@antseed/cli 0.1.179 → 0.1.181

package/dist/gateway/store.d.ts

@@ -1,15 +1,33 @@
-import { type PeriodSpend, type SpendLimits } from './limits.js';
+import Database from 'better-sqlite3';
+import { type RoutingPolicy } from '../routing-policy/policy.js';
+import { type BudgetLimits, type BudgetPeriod, type BudgetSpend, type LimitPeriod, type SpendLimits } from './limits.js';
 export type ApiKeySource = 'created' | 'tunnel-env';
 export type ApiKeyStatus = 'active' | 'revoked';
+export type OrgRole = 'owner' | 'admin' | 'member';
+export type WorkspaceRole = 'admin' | 'member';
+export type MemberStatus = 'active' | 'invited' | 'disabled';
+export declare const DEFAULT_WORKSPACE_ID = "ws_default";
 export interface ApiKeyRecord {
     id: string;
     label: string;
     hint: string;
-    /** Buyer identity (wallet) that pays for this key's requests. */
+    /** Buyer identity (wallet) that pays for this key's requests: its workspace's. */
     buyerIdentity: string;
+    workspaceId: string;
+    /** Member the key belongs to; null for keys created by the CLI or a management token. */
+    ownerMemberId: string | null;
     source: ApiKeySource;
     status: ApiKeyStatus;
-    limits: SpendLimits;
+    /** Set by workspace admins (the admin layer). */
+    limits: BudgetLimits;
+    routingPolicy: RoutingPolicy | null;
+    /**
+     * Set by the key's owner on top of the admin layer (the owner layer): they
+     * may change these freely, but each only narrows the admin layer, so the
+     * owner can never get more than the admins allow.
+     */
+    ownerLimits: BudgetLimits;
+    ownerRoutingPolicy: RoutingPolicy | null;
     /** Whether the key holder may fund the key's wallet with x402 top-ups. */
     topupEnabled: boolean;
     expiresAt: number | null;
@@ -17,6 +35,135 @@ export interface ApiKeyRecord {
     revokedAt: number | null;
     lastUsedAt: number | null;
 }
+export interface WorkspaceRecord {
+    id: string;
+    name: string;
+    buyerIdentity: string;
+    isDefault: boolean;
+    /** Cached address of the buyer identity's wallet; null until known. */
+    walletAddress: string | null;
+    limits: BudgetLimits;
+    /** Set by workspace admins. */
+    routingPolicy: RoutingPolicy | null;
+    /** Set by org admins; applied before `routingPolicy`. */
+    orgRoutingPolicy: RoutingPolicy | null;
+    createdAt: number;
+}
+/** Whose chat history: a console member's, or an API key holder's (the CLI and key sessions). */
+export interface ChatThreadOwner {
+    kind: 'member' | 'key';
+    id: string;
+    workspaceId: string;
+}
+export interface ChatThreadSummary {
+    id: string;
+    workspaceId: string;
+    owner: {
+        kind: 'member' | 'key';
+        id: string;
+    };
+    title: string;
+    model: string | null;
+    peerId: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface ChatThreadRecord extends ChatThreadSummary {
+    /** AI SDK UIMessages, as the web chat and `antseed chat` exchange them. */
+    messages: unknown[];
+}
+export interface MemberRecord {
+    id: string;
+    label: string;
+    email: string | null;
+    orgRole: OrgRole;
+    status: MemberStatus;
+    limits: BudgetLimits;
+    routingPolicy: RoutingPolicy | null;
+    maxKeys: number | null;
+    createdAt: number;
+}
+export interface InviteRecord {
+    id: string;
+    memberId: string;
+    label: string;
+    email: string | null;
+    orgRole: OrgRole;
+    workspaces: Array<{
+        workspaceId: string;
+        role: WorkspaceRole;
+    }>;
+    createdBy: string | null;
+    expiresAt: number;
+    usedAt: number | null;
+    createdAt: number;
+}
+export interface PeerListRecord {
+    id: string;
+    name: string;
+    description: string | null;
+    peerIds: string[];
+    createdAt: number;
+}
+export interface PresetRecord {
+    id: string;
+    slug: string;
+    name: string;
+    workspaceId: string | null;
+    model: string;
+    routingPolicy: RoutingPolicy | null;
+    systemPrompt: string | null;
+    params: Record<string, unknown>;
+    createdAt: number;
+}
+export interface AdminTokenRecord {
+    id: string;
+    label: string;
+    hint: string;
+    scope: 'admin' | 'read';
+    createdBy: string | null;
+    /** Null never expires (owners only). */
+    expiresAt: number | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+    revokedAt: number | null;
+}
+export type AuditActorKind = 'member' | 'token' | 'key' | 'system' | 'cli';
+/** One audit-log row; same shape as the console's `AuditEntry`. */
+export interface AuditRecord {
+    id: string;
+    at: number;
+    actor: {
+        kind: AuditActorKind;
+        id: string | null;
+        label: string | null;
+    };
+    action: string;
+    target: {
+        kind: string;
+        id: string | null;
+        label: string | null;
+    } | null;
+    details: Record<string, unknown>;
+    ip: string | null;
+}
+/** Input of `GatewayStore.recordAudit`. Never put secrets in `details`. */
+export interface AuditInput {
+    actor: {
+        kind: AuditActorKind;
+        id: string | null;
+        label?: string | null;
+    };
+    /** Dotted verb, e.g. "key.create", "workspace.policy.update". */
+    action: string;
+    target?: {
+        kind: string;
+        id: string | null;
+        label?: string | null;
+    } | null;
+    details?: Record<string, unknown>;
+    ip?: string | null;
+}
 /**
  * Balance movements per key, as signed deltas in USDC base units: spend is
  * negative, credit (a top-up or payment received for the key) is positive.
@@ -36,6 +183,14 @@ export interface LedgerEntryInput {
     outputTokens?: number;
     note?: string | null;
     createdAt: number;
+    /**
+     * Who the spend counts against, fixed when it is recorded. Missing fields
+     * come from the request (`requestTag`), else from the key as it is now.
+     */
+    workspaceId?: string | null;
+    memberId?: string | null;
+    model?: string | null;
+    endUser?: string | null;
 }
 export interface GatewayRequestStart {
     tag: string;
@@ -45,6 +200,23 @@ export interface GatewayRequestStart {
     path: string;
     model: string | null;
     startedAt: number;
+    /** Default to the key's workspace and owner. */
+    workspaceId?: string | null;
+    memberId?: string | null;
+    endUser?: string | null;
+}
+export interface RequestOutcome {
+    sellerPeerId?: string | null;
+    latencyMs?: number | null;
+    endUser?: string | null;
+    /** Served by a free seller (all advertised prices zero): no spend will be reported. */
+    servedFree?: boolean;
+}
+/** What a key listing shows: lifetime requests and spend, and spend since a given time. */
+export interface KeyUsageSummary {
+    requests: number;
+    spentUsdc: number;
+    spentSinceUsdc: number;
 }
 export interface KeyUsageStats {
     requests: number;
@@ -55,22 +227,251 @@ export interface KeyUsageStats {
     cachedInputTokens: number;
     outputTokens: number;
 }
+/** Narrows request-log and usage queries. `keyIds` is the caller's visibility scope (null = everything). */
+export interface UsageFilter {
+    keyIds?: readonly string[] | null;
+    workspaceId?: string | null;
+    keyId?: string | null;
+    memberId?: string | null;
+    model?: string | null;
+    from?: number | null;
+    to?: number | null;
+}
+/** Request-log filters on top of `UsageFilter`. */
+export interface RequestLogFilter extends UsageFilter {
+    /** 'error' = finished with status >= 400; requests still in flight are neither. */
+    status?: 'ok' | 'error' | number | null;
+    /** Substring (case-insensitive) of the model, key label, end user, tag, seller, path, or error code/message. */
+    q?: string | null;
+    /** Rows strictly older than this position (newest first). */
+    before?: RequestCursor | null;
+    limit?: number;
+}
+/** Position in the request log, ordered by (startedAt, tag) descending. */
+export interface RequestCursor {
+    startedAt: number;
+    tag: string;
+}
+/** Why a request failed, from the gateway's own error or the buyer's/seller's error body. */
+export interface RequestError {
+    code: string | null;
+    message: string | null;
+}
+export type UsageGroupBy = 'hour' | 'day' | 'model' | 'key' | 'member' | 'peer' | 'workspace' | 'user';
+/**
+ * A usage group, split further by a second grouping when one was asked for.
+ * `others` marks the row that folds the end users past the largest
+ * `MAX_USER_GROUPS` (its count of them); its group is `OTHER_USERS_GROUP`.
+ */
+export type UsageGroupRow = {
+    group: string | null;
+    others?: number;
+    splits?: UsageSplitRow[];
+} & UsageTotalsRow;
+export type UsageSplitRow = {
+    group: string | null;
+    others?: number;
+} & UsageTotalsRow;
+/**
+ * End users are whatever a key holder sends, so a report by user keeps the
+ * largest ones and folds the rest into one row.
+ */
+export declare const MAX_USER_GROUPS = 100;
+export declare const OTHER_USERS_GROUP = "\0others";
+/** Token counts a response reported about itself (`inputTokens` includes cached input). */
+export interface ResponseTokenCounts {
+    inputTokens: number;
+    cachedInputTokens: number;
+    outputTokens: number;
+}
+export interface UsageTotalsRow {
+    requests: number;
+    failedRequests: number;
+    spentUsdc: number;
+    inputTokens: number;
+    cachedInputTokens: number;
+    outputTokens: number;
+}
+export interface RequestLogRow {
+    tag: string;
+    startedAt: number;
+    finishedAt: number | null;
+    keyId: string;
+    keyLabel: string;
+    workspaceId: string;
+    memberId: string | null;
+    endUser: string | null;
+    method: string;
+    path: string;
+    model: string | null;
+    status: number | null;
+    sellerPeerId: string | null;
+    latencyMs: number | null;
+    spentUsdc: number | null;
+    inputTokens: number;
+    cachedInputTokens: number;
+    outputTokens: number;
+    errorCode: string | null;
+    errorMessage: string | null;
+    /** Served by a free seller: its cost is $0 with no spend to wait for. */
+    servedFree: boolean;
+    /**
+     * A model request that did not fail and was not served free, but has no
+     * spend recorded yet (the buyer reports it a moment after the response).
+     */
+    costPending: boolean;
+}
+/** One request with its bodies (null unless content logging was on for it). */
+export interface RequestDetailRow extends RequestLogRow {
+    requestBody: string | null;
+    responseBody: string | null;
+}
+export type BudgetScope = {
+    keyId: string;
+} | {
+    memberId: string;
+} | {
+    workspaceId: string;
+};
 export declare function gatewayDir(dataDir: string): string;
 /**
- * Durable state for the API-key gateway: keys, request log and the per-key
- * ledger. SQLite in WAL mode so `antseed gateway key …`
- * commands can change keys while a gateway process is serving them.
+ * Durable state for the API-key gateway and its console: keys, request log,
+ * the per-key ledger, and the organization around them (workspaces, members,
+ * invites, presets, peer lists, management tokens, settings). SQLite in WAL
+ * mode so `antseed gateway key …` commands can change keys while a gateway
+ * process is serving them.
  */
 export declare class GatewayStore {
     private readonly _now;
     private readonly _db;
+    private readonly _statements;
+    private readonly _settings;
+    private readonly _touched;
     constructor(dataDir: string, _now?: () => number);
+    /**
+     * Switching a database to WAL needs it to itself, and SQLite answers
+     * SQLITE_BUSY at once (no busy handler) while other processes have it
+     * open, e.g. several opening an old database together: retry for a while.
+     */
+    private _enableWal;
+    /** The underlying database; the console's auth module keeps its own tables in it. */
+    get database(): Database.Database;
     close(): void;
+    private _count;
+    /** A prepared statement, cached by its SQL (hot paths run the same few statements on every request). */
+    private _stmt;
+    /**
+     * Several processes (the gateway, `antseed gateway key …`) may open an old
+     * database at once: the version is re-read inside an IMMEDIATE transaction,
+     * which holds the write lock, so only the first one applies a migration.
+     */
     private _migrate;
+    getWorkspace(id: string): WorkspaceRecord | null;
+    listWorkspaces(): WorkspaceRecord[];
+    defaultWorkspace(): WorkspaceRecord;
+    workspaceForKey(keyId: string): WorkspaceRecord | null;
+    createWorkspace(input: {
+        name: string;
+        buyerIdentity: string;
+        walletAddress?: string | null;
+        limits?: BudgetLimits;
+        routingPolicy?: RoutingPolicy | null;
+        orgRoutingPolicy?: RoutingPolicy | null;
+    }): WorkspaceRecord;
+    /** Caches the wallet address of every workspace paying with this identity. */
+    setWalletAddress(buyerIdentity: string, address: string | null): void;
+    updateWorkspace(id: string, patch: {
+        name?: string;
+        limits?: Partial<BudgetLimits>;
+        routingPolicy?: RoutingPolicy | null;
+        orgRoutingPolicy?: RoutingPolicy | null;
+    }): WorkspaceRecord;
+    /** Soft delete: history keeps pointing at it. The default workspace cannot be deleted. */
+    deleteWorkspace(id: string): void;
+    /**
+     * The workspace that pays with this identity, created (named after the
+     * identity) when there is none. Keeps `antseed gateway key create
+     * --identity/--new-identity` working.
+     */
+    ensureWorkspaceForIdentity(buyerIdentity: string): WorkspaceRecord;
+    countWorkspaceKeys(workspaceId: string, activeOnly?: boolean): number;
+    countWorkspaceMembers(workspaceId: string): number;
+    workspaceMembers(workspaceId: string): Array<{
+        member: MemberRecord;
+        role: WorkspaceRole;
+    }>;
+    setWorkspaceMember(workspaceId: string, memberId: string, role: WorkspaceRole): void;
+    removeWorkspaceMember(workspaceId: string, memberId: string): boolean;
+    getMember(id: string): MemberRecord | null;
+    findMemberByEmail(email: string): MemberRecord | null;
+    listMembers(): MemberRecord[];
+    /** Workspaces (not deleted) the member belongs to, with their role. */
+    memberWorkspaceRoles(memberId: string): Map<string, WorkspaceRole>;
+    /** True once an active owner exists. */
+    isSetupComplete(): boolean;
+    countActiveOwners(): number;
+    /** The first owner, created when the console is claimed; admin of the Default workspace. */
+    createOwner(input: {
+        label: string;
+        email: string | null;
+    }): MemberRecord;
+    private _insertMember;
+    updateMember(id: string, patch: {
+        label?: string;
+        email?: string | null;
+        orgRole?: OrgRole;
+        limits?: Partial<BudgetLimits>;
+        routingPolicy?: RoutingPolicy | null;
+        maxKeys?: number | null;
+    }): MemberRecord;
+    setMemberStatus(id: string, status: MemberStatus): MemberRecord;
+    /**
+     * Creates the invited member (status 'invited', already in its workspaces)
+     * and a single-use link token, of which only the SHA-256 is stored.
+     */
+    createInvite(input: {
+        label: string;
+        email: string | null;
+        orgRole: OrgRole;
+        workspaces: Array<{
+            workspaceId: string;
+            role: WorkspaceRole;
+        }>;
+        expiresAt: number;
+        createdBy: string | null;
+    }): {
+        invite: InviteRecord;
+        token: string;
+    };
+    getInvite(id: string): InviteRecord | null;
+    /** Invites not yet used (expired ones included, so they can be cleaned up). */
+    listInvites(): InviteRecord[];
+    /** Deletes an unused invite and the member it created, if that member never joined. */
+    deleteInvite(id: string): boolean;
+    /** The invite behind a token hash while it is usable, without consuming it. */
+    peekInvite(tokenHash: string, now: number): {
+        invite: InviteRecord;
+        member: MemberRecord;
+    } | null;
+    /** Token hash of a member's newest live (unused, unexpired) invite, for SSO activation by email. */
+    liveInviteHash(memberId: string, now: number): string | null;
+    /** Why an invite token is not usable: already used, expired, or unknown (also for a live one). */
+    inviteState(tokenHash: string, now: number): 'used' | 'expired' | 'unknown';
+    /** Marks the invite used and its member active; null when the token is unknown, used or expired. */
+    consumeInvite(tokenHash: string, now: number): MemberRecord | null;
+    /**
+     * Creates a key in `workspaceId`, or, for callers that only name an
+     * identity (the CLI), in the workspace paying with that identity.
+     */
     createKey(input: {
         label: string;
-        buyerIdentity: string;
+        buyerIdentity?: string;
+        workspaceId?: string;
+        ownerMemberId?: string | null;
         limits: SpendLimits;
+        routingPolicy?: RoutingPolicy | null;
+        ownerLimits?: BudgetLimits;
+        ownerRoutingPolicy?: RoutingPolicy | null;
         expiresAt: number | null;
         topupEnabled?: boolean;
     }): {
@@ -91,24 +492,208 @@ export declare class GatewayStore {
     retireEnvironmentKey(): ApiKeyRecord | null;
     findKeyBySecret(secret: string): ApiKeyRecord | null;
     getKey(id: string): ApiKeyRecord | null;
-    listKeys(): ApiKeyRecord[];
+    listKeys(filter?: {
+        workspaceId?: string;
+        ownerMemberId?: string;
+    }): ApiKeyRecord[];
     countActiveKeys(): number;
+    countActiveKeysForMember(memberId: string): number;
     setLimits(id: string, limits: Partial<SpendLimits>): ApiKeyRecord;
     setTopupEnabled(id: string, enabled: boolean): ApiKeyRecord;
+    updateKey(id: string, patch: {
+        label?: string;
+        limits?: Partial<BudgetLimits>;
+        routingPolicy?: RoutingPolicy | null;
+        ownerLimits?: Partial<BudgetLimits>;
+        ownerRoutingPolicy?: RoutingPolicy | null;
+        topupEnabled?: boolean;
+        expiresAt?: number | null;
+        ownerMemberId?: string | null;
+    }): ApiKeyRecord;
+    /** New secret for the same key id; usage history, limits and policy stay. */
+    rotateKey(id: string): {
+        key: ApiKeyRecord;
+        secret: string;
+    };
     revokeKey(id: string): ApiKeyRecord;
+    /** Revokes every active key a member owns; returns their ids. */
+    revokeMemberKeys(memberId: string): string[];
+    /** Records use at most once a minute per key (per process), so requests do not each write. */
     touchKey(id: string): void;
+    private _shouldTouch;
     startRequest(input: GatewayRequestStart): void;
+    /** `error` is kept for failed requests (code ≤ 100, message ≤ 500 characters). */
     finishRequest(tag: string, result: {
         status: number;
         buyerRequestId: string | null;
+        error?: RequestError | null;
     }): void;
+    /** Seller, latency and end user of a request; null fields leave what is stored. */
+    recordRequestOutcome(tag: string, outcome: RequestOutcome): void;
+    /**
+     * The token counts the response itself reported, read by the gateway as it
+     * streamed past. Usage falls back to them while (or if ever) the request
+     * has no spend with token counts in the ledger, so they never add up twice.
+     */
+    recordResponseUsage(tag: string, usage: ResponseTokenCounts): void;
+    /** Only called while content logging is on. */
+    recordRequestContent(tag: string, content: {
+        requestBody?: string | null;
+        responseBody?: string | null;
+    }): void;
+    /** Forgets every stored request and response body; for when content logging is turned off. */
+    clearRequestContent(): number;
+    /**
+     * Drops request-log rows started before `before`, `chunkSize` rows per
+     * transaction so a large backlog never holds the write lock for long. Their
+     * request counts move into `request_rollups` (per hour, key, workspace,
+     * member, model, seller and end user) so usage reports keep counting them;
+     * spend and tokens live in the ledger, which is never pruned. Pruned
+     * periods are therefore counted at hour granularity. Yields to the event
+     * loop between chunks, so requests keep flowing while a backlog drains.
+     */
+    pruneRequests(before: number, chunkSize?: number): Promise<number>;
+    /** Who a request was attributed to when it started. */
     findRequest(tag: string): {
         keyId: string;
         buyerIdentity: string;
+        workspaceId: string | null;
+        memberId: string | null;
+        model: string | null;
+        endUser: string | null;
     } | null;
-    /** Returns false when the entry was already recorded (same externalRef). */
+    /** Requests per seller since a time, with the median latency this gateway measured. */
+    peerStats(sinceMs: number): Array<{
+        peerId: string;
+        requests: number;
+        latencyMsP50: number | null;
+    }>;
+    /** Newest first, ordered by (startedAt, tag); pass the last row as `before` for the next page. Bodies are not read. */
+    listRequests(filter: RequestLogFilter): RequestLogRow[];
+    /** One request with its bodies; `keyIds` limits it to what the caller may see. */
+    getRequest(tag: string, keyIds?: readonly string[] | null): RequestDetailRow | null;
+    /** The page of requests first, then one grouped ledger read for just those tags. */
+    private _requestRows;
+    /**
+     * Totals plus one row per group (each split by `splitBy` when given),
+     * attributed as at request time. Request counts come from the request log
+     * plus the rollups of pruned rows; spend and tokens from the ledger, and
+     * the tokens of requests whose spend carries none (not reported yet, or
+     * never) from the usage their responses reported.
+     */
+    usageReport(filter: UsageFilter, groupBy: UsageGroupBy | null, splitBy?: UsageGroupBy | null): {
+        totals: UsageTotalsRow;
+        groups: UsageGroupRow[];
+    };
+    /**
+     * Returns false when the entry was already recorded (same externalRef).
+     * The entry is attributed to the workspace, member, model and end user of
+     * its request (or, without one, of its key as it is now) unless given.
+     */
     recordLedgerEntry(entry: LedgerEntryInput): boolean;
-    periodSpend(keyId: string, now?: number): PeriodSpend;
+    /** A key's spend for the periods `antseed gateway key` shows. */
+    periodSpend(keyId: string, now?: number): Record<LimitPeriod, number>;
+    /**
+     * Settled spend per budget period of a key, member or workspace, as
+     * attributed when it was spent. Only `periods` are summed (the rest are 0),
+     * in one indexed query.
+     */
+    spendByPeriod(scope: BudgetScope, now?: number, periods?: readonly BudgetPeriod[]): BudgetSpend;
     usageStats(keyId: string, since?: number): KeyUsageStats;
+    /**
+     * Lifetime requests and spend, plus spend since `since`, for many keys in
+     * one grouped query per table (rather than `usageStats` per key). Every
+     * id asked for gets an entry.
+     */
+    keyUsageSummaries(keyIds: readonly string[], since: number): Map<string, KeyUsageSummary>;
+    listPeerLists(): PeerListRecord[];
+    getPeerList(id: string): PeerListRecord | null;
+    createPeerList(input: {
+        name: string;
+        description: string | null;
+        peerIds: string[];
+    }): PeerListRecord;
+    updatePeerList(id: string, patch: {
+        name?: string;
+        description?: string | null;
+        peerIds?: string[];
+    }): PeerListRecord;
+    deletePeerList(id: string): boolean;
+    listPresets(): PresetRecord[];
+    getPreset(id: string): PresetRecord | null;
+    /**
+     * An org-wide preset wins over a workspace's own with the same slug, so a
+     * workspace admin cannot replace an org-mandated preset (and its system
+     * prompt) for their workspace.
+     */
+    findPresetBySlug(slug: string, workspaceId: string | null): PresetRecord | null;
+    createPreset(input: Omit<PresetRecord, 'id' | 'createdAt'>): PresetRecord;
+    updatePreset(id: string, patch: Partial<Omit<PresetRecord, 'id' | 'createdAt' | 'workspaceId'>>): PresetRecord;
+    deletePreset(id: string): boolean;
+    /**
+     * `createdBy` is the creating member's id (null from the CLI); the token
+     * stops working when that member is no longer an active admin or owner.
+     * `expiresAt` null never expires.
+     */
+    createAdminToken(input: {
+        label: string;
+        scope: 'admin' | 'read';
+        createdBy: string | null;
+        expiresAt?: number | null;
+    }): {
+        token: AdminTokenRecord;
+        secret: string;
+    };
+    getAdminToken(id: string): AdminTokenRecord | null;
+    listAdminTokens(): AdminTokenRecord[];
+    /** Active token for a presented secret (hash lookup). */
+    findAdminTokenBySecret(secret: string): AdminTokenRecord | null;
+    /** Like `touchKey`: at most once a minute per token. */
+    touchAdminToken(id: string): void;
+    revokeAdminToken(id: string): boolean;
+    /** Revokes every token a member created (when they are disabled or lose admin); returns their ids. */
+    revokeAdminTokensCreatedBy(memberId: string): string[];
+    /**
+     * Appends one audit entry. Every mutating console action calls this:
+     *
+     *   deps.store.recordAudit({ actor, action, target, details, ip })
+     *
+     * `actor` comes from `auditActor(store, principal)` in console-api/access.ts
+     * (`{ kind: 'cli', id: null }` from CLI commands), `ip` from
+     * `clientIp(request)`. `details` must never contain secrets.
+     */
+    recordAudit(input: AuditInput): AuditRecord;
+    /** Newest first. `before` is the opaque cursor returned as `nextBefore`. */
+    listAudit(filter?: {
+        before?: string | null;
+        limit?: number;
+        actorId?: string | null;
+        action?: string | null;
+    }): {
+        entries: AuditRecord[];
+        nextBefore: string | null;
+    };
+    /** A member's or a key's conversations in a workspace, newest first (without their messages). */
+    listChatThreads(owner: ChatThreadOwner, limit?: number): ChatThreadSummary[];
+    getChatThread(id: string): ChatThreadRecord | null;
+    /** Creates or replaces a conversation; the owner and creation time of an existing one never change. */
+    saveChatThread(input: {
+        id: string;
+        owner: ChatThreadOwner;
+        title: string;
+        model: string | null;
+        peerId: string | null;
+        messages: unknown[];
+    }): void;
+    deleteChatThread(id: string): boolean;
+    /**
+     * Settings are read on every request, so values are cached for a few
+     * seconds. A write through this store clears its cache at once; a write by
+     * another process (a CLI command) is seen within `SETTINGS_TTL_MS`.
+     */
+    getSetting<T>(key: string): T | null;
+    setSetting(key: string, value: unknown): void;
 }
+/** Groupings whose groups are UTC time buckets (listed oldest first). */
+export declare function isTimeGrouping(groupBy: UsageGroupBy): boolean;
 //# sourceMappingURL=store.d.ts.map