@robhowley/pi-openrouter 0.10.0 → 0.11.0

package/extensions/openrouter/__tests__/api-key-commands.test.ts

@@ -0,0 +1,231 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  createApiKey: vi.fn(),
+  setApiKeyDisabled: vi.fn(),
+}));
+
+vi.mock('../account-client.js', () => ({
+  createApiKey: mocks.createApiKey,
+  setApiKeyDisabled: mocks.setApiKeyDisabled,
+}));
+
+import {
+  handleApiKeyCreate,
+  handleApiKeyDisable,
+  handleApiKeyEnable,
+  isUtcIsoTimestamp,
+  parseApiKeyCreateArgs,
+} from '../api-key-commands.js';
+
+describe('api-key-commands', () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+    mocks.createApiKey.mockResolvedValue({
+      key: 'sk-or-v1-secret',
+      keyState: {
+        name: 'Team Key',
+        hash: 'hash-123',
+        disabled: false,
+      },
+    });
+    mocks.setApiKeyDisabled.mockImplementation(async (hash: string, disabled: boolean) => ({
+      name: disabled ? 'Disabled Key' : 'Enabled Key',
+      hash,
+      disabled,
+    }));
+  });
+
+  describe('isUtcIsoTimestamp', () => {
+    it('accepts canonical UTC ISO timestamps with or without milliseconds', () => {
+      expect(isUtcIsoTimestamp('2026-06-01T00:00:00Z')).toBe(true);
+      expect(isUtcIsoTimestamp('2026-06-01T00:00:00.000Z')).toBe(true);
+    });
+
+    it('rejects non-UTC or malformed timestamps', () => {
+      expect(isUtcIsoTimestamp('2026-06-01T00:00:00+00:00')).toBe(false);
+      expect(isUtcIsoTimestamp('2026-06-01')).toBe(false);
+      expect(isUtcIsoTimestamp('wat')).toBe(false);
+    });
+  });
+
+  describe('parseApiKeyCreateArgs', () => {
+    it('parses create args and maps none/incl fields to SDK-friendly values', () => {
+      const parsed = parseApiKeyCreateArgs(
+        'team limit=none reset=weekly byok=incl workspace=ws-1 expires=2026-06-01T00:00:00Z',
+      );
+
+      expect(parsed).toEqual({
+        ok: true,
+        value: {
+          name: 'team',
+          limit: null,
+          limitReset: 'weekly',
+          includeByokInLimit: true,
+          workspaceId: 'ws-1',
+          expiresAt: new Date('2026-06-01T00:00:00Z'),
+        },
+      });
+    });
+
+    it('supports quoted key names with spaces', () => {
+      const parsed = parseApiKeyCreateArgs('"Team Key" limit=10');
+
+      expect(parsed).toEqual({
+        ok: true,
+        value: {
+          name: 'Team Key',
+          limit: 10,
+        },
+      });
+    });
+
+    it('rejects option-like first tokens because name is required', () => {
+      const parsed = parseApiKeyCreateArgs('limit=25 reset=weekly');
+
+      expect(parsed).toEqual({
+        ok: false,
+        message:
+          'Usage: /openrouter api-key-create <name> [limit=<usd|none>] [reset=<daily|weekly|monthly|none>] [byok=<incl|excl>] [workspace=<id>] [expires=<UTC ISO>]',
+      });
+    });
+
+    it('rejects invalid numeric limits', () => {
+      const parsed = parseApiKeyCreateArgs('team limit=abc');
+
+      expect(parsed).toEqual({
+        ok: false,
+        message: 'Invalid limit value: "abc"\nExpected a non-negative USD amount or \'none\'.',
+      });
+    });
+
+    it('rejects invalid reset values', () => {
+      const parsed = parseApiKeyCreateArgs('team reset=hourly');
+
+      expect(parsed).toEqual({
+        ok: false,
+        message: 'Invalid reset value: "hourly"\nAllowed values: daily, weekly, monthly, none.',
+      });
+    });
+
+    it('rejects invalid byok values', () => {
+      const parsed = parseApiKeyCreateArgs('team byok=maybe');
+
+      expect(parsed).toEqual({
+        ok: false,
+        message: 'Invalid byok value: "maybe"\nAllowed values: incl, excl.',
+      });
+    });
+
+    it('rejects non-UTC expiry values', () => {
+      const parsed = parseApiKeyCreateArgs('team expires=2026-06-01T00:00:00+00:00');
+
+      expect(parsed).toEqual({
+        ok: false,
+        message:
+          'Invalid expires value: "2026-06-01T00:00:00+00:00"\nExpected an ISO 8601 UTC timestamp ending in Z, for example 2026-06-01T00:00:00Z.',
+      });
+    });
+  });
+
+  describe('handleApiKeyCreate', () => {
+    it('calls createApiKey with parsed args and returns the secret out-of-band exactly once', async () => {
+      const result = await handleApiKeyCreate(
+        'team limit=25.5 reset=none byok=excl workspace=ws-9 expires=2026-06-01T00:00:00Z',
+      );
+
+      expect(mocks.createApiKey).toHaveBeenCalledWith({
+        name: 'team',
+        limit: 25.5,
+        limitReset: null,
+        includeByokInLimit: false,
+        workspaceId: 'ws-9',
+        expiresAt: new Date('2026-06-01T00:00:00Z'),
+      });
+      expect(result.success).toBe(true);
+      expect(result.message).toContain('OpenRouter API key created');
+      expect(result.message).toContain('Use /openrouter account to inspect or toggle the key.');
+      expect(result.message).toContain('Secret shown in secure overlay; store it now.');
+      expect(result.message).toContain('Warning: This secret cannot be recovered');
+      expect(result.message).not.toContain('sk-or-v1-secret');
+      expect(result.message).not.toContain('hash-123');
+      expect(result.secret).toBe('sk-or-v1-secret');
+    });
+
+    it('returns validation failures before calling account-client helpers', async () => {
+      const result = await handleApiKeyCreate('team limit=-1');
+
+      expect(mocks.createApiKey).not.toHaveBeenCalled();
+      expect(result).toEqual({
+        success: false,
+        message: 'Invalid limit value: "-1"\nExpected a non-negative USD amount or \'none\'.',
+      });
+    });
+
+    it('surfaces helper errors as failure messages', async () => {
+      mocks.createApiKey.mockRejectedValue(
+        new Error('Management key required to create API keys.'),
+      );
+
+      const result = await handleApiKeyCreate('team');
+
+      expect(result).toEqual({
+        success: false,
+        message: 'Management key required to create API keys.',
+      });
+    });
+  });
+
+  describe('handleApiKeyDisable / handleApiKeyEnable', () => {
+    it('disables a key by hash without echoing the hash in the success message', async () => {
+      const result = await handleApiKeyDisable('hash-disable');
+
+      expect(mocks.setApiKeyDisabled).toHaveBeenCalledWith('hash-disable', true);
+      expect(result).toEqual({
+        success: true,
+        message:
+          'OpenRouter API key disabled\nName: Disabled Key\nStatus: disabled\nRun /openrouter account to verify.',
+      });
+    });
+
+    it('enables a key by hash without echoing the hash in the success message', async () => {
+      const result = await handleApiKeyEnable('hash-enable');
+
+      expect(mocks.setApiKeyDisabled).toHaveBeenCalledWith('hash-enable', false);
+      expect(result).toEqual({
+        success: true,
+        message:
+          'OpenRouter API key enabled\nName: Enabled Key\nStatus: enabled\nRun /openrouter account to verify.',
+      });
+    });
+
+    it('sanitizes helper errors that might include hashes', async () => {
+      mocks.setApiKeyDisabled.mockRejectedValue(new Error('OpenRouter rejected hash-disable'));
+
+      const result = await handleApiKeyDisable('hash-disable');
+
+      expect(result).toEqual({
+        success: false,
+        message:
+          'Failed to disable OpenRouter API key. Check the key identifier and management-key permissions.',
+      });
+      expect(result.message).not.toContain('hash-disable');
+      expect(result.message).not.toContain('rejected');
+    });
+
+    it('requires exactly one hash argument', async () => {
+      const result = await handleApiKeyDisable('');
+      const resultWithExtra = await handleApiKeyEnable('hash extra');
+
+      expect(mocks.setApiKeyDisabled).not.toHaveBeenCalled();
+      expect(result).toEqual({
+        success: false,
+        message: 'Usage: /openrouter api-key-disable <hash>',
+      });
+      expect(resultWithExtra).toEqual({
+        success: false,
+        message: 'Usage: /openrouter api-key-enable <hash>',
+      });
+    });
+  });
+});

package/extensions/openrouter/__tests__/commands.test.ts

@@ -37,8 +37,15 @@ const { mocks, overlayConstructorCalls, MockUsageOverlayComponent } = vi.hoisted
       getCurrentSessionId: vi.fn(),
       getAllKeys: vi.fn(),
       getCurrentKey: vi.fn(),
+      resolveCurrentKeyRelation: vi.fn(),
       getAccountCredits: vi.fn(),
       computeRollupStatus: vi.fn(),
+      formatCurrency: vi.fn((amount: number) => `$${amount.toFixed(2)}`),
+      formatRemaining: vi.fn((used: number, limit?: number) =>
+        limit === undefined
+          ? `$${used.toFixed(2)} / unlimited`
+          : `$${used.toFixed(2)} / $${limit.toFixed(2)}`,
+      ),
       sortKeys: vi.fn(),
       syncModels: vi.fn(),
       getSyncState: vi.fn(),
@@ -52,6 +59,9 @@ const { mocks, overlayConstructorCalls, MockUsageOverlayComponent } = vi.hoisted
       handleModelOverrideSet: vi.fn(),
       handleModelOverrideClear: vi.fn(),
       handleModelOverrideList: vi.fn(),
+      handleApiKeyCreate: vi.fn(),
+      handleApiKeyDisable: vi.fn(),
+      handleApiKeyEnable: vi.fn(),
     },
   };
 });
@@ -83,11 +93,14 @@ vi.mock('../hooks.js', () => ({
 vi.mock('../account-client.js', () => ({
   getAllKeys: mocks.getAllKeys,
   getCurrentKey: mocks.getCurrentKey,
+  resolveCurrentKeyRelation: mocks.resolveCurrentKeyRelation,
   getAccountCredits: mocks.getAccountCredits,
 }));
 
 vi.mock('../account-format.js', () => ({
   computeRollupStatus: mocks.computeRollupStatus,
+  formatCurrency: mocks.formatCurrency,
+  formatRemaining: mocks.formatRemaining,
   sortKeys: mocks.sortKeys,
 }));
 
@@ -115,6 +128,12 @@ vi.mock('../models/override-commands.js', () => ({
   handleModelOverrideList: mocks.handleModelOverrideList,
 }));
 
+vi.mock('../api-key-commands.js', () => ({
+  handleApiKeyCreate: mocks.handleApiKeyCreate,
+  handleApiKeyDisable: mocks.handleApiKeyDisable,
+  handleApiKeyEnable: mocks.handleApiKeyEnable,
+}));
+
 vi.mock('../overlay.js', () => ({
   UsageOverlayComponent: MockUsageOverlayComponent,
 }));
@@ -180,6 +199,17 @@ const keyInfo = {
   spend: 10,
 } as const;
 
+function createKeyInventory(
+  keys: any[] = [keyInfo],
+  options: { canManageKeys?: boolean; degradedReason?: string } = {},
+) {
+  return {
+    keys,
+    canManageKeys: options.canManageKeys ?? true,
+    ...(options.degradedReason ? { degradedReason: options.degradedReason } : {}),
+  };
+}
+
 describe('registerOpenRouterCommands', () => {
   beforeEach(() => {
     vi.resetAllMocks();
@@ -195,8 +225,13 @@ describe('registerOpenRouterCommands', () => {
         message.includes('429') || message.includes('rate limit') || message.includes('rate-limit')
       );
     });
-    mocks.getAllKeys.mockResolvedValue([keyInfo]);
+    mocks.getAllKeys.mockResolvedValue(createKeyInventory());
     mocks.getCurrentKey.mockResolvedValue(keyInfo);
+    mocks.resolveCurrentKeyRelation.mockResolvedValue({
+      kind: 'inventory-match',
+      hash: keyInfo.hash,
+      label: keyInfo.label,
+    });
     mocks.getAccountCredits.mockResolvedValue(25);
     mocks.computeRollupStatus.mockReturnValue({ status: 'healthy', message: 'healthy' });
     mocks.sortKeys.mockImplementation((keys) => keys);
@@ -215,6 +250,13 @@ describe('registerOpenRouterCommands', () => {
       message: 'override cleared',
     });
     mocks.handleModelOverrideList.mockResolvedValue('override list');
+    mocks.handleApiKeyCreate.mockResolvedValue({
+      success: true,
+      message: 'api key created\nSecret shown in secure overlay; store it now.',
+      secret: 'sk-or-v1-created-secret',
+    });
+    mocks.handleApiKeyDisable.mockResolvedValue({ success: true, message: 'api key disabled' });
+    mocks.handleApiKeyEnable.mockResolvedValue({ success: true, message: 'api key enabled' });
   });
 
   it('registers the expected command names and descriptions', () => {
@@ -238,11 +280,11 @@ describe('registerOpenRouterCommands', () => {
       'Show OpenRouter account and key health',
     );
     expect(commands.get('openrouter')?.description).toBe(
-      'OpenRouter commands: usage, account, session, models-sync, models-status',
+      `OpenRouter commands: ${OPENROUTER_SUBCOMMANDS.join(', ')}`,
     );
   });
 
-  it('keeps /openrouter subcommand completions unchanged', () => {
+  it('hides hash toggle subcommands from public /openrouter completions', () => {
     const { commands, pi } = createMockPi();
 
     registerOpenRouterCommands(pi as any);
@@ -253,6 +295,9 @@ describe('registerOpenRouterCommands', () => {
       { value: 'model-override-clear', label: 'model-override-clear' },
       { value: 'model-override-list', label: 'model-override-list' },
     ]);
+    expect(command.getArgumentCompletions('api-key-')).toEqual([
+      { value: 'api-key-create', label: 'api-key-create' },
+    ]);
     expect(command.getArgumentCompletions('zzz')).toBeNull();
     expect(OPENROUTER_SUBCOMMANDS).toEqual([
       'usage',
@@ -263,6 +308,7 @@ describe('registerOpenRouterCommands', () => {
       'model-override-set',
       'model-override-clear',
       'model-override-list',
+      'api-key-create',
     ]);
   });
 
@@ -288,8 +334,129 @@ describe('registerOpenRouterCommands', () => {
     await commands.get('openrouter').handler('account', ctx);
 
     expect(mocks.getAllKeys).toHaveBeenCalledTimes(1);
+    expect(mocks.resolveCurrentKeyRelation).toHaveBeenCalledWith([keyInfo]);
+    expect(mocks.getCurrentKey).not.toHaveBeenCalled();
+    expect(mocks.getAccountCredits).toHaveBeenCalledTimes(1);
+    expect(ctx.ui.custom).toHaveBeenCalledTimes(1);
+  });
+
+  it('passes an inventory-match relation into the overlay disable guard', async () => {
+    const { commands, pi } = createMockPi();
+    const ctx = createMockContext();
+
+    const activeKey = {
+      ...keyInfo,
+      name: 'default-space-key',
+      label: 'sk-or-v1-8ef...062',
+      hash: 'hash-default-space',
+      workspaceName: 'Default',
+    };
+    mocks.getAllKeys.mockResolvedValue(createKeyInventory([activeKey]));
+    mocks.resolveCurrentKeyRelation.mockResolvedValue({
+      kind: 'inventory-match',
+      hash: 'hash-default-space',
+      label: 'sk-or-v1-8ef...062',
+    });
+
+    registerOpenRouterCommands(pi as any);
+    await commands.get('openrouter').handler('account', ctx);
+
+    const overlayFactory = ctx.ui.custom.mock.calls[0]![0];
+    const overlay = overlayFactory(
+      { requestRender: vi.fn() },
+      { bold: (text: string) => text, fg: (_style: string, text: string) => text },
+      {},
+      vi.fn(),
+    );
+
+    expect(overlay.render(120).join('\n')).toContain(
+      'readonly  Cannot disable the active management key.',
+    );
+
+    overlay.dispose();
+  });
+
+  it('allows disabling inventory rows when current auth is an external provisioning key', async () => {
+    const { commands, pi } = createMockPi();
+    const ctx = createMockContext();
+
+    const inventoryKey = {
+      ...keyInfo,
+      name: 'default-space-key',
+      label: 'sk-or-v1-8ef...062',
+      hash: 'hash-default-space',
+      workspaceName: 'Default',
+    };
+    mocks.getAllKeys.mockResolvedValue(createKeyInventory([inventoryKey]));
+    mocks.resolveCurrentKeyRelation.mockResolvedValue({
+      kind: 'external-provisioning',
+      label: 'sk-or-v1-4a0...459',
+    });
+
+    registerOpenRouterCommands(pi as any);
+    await commands.get('openrouter').handler('account', ctx);
+
+    const overlayFactory = ctx.ui.custom.mock.calls[0]![0];
+    const overlay = overlayFactory(
+      { requestRender: vi.fn() },
+      { bold: (text: string) => text, fg: (_style: string, text: string) => text },
+      {},
+      vi.fn(),
+    );
+
+    expect(overlay.render(120).join('\n')).toContain('t disable');
+    expect(overlay.render(120).join('\n')).not.toContain(
+      'readonly  Cannot verify current key matches this row.',
+    );
+
+    overlay.dispose();
+  });
+
+  it('keeps empty key inventory distinct from management-capability fallback in the command flow', async () => {
+    const { commands, pi } = createMockPi();
+    const ctx = createMockContext();
+
+    mocks.getAllKeys.mockResolvedValue(createKeyInventory([], { canManageKeys: true }));
+
+    registerOpenRouterCommands(pi as any);
+    await commands.get('openrouter').handler('account', ctx);
+
+    expect(mocks.getCurrentKey).not.toHaveBeenCalled();
     expect(mocks.getAccountCredits).toHaveBeenCalledTimes(1);
+  });
+
+  it('routes /openrouter account through the readonly fallback when management inventory is unavailable', async () => {
+    const { commands, pi } = createMockPi();
+    const ctx = createMockContext();
+
+    mocks.getAllKeys.mockResolvedValue(
+      createKeyInventory([], {
+        canManageKeys: false,
+        degradedReason: 'management-unavailable',
+      }),
+    );
+    mocks.getCurrentKey.mockResolvedValue({ ...keyInfo, hash: undefined } as any);
+
+    registerOpenRouterCommands(pi as any);
+    await commands.get('openrouter').handler('account', ctx);
+
+    expect(mocks.getCurrentKey).toHaveBeenCalled();
     expect(ctx.ui.custom).toHaveBeenCalledTimes(1);
+
+    const overlayFactory = ctx.ui.custom.mock.calls[0]![0];
+    const overlay = overlayFactory(
+      { requestRender: vi.fn() },
+      { bold: (text: string) => text, fg: (_style: string, text: string) => text },
+      {},
+      vi.fn(),
+    );
+
+    expect(overlay.render(120).join('\n')).toContain(
+      'readonly  Set OPENROUTER_MANAGEMENT_KEY to toggle keys.',
+    );
+    expect(overlay.render(120).join('\n')).not.toContain('·  t ');
+
+    overlay.dispose();
   });
 
   it('routes /openrouter session to the current session notifier', async () => {
@@ -420,6 +587,61 @@ describe('registerOpenRouterCommands', () => {
     expect(ctx.ui.notify).toHaveBeenCalledWith('override list', 'info');
   });
 
+  it('routes api-key-create through the dedicated handler, secure overlay, and redacted notifier', async () => {
+    const { commands, pi } = createMockPi();
+    const ctx = createMockContext();
+
+    registerOpenRouterCommands(pi as any);
+    await commands
+      .get('openrouter')
+      .handler('api-key-create team limit=25 reset=monthly byok=incl', ctx);
+
+    expect(mocks.handleApiKeyCreate).toHaveBeenCalledWith('team limit=25 reset=monthly byok=incl');
+    expect(ctx.ui.custom).toHaveBeenCalledTimes(1);
+    expect(ctx.ui.notify).toHaveBeenCalledWith(
+      'api key created\nSecret shown in secure overlay; store it now.',
+      'info',
+    );
+    expect(ctx.ui.notify).not.toHaveBeenCalledWith(
+      expect.stringContaining('sk-or-v1-created-secret'),
+      expect.anything(),
+    );
+
+    const overlayFactory = ctx.ui.custom.mock.calls[0]![0];
+    const overlay = overlayFactory(
+      { requestRender: vi.fn() },
+      { bold: (text: string) => text, fg: (_style: string, text: string) => text },
+      {},
+      vi.fn(),
+    );
+    const rendered = overlay.render(160).join('\n');
+    expect(rendered.split('sk-or-v1-created-secret')).toHaveLength(2);
+  });
+
+  it('keeps hidden api-key-disable routing through the error notifier', async () => {
+    const { commands, pi } = createMockPi();
+    const ctx = createMockContext();
+
+    mocks.handleApiKeyDisable.mockResolvedValue({ success: false, message: 'disable failed' });
+
+    registerOpenRouterCommands(pi as any);
+    await commands.get('openrouter').handler('api-key-disable hash-123', ctx);
+
+    expect(mocks.handleApiKeyDisable).toHaveBeenCalledWith('hash-123');
+    expect(ctx.ui.notify).toHaveBeenCalledWith('disable failed', 'error');
+  });
+
+  it('keeps hidden api-key-enable routing through the info notifier', async () => {
+    const { commands, pi } = createMockPi();
+    const ctx = createMockContext();
+
+    registerOpenRouterCommands(pi as any);
+    await commands.get('openrouter').handler('api-key-enable hash-123', ctx);
+
+    expect(mocks.handleApiKeyEnable).toHaveBeenCalledWith('hash-123');
+    expect(ctx.ui.notify).toHaveBeenCalledWith('api key enabled', 'info');
+  });
+
   it('keeps unknown-subcommand messaging unchanged', async () => {
     const { commands, pi } = createMockPi();
     const ctx = createMockContext();

package/extensions/openrouter/__tests__/normalizers.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, it } from 'vitest';
 import type { Model as SDKModel } from '@openrouter/sdk/models/index.js';
-import type { GetCurrentKeyData, ListData } from '@openrouter/sdk/models/operations/index.js';
+import type {
+  CreateKeysData,
+  GetCurrentKeyData,
+  ListData,
+  UpdateKeysData,
+} from '@openrouter/sdk/models/operations/index.js';
 import {
   normalizeOpenRouterModel,
   normalizeSdkKeyMetadata,
@@ -89,6 +94,58 @@ function createListKeyData(overrides: Partial<ListData> = {}): ListData {
   };
 }
 
+function createCreateKeysData(overrides: Partial<CreateKeysData> = {}): CreateKeysData {
+  return {
+    byokUsage: 0,
+    byokUsageDaily: 0,
+    byokUsageMonthly: 0,
+    byokUsageWeekly: 0,
+    createdAt: '2026-05-22T00:00:00.000Z',
+    creatorUserId: null,
+    disabled: false,
+    hash: 'hash-create',
+    includeByokInLimit: true,
+    label: 'sk-or-v1-create',
+    limit: 100,
+    limitRemaining: 40,
+    limitReset: 'weekly',
+    name: 'Created Key',
+    updatedAt: null,
+    usage: 60,
+    usageDaily: 0,
+    usageMonthly: 0,
+    usageWeekly: 0,
+    workspaceId: 'ws-create',
+    ...overrides,
+  };
+}
+
+function createUpdateKeysData(overrides: Partial<UpdateKeysData> = {}): UpdateKeysData {
+  return {
+    byokUsage: 0,
+    byokUsageDaily: 0,
+    byokUsageMonthly: 0,
+    byokUsageWeekly: 0,
+    createdAt: '2026-05-22T00:00:00.000Z',
+    creatorUserId: null,
+    disabled: false,
+    hash: 'hash-update',
+    includeByokInLimit: false,
+    label: 'sk-or-v1-update',
+    limit: 100,
+    limitRemaining: 40,
+    limitReset: null,
+    name: 'Updated Key',
+    updatedAt: null,
+    usage: 60,
+    usageDaily: 0,
+    usageMonthly: 0,
+    usageWeekly: 0,
+    workspaceId: 'ws-update',
+    ...overrides,
+  };
+}
+
 describe('sdkModelToOpenRouterModel', () => {
   it('normalizes SDK camelCase fields into canonical snake_case model shape', () => {
     const normalized = sdkModelToOpenRouterModel(
@@ -237,9 +294,9 @@ describe('normalizeSdkKeyMetadata', () => {
       remaining: 0,
       byok: 'excl',
       resetCadence: 'daily',
-      hash: 'unknown',
       disabled: false,
     });
+    expect(normalized).not.toHaveProperty('hash');
     expect('limit' in normalized).toBe(true);
     expect('remaining' in normalized).toBe(true);
   });
@@ -258,9 +315,9 @@ describe('normalizeSdkKeyMetadata', () => {
       name: 'sk-or-v1-current',
       byok: '?',
       resetCadence: 'partial',
-      hash: 'unknown',
       disabled: false,
     });
+    expect(normalized).not.toHaveProperty('hash');
     expect(normalized).not.toHaveProperty('limit');
     expect(normalized).not.toHaveProperty('remaining');
   });
@@ -285,4 +342,30 @@ describe('normalizeSdkKeyMetadata', () => {
       remaining: 40,
     });
   });
+
+  it('normalizes create responses with weekly resets', () => {
+    const normalized = normalizeSdkKeyMetadata(createCreateKeysData());
+
+    expect(normalized).toMatchObject({
+      name: 'Created Key',
+      label: 'sk-or-v1-create',
+      byok: 'incl',
+      resetCadence: 'weekly',
+      hash: 'hash-create',
+      disabled: false,
+    });
+  });
+
+  it('treats null limitReset in update responses as never', () => {
+    const normalized = normalizeSdkKeyMetadata(createUpdateKeysData());
+
+    expect(normalized).toMatchObject({
+      name: 'Updated Key',
+      label: 'sk-or-v1-update',
+      byok: 'excl',
+      resetCadence: 'never',
+      hash: 'hash-update',
+      disabled: false,
+    });
+  });
 });