@antseed/cli 0.1.179 → 0.1.181

package/dist/gateway/store.js

@@ -1,101 +1,417 @@
 import { DEFAULT_BUYER_IDENTITY } from '@antseed/node';
 import Database from 'better-sqlite3';
-import { mkdirSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { generateApiKey, hashApiKey, apiKeyHint, newKeyId } from './keys.js';
-import { LIMIT_PERIODS, periodStart } from './limits.js';
-const MIGRATIONS = [
-    `
-  CREATE TABLE api_keys (
-    id TEXT PRIMARY KEY,
-    label TEXT NOT NULL,
-    key_hash TEXT NOT NULL UNIQUE,
-    key_hint TEXT NOT NULL,
-    buyer_identity TEXT NOT NULL,
-    source TEXT NOT NULL DEFAULT 'created',
-    status TEXT NOT NULL DEFAULT 'active',
-    daily_limit_usdc INTEGER,
-    monthly_limit_usdc INTEGER,
-    total_limit_usdc INTEGER,
-    expires_at INTEGER,
-    created_at INTEGER NOT NULL,
-    revoked_at INTEGER,
-    last_used_at INTEGER
-  );
-  CREATE TABLE gateway_requests (
-    tag TEXT PRIMARY KEY,
-    key_id TEXT NOT NULL,
-    buyer_identity TEXT NOT NULL,
-    method TEXT NOT NULL,
-    path TEXT NOT NULL,
-    model TEXT,
-    status INTEGER,
-    buyer_request_id TEXT,
-    started_at INTEGER NOT NULL,
-    finished_at INTEGER
-  );
-  CREATE INDEX gateway_requests_key_time ON gateway_requests(key_id, started_at);
-  CREATE TABLE ledger_entries (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    kind TEXT NOT NULL CHECK (kind IN ('spend', 'credit')),
-    key_id TEXT NOT NULL,
-    buyer_identity TEXT NOT NULL,
-    amount_usdc INTEGER NOT NULL,
-    external_ref TEXT NOT NULL UNIQUE,
-    request_tag TEXT,
-    seller_peer_id TEXT,
-    input_tokens INTEGER NOT NULL DEFAULT 0,
-    cached_input_tokens INTEGER NOT NULL DEFAULT 0,
-    output_tokens INTEGER NOT NULL DEFAULT 0,
-    note TEXT,
-    created_at INTEGER NOT NULL
-  );
-  CREATE INDEX ledger_entries_key_time ON ledger_entries(key_id, kind, created_at);
-  `,
-    `
-  ALTER TABLE api_keys ADD COLUMN topup_enabled INTEGER NOT NULL DEFAULT 0;
-  `,
-];
+import { isRoutingPolicy, normalizePolicy } from '../routing-policy/policy.js';
+import { ADMIN_TOKEN_PREFIX, apiKeyHint, generateApiKey, hashApiKey, newKeyId } from './keys.js';
+import { BUDGET_PERIODS, LIMIT_PERIODS, NO_BUDGET_LIMITS, fullLimits, periodStart, } from './limits.js';
+import { MIGRATIONS } from './store-migrations.js';
+export const DEFAULT_WORKSPACE_ID = 'ws_default';
+function chatThreadSummary(row) {
+    return {
+        id: row.id,
+        workspaceId: row.workspace_id,
+        owner: { kind: row.owner_kind, id: row.owner_id },
+        title: row.title,
+        model: row.model,
+        peerId: row.peer_id,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+/**
+ * End users are whatever a key holder sends, so a report by user keeps the
+ * largest ones and folds the rest into one row.
+ */
+export const MAX_USER_GROUPS = 100;
+export const OTHER_USERS_GROUP = '\u0000others';
+/** Best effort: a file we do not own (or a filesystem without modes) keeps its mode. */
+function restrictMode(path, mode) {
+    try {
+        if (existsSync(path))
+            chmodSync(path, mode);
+    }
+    catch {
+        // not ours to change
+    }
+}
 export function gatewayDir(dataDir) {
     return join(dataDir, 'gateway');
 }
+function newId(prefix) {
+    return `${prefix}_${randomBytes(6).toString('hex')}`;
+}
+function parsePolicy(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return isRoutingPolicy(parsed) ? normalizePolicy(parsed) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function policyJson(policy) {
+    return policy ? JSON.stringify(normalizePolicy(policy)) : null;
+}
+function parseJson(raw, fallback) {
+    if (!raw)
+        return fallback;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return fallback;
+    }
+}
+function rowLimits(row, prefix = '') {
+    const limit = (period) => row[`${prefix}${period}_limit_usdc`];
+    return {
+        daily: limit('daily'),
+        weekly: limit('weekly'),
+        monthly: limit('monthly'),
+        total: limit('total'),
+    };
+}
 /**
- * Durable state for the API-key gateway: keys, request log and the per-key
- * ledger. SQLite in WAL mode so `antseed gateway key …`
- * commands can change keys while a gateway process is serving them.
+ * Durable state for the API-key gateway and its console: keys, request log,
+ * the per-key ledger, and the organization around them (workspaces, members,
+ * invites, presets, peer lists, management tokens, settings). SQLite in WAL
+ * mode so `antseed gateway key …` commands can change keys while a gateway
+ * process is serving them.
  */
 export class GatewayStore {
     _now;
     _db;
+    _statements = new Map();
+    _settings = new Map();
+    _touched = new Map();
     constructor(dataDir, _now = () => Date.now()) {
         this._now = _now;
-        mkdirSync(gatewayDir(dataDir), { recursive: true });
-        this._db = new Database(join(gatewayDir(dataDir), 'gateway.db'));
-        this._db.pragma('journal_mode = WAL');
+        const dir = gatewayDir(dataDir);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        // Key hashes, sessions and request bodies live here: owner-only.
+        restrictMode(dir, 0o700);
+        const file = join(dir, 'gateway.db');
+        this._db = new Database(file, { timeout: 5000 });
         this._db.pragma('busy_timeout = 5000');
+        this._enableWal();
         this._db.pragma('foreign_keys = ON');
+        for (const path of [file, `${file}-wal`, `${file}-shm`])
+            restrictMode(path, 0o600);
         this._migrate();
     }
+    /**
+     * Switching a database to WAL needs it to itself, and SQLite answers
+     * SQLITE_BUSY at once (no busy handler) while other processes have it
+     * open, e.g. several opening an old database together: retry for a while.
+     */
+    _enableWal() {
+        const deadline = Date.now() + 5_000;
+        for (;;) {
+            try {
+                this._db.pragma('journal_mode = WAL');
+                return;
+            }
+            catch (error) {
+                if (error.code !== 'SQLITE_BUSY' || Date.now() > deadline)
+                    throw error;
+                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10 + Math.floor(Math.random() * 20));
+            }
+        }
+    }
+    /** The underlying database; the console's auth module keeps its own tables in it. */
+    get database() {
+        return this._db;
+    }
     close() {
+        this._statements.clear();
         this._db.close();
     }
+    _count(sql, ...params) {
+        return this._stmt(sql).get(...params).count;
+    }
+    /** A prepared statement, cached by its SQL (hot paths run the same few statements on every request). */
+    _stmt(sql) {
+        let statement = this._statements.get(sql);
+        if (!statement) {
+            if (this._statements.size >= MAX_CACHED_STATEMENTS)
+                this._statements.clear();
+            statement = this._db.prepare(sql);
+            this._statements.set(sql, statement);
+        }
+        return statement;
+    }
+    /**
+     * Several processes (the gateway, `antseed gateway key …`) may open an old
+     * database at once: the version is re-read inside an IMMEDIATE transaction,
+     * which holds the write lock, so only the first one applies a migration.
+     */
     _migrate() {
-        const version = this._db.pragma('user_version', { simple: true });
-        for (let index = version; index < MIGRATIONS.length; index += 1) {
-            this._db.transaction(() => {
+        if (this._db.pragma('user_version', { simple: true }) >= MIGRATIONS.length)
+            return;
+        this._db.transaction(() => {
+            const version = this._db.pragma('user_version', { simple: true });
+            for (let index = version; index < MIGRATIONS.length; index += 1) {
                 this._db.exec(MIGRATIONS[index]);
                 this._db.pragma(`user_version = ${index + 1}`);
-            })();
-        }
+            }
+        }).immediate();
+    }
+    // ── Workspaces ──────────────────────────────────────────────────────────
+    getWorkspace(id) {
+        const row = this._stmt('SELECT * FROM workspaces WHERE id = ? AND deleted_at IS NULL').get(id);
+        return row ? toWorkspace(row) : null;
+    }
+    listWorkspaces() {
+        const rows = this._stmt('SELECT * FROM workspaces WHERE deleted_at IS NULL ORDER BY is_default DESC, created_at, id').all();
+        return rows.map(toWorkspace);
+    }
+    defaultWorkspace() {
+        return this.getWorkspace(DEFAULT_WORKSPACE_ID);
+    }
+    workspaceForKey(keyId) {
+        const row = this._stmt('SELECT workspace_id FROM api_keys WHERE id = ?').get(keyId);
+        return row?.workspace_id ? this.getWorkspace(row.workspace_id) : null;
+    }
+    createWorkspace(input) {
+        const id = newId('ws');
+        const limits = input.limits ?? NO_BUDGET_LIMITS;
+        this._stmt(`
+      INSERT INTO workspaces (id, name, buyer_identity, is_default, wallet_address, daily_limit_usdc, weekly_limit_usdc, monthly_limit_usdc, total_limit_usdc, routing_policy, org_routing_policy, created_at)
+      VALUES (?, ?, ?, 0, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.name, input.buyerIdentity, input.walletAddress ?? null, limits.daily, limits.weekly, limits.monthly, limits.total, policyJson(input.routingPolicy), policyJson(input.orgRoutingPolicy), this._now());
+        return this.getWorkspace(id);
+    }
+    /** Caches the wallet address of every workspace paying with this identity. */
+    setWalletAddress(buyerIdentity, address) {
+        this._stmt('UPDATE workspaces SET wallet_address = ? WHERE buyer_identity = ?').run(address, buyerIdentity);
+    }
+    updateWorkspace(id, patch) {
+        const current = this.getWorkspace(id);
+        if (!current)
+            throw new Error(`Unknown workspace "${id}".`);
+        const limits = { ...current.limits, ...(patch.limits ?? {}) };
+        const policy = patch.routingPolicy === undefined ? current.routingPolicy : patch.routingPolicy;
+        const orgPolicy = patch.orgRoutingPolicy === undefined ? current.orgRoutingPolicy : patch.orgRoutingPolicy;
+        this._stmt(`
+      UPDATE workspaces SET name = ?, daily_limit_usdc = ?, weekly_limit_usdc = ?, monthly_limit_usdc = ?, total_limit_usdc = ?, routing_policy = ?,
+        org_routing_policy = ?
+      WHERE id = ?
+    `).run(patch.name ?? current.name, limits.daily, limits.weekly, limits.monthly, limits.total, policyJson(policy), policyJson(orgPolicy), id);
+        return this.getWorkspace(id);
+    }
+    /** Soft delete: history keeps pointing at it. The default workspace cannot be deleted. */
+    deleteWorkspace(id) {
+        if (id === DEFAULT_WORKSPACE_ID)
+            throw new Error('The Default workspace cannot be deleted.');
+        this._db.transaction(() => {
+            this._stmt('UPDATE workspaces SET deleted_at = ? WHERE id = ? AND deleted_at IS NULL').run(this._now(), id);
+            this._stmt('DELETE FROM workspace_members WHERE workspace_id = ?').run(id);
+        })();
+    }
+    /**
+     * The workspace that pays with this identity, created (named after the
+     * identity) when there is none. Keeps `antseed gateway key create
+     * --identity/--new-identity` working.
+     */
+    ensureWorkspaceForIdentity(buyerIdentity) {
+        if (buyerIdentity === DEFAULT_BUYER_IDENTITY)
+            return this.defaultWorkspace();
+        const row = this._stmt('SELECT * FROM workspaces WHERE buyer_identity = ? AND deleted_at IS NULL ORDER BY created_at, id LIMIT 1')
+            .get(buyerIdentity);
+        return row ? toWorkspace(row) : this.createWorkspace({ name: buyerIdentity, buyerIdentity });
+    }
+    countWorkspaceKeys(workspaceId, activeOnly = true) {
+        return this._count(`SELECT COUNT(*) AS count FROM api_keys WHERE workspace_id = ?${activeOnly ? " AND status = 'active'" : ''}`, workspaceId);
+    }
+    countWorkspaceMembers(workspaceId) {
+        return this._count('SELECT COUNT(*) AS count FROM workspace_members WHERE workspace_id = ?', workspaceId);
+    }
+    workspaceMembers(workspaceId) {
+        const rows = this._stmt(`
+      SELECT m.*, wm.role AS ws_role FROM workspace_members wm JOIN members m ON m.id = wm.member_id
+      WHERE wm.workspace_id = ? ORDER BY m.created_at, m.id
+    `).all(workspaceId);
+        return rows.map((row) => ({ member: toMember(row), role: row.ws_role }));
+    }
+    setWorkspaceMember(workspaceId, memberId, role) {
+        this._stmt(`
+      INSERT INTO workspace_members (workspace_id, member_id, role) VALUES (?, ?, ?)
+      ON CONFLICT (workspace_id, member_id) DO UPDATE SET role = excluded.role
+    `).run(workspaceId, memberId, role);
+    }
+    removeWorkspaceMember(workspaceId, memberId) {
+        return this._stmt('DELETE FROM workspace_members WHERE workspace_id = ? AND member_id = ?').run(workspaceId, memberId).changes > 0;
+    }
+    // ── Members ─────────────────────────────────────────────────────────────
+    getMember(id) {
+        const row = this._stmt('SELECT * FROM members WHERE id = ?').get(id);
+        return row ? toMember(row) : null;
+    }
+    findMemberByEmail(email) {
+        const row = this._stmt('SELECT * FROM members WHERE lower(email) = lower(?)').get(email.trim());
+        return row ? toMember(row) : null;
+    }
+    listMembers() {
+        return this._stmt('SELECT * FROM members ORDER BY created_at, id').all().map(toMember);
+    }
+    /** Workspaces (not deleted) the member belongs to, with their role. */
+    memberWorkspaceRoles(memberId) {
+        const rows = this._stmt(`
+      SELECT wm.workspace_id, wm.role FROM workspace_members wm JOIN workspaces w ON w.id = wm.workspace_id
+      WHERE wm.member_id = ? AND w.deleted_at IS NULL
+    `).all(memberId);
+        return new Map(rows.map((row) => [row.workspace_id, row.role]));
+    }
+    /** True once an active owner exists. */
+    isSetupComplete() {
+        return this._stmt("SELECT 1 FROM members WHERE org_role = 'owner' AND status = 'active' LIMIT 1").get() !== undefined;
+    }
+    countActiveOwners() {
+        return this._count("SELECT COUNT(*) AS count FROM members WHERE org_role = 'owner' AND status = 'active'");
+    }
+    /** The first owner, created when the console is claimed; admin of the Default workspace. */
+    createOwner(input) {
+        return this._db.transaction(() => {
+            if (this.isSetupComplete())
+                throw new Error('The console already has an owner.');
+            const member = this._insertMember({ label: input.label, email: input.email, orgRole: 'owner', status: 'active' });
+            this.setWorkspaceMember(DEFAULT_WORKSPACE_ID, member.id, 'admin');
+            return member;
+        })();
+    }
+    _insertMember(input) {
+        const id = newId('mem');
+        this._stmt('INSERT INTO members (id, label, email, org_role, status, created_at) VALUES (?, ?, ?, ?, ?, ?)')
+            .run(id, input.label, input.email?.trim() || null, input.orgRole, input.status, this._now());
+        return this.getMember(id);
+    }
+    updateMember(id, patch) {
+        const current = this.getMember(id);
+        if (!current)
+            throw new Error(`Unknown member "${id}".`);
+        const limits = { ...current.limits, ...(patch.limits ?? {}) };
+        this._stmt(`
+      UPDATE members SET label = ?, email = ?, org_role = ?, daily_limit_usdc = ?, weekly_limit_usdc = ?, monthly_limit_usdc = ?,
+        total_limit_usdc = ?, routing_policy = ?, max_keys = ? WHERE id = ?
+    `).run(patch.label ?? current.label, patch.email === undefined ? current.email : (patch.email?.trim() || null), patch.orgRole ?? current.orgRole, limits.daily, limits.weekly, limits.monthly, limits.total, policyJson(patch.routingPolicy === undefined ? current.routingPolicy : patch.routingPolicy), patch.maxKeys === undefined ? current.maxKeys : patch.maxKeys, id);
+        return this.getMember(id);
+    }
+    setMemberStatus(id, status) {
+        const result = this._stmt('UPDATE members SET status = ? WHERE id = ?').run(status, id);
+        if (result.changes === 0)
+            throw new Error(`Unknown member "${id}".`);
+        return this.getMember(id);
+    }
+    // ── Invites ─────────────────────────────────────────────────────────────
+    /**
+     * Creates the invited member (status 'invited', already in its workspaces)
+     * and a single-use link token, of which only the SHA-256 is stored.
+     */
+    createInvite(input) {
+        const token = randomBytes(32).toString('base64url');
+        const invite = this._db.transaction(() => {
+            const member = this._insertMember({ label: input.label, email: input.email, orgRole: input.orgRole, status: 'invited' });
+            for (const entry of input.workspaces)
+                this.setWorkspaceMember(entry.workspaceId, member.id, entry.role);
+            const id = newId('inv');
+            this._stmt(`
+        INSERT INTO invites (id, token_hash, member_id, label, email, org_role, workspace_roles, created_by, expires_at, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(id, hashApiKey(token), member.id, input.label, member.email, input.orgRole, JSON.stringify(input.workspaces), input.createdBy, input.expiresAt, this._now());
+            return this.getInvite(id);
+        })();
+        return { invite, token };
+    }
+    getInvite(id) {
+        const row = this._stmt('SELECT * FROM invites WHERE id = ?').get(id);
+        return row ? toInvite(row) : null;
+    }
+    /** Invites not yet used (expired ones included, so they can be cleaned up). */
+    listInvites() {
+        return this._stmt('SELECT * FROM invites WHERE used_at IS NULL ORDER BY created_at DESC').all().map(toInvite);
+    }
+    /** Deletes an unused invite and the member it created, if that member never joined. */
+    deleteInvite(id) {
+        return this._db.transaction(() => {
+            const invite = this.getInvite(id);
+            if (!invite || invite.usedAt !== null)
+                return false;
+            this._stmt('DELETE FROM invites WHERE id = ?').run(id);
+            const member = this.getMember(invite.memberId);
+            if (member?.status === 'invited') {
+                this._stmt('DELETE FROM workspace_members WHERE member_id = ?').run(member.id);
+                this._stmt('DELETE FROM members WHERE id = ?').run(member.id);
+            }
+            return true;
+        })();
+    }
+    /** The invite behind a token hash while it is usable, without consuming it. */
+    peekInvite(tokenHash, now) {
+        const row = this._stmt('SELECT * FROM invites WHERE token_hash = ? AND used_at IS NULL AND expires_at > ?').get(tokenHash, now);
+        if (!row)
+            return null;
+        const member = this.getMember(row.member_id);
+        return member && member.status === 'invited' ? { invite: toInvite(row), member } : null;
+    }
+    /** Token hash of a member's newest live (unused, unexpired) invite, for SSO activation by email. */
+    liveInviteHash(memberId, now) {
+        const row = this._stmt('SELECT token_hash FROM invites WHERE member_id = ? AND used_at IS NULL AND expires_at > ? ORDER BY created_at DESC LIMIT 1')
+            .get(memberId, now);
+        return row?.token_hash ?? null;
+    }
+    /** Why an invite token is not usable: already used, expired, or unknown (also for a live one). */
+    inviteState(tokenHash, now) {
+        const row = this._stmt('SELECT used_at, expires_at FROM invites WHERE token_hash = ?').get(tokenHash);
+        if (!row)
+            return 'unknown';
+        if (row.used_at !== null)
+            return 'used';
+        return row.expires_at <= now ? 'expired' : 'unknown';
+    }
+    /** Marks the invite used and its member active; null when the token is unknown, used or expired. */
+    consumeInvite(tokenHash, now) {
+        return this._db.transaction(() => {
+            const found = this.peekInvite(tokenHash, now);
+            if (!found)
+                return null;
+            this._stmt('UPDATE invites SET used_at = ? WHERE id = ?').run(now, found.invite.id);
+            return this.setMemberStatus(found.member.id, 'active');
+        })();
     }
     // ── Keys ────────────────────────────────────────────────────────────────
+    /**
+     * Creates a key in `workspaceId`, or, for callers that only name an
+     * identity (the CLI), in the workspace paying with that identity.
+     */
     createKey(input) {
+        let workspace;
+        if (input.workspaceId) {
+            const found = this.getWorkspace(input.workspaceId);
+            if (!found)
+                throw new Error(`Unknown workspace "${input.workspaceId}".`);
+            if (input.buyerIdentity && input.buyerIdentity !== found.buyerIdentity) {
+                throw new Error(`Workspace "${found.name}" pays with identity "${found.buyerIdentity}", not "${input.buyerIdentity}".`);
+            }
+            workspace = found;
+        }
+        else {
+            workspace = this.ensureWorkspaceForIdentity(input.buyerIdentity ?? DEFAULT_BUYER_IDENTITY);
+        }
         const generated = generateApiKey();
         const id = newKeyId();
-        this._db.prepare(`
-      INSERT INTO api_keys (id, label, key_hash, key_hint, buyer_identity, source, daily_limit_usdc, monthly_limit_usdc, total_limit_usdc, topup_enabled, expires_at, created_at)
-      VALUES (?, ?, ?, ?, ?, 'created', ?, ?, ?, ?, ?, ?)
-    `).run(id, input.label, generated.hash, generated.hint, input.buyerIdentity, input.limits.daily, input.limits.monthly, input.limits.total, input.topupEnabled ? 1 : 0, input.expiresAt, this._now());
+        const limits = fullLimits(input.limits);
+        const ownerLimits = input.ownerLimits ?? NO_BUDGET_LIMITS;
+        this._stmt(`
+      INSERT INTO api_keys (id, label, key_hash, key_hint, buyer_identity, workspace_id, owner_member_id, source,
+        daily_limit_usdc, weekly_limit_usdc, monthly_limit_usdc, total_limit_usdc, routing_policy,
+        owner_daily_limit_usdc, owner_weekly_limit_usdc, owner_monthly_limit_usdc, owner_total_limit_usdc, owner_routing_policy,
+        topup_enabled, expires_at, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, 'created', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.label, generated.hash, generated.hint, workspace.buyerIdentity, workspace.id, input.ownerMemberId ?? null, limits.daily, limits.weekly, limits.monthly, limits.total, policyJson(input.routingPolicy), ownerLimits.daily, ownerLimits.weekly, ownerLimits.monthly, ownerLimits.total, policyJson(input.ownerRoutingPolicy), input.topupEnabled ? 1 : 0, input.expiresAt, this._now());
         return { key: this.getKey(id), secret: generated.secret };
     }
     /**
@@ -105,17 +421,17 @@ export class GatewayStore {
      */
     syncEnvironmentKey(secret) {
         const hash = hashApiKey(secret);
-        const existing = this._db.prepare("SELECT id FROM api_keys WHERE source = 'tunnel-env'").get();
+        const existing = this._stmt("SELECT id FROM api_keys WHERE source = 'tunnel-env'").get();
         if (existing) {
-            this._db.prepare("UPDATE api_keys SET key_hash = ?, key_hint = ?, status = 'active', revoked_at = NULL WHERE id = ?")
+            this._stmt("UPDATE api_keys SET key_hash = ?, key_hint = ?, status = 'active', revoked_at = NULL WHERE id = ?")
                 .run(hash, apiKeyHint(secret), existing.id);
             return this.getKey(existing.id);
         }
         const id = newKeyId();
-        this._db.prepare(`
-      INSERT INTO api_keys (id, label, key_hash, key_hint, buyer_identity, source, created_at)
-      VALUES (?, 'Tunnel key', ?, ?, ?, 'tunnel-env', ?)
-    `).run(id, hash, apiKeyHint(secret), DEFAULT_BUYER_IDENTITY, this._now());
+        this._stmt(`
+      INSERT INTO api_keys (id, label, key_hash, key_hint, buyer_identity, workspace_id, source, created_at)
+      VALUES (?, 'Tunnel key', ?, ?, ?, ?, 'tunnel-env', ?)
+    `).run(id, hash, apiKeyHint(secret), DEFAULT_BUYER_IDENTITY, DEFAULT_WORKSPACE_ID, this._now());
         return this.getKey(id);
     }
     /**
@@ -124,111 +440,829 @@ export class GatewayStore {
      * revoked key, or null when there was no active one.
      */
     retireEnvironmentKey() {
-        const existing = this._db.prepare("SELECT id FROM api_keys WHERE source = 'tunnel-env' AND status = 'active'").get();
+        const existing = this._stmt("SELECT id FROM api_keys WHERE source = 'tunnel-env' AND status = 'active'").get();
         return existing ? this.revokeKey(existing.id) : null;
     }
     findKeyBySecret(secret) {
-        const row = this._db.prepare('SELECT * FROM api_keys WHERE key_hash = ?').get(hashApiKey(secret));
+        const row = this._stmt('SELECT * FROM api_keys WHERE key_hash = ?').get(hashApiKey(secret));
         return row ? toKey(row) : null;
     }
     getKey(id) {
-        const row = this._db.prepare('SELECT * FROM api_keys WHERE id = ?').get(id);
+        const row = this._stmt('SELECT * FROM api_keys WHERE id = ?').get(id);
         return row ? toKey(row) : null;
     }
-    listKeys() {
-        const rows = this._db.prepare('SELECT * FROM api_keys ORDER BY created_at, id').all();
-        return rows.map(toKey);
+    listKeys(filter = {}) {
+        const where = [];
+        const params = [];
+        if (filter.workspaceId) {
+            where.push('workspace_id = ?');
+            params.push(filter.workspaceId);
+        }
+        if (filter.ownerMemberId) {
+            where.push('owner_member_id = ?');
+            params.push(filter.ownerMemberId);
+        }
+        const sql = `SELECT * FROM api_keys ${whereClause(where)} ORDER BY created_at, id`;
+        return this._stmt(sql).all(...params).map(toKey);
     }
     countActiveKeys() {
-        return this._db.prepare("SELECT COUNT(*) AS count FROM api_keys WHERE status = 'active'").get().count;
+        return this._count("SELECT COUNT(*) AS count FROM api_keys WHERE status = 'active'");
+    }
+    countActiveKeysForMember(memberId) {
+        return this._count("SELECT COUNT(*) AS count FROM api_keys WHERE status = 'active' AND owner_member_id = ?", memberId);
     }
     setLimits(id, limits) {
         const key = this.getKey(id);
         if (!key)
             throw new Error(`Unknown key "${id}".`);
         const next = { ...key.limits, ...limits };
-        this._db.prepare('UPDATE api_keys SET daily_limit_usdc = ?, monthly_limit_usdc = ?, total_limit_usdc = ? WHERE id = ?')
-            .run(next.daily, next.monthly, next.total, id);
+        this._stmt('UPDATE api_keys SET daily_limit_usdc = ?, weekly_limit_usdc = ?, monthly_limit_usdc = ?, total_limit_usdc = ? WHERE id = ?')
+            .run(next.daily, next.weekly ?? null, next.monthly, next.total, id);
         return this.getKey(id);
     }
     setTopupEnabled(id, enabled) {
-        const result = this._db.prepare('UPDATE api_keys SET topup_enabled = ? WHERE id = ?').run(enabled ? 1 : 0, id);
+        const result = this._stmt('UPDATE api_keys SET topup_enabled = ? WHERE id = ?').run(enabled ? 1 : 0, id);
         if (result.changes === 0)
             throw new Error(`Unknown key "${id}".`);
         return this.getKey(id);
     }
+    updateKey(id, patch) {
+        const key = this.getKey(id);
+        if (!key)
+            throw new Error(`Unknown key "${id}".`);
+        const limits = { ...key.limits, ...(patch.limits ?? {}) };
+        const ownerLimits = { ...key.ownerLimits, ...(patch.ownerLimits ?? {}) };
+        this._stmt(`
+      UPDATE api_keys SET label = ?, daily_limit_usdc = ?, weekly_limit_usdc = ?, monthly_limit_usdc = ?, total_limit_usdc = ?,
+        routing_policy = ?, owner_daily_limit_usdc = ?, owner_weekly_limit_usdc = ?, owner_monthly_limit_usdc = ?, owner_total_limit_usdc = ?,
+        owner_routing_policy = ?, topup_enabled = ?, expires_at = ?, owner_member_id = ? WHERE id = ?
+    `).run(patch.label ?? key.label, limits.daily, limits.weekly, limits.monthly, limits.total, policyJson(patch.routingPolicy === undefined ? key.routingPolicy : patch.routingPolicy), ownerLimits.daily, ownerLimits.weekly, ownerLimits.monthly, ownerLimits.total, policyJson(patch.ownerRoutingPolicy === undefined ? key.ownerRoutingPolicy : patch.ownerRoutingPolicy), (patch.topupEnabled ?? key.topupEnabled) ? 1 : 0, patch.expiresAt === undefined ? key.expiresAt : patch.expiresAt, patch.ownerMemberId === undefined ? key.ownerMemberId : patch.ownerMemberId, id);
+        return this.getKey(id);
+    }
+    /** New secret for the same key id; usage history, limits and policy stay. */
+    rotateKey(id) {
+        const generated = generateApiKey();
+        const result = this._stmt("UPDATE api_keys SET key_hash = ?, key_hint = ? WHERE id = ? AND status = 'active'")
+            .run(generated.hash, generated.hint, id);
+        if (result.changes === 0)
+            throw new Error(this.getKey(id) ? `Key "${id}" is revoked.` : `Unknown key "${id}".`);
+        return { key: this.getKey(id), secret: generated.secret };
+    }
     revokeKey(id) {
-        const result = this._db.prepare("UPDATE api_keys SET status = 'revoked', revoked_at = ? WHERE id = ? AND status = 'active'")
+        const result = this._stmt("UPDATE api_keys SET status = 'revoked', revoked_at = ? WHERE id = ? AND status = 'active'")
             .run(this._now(), id);
         if (result.changes === 0 && !this.getKey(id))
             throw new Error(`Unknown key "${id}".`);
         return this.getKey(id);
     }
+    /** Revokes every active key a member owns; returns their ids. */
+    revokeMemberKeys(memberId) {
+        const ids = this._stmt("SELECT id FROM api_keys WHERE owner_member_id = ? AND status = 'active'").all(memberId)
+            .map((row) => row.id);
+        for (const id of ids)
+            this.revokeKey(id);
+        return ids;
+    }
+    /** Records use at most once a minute per key (per process), so requests do not each write. */
     touchKey(id) {
-        this._db.prepare('UPDATE api_keys SET last_used_at = ? WHERE id = ?').run(this._now(), id);
+        const now = this._now();
+        if (!this._shouldTouch(`key:${id}`, now))
+            return;
+        this._stmt('UPDATE api_keys SET last_used_at = ? WHERE id = ?').run(now, id);
+    }
+    _shouldTouch(id, now) {
+        const last = this._touched.get(id);
+        if (last !== undefined && now - last < TOUCH_INTERVAL_MS && now >= last)
+            return false;
+        if (this._touched.size >= MAX_TRACKED_TOUCHES)
+            this._touched.clear();
+        this._touched.set(id, now);
+        return true;
     }
     // ── Requests ────────────────────────────────────────────────────────────
     startRequest(input) {
-        this._db.prepare(`
-      INSERT INTO gateway_requests (tag, key_id, buyer_identity, method, path, model, started_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?)
-    `).run(input.tag, input.keyId, input.buyerIdentity, input.method, input.path, input.model, input.startedAt);
+        this._stmt(`
+      INSERT INTO gateway_requests (tag, key_id, buyer_identity, method, path, model, started_at, workspace_id, member_id, end_user)
+      VALUES (?, ?, ?, ?, ?, ?, ?,
+        COALESCE(?, (SELECT workspace_id FROM api_keys WHERE id = ?)),
+        COALESCE(?, (SELECT owner_member_id FROM api_keys WHERE id = ?)),
+        ?)
+    `).run(input.tag, input.keyId, input.buyerIdentity, input.method, input.path, input.model, input.startedAt, input.workspaceId ?? null, input.keyId, input.memberId ?? null, input.keyId, input.endUser ?? null);
     }
+    /** `error` is kept for failed requests (code ≤ 100, message ≤ 500 characters). */
     finishRequest(tag, result) {
-        this._db.prepare('UPDATE gateway_requests SET status = ?, buyer_request_id = ?, finished_at = ? WHERE tag = ?')
-            .run(result.status, result.buyerRequestId, this._now(), tag);
+        this._stmt(`
+      UPDATE gateway_requests SET status = ?, buyer_request_id = ?, finished_at = ?, error_code = ?, error_message = ? WHERE tag = ?
+    `).run(result.status, result.buyerRequestId, this._now(), result.error?.code?.slice(0, MAX_ERROR_CODE) || null, result.error?.message?.slice(0, MAX_ERROR_MESSAGE) || null, tag);
+    }
+    /** Seller, latency and end user of a request; null fields leave what is stored. */
+    recordRequestOutcome(tag, outcome) {
+        this._stmt(`
+      UPDATE gateway_requests SET seller_peer_id = COALESCE(?, seller_peer_id), latency_ms = COALESCE(?, latency_ms),
+        end_user = COALESCE(?, end_user), served_free = MAX(served_free, ?) WHERE tag = ?
+    `).run(outcome.sellerPeerId ?? null, outcome.latencyMs ?? null, outcome.endUser ?? null, outcome.servedFree ? 1 : 0, tag);
+    }
+    /**
+     * The token counts the response itself reported, read by the gateway as it
+     * streamed past. Usage falls back to them while (or if ever) the request
+     * has no spend with token counts in the ledger, so they never add up twice.
+     */
+    recordResponseUsage(tag, usage) {
+        this._stmt(`
+      UPDATE gateway_requests SET usage_input_tokens = ?, usage_cached_input_tokens = ?, usage_output_tokens = ? WHERE tag = ?
+    `).run(usage.inputTokens, usage.cachedInputTokens, usage.outputTokens, tag);
+    }
+    /** Only called while content logging is on. */
+    recordRequestContent(tag, content) {
+        this._stmt(`
+      UPDATE gateway_requests SET request_body = COALESCE(?, request_body), response_body = COALESCE(?, response_body) WHERE tag = ?
+    `).run(content.requestBody ?? null, content.responseBody ?? null, tag);
+    }
+    /** Forgets every stored request and response body; for when content logging is turned off. */
+    clearRequestContent() {
+        return this._stmt(`
+      UPDATE gateway_requests SET request_body = NULL, response_body = NULL WHERE request_body IS NOT NULL OR response_body IS NOT NULL
+    `).run().changes;
     }
+    /**
+     * Drops request-log rows started before `before`, `chunkSize` rows per
+     * transaction so a large backlog never holds the write lock for long. Their
+     * request counts move into `request_rollups` (per hour, key, workspace,
+     * member, model, seller and end user) so usage reports keep counting them;
+     * spend and tokens live in the ledger, which is never pruned. Pruned
+     * periods are therefore counted at hour granularity. Yields to the event
+     * loop between chunks, so requests keep flowing while a backlog drains.
+     */
+    async pruneRequests(before, chunkSize = 5_000) {
+        const select = this._stmt('SELECT rowid FROM gateway_requests WHERE started_at < ? ORDER BY started_at LIMIT ?').pluck();
+        const rollup = this._stmt(`
+      INSERT INTO request_rollups (hour_start, key_id, workspace_id, member_id, model, seller_peer_id, end_user, requests, failed_requests)
+      SELECT (r.started_at / ${HOUR_MS}) * ${HOUR_MS}, r.key_id, r.workspace_id, r.member_id, r.model, r.seller_peer_id, r.end_user,
+        COUNT(*), SUM(${FAILED_SQL})
+      FROM gateway_requests r WHERE r.rowid IN (SELECT value FROM json_each(?))
+      GROUP BY 1, 2, 3, 4, 5, 6, 7
+    `);
+        const remove = this._stmt('DELETE FROM gateway_requests WHERE rowid IN (SELECT value FROM json_each(?))');
+        const pruneChunk = this._db.transaction(() => {
+            const ids = select.all(before, chunkSize);
+            if (ids.length === 0)
+                return 0;
+            const json = JSON.stringify(ids);
+            rollup.run(json);
+            remove.run(json);
+            return ids.length;
+        });
+        let removed = 0;
+        for (;;) {
+            const count = pruneChunk.immediate();
+            removed += count;
+            if (count < chunkSize)
+                return removed;
+            await new Promise((resolve) => setImmediate(resolve));
+        }
+    }
+    /** Who a request was attributed to when it started. */
     findRequest(tag) {
-        const row = this._db.prepare('SELECT key_id, buyer_identity FROM gateway_requests WHERE tag = ?').get(tag);
-        return row ? { keyId: row.key_id, buyerIdentity: row.buyer_identity } : null;
+        const row = this._stmt('SELECT key_id, buyer_identity, workspace_id, member_id, model, end_user FROM gateway_requests WHERE tag = ?').get(tag);
+        return row
+            ? { keyId: row.key_id, buyerIdentity: row.buyer_identity, workspaceId: row.workspace_id, memberId: row.member_id, model: row.model, endUser: row.end_user }
+            : null;
+    }
+    /** Requests per seller since a time, with the median latency this gateway measured. */
+    peerStats(sinceMs) {
+        const rows = this._stmt(`
+      SELECT seller_peer_id AS peer, latency_ms AS latency FROM gateway_requests
+      WHERE started_at >= ? AND seller_peer_id IS NOT NULL
+    `).all(sinceMs);
+        const byPeer = new Map();
+        for (const row of rows) {
+            const entry = byPeer.get(row.peer) ?? { requests: 0, latencies: [] };
+            entry.requests += 1;
+            if (row.latency !== null)
+                entry.latencies.push(row.latency);
+            byPeer.set(row.peer, entry);
+        }
+        return [...byPeer].map(([peerId, entry]) => {
+            const sorted = entry.latencies.sort((a, b) => a - b);
+            return { peerId, requests: entry.requests, latencyMsP50: sorted.length ? sorted[Math.floor((sorted.length - 1) / 2)] : null };
+        });
+    }
+    /** Newest first, ordered by (startedAt, tag); pass the last row as `before` for the next page. Bodies are not read. */
+    listRequests(filter) {
+        const { where, params } = scopeSql(filter, REQUEST_COLUMNS);
+        if (filter.status === 'ok')
+            where.push('r.status IS NOT NULL AND r.status < 400');
+        else if (filter.status === 'error')
+            where.push(FAILED_SQL);
+        else if (typeof filter.status === 'number') {
+            where.push('r.status = ?');
+            params.push(filter.status);
+        }
+        const q = filter.q?.trim();
+        if (q) {
+            const pattern = `%${escapeLike(q)}%`;
+            const columns = ['r.model', 'k.label', 'r.end_user', 'r.tag', 'r.seller_peer_id', 'r.path', 'r.error_code', 'r.error_message'];
+            where.push(`(${columns.map((c) => `${c} LIKE ? ESCAPE '\\'`).join(' OR ')})`);
+            params.push(...columns.map(() => pattern));
+        }
+        if (filter.before) {
+            where.push('(r.started_at < ? OR (r.started_at = ? AND r.tag < ?))');
+            params.push(filter.before.startedAt, filter.before.startedAt, filter.before.tag);
+        }
+        const limit = Math.max(1, Math.min(filter.limit ?? 50, 100_000));
+        return this._requestRows(where, params, limit, false);
+    }
+    /** One request with its bodies; `keyIds` limits it to what the caller may see. */
+    getRequest(tag, keyIds = null) {
+        const { where, params } = scopeSql({ keyIds }, REQUEST_COLUMNS);
+        where.push('r.tag = ?');
+        params.push(tag);
+        return this._requestRows(where, params, 1, true)[0] ?? null;
+    }
+    /** The page of requests first, then one grouped ledger read for just those tags. */
+    _requestRows(where, params, limit, withBodies) {
+        const rows = this._stmt(`
+      WITH page AS (
+        SELECT r.tag, r.started_at, r.finished_at, r.key_id, k.label AS key_label, COALESCE(r.workspace_id, k.workspace_id) AS ws_id,
+          r.member_id, r.end_user, r.method, r.path, r.model, r.status, r.seller_peer_id, r.latency_ms, r.error_code, r.error_message,
+          r.served_free, r.usage_input_tokens, r.usage_cached_input_tokens, r.usage_output_tokens
+          ${withBodies ? ', r.request_body, r.response_body' : ''}
+        FROM gateway_requests r LEFT JOIN api_keys k ON k.id = r.key_id
+        ${whereClause(where)}
+        ORDER BY r.started_at DESC, r.tag DESC LIMIT ?
+      ),
+      spend AS (
+        SELECT l.request_tag AS tag, -SUM(l.amount_usdc) AS spent, SUM(l.input_tokens) AS in_tokens,
+          SUM(l.cached_input_tokens) AS cached_tokens, SUM(l.output_tokens) AS out_tokens
+        FROM ledger_entries l WHERE l.kind = 'spend' AND l.request_tag IN (SELECT tag FROM page) GROUP BY l.request_tag
+      )
+      SELECT page.*, spend.spent, COALESCE(spend.in_tokens, 0) AS in_tokens, COALESCE(spend.cached_tokens, 0) AS cached_tokens,
+        COALESCE(spend.out_tokens, 0) AS out_tokens
+      FROM page LEFT JOIN spend ON spend.tag = page.tag
+      ORDER BY page.started_at DESC, page.tag DESC
+    `).all(...params, limit);
+        return rows.map((row) => {
+            // Ledger tokens when the spend reported any, else what the response said.
+            const ledgerTokens = row['in_tokens'] + row['cached_tokens'] + row['out_tokens'] > 0;
+            const status = row['status'];
+            const servedFree = row['served_free'] === 1;
+            return {
+                tag: row['tag'],
+                startedAt: row['started_at'],
+                finishedAt: row['finished_at'],
+                keyId: row['key_id'],
+                keyLabel: row['key_label'] ?? row['key_id'],
+                workspaceId: row['ws_id'] ?? DEFAULT_WORKSPACE_ID,
+                memberId: row['member_id'],
+                endUser: row['end_user'],
+                method: row['method'],
+                path: row['path'],
+                model: row['model'],
+                status: row['status'],
+                sellerPeerId: row['seller_peer_id'],
+                latencyMs: row['latency_ms'],
+                spentUsdc: row['spent'],
+                inputTokens: ledgerTokens ? row['in_tokens'] : row['usage_input_tokens'] ?? 0,
+                cachedInputTokens: ledgerTokens ? row['cached_tokens'] : row['usage_cached_input_tokens'] ?? 0,
+                outputTokens: ledgerTokens ? row['out_tokens'] : row['usage_output_tokens'] ?? 0,
+                errorCode: row['error_code'],
+                errorMessage: row['error_message'],
+                servedFree,
+                costPending: row['spent'] === null && !servedFree && row['model'] !== null && (status === null || status < 400),
+                ...(withBodies ? { requestBody: row['request_body'], responseBody: row['response_body'] } : {}),
+            };
+        });
+    }
+    /**
+     * Totals plus one row per group (each split by `splitBy` when given),
+     * attributed as at request time. Request counts come from the request log
+     * plus the rollups of pruned rows; spend and tokens from the ledger, and
+     * the tokens of requests whose spend carries none (not reported yet, or
+     * never) from the usage their responses reported.
+     */
+    usageReport(filter, groupBy, splitBy = null) {
+        const select = (columns) => `${groupExpression(groupBy, columns)} AS g, ${splitBy ? groupExpression(splitBy, columns) : 'NULL'} AS s`;
+        const req = scopeSql(filter, REQUEST_COLUMNS);
+        const requestRows = this._stmt(`
+      SELECT ${select(REQUEST_COLUMNS)}, COUNT(*) AS requests, COALESCE(SUM(${FAILED_SQL}), 0) AS failed
+      FROM gateway_requests r ${whereClause(req.where)} GROUP BY g, s
+    `).all(...req.params);
+        const roll = scopeSql(filter, ROLLUP_COLUMNS);
+        const rollupRows = this._stmt(`
+      SELECT ${select(ROLLUP_COLUMNS)}, SUM(u.requests) AS requests, SUM(u.failed_requests) AS failed
+      FROM request_rollups u ${whereClause(roll.where)} GROUP BY g, s
+    `).all(...roll.params);
+        const led = scopeSql(filter, LEDGER_COLUMNS);
+        led.where.push("l.kind = 'spend'");
+        const ledgerRows = this._stmt(`
+      SELECT ${select(LEDGER_COLUMNS)}, COALESCE(-SUM(l.amount_usdc), 0) AS spent, COALESCE(SUM(l.input_tokens), 0) AS input_tokens,
+        COALESCE(SUM(l.cached_input_tokens), 0) AS cached_input_tokens, COALESCE(SUM(l.output_tokens), 0) AS output_tokens
+      FROM ledger_entries l ${whereClause(led.where)} GROUP BY g, s
+    `).all(...led.params);
+        const fallback = scopeSql(filter, REQUEST_COLUMNS);
+        fallback.where.push(REPORTED_TOKENS_ONLY_SQL);
+        const responseRows = this._stmt(`
+      SELECT ${select(REQUEST_COLUMNS)}, SUM(r.usage_input_tokens) AS input_tokens, COALESCE(SUM(r.usage_cached_input_tokens), 0) AS cached_input_tokens,
+        COALESCE(SUM(r.usage_output_tokens), 0) AS output_tokens
+      FROM gateway_requests r ${whereClause(fallback.where)} GROUP BY g, s
+    `).all(...fallback.params);
+        const groups = new Map();
+        const entries = (group, split) => {
+            let found = groups.get(group);
+            if (!found) {
+                found = { totals: emptyUsageTotals(), splits: new Map() };
+                groups.set(group, found);
+            }
+            if (!splitBy)
+                return [found.totals];
+            let part = found.splits.get(split);
+            if (!part) {
+                part = emptyUsageTotals();
+                found.splits.set(split, part);
+            }
+            return [found.totals, part];
+        };
+        for (const row of [...requestRows, ...rollupRows]) {
+            for (const target of entries(row.g, row.s)) {
+                target.requests += row.requests;
+                target.failedRequests += row.failed;
+            }
+        }
+        const tokenRows = [...ledgerRows, ...responseRows];
+        for (const row of tokenRows) {
+            for (const target of entries(row.g, row.s)) {
+                target.spentUsdc += row.spent ?? 0;
+                target.inputTokens += row.input_tokens;
+                target.cachedInputTokens += row.cached_input_tokens;
+                target.outputTokens += row.output_tokens;
+            }
+        }
+        const totals = emptyUsageTotals();
+        for (const { totals: value } of groups.values()) {
+            for (const field of Object.keys(totals))
+                totals[field] += value[field];
+        }
+        if (!groupBy)
+            return { totals, groups: [] };
+        const bySize = (a, b) => b.spentUsdc - a.spentUsdc || b.requests - a.requests;
+        const list = [...groups].map(([group, entry]) => ({
+            group,
+            ...entry.totals,
+            ...(splitBy ? { splits: capUserGroups(splitBy, [...entry.splits].map(([split, part]) => ({ group: split, ...part })).sort(bySize)) } : {}),
+        }));
+        if (isTimeGrouping(groupBy))
+            list.sort((a, b) => String(a.group).localeCompare(String(b.group)));
+        else
+            list.sort(bySize);
+        return { totals, groups: capUserGroups(groupBy, list) };
     }
     // ── Ledger ──────────────────────────────────────────────────────────────
-    /** Returns false when the entry was already recorded (same externalRef). */
+    /**
+     * Returns false when the entry was already recorded (same externalRef).
+     * The entry is attributed to the workspace, member, model and end user of
+     * its request (or, without one, of its key as it is now) unless given.
+     */
     recordLedgerEntry(entry) {
         if (!Number.isSafeInteger(entry.amountUsdc) || entry.amountUsdc < 0) {
             throw new Error('Ledger amounts are non-negative integer USDC base units; the kind sets the sign.');
         }
         const signed = entry.kind === 'spend' ? -entry.amountUsdc : entry.amountUsdc;
-        const result = this._db.prepare(`
+        const request = entry.requestTag ? this.findRequest(entry.requestTag) : null;
+        const key = request ? null : this.getKey(entry.keyId);
+        const workspaceId = entry.workspaceId ?? request?.workspaceId ?? key?.workspaceId ?? null;
+        let memberId = entry.memberId;
+        if (memberId === undefined)
+            memberId = request ? request.memberId : key?.ownerMemberId ?? null;
+        const result = this._stmt(`
       INSERT OR IGNORE INTO ledger_entries
         (kind, key_id, buyer_identity, amount_usdc, external_ref, request_tag, seller_peer_id,
-         input_tokens, cached_input_tokens, output_tokens, note, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(entry.kind, entry.keyId, entry.buyerIdentity, signed, entry.externalRef, entry.requestTag ?? null, entry.sellerPeerId ?? null, entry.inputTokens ?? 0, entry.cachedInputTokens ?? 0, entry.outputTokens ?? 0, entry.note ?? null, entry.createdAt);
+         input_tokens, cached_input_tokens, output_tokens, note, created_at, workspace_id, member_id, model, end_user)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(entry.kind, entry.keyId, entry.buyerIdentity, signed, entry.externalRef, entry.requestTag ?? null, entry.sellerPeerId ?? null, entry.inputTokens ?? 0, entry.cachedInputTokens ?? 0, entry.outputTokens ?? 0, entry.note ?? null, entry.createdAt, workspaceId, memberId, entry.model ?? request?.model ?? null, entry.endUser ?? request?.endUser ?? null);
         return result.changes > 0;
     }
+    /** A key's spend for the periods `antseed gateway key` shows. */
     periodSpend(keyId, now = this._now()) {
-        const statement = this._db.prepare("SELECT COALESCE(-SUM(amount_usdc), 0) AS spent FROM ledger_entries WHERE key_id = ? AND kind = 'spend' AND created_at >= ?");
-        const spend = {};
-        for (const period of LIMIT_PERIODS) {
-            spend[period] = statement.get(keyId, periodStart(period, now)).spent;
+        const all = this.spendByPeriod({ keyId }, now);
+        return Object.fromEntries(LIMIT_PERIODS.map((period) => [period, all[period]]));
+    }
+    /**
+     * Settled spend per budget period of a key, member or workspace, as
+     * attributed when it was spent. Only `periods` are summed (the rest are 0),
+     * in one indexed query.
+     */
+    spendByPeriod(scope, now = this._now(), periods = BUDGET_PERIODS) {
+        const spend = { daily: 0, weekly: 0, monthly: 0, total: 0 };
+        if (periods.length === 0)
+            return spend;
+        // Read from the rollups the ledger trigger keeps (see migration v3):
+        // the lifetime total is one row, a dated period at most 31 daily rows,
+        // however long the ledger grows. Periods start at UTC midnight, so they
+        // align with the daily rows.
+        const { kind, id } = budgetScopeRow(scope);
+        if (periods.includes('total')) {
+            const row = this._stmt('SELECT total_usdc FROM spend_totals WHERE scope_kind = ? AND scope_id = ?').get(kind, id);
+            spend.total = row?.total_usdc ?? 0;
+        }
+        const dated = periods.filter((period) => period !== 'total');
+        if (dated.length > 0) {
+            const starts = dated.map((period) => periodStart(period, now));
+            const row = this._stmt(`
+        SELECT ${dated.map((_, index) => `COALESCE(SUM(CASE WHEN day_start >= ? THEN amount_usdc ELSE 0 END), 0) AS p${index}`).join(', ')}
+        FROM spend_daily WHERE scope_kind = ? AND scope_id = ? AND day_start >= ?
+      `).get(...starts, kind, id, Math.min(...starts));
+            dated.forEach((period, index) => { spend[period] = row[`p${index}`] ?? 0; });
         }
         return spend;
     }
     usageStats(keyId, since = 0) {
-        const requests = this._db.prepare(`
-      SELECT COUNT(*) AS requests,
-             COALESCE(SUM(CASE WHEN status IS NULL OR status >= 400 THEN 1 ELSE 0 END), 0) AS failed
-      FROM gateway_requests WHERE key_id = ? AND started_at >= ?
+        const requests = this._stmt(`
+      SELECT COUNT(*) AS requests, COALESCE(SUM(${FAILED_SQL}), 0) AS failed
+      FROM gateway_requests r WHERE r.key_id = ? AND r.started_at >= ?
     `).get(keyId, since);
-        const ledger = this._db.prepare(`
+        const rolled = this._stmt(`
+      SELECT COALESCE(SUM(requests), 0) AS requests, COALESCE(SUM(failed_requests), 0) AS failed
+      FROM request_rollups WHERE key_id = ? AND hour_start >= ?
+    `).get(keyId, since);
+        const ledger = this._stmt(`
       SELECT COALESCE(-SUM(CASE WHEN kind = 'spend' THEN amount_usdc ELSE 0 END), 0) AS spent,
              COALESCE(SUM(CASE WHEN kind = 'credit' THEN amount_usdc ELSE 0 END), 0) AS credited,
              COALESCE(SUM(input_tokens), 0) AS input_tokens,
              COALESCE(SUM(cached_input_tokens), 0) AS cached_input_tokens,
              COALESCE(SUM(output_tokens), 0) AS output_tokens
       FROM ledger_entries WHERE key_id = ? AND created_at >= ?
+    `).get(keyId, since);
+        // As in the usage report, requests without metered tokens count the response's own.
+        const reported = this._stmt(`
+      SELECT COALESCE(SUM(r.usage_input_tokens), 0) AS input_tokens,
+             COALESCE(SUM(r.usage_cached_input_tokens), 0) AS cached_input_tokens,
+             COALESCE(SUM(r.usage_output_tokens), 0) AS output_tokens
+      FROM gateway_requests r
+      WHERE r.key_id = ? AND r.started_at >= ? AND ${REPORTED_TOKENS_ONLY_SQL}
     `).get(keyId, since);
         return {
-            requests: requests.requests,
-            failedRequests: requests.failed,
+            requests: requests.requests + rolled.requests,
+            failedRequests: requests.failed + rolled.failed,
             spentUsdc: ledger.spent,
             creditedUsdc: ledger.credited,
-            inputTokens: ledger.input_tokens,
-            cachedInputTokens: ledger.cached_input_tokens,
-            outputTokens: ledger.output_tokens,
+            inputTokens: ledger.input_tokens + reported.input_tokens,
+            cachedInputTokens: ledger.cached_input_tokens + reported.cached_input_tokens,
+            outputTokens: ledger.output_tokens + reported.output_tokens,
         };
     }
+    /**
+     * Lifetime requests and spend, plus spend since `since`, for many keys in
+     * one grouped query per table (rather than `usageStats` per key). Every
+     * id asked for gets an entry.
+     */
+    keyUsageSummaries(keyIds, since) {
+        const summaries = new Map(keyIds.map((id) => [id, { requests: 0, spentUsdc: 0, spentSinceUsdc: 0 }]));
+        if (keyIds.length === 0)
+            return summaries;
+        const ids = JSON.stringify(keyIds);
+        const requests = this._stmt(`
+      SELECT key_id, COUNT(*) AS requests FROM gateway_requests
+      WHERE key_id IN (SELECT value FROM json_each(?)) GROUP BY key_id
+    `).all(ids);
+        const rolled = this._stmt(`
+      SELECT key_id, SUM(requests) AS requests FROM request_rollups
+      WHERE key_id IN (SELECT value FROM json_each(?)) GROUP BY key_id
+    `).all(ids);
+        for (const row of [...requests, ...rolled]) {
+            const summary = summaries.get(row.key_id);
+            if (summary)
+                summary.requests += row.requests;
+        }
+        const spend = this._stmt(`
+      SELECT key_id, -SUM(amount_usdc) AS spent, -SUM(CASE WHEN created_at >= ? THEN amount_usdc ELSE 0 END) AS spent_since
+      FROM ledger_entries WHERE key_id IN (SELECT value FROM json_each(?)) AND kind = 'spend' GROUP BY key_id
+    `).all(since, ids);
+        for (const row of spend) {
+            const summary = summaries.get(row.key_id);
+            if (!summary)
+                continue;
+            summary.spentUsdc = row.spent;
+            summary.spentSinceUsdc = row.spent_since;
+        }
+        return summaries;
+    }
+    // ── Peer lists ──────────────────────────────────────────────────────────
+    listPeerLists() {
+        return this._stmt('SELECT * FROM peer_lists ORDER BY created_at, id').all().map(toPeerList);
+    }
+    getPeerList(id) {
+        const row = this._stmt('SELECT * FROM peer_lists WHERE id = ?').get(id);
+        return row ? toPeerList(row) : null;
+    }
+    createPeerList(input) {
+        const id = newId('pl');
+        this._stmt('INSERT INTO peer_lists (id, name, description, peer_ids, created_at) VALUES (?, ?, ?, ?, ?)')
+            .run(id, input.name, input.description, JSON.stringify(input.peerIds), this._now());
+        return this.getPeerList(id);
+    }
+    updatePeerList(id, patch) {
+        const current = this.getPeerList(id);
+        if (!current)
+            throw new Error(`Unknown peer list "${id}".`);
+        this._stmt('UPDATE peer_lists SET name = ?, description = ?, peer_ids = ? WHERE id = ?').run(patch.name ?? current.name, patch.description === undefined ? current.description : patch.description, JSON.stringify(patch.peerIds ?? current.peerIds), id);
+        return this.getPeerList(id);
+    }
+    deletePeerList(id) {
+        return this._stmt('DELETE FROM peer_lists WHERE id = ?').run(id).changes > 0;
+    }
+    // ── Presets ─────────────────────────────────────────────────────────────
+    listPresets() {
+        return this._stmt('SELECT * FROM presets ORDER BY created_at, id').all().map(toPreset);
+    }
+    getPreset(id) {
+        const row = this._stmt('SELECT * FROM presets WHERE id = ?').get(id);
+        return row ? toPreset(row) : null;
+    }
+    /**
+     * An org-wide preset wins over a workspace's own with the same slug, so a
+     * workspace admin cannot replace an org-mandated preset (and its system
+     * prompt) for their workspace.
+     */
+    findPresetBySlug(slug, workspaceId) {
+        const row = this._stmt(`
+      SELECT * FROM presets WHERE slug = ? AND (workspace_id IS NULL OR workspace_id = ?)
+      ORDER BY workspace_id IS NOT NULL LIMIT 1
+    `).get(slug, workspaceId);
+        return row ? toPreset(row) : null;
+    }
+    createPreset(input) {
+        const id = newId('pre');
+        this._stmt(`
+      INSERT INTO presets (id, slug, name, workspace_id, model, routing_policy, system_prompt, params, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.slug, input.name, input.workspaceId, input.model, policyJson(input.routingPolicy), input.systemPrompt, JSON.stringify(input.params ?? {}), this._now());
+        return this.getPreset(id);
+    }
+    updatePreset(id, patch) {
+        const current = this.getPreset(id);
+        if (!current)
+            throw new Error(`Unknown preset "${id}".`);
+        const next = { ...current, ...patch };
+        this._stmt(`
+      UPDATE presets SET slug = ?, name = ?, model = ?, routing_policy = ?, system_prompt = ?, params = ? WHERE id = ?
+    `).run(next.slug, next.name, next.model, policyJson(next.routingPolicy), next.systemPrompt, JSON.stringify(next.params ?? {}), id);
+        return this.getPreset(id);
+    }
+    deletePreset(id) {
+        return this._stmt('DELETE FROM presets WHERE id = ?').run(id).changes > 0;
+    }
+    // ── Management tokens ───────────────────────────────────────────────────
+    /**
+     * `createdBy` is the creating member's id (null from the CLI); the token
+     * stops working when that member is no longer an active admin or owner.
+     * `expiresAt` null never expires.
+     */
+    createAdminToken(input) {
+        const secret = `${ADMIN_TOKEN_PREFIX}${randomBytes(32).toString('base64url')}`;
+        const id = newId('tok');
+        this._stmt('INSERT INTO admin_tokens (id, label, token_hash, hint, scope, created_by, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+            .run(id, input.label, hashApiKey(secret), apiKeyHint(secret), input.scope, input.createdBy, input.expiresAt ?? null, this._now());
+        return { token: this.getAdminToken(id), secret };
+    }
+    getAdminToken(id) {
+        const row = this._stmt('SELECT * FROM admin_tokens WHERE id = ?').get(id);
+        return row ? toAdminToken(row) : null;
+    }
+    listAdminTokens() {
+        return this._stmt('SELECT * FROM admin_tokens WHERE revoked_at IS NULL ORDER BY created_at, id').all()
+            .map(toAdminToken);
+    }
+    /** Active token for a presented secret (hash lookup). */
+    findAdminTokenBySecret(secret) {
+        const row = this._stmt('SELECT * FROM admin_tokens WHERE token_hash = ? AND revoked_at IS NULL').get(hashApiKey(secret));
+        return row ? toAdminToken(row) : null;
+    }
+    /** Like `touchKey`: at most once a minute per token. */
+    touchAdminToken(id) {
+        const now = this._now();
+        if (!this._shouldTouch(`token:${id}`, now))
+            return;
+        this._stmt('UPDATE admin_tokens SET last_used_at = ? WHERE id = ?').run(now, id);
+    }
+    revokeAdminToken(id) {
+        return this._stmt('UPDATE admin_tokens SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL').run(this._now(), id).changes > 0;
+    }
+    /** Revokes every token a member created (when they are disabled or lose admin); returns their ids. */
+    revokeAdminTokensCreatedBy(memberId) {
+        const rows = this._stmt('SELECT id FROM admin_tokens WHERE created_by = ? AND revoked_at IS NULL').all(memberId);
+        const now = this._now();
+        const revoke = this._stmt('UPDATE admin_tokens SET revoked_at = ? WHERE id = ?');
+        this._db.transaction(() => { for (const row of rows)
+            revoke.run(now, row.id); })();
+        return rows.map((row) => row.id);
+    }
+    // ── Audit log ───────────────────────────────────────────────────────────
+    /**
+     * Appends one audit entry. Every mutating console action calls this:
+     *
+     *   deps.store.recordAudit({ actor, action, target, details, ip })
+     *
+     * `actor` comes from `auditActor(store, principal)` in console-api/access.ts
+     * (`{ kind: 'cli', id: null }` from CLI commands), `ip` from
+     * `clientIp(request)`. `details` must never contain secrets.
+     */
+    recordAudit(input) {
+        const id = newId('aud');
+        const at = this._now();
+        this._stmt(`
+      INSERT INTO audit_log (id, at, actor_kind, actor_id, actor_label, action, target_kind, target_id, target_label, details, ip)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, at, input.actor.kind, input.actor.id, input.actor.label ?? null, input.action, input.target?.kind ?? null, input.target?.id ?? null, input.target?.label ?? null, JSON.stringify(input.details ?? {}), input.ip ?? null);
+        return {
+            id,
+            at,
+            actor: { kind: input.actor.kind, id: input.actor.id, label: input.actor.label ?? null },
+            action: input.action,
+            target: input.target ? { kind: input.target.kind, id: input.target.id, label: input.target.label ?? null } : null,
+            details: input.details ?? {},
+            ip: input.ip ?? null,
+        };
+    }
+    /** Newest first. `before` is the opaque cursor returned as `nextBefore`. */
+    listAudit(filter = {}) {
+        const limit = Math.max(1, Math.min(500, Math.floor(filter.limit ?? 100)));
+        const where = [];
+        const params = [];
+        const before = filter.before ? Number.parseInt(filter.before, 10) : NaN;
+        if (Number.isFinite(before)) {
+            where.push('seq < ?');
+            params.push(before);
+        }
+        if (filter.actorId) {
+            where.push('actor_id = ?');
+            params.push(filter.actorId);
+        }
+        if (filter.action) {
+            // "key" matches "key" and "key.*"
+            where.push("(action = ? OR action LIKE ? ESCAPE '\\')");
+            params.push(filter.action, `${escapeLike(filter.action)}.%`);
+        }
+        const rows = this._stmt(`SELECT * FROM audit_log ${whereClause(where)} ORDER BY seq DESC LIMIT ?`)
+            .all(...params, limit + 1);
+        const page = rows.slice(0, limit);
+        return {
+            entries: page.map(toAudit),
+            nextBefore: rows.length > limit ? String(page[page.length - 1]['seq']) : null,
+        };
+    }
+    // ── Chat history ────────────────────────────────────────────────────────
+    /** A member's or a key's conversations in a workspace, newest first (without their messages). */
+    listChatThreads(owner, limit = 200) {
+        return this._stmt(`
+      SELECT id, workspace_id, owner_kind, owner_id, title, model, peer_id, created_at, updated_at FROM chat_threads
+      WHERE owner_kind = ? AND owner_id = ? AND workspace_id = ? ORDER BY updated_at DESC LIMIT ?
+    `).all(owner.kind, owner.id, owner.workspaceId, limit).map(chatThreadSummary);
+    }
+    getChatThread(id) {
+        const row = this._stmt('SELECT * FROM chat_threads WHERE id = ?').get(id);
+        return row ? { ...chatThreadSummary(row), messages: parseJson(row.messages, []) } : null;
+    }
+    /** Creates or replaces a conversation; the owner and creation time of an existing one never change. */
+    saveChatThread(input) {
+        const now = this._now();
+        this._stmt(`
+      INSERT INTO chat_threads (id, workspace_id, owner_kind, owner_id, title, model, peer_id, messages, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (id) DO UPDATE SET title = excluded.title, model = excluded.model, peer_id = excluded.peer_id, messages = excluded.messages, updated_at = excluded.updated_at
+    `).run(input.id, input.owner.workspaceId, input.owner.kind, input.owner.id, input.title, input.model, input.peerId, JSON.stringify(input.messages), now, now);
+    }
+    deleteChatThread(id) {
+        return this._stmt('DELETE FROM chat_threads WHERE id = ?').run(id).changes > 0;
+    }
+    // ── Settings ────────────────────────────────────────────────────────────
+    /**
+     * Settings are read on every request, so values are cached for a few
+     * seconds. A write through this store clears its cache at once; a write by
+     * another process (a CLI command) is seen within `SETTINGS_TTL_MS`.
+     */
+    getSetting(key) {
+        const now = Date.now();
+        let cached = this._settings.get(key);
+        if (!cached || now - cached.at >= SETTINGS_TTL_MS || now < cached.at) {
+            const row = this._stmt('SELECT value FROM settings WHERE key = ?').get(key);
+            cached = { raw: row?.value ?? null, at: now };
+            this._settings.set(key, cached);
+        }
+        // Parsed per call so callers never share (and mutate) one object.
+        return cached.raw === null ? null : parseJson(cached.raw, null);
+    }
+    setSetting(key, value) {
+        this._settings.delete(key);
+        if (value === null || value === undefined) {
+            this._stmt('DELETE FROM settings WHERE key = ?').run(key);
+            return;
+        }
+        this._stmt('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value')
+            .run(key, JSON.stringify(value));
+    }
+}
+const REQUEST_COLUMNS = {
+    key: 'r.key_id', workspace: 'r.workspace_id', member: 'r.member_id', model: 'r.model', peer: 'r.seller_peer_id', user: 'r.end_user', time: 'r.started_at',
+};
+const LEDGER_COLUMNS = {
+    key: 'l.key_id', workspace: 'l.workspace_id', member: 'l.member_id', model: 'l.model', peer: 'l.seller_peer_id', user: 'l.end_user', time: 'l.created_at',
+};
+const ROLLUP_COLUMNS = {
+    key: 'u.key_id', workspace: 'u.workspace_id', member: 'u.member_id', model: 'u.model', peer: 'u.seller_peer_id', user: 'u.end_user', time: 'u.hour_start',
+};
+const HOUR_MS = 60 * 60 * 1000;
+const TOUCH_INTERVAL_MS = 60 * 1000;
+const MAX_TRACKED_TOUCHES = 10_000;
+const SETTINGS_TTL_MS = 5_000;
+const MAX_CACHED_STATEMENTS = 500;
+const MAX_ERROR_CODE = 100;
+const MAX_ERROR_MESSAGE = 500;
+/** A failed request: finished with an error status. One still in flight is not a failure. */
+const FAILED_SQL = '(r.finished_at IS NOT NULL AND (r.status IS NULL OR r.status >= 400))';
+/**
+ * A request whose tokens come only from its response: its spend recorded no
+ * token counts (free sellers record none), so the response's own count is used.
+ */
+const REPORTED_TOKENS_ONLY_SQL = `(r.usage_input_tokens IS NOT NULL AND NOT EXISTS (
+  SELECT 1 FROM ledger_entries t WHERE t.request_tag = r.tag AND t.kind = 'spend' AND t.input_tokens + t.cached_input_tokens + t.output_tokens > 0
+))`;
+/** WHERE clauses shared by request-log, rollup and ledger queries. */
+function scopeSql(filter, columns) {
+    const where = [];
+    const params = [];
+    if (filter.keyIds) {
+        where.push(`${columns.key} IN (SELECT value FROM json_each(?))`);
+        params.push(JSON.stringify(filter.keyIds));
+    }
+    if (filter.keyId) {
+        where.push(`${columns.key} = ?`);
+        params.push(filter.keyId);
+    }
+    if (filter.workspaceId) {
+        where.push(`${columns.workspace} = ?`);
+        params.push(filter.workspaceId);
+    }
+    if (filter.memberId) {
+        where.push(`${columns.member} = ?`);
+        params.push(filter.memberId);
+    }
+    if (filter.model) {
+        where.push(`${columns.model} = ?`);
+        params.push(filter.model);
+    }
+    if (filter.from != null) {
+        where.push(`${columns.time} >= ?`);
+        params.push(filter.from);
+    }
+    if (filter.to != null) {
+        where.push(`${columns.time} < ?`);
+        params.push(filter.to);
+    }
+    return { where, params };
+}
+function whereClause(where) {
+    return where.length > 0 ? `WHERE ${where.join(' AND ')}` : '';
+}
+/** Escapes LIKE wildcards; the queries declare backslash as the escape character. */
+function escapeLike(value) {
+    return value.replace(/[\\%_]/g, (c) => `\\${c}`);
+}
+/** The SQL a usage report groups by; one group ('all') without a grouping. */
+function groupExpression(groupBy, columns) {
+    if (!groupBy)
+        return "'all'";
+    if (groupBy === 'day')
+        return `strftime('%Y-%m-%d', ${columns.time} / 1000, 'unixepoch')`;
+    if (groupBy === 'hour')
+        return `strftime('%Y-%m-%dT%H', ${columns.time} / 1000, 'unixepoch')`;
+    return columns[groupBy];
+}
+/** Groupings whose groups are UTC time buckets (listed oldest first). */
+export function isTimeGrouping(groupBy) {
+    return groupBy === 'day' || groupBy === 'hour';
+}
+/** Groups by end user past the largest `MAX_USER_GROUPS` (rows come sorted largest first), folded into one. */
+function capUserGroups(groupBy, rows) {
+    if (groupBy !== 'user' || rows.length <= MAX_USER_GROUPS)
+        return rows;
+    const rest = rows.slice(MAX_USER_GROUPS);
+    const other = { group: OTHER_USERS_GROUP, others: rest.length, ...emptyUsageTotals() };
+    for (const row of rest) {
+        for (const field of Object.keys(emptyUsageTotals()))
+            other[field] += row[field];
+    }
+    return [...rows.slice(0, MAX_USER_GROUPS), other];
+}
+function emptyUsageTotals() {
+    return { requests: 0, failedRequests: 0, spentUsdc: 0, inputTokens: 0, cachedInputTokens: 0, outputTokens: 0 };
+}
+/** The `spend_totals` / `spend_daily` row key of a budget scope. */
+function budgetScopeRow(scope) {
+    if ('keyId' in scope)
+        return { kind: 'key', id: scope.keyId };
+    if ('memberId' in scope)
+        return { kind: 'member', id: scope.memberId };
+    return { kind: 'workspace', id: scope.workspaceId };
 }
 function toKey(row) {
     return {
@@ -236,13 +1270,14 @@ function toKey(row) {
         label: row.label,
         hint: row.key_hint,
         buyerIdentity: row.buyer_identity,
+        workspaceId: row.workspace_id ?? DEFAULT_WORKSPACE_ID,
+        ownerMemberId: row.owner_member_id,
         source: row.source,
         status: row.status,
-        limits: {
-            daily: row.daily_limit_usdc,
-            monthly: row.monthly_limit_usdc,
-            total: row.total_limit_usdc,
-        },
+        limits: rowLimits(row),
+        routingPolicy: parsePolicy(row.routing_policy),
+        ownerLimits: rowLimits(row, 'owner_'),
+        ownerRoutingPolicy: parsePolicy(row.owner_routing_policy),
         topupEnabled: row.topup_enabled === 1,
         expiresAt: row.expires_at,
         createdAt: row.created_at,
@@ -250,4 +1285,91 @@ function toKey(row) {
         lastUsedAt: row.last_used_at,
     };
 }
+function toWorkspace(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        buyerIdentity: row.buyer_identity,
+        isDefault: row.is_default === 1,
+        walletAddress: row.wallet_address,
+        limits: rowLimits(row),
+        routingPolicy: parsePolicy(row.routing_policy),
+        orgRoutingPolicy: parsePolicy(row.org_routing_policy),
+        createdAt: row.created_at,
+    };
+}
+function toMember(row) {
+    return {
+        id: row.id,
+        label: row.label,
+        email: row.email,
+        orgRole: row.org_role,
+        status: row.status,
+        limits: rowLimits(row),
+        routingPolicy: parsePolicy(row.routing_policy),
+        maxKeys: row.max_keys,
+        createdAt: row.created_at,
+    };
+}
+function toInvite(row) {
+    return {
+        id: row.id,
+        memberId: row.member_id,
+        label: row.label,
+        email: row.email,
+        orgRole: row.org_role,
+        workspaces: parseJson(row.workspace_roles, []),
+        createdBy: row.created_by,
+        expiresAt: row.expires_at,
+        usedAt: row.used_at,
+        createdAt: row.created_at,
+    };
+}
+function toPeerList(row) {
+    return {
+        id: row['id'],
+        name: row['name'],
+        description: row['description'],
+        peerIds: parseJson(row['peer_ids'], []),
+        createdAt: row['created_at'],
+    };
+}
+function toPreset(row) {
+    return {
+        id: row['id'],
+        slug: row['slug'],
+        name: row['name'],
+        workspaceId: row['workspace_id'],
+        model: row['model'],
+        routingPolicy: parsePolicy(row['routing_policy']),
+        systemPrompt: row['system_prompt'],
+        params: parseJson(row['params'], {}),
+        createdAt: row['created_at'],
+    };
+}
+function toAdminToken(row) {
+    return {
+        id: row['id'],
+        label: row['label'],
+        hint: row['hint'],
+        scope: row['scope'],
+        createdBy: row['created_by'],
+        expiresAt: row['expires_at'] ?? null,
+        createdAt: row['created_at'],
+        lastUsedAt: row['last_used_at'],
+        revokedAt: row['revoked_at'],
+    };
+}
+function toAudit(row) {
+    const targetKind = row['target_kind'];
+    return {
+        id: row['id'],
+        at: row['at'],
+        actor: { kind: row['actor_kind'], id: row['actor_id'], label: row['actor_label'] },
+        action: row['action'],
+        target: targetKind ? { kind: targetKind, id: row['target_id'], label: row['target_label'] } : null,
+        details: parseJson(row['details'], {}),
+        ip: row['ip'],
+    };
+}
 //# sourceMappingURL=store.js.map