
+-- default) vs per_key (each recipient key carries its own cap and counter).
+ALTER TABLE "api_keys" ADD COLUMN "concurrency_scope" TEXT NOT NULL DEFAULT 'family';

package/migrations/lite-sqlite3/0038_add_accounts_quota_snapshot.sql

@@ -0,0 +1,4 @@
+-- SQLite mirror of `full-postgres/0038_add_accounts_quota_snapshot.sql`:
+-- the column is `text` (the SQLite representation of jsonb).
+ALTER TABLE "provider_accounts"
+  ADD COLUMN "quota_snapshot" text;

package/migrations/lite-sqlite3/0039_add_telemetry_provider_model_indexes.sql

@@ -0,0 +1,6 @@
+-- SQLite mirror of `full-postgres/0039_add_telemetry_provider_model_indexes.sql`.
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_provider_created_idx"
+  ON "telemetry_events" ("tenant_id", "provider_id", "created_at");
+
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_model_created_idx"
+  ON "telemetry_events" ("tenant_id", "requested_model", "created_at");

package/migrations/lite-sqlite3/0040_add_models_dialect.sql

@@ -0,0 +1,3 @@
+-- Explicit wire dialect per model row (nullable; absent = resolver fallback).
+-- See documentation/features/09-wire-dialects.md.
+ALTER TABLE "models" ADD COLUMN "dialect" TEXT;

package/migrations/lite-sqlite3/0041_add_daily_checkin_ledger_account_fk.sql

@@ -0,0 +1,26 @@
+-- `daily_checkin_ledger.account_id` referenced `provider_accounts.id` only by
+-- convention; deleting an account left orphan ledger rows behind. This adds the
+-- missing FK with `ON DELETE CASCADE` so a deleted account's daily check-in
+-- markers go with it.
+--
+-- SQLite cannot add a FK to an existing table in place, so the ledger is
+-- rebuilt with the constraint. The runner wraps the file in a transaction, so
+-- `PRAGMA foreign_keys = OFF` is unusable (a no-op inside a transaction);
+-- `defer_foreign_keys` postpones enforcement to commit time instead, letting
+-- the drop/rename complete mid-rebuild.
+
+PRAGMA defer_foreign_keys = ON;
+
+CREATE TABLE "daily_checkin_ledger__new" (
+  "day_key" text NOT NULL,
+  "account_id" text NOT NULL,
+  "claimed_at" text DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')) NOT NULL,
+  CONSTRAINT "daily_checkin_ledger_day_key_account_id_pk" PRIMARY KEY("day_key", "account_id"),
+  CONSTRAINT "daily_checkin_ledger_account_id_provider_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "provider_accounts"("id") ON DELETE cascade
+);
+INSERT INTO "daily_checkin_ledger__new" ("day_key", "account_id", "claimed_at")
+  SELECT "day_key", "account_id", "claimed_at" FROM "daily_checkin_ledger";
+DROP TABLE "daily_checkin_ledger";
+ALTER TABLE "daily_checkin_ledger__new" RENAME TO "daily_checkin_ledger";
+
+PRAGMA defer_foreign_keys = OFF;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.7.3",
+  "version": "2.7.5",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",
@@ -39,7 +39,7 @@
     "bun": ">=1.4.0"
   },
   "scripts": {
-    "dev": "bun run dev:stack",
+    "dev": "bun run dev:watch",
     "dev:watch": "bun run scripts/dev/supervisor.ts",
     "test": "bun run scripts/test/run.ts",
     "build": "bun run scripts/build/build.ts",
@@ -47,14 +47,13 @@
     "setup": "bun run scripts/cli/setup.ts",
     "start": "bun run scripts/cli/main.ts start",
     "doctor": "bun run scripts/cli/doctor.ts",
-    "probe:egress": "bun run scripts/tools/probe-egress.ts",
     "restart": "bun run scripts/build/restart.ts",
     "build:aot": "bun run scripts/build/aot.ts",
     "dev:stack": "concurrently -n BACKEND,DASHBOARD -c cyan,magenta --kill-others-on-fail \"bun run dev:backend\" \"bun run dashboard:dev\"",
     "typecheck": "tsc --noEmit",
     "test:watch": "bun run scripts/test/run.ts --watch",
     "test-db:up": "docker compose -f docker-compose.test.yml up -d --wait postgres-test",
-    "dev:backend": "bun run --hot src/main.ts",
+    "dev:backend": "bun run src/main.ts",
     "dev:console-auth": "bun run scripts/test/console-session.ts",
     "dev:visual-baseline": "bun run scripts/test/visual-baseline.ts",
     "build:binary": "bun run scripts/build/compile.ts",
@@ -78,7 +77,6 @@
     "jsonrepair": "^3.15.0",
     "pg": "8.23.0",
     "pino": "^10.3.1",
-    "pino-pretty": "^13.1.3",
     "protobufjs": "^7.6.5",
     "socks-proxy-agent": "^10.1.0",
     "systray2": "2.1.4",
@@ -91,6 +89,7 @@
     "bun-types": "1.4.0",
     "concurrently": "^10.0.5",
     "drizzle-kit": "^0.31.11",
+    "pino-pretty": "^13.1.3",
     "typescript": "5.9.2"
   }
 }