Upgrade Sub2API to v0.2.11 with preserved product contracts

.github/scripts/ui-baseline.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
-  "baseline_ref": "ui-approved-2026-09-24-v028-version-badge-v2",
-  "baseline_commit": "d50f5d0d9d7b7eb5c69614ef3c91239aba72d75b",
+  "baseline_ref": "ui-approved-2026-10-01-v0211-version-badge",
+  "baseline_commit": "be36f46044301526977db2a2800dfb6be0f01de7",
   "protected_paths": [
     "landing/",
     "frontend/",

.github/scripts/verify-ui-boundary.test.mjs

@@ -1,6 +1,8 @@
 import assert from 'node:assert/strict'
-import { execFileSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
+import { execFileSync, spawnSync } from 'node:child_process'
+import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import test from 'node:test'
 import {
   evaluateChangedPaths,
@@ -292,3 +294,35 @@ test('requires the console entry to keep the approved asset references', () => {
     ['console/index.html asset references differ from approved baseline'],
   )
 })
+
+test('compatibility builds accept evolved output and reject changes to published assets', () => {
+  const root = mkdtempSync(join(tmpdir(), 'frozen-build-contract-'))
+  try {
+    const scripts = join(root, 'deploy/zero-one')
+    const assets = join(scripts, 'recovered-frontend/console/assets')
+    const bin = join(root, 'bin')
+    mkdirSync(assets, { recursive: true })
+    mkdirSync(bin)
+    writeFileSync(join(assets, 'published.js'), 'historical output')
+    symlinkSync('.', join(assets, 'historical-alias'))
+    copyFileSync(new URL('../../deploy/zero-one/verify-frozen-console-build.mjs', import.meta.url), join(scripts, 'verify-frozen-console-build.mjs'))
+    writeFileSync(join(bin, 'pnpm'), `#!/usr/bin/env node
+const fs = require('node:fs')
+fs.writeFileSync(process.env.ZERO_ONE_FROZEN_BUILD_ROOT + '/different-output.js', 'evolved API caller source')
+if (process.env.FROZEN_TEST_MUTATION === 'true') fs.writeFileSync(process.env.FROZEN_TEST_ASSET, 'unexpected rewrite')
+`)
+    chmodSync(join(bin, 'pnpm'), 0o755)
+    const run = (mutation) => spawnSync(process.execPath, [join(scripts, 'verify-frozen-console-build.mjs'), 'cn-provider-admin'], {
+      encoding: 'utf8',
+      env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, FROZEN_TEST_ASSET: join(assets, 'published.js'), FROZEN_TEST_MUTATION: String(mutation) },
+    })
+    const compatible = run(false)
+    assert.equal(compatible.status, 0, compatible.stderr)
+    assert.equal(readFileSync(join(assets, 'published.js'), 'utf8'), 'historical output')
+    const mutation = run(true)
+    assert.notEqual(mutation.status, 0)
+    assert.match(mutation.stderr, /modified frozen production assets/)
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})

.github/upstream-baseline.json

@@ -1,13 +1,13 @@
 {
   "schema_version": 5,
   "repository": "Wei-Shaw/sub2api",
-  "release": "v0.2.8",
-  "commit": "fd80b08c90b55edcad5b00171b53f08721d30da1",
+  "release": "v0.2.11",
+  "commit": "96f4c115c9749078f90cbf210a01d39baf3f53b6",
   "upstream_sync": {
-    "previous_release": "v0.2.7",
-    "previous_commit": "aea725f2ea644d5592d0bbb1d63b607efa7e200a",
-    "product_commit": "a8da9f14efcf8ac8e82730088b249071beb52ed5",
-    "merge_commit": "f0ed107cfd1ce9111b01551998e5b3d4a80675f1"
+    "previous_release": "v0.2.8",
+    "previous_commit": "fd80b08c90b55edcad5b00171b53f08721d30da1",
+    "product_commit": "ce899e5ae03cf4265855022a54d2d1ef5b5c5a68",
+    "merge_commit": "9d9aecbb860b8bceb1ae0c031a7c77f08c7b3d83"
   },
   "approved_backports": [],
   "preserve_bytes_on_upstream_sync": [
@@ -1308,7 +1308,14 @@
     "frontend/src/views/user/__tests__/ChannelStatusV1View.refresh.spec.ts",
     "frontend/src/api/admin/ops.ts",
     "docs/upgrades/v0.2.8.md",
-    "docs/upgrades/v0.2.8-change-map.json"
+    "docs/upgrades/v0.2.8-change-map.json",
+    "frontend/src/utils/planType.ts",
+    "frontend/src/views/admin/__tests__/groupModelAllowlist.spec.ts",
+    "frontend/src/views/admin/groupModelAllowlist.ts",
+    "docs/upgrades/v0.2.11.md",
+    "docs/upgrades/v0.2.11-change-map.json",
+    "backend/internal/service/account_stats_pricing_test.go",
+    "backend/internal/service/billing_inflight_reservation_test.go"
   ],
   "retired_preserved_paths": [
     {
@@ -1867,7 +1874,7 @@
   "legacy_hotfixes": [
     {
       "name": "approved-v0.1.179-production-correctness-and-billing-compatibility",
-      "valid_for_release": "v0.2.8",
+      "valid_for_release": "v0.2.11",
       "exit_condition": "Remove each path when the first stable upstream release containing its equivalent production-correctness fix becomes the baseline; remove the entire block when no listed path remains.",
       "paths": [
         "backend/internal/handler/admin/admin_basic_handlers_test.go",
@@ -1897,15 +1904,15 @@
     },
     {
       "name": "approved-v0.1.179-version-metadata-alignment",
-      "valid_for_release": "v0.2.8",
+      "valid_for_release": "v0.2.11",
       "exit_condition": "Remove this metadata alignment when the first stable upstream release makes backend/cmd/server/VERSION match the baseline release.",
       "paths": [
         "backend/cmd/server/VERSION"
       ]
     },
     {
       "name": "approved-v0.1.179-race-safety",
-      "valid_for_release": "v0.2.8",
+      "valid_for_release": "v0.2.11",
       "exit_condition": "Remove each path when the first stable upstream release contains the equivalent race-safe runtime cache and asynchronous test fixture handling.",
       "paths": [
         "backend/internal/service/content_moderation.go",
@@ -1920,23 +1927,23 @@
     },
     {
       "name": "approved-v0.1.179-remove-unconditional-sticky-debug-logs",
-      "valid_for_release": "v0.2.8",
+      "valid_for_release": "v0.2.11",
       "exit_condition": "Remove this hotfix when the first stable upstream release removes or explicitly gates the equivalent per-request sticky-session debug logs.",
       "paths": [
         "backend/internal/service/gateway_scheduling.go"
       ]
     },
     {
       "name": "approved-v0.1.181-grok-mapping-test-isolation",
-      "valid_for_release": "v0.2.8",
+      "valid_for_release": "v0.2.11",
       "exit_condition": "Remove this hotfix when the first stable upstream release contains equivalent runtime model-mapping isolation in the canonical scheduling test.",
       "paths": [
         "backend/internal/service/openai_model_mapping_test.go"
       ]
     },
     {
       "name": "approved-v0.1.182-go-dependency-security-updates",
-      "valid_for_release": "v0.2.8",
+      "valid_for_release": "v0.2.11",
       "exit_condition": "Remove this hotfix when the first stable upstream release uses golang.org/x/image v0.45.0 or later, Testcontainers v0.44.0 or later, github.com/moby/go-archive v0.3.0 or later, and no longer depends on github.com/docker/docker.",
       "paths": [
         "backend/go.mod",
@@ -1948,7 +1955,7 @@
     },
     {
       "name": "approved-v0.2.7-sse-keepalive-test-determinism",
-      "valid_for_release": "v0.2.8",
+      "valid_for_release": "v0.2.11",
       "exit_condition": "Remove this hotfix when the first stable upstream release makes the ordinary-client SSE keepalive test tolerate a comment payload and at least two ticker periods of runner scheduling delay.",
       "paths": [
         "backend/internal/service/gemini_sse_comment_compat_test.go"
@@ -2168,7 +2175,10 @@
         "frontend/src/views/admin/__tests__/BackupView.spec.ts",
         "frontend/src/views/admin/__tests__/RiskControlView.spec.ts",
         "frontend/src/views/admin/__tests__/UsersView.spec.ts",
-        "frontend/src/views/user/__tests__/ChannelStatusV1View.refresh.spec.ts"
+        "frontend/src/views/user/__tests__/ChannelStatusV1View.refresh.spec.ts",
+        "frontend/src/utils/planType.ts",
+        "frontend/src/views/admin/__tests__/groupModelAllowlist.spec.ts",
+        "frontend/src/views/admin/groupModelAllowlist.ts"
       ]
     },
     {
@@ -2580,7 +2590,11 @@
         "backend/migrations/opencode_go_platform_migration_test.go",
         "backend/migrations/purge_unlimited_user_platform_quotas_migration_test.go",
         "backend/internal/repository/purge_unlimited_user_platform_quotas_migration_integration_test.go",
-        "frontend/src/api/admin/ops.ts"
+        "frontend/src/api/admin/ops.ts",
+        "docs/upgrades/v0.2.11.md",
+        "docs/upgrades/v0.2.11-change-map.json",
+        "backend/internal/service/account_stats_pricing_test.go",
+        "backend/internal/service/billing_inflight_reservation_test.go"
       ]
     },
     {

backend/cmd/server/VERSION

@@ -1 +1 @@
-0.2.8
+0.2.11

backend/internal/config/config.go

@@ -89,6 +89,7 @@ type Config struct {
 	Pricing                 PricingConfig                 `mapstructure:"pricing"`
 	Gateway                 GatewayConfig                 `mapstructure:"gateway"`
 	APIKeyAuth              APIKeyAuthCacheConfig         `mapstructure:"api_key_auth_cache"`
+	APIKeyCreate            APIKeyCreateConfig            `mapstructure:"api_key_create"`
 	SubscriptionCache       SubscriptionCacheConfig       `mapstructure:"subscription_cache"`
 	SubscriptionMaintenance SubscriptionMaintenanceConfig `mapstructure:"subscription_maintenance"`
 	Dashboard               DashboardCacheConfig          `mapstructure:"dashboard_cache"`
@@ -921,6 +922,30 @@ type BillingConfig struct {
 	// UserPlatformQuotaSentinelTTLSeconds sentinel(无 limit 占位)entry 的 TTL,
 	// 显著短于 quota cache 默认 86400s 以控 Redis 内存;默认 3600=1h。
 	UserPlatformQuotaSentinelTTLSeconds int `mapstructure:"user_platform_quota_sentinel_ttl_seconds"`
+	// InflightReservation 余额模式在途请求预留（Redis），防止并发请求在预检时看到同一份余额而集体透支。
+	InflightReservation InflightReservationConfig `mapstructure:"inflight_reservation"`
+}
+
+// InflightReservationConfig 余额模式在途预留配置。
+// 准入时按 输入估算 + 输出单价 × max_tokens 估算单请求费用，在 Redis 中原子地
+// 校验 缓存余额 - 在途预留合计 >= 估算 后登记预留；handler 和异步计费任务
+// 均结束后释放，长请求期间续期，进程崩溃时由 TTL 回收。
+// 估算失败或 Redis 不可用时 fail-open，退回旧的仅余额 > 阈值检查。
+type InflightReservationConfig struct {
+	Enabled bool `mapstructure:"enabled"`
+	// TTLSeconds 单条预留的最长存活时间；进程崩溃等泄漏的预留到期自动失效。
+	TTLSeconds int `mapstructure:"ttl_seconds"`
+	// DefaultMaxTokens 请求未携带 max_tokens 时用于估算的输出 token 数。
+	DefaultMaxTokens int `mapstructure:"default_max_tokens"`
+	// MaxOutputTokens 估算输出 token 的上限（max_tokens 超出时截断）。
+	MaxOutputTokens int `mapstructure:"max_output_tokens"`
+	// MaxInputTokens 输入 token 估算（请求体字节数 / 4）的上限。
+	MaxInputTokens int `mapstructure:"max_input_tokens"`
+	// MaxReservationUSD 单请求预留金额上限；0 表示不设上限。
+	MaxReservationUSD float64 `mapstructure:"max_reservation_usd"`
+	// FailClosedOnUnpriced 无法为请求估算费用（模型/分组/渠道均无定价）时是否拒绝请求。
+	// 默认 false：放行且不预留（fail-open，节流告警日志）。
+	FailClosedOnUnpriced bool `mapstructure:"fail_closed_on_unpriced"`
 }
 
 type CircuitBreakerConfig struct {
@@ -1696,6 +1721,14 @@ type APIKeyAuthCacheConfig struct {
 	InvalidAbuse       InvalidAuthAbuseConfig `mapstructure:"invalid_abuse"`
 }
 
+// APIKeyCreateConfig 用户创建 API Key 的防滥用限制（0 表示不限制）
+type APIKeyCreateConfig struct {
+	// MaxActivePerUser 单个用户同时存在（未删除）的 API Key 上限
+	MaxActivePerUser int `mapstructure:"max_active_per_user"`
+	// MaxPerUserPerHour 单个用户每小时可创建的 API Key 次数（删除不返还次数）
+	MaxPerUserPerHour int `mapstructure:"max_per_user_per_hour"`
+}
+
 type InvalidAuthAbuseConfig struct {
 	Enabled       bool `mapstructure:"enabled"`
 	Threshold     int  `mapstructure:"threshold"`
@@ -2093,6 +2126,13 @@ func setDefaults() {
 	viper.SetDefault("billing.minimum_balance_reserve", 0.000001)
 	viper.SetDefault("billing.user_platform_quota_cache_ttl_seconds", 86400)
 	viper.SetDefault("billing.user_platform_quota_sentinel_ttl_seconds", 3600)
+	viper.SetDefault("billing.inflight_reservation.enabled", true)
+	viper.SetDefault("billing.inflight_reservation.ttl_seconds", 900)
+	viper.SetDefault("billing.inflight_reservation.default_max_tokens", 8192)
+	viper.SetDefault("billing.inflight_reservation.max_output_tokens", 128000)
+	viper.SetDefault("billing.inflight_reservation.max_input_tokens", 200000)
+	viper.SetDefault("billing.inflight_reservation.max_reservation_usd", 0)
+	viper.SetDefault("billing.inflight_reservation.fail_closed_on_unpriced", false)
 
 	// Turnstile
 	viper.SetDefault("turnstile.required", false)
@@ -2320,6 +2360,8 @@ func setDefaults() {
 	viper.SetDefault("api_key_auth_cache.invalid_abuse.window_seconds", 60)
 	viper.SetDefault("api_key_auth_cache.invalid_abuse.block_seconds", 60)
 	viper.SetDefault("api_key_auth_cache.invalid_abuse.capacity", 16384)
+	viper.SetDefault("api_key_create.max_active_per_user", 200)
+	viper.SetDefault("api_key_create.max_per_user_per_hour", 60)
 
 	// Subscription auth L1 cache
 	viper.SetDefault("subscription_cache.l1_size", 16384)
@@ -2699,6 +2741,12 @@ func (c *Config) Validate() error {
 			return fmt.Errorf("server.h2c.max_upload_buffer_per_stream must be positive")
 		}
 	}
+	if c.APIKeyCreate.MaxActivePerUser < 0 {
+		return fmt.Errorf("api_key_create.max_active_per_user must be non-negative")
+	}
+	if c.APIKeyCreate.MaxPerUserPerHour < 0 {
+		return fmt.Errorf("api_key_create.max_per_user_per_hour must be non-negative")
+	}
 	if c.APIKeyAuth.InvalidAbuse.Enabled {
 		if c.APIKeyAuth.InvalidAbuse.Threshold < 10 {
 			return fmt.Errorf("api_key_auth_cache.invalid_abuse.threshold must be at least 10")
@@ -3050,6 +3098,11 @@ func (c *Config) Validate() error {
 	if c.Billing.MinimumBalanceReserve < 0 {
 		return fmt.Errorf("billing.minimum_balance_reserve must be non-negative")
 	}
+	if c.Billing.InflightReservation.TTLSeconds < 0 || c.Billing.InflightReservation.DefaultMaxTokens < 0 ||
+		c.Billing.InflightReservation.MaxOutputTokens < 0 || c.Billing.InflightReservation.MaxInputTokens < 0 ||
+		c.Billing.InflightReservation.MaxReservationUSD < 0 {
+		return fmt.Errorf("billing.inflight_reservation values must be non-negative")
+	}
 	if c.Database.MaxOpenConns <= 0 {
 		return fmt.Errorf("database.max_open_conns must be positive")
 	}