Changelog

Unreleased

Removed

• Deleted the unwired managed-key scaffold (operator-decryptable, wired into zero routes) — it contradicted the BYOK-first zero-knowledge model. Recoverable from git history when a real client-wrapped design ships.

Security & billing

• Managed-key paid tiers are gated "Coming soon" and Stripe checkout is disabled for them, so no one pays for an unbuilt feature. Single MANAGED_KEYS_AVAILABLE toggle across the relay and pricing page.

Reliability

• Mid-stream SSE idle watchdog (GATEWAY_STREAM_IDLE_TIMEOUT_MS, default 60s) aborts a stalled upstream that stops sending chunks mid-stream.

Deployment

• Docker image is now self-contained and hardened: multi-stage, non-root USER bun, HEALTHCHECK, digest-pinned base. CI runs a docker run + /health smoke on PRs and main.

Web & legal

• DRAFT privacy, terms, and security pages grounded in the real architecture (GDPR + CCPA + ToS), plus /.well-known/security.txt (RFC 9116). Banner-marked DRAFT pending legal review.

Docs

• README savings endpoint corrected to the auth-gated /v1/status.
• Added a network-exposed deployment checklist (docs/DEPLOY.md).

0.2.0

Security

• /health no longer leaks provider topology — it returns only { ok, auth }. The full provider inventory, key presence, live quota, and savings moved to the auth-gated GET /v1/status.
• Per-client rate limiting on /v1/chat/completions and /v1/research via GATEWAY_RATELIMIT_RPM (keyed by client IP then bearer token; returns 429 + Retry-After). Off by default.
• Schema-validated request bodies (zod) at the gateway and the relay's public magic-link endpoint, via the new @zintus/schemas package.
• Rate-limit keying hardened: defaults to the unspoofable bearer token; X-Forwarded-For is trusted only behind a configured reverse proxy.
• CI security job: bun audit (high) plus gitleaks secret scanning over full history.

Reliability

• Provider fetches are cancellable — an AbortSignal threads RouteRequest → router → provider fetch, releasing in-flight quota on disconnect/timeout instead of leaking it.
• Graceful shutdown drains in-flight streams on SIGTERM/SIGINT, flips /health to 503 draining, and closes the cloud relay connection, bounded by GATEWAY_DRAIN_TIMEOUT_MS.
• Circuit-breaker half-open gate: a recovering provider admits a single probe at a time so a concurrent burst can't all rush a provider that may still be down.

Observability

• Opt-in error sink wires onError → Sentry via SENTRY_DSN (dynamically loaded; zero dependency when unset). New zintus_gateway_rate_limited_total Prometheus counter.

Performance

• memory-store indexes on thread_id (plus a thread_id,key composite), removing full-table scans on every memory read path.

Docs

• Added docs/PRODUCTION-ARCHITECTURE.md, a root .env.example, this changelog, and expanded SECURITY.md.