omnigateway 0.10.3 → 0.11.1

package/bin/omni.js

@@ -75,7 +75,10 @@ function note(ctx, writer, message) {
 function formatTime(at) {
   if (at === null || !Number.isFinite(at))
     return "\u2014";
-  return new Date(at).toISOString().replace("T", " ").slice(0, 19);
+  const date = new Date(at);
+  if (Number.isNaN(date.getTime()))
+    return "out of range";
+  return date.toISOString().replace("T", " ").slice(0, 19);
 }
 function formatAge(from, now) {
   if (from === null || !Number.isFinite(from))
@@ -19238,13 +19241,13 @@ function prepareArtifact(input2) {
     error: error61.value
   };
   const json2 = JSON.stringify(bounded);
-  const size = encoder2.encode(json2).length;
+  const size = Buffer.byteLength(json2);
   if (size <= MAX_ARTIFACT_BYTES)
     return { artifact: bounded, json: json2 };
   const marker = omission(size);
   const omitted = omitBodies(bounded, marker);
   const omittedJson = JSON.stringify(omitted);
-  if (encoder2.encode(omittedJson).length <= MAX_ARTIFACT_BYTES) {
+  if (Buffer.byteLength(omittedJson) <= MAX_ARTIFACT_BYTES) {
     return { artifact: omitted, json: omittedJson };
   }
   const stripped = { ...omitted, error: marker };
@@ -19504,6 +19507,261 @@ function estimateCachedInputTokens(request) {
   }
   return cached2;
 }
+// packages/store/src/sqlite/rollup.ts
+var HOUR_MS = 3600000;
+function hourOf(at) {
+  return Math.floor(at / HOUR_MS);
+}
+var DAY_MS = 86400000;
+function hostDayOffsetMinutes() {
+  return -new Date().getTimezoneOffset() || 0;
+}
+function startOfDay(at, offsetMinutes) {
+  const offsetMs = offsetMinutes * 60000;
+  return Math.floor((at + offsetMs) / DAY_MS) * DAY_MS - offsetMs;
+}
+var UPSERT = `
+  INSERT INTO usage_daily
+    (day, provider, credential_id, requested_model, resolved_model, api_key_id,
+     requests, errors, input_tokens, output_tokens, cache_read_tokens,
+     cache_write_tokens, rtk_saved_tokens, rtk_applied_requests, cost_usd, duration_ms_sum)
+  VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+  ON CONFLICT (day, provider, credential_id, requested_model, resolved_model, api_key_id)
+  DO UPDATE SET
+    requests           = requests + excluded.requests,
+    errors             = errors + excluded.errors,
+    input_tokens       = input_tokens + excluded.input_tokens,
+    output_tokens      = output_tokens + excluded.output_tokens,
+    cache_read_tokens  = cache_read_tokens + excluded.cache_read_tokens,
+    cache_write_tokens    = cache_write_tokens + excluded.cache_write_tokens,
+    rtk_saved_tokens      = rtk_saved_tokens + excluded.rtk_saved_tokens,
+    rtk_applied_requests  = rtk_applied_requests + excluded.rtk_applied_requests,
+    cost_usd              = cost_usd + excluded.cost_usd,
+    duration_ms_sum    = duration_ms_sum + excluded.duration_ms_sum`;
+function keyOf(log, dayOffsetMinutes) {
+  return [
+    startOfDay(log.at, dayOffsetMinutes),
+    log.resolvedProvider ?? "",
+    log.credentialId ?? "",
+    log.requestedModel,
+    log.resolvedModel ?? "",
+    log.apiKeyId ?? ""
+  ];
+}
+function countersOf(log) {
+  return {
+    requests: 1,
+    errors: log.status >= 400 ? 1 : 0,
+    inputTokens: log.inputTokens,
+    outputTokens: log.outputTokens,
+    cacheReadTokens: log.cacheReadTokens,
+    cacheWriteTokens: log.cacheWriteTokens,
+    rtkSavedTokens: log.rtkEstimatedTokensSaved,
+    rtkAppliedRequests: log.rtkApplied ? 1 : 0,
+    costUsd: log.costUsd,
+    durationMsSum: log.durationMs
+  };
+}
+var BACKFILL_UPSERT = `
+  INSERT INTO usage_daily
+    (day, provider, credential_id, requested_model, resolved_model, api_key_id,
+     requests, errors, input_tokens, output_tokens, cache_read_tokens,
+     cache_write_tokens, cost_usd, duration_ms_sum)
+  VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+  ON CONFLICT (day, provider, credential_id, requested_model, resolved_model, api_key_id)
+  DO UPDATE SET
+    requests           = requests + excluded.requests,
+    errors             = errors + excluded.errors,
+    input_tokens       = input_tokens + excluded.input_tokens,
+    output_tokens      = output_tokens + excluded.output_tokens,
+    cache_read_tokens  = cache_read_tokens + excluded.cache_read_tokens,
+    cache_write_tokens = cache_write_tokens + excluded.cache_write_tokens,
+    cost_usd           = cost_usd + excluded.cost_usd,
+    duration_ms_sum    = duration_ms_sum + excluded.duration_ms_sum`;
+function upsertPreRtk(db, key, c) {
+  db.run(BACKFILL_UPSERT, [
+    ...key,
+    c.requests,
+    c.errors,
+    c.inputTokens,
+    c.outputTokens,
+    c.cacheReadTokens,
+    c.cacheWriteTokens,
+    c.costUsd,
+    c.durationMsSum
+  ]);
+}
+function upsert(db, key, c) {
+  db.run(UPSERT, [
+    ...key,
+    c.requests,
+    c.errors,
+    c.inputTokens,
+    c.outputTokens,
+    c.cacheReadTokens,
+    c.cacheWriteTokens,
+    c.rtkSavedTokens,
+    c.rtkAppliedRequests,
+    c.costUsd,
+    c.durationMsSum
+  ]);
+}
+function rollupLog(db, log, dayOffsetMinutes) {
+  upsert(db, keyOf(log, dayOffsetMinutes), countersOf(log));
+}
+function backfillDaily(db, dayOffsetMinutes) {
+  const groups = new Map;
+  for (const row of db.query(`SELECT at, api_key_id, requested_model, resolved_provider, resolved_model, credential_id,
+              status, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,
+              duration_ms, cost_usd
+         FROM request_logs`).all()) {
+    const key = [
+      startOfDay(row.at, dayOffsetMinutes),
+      row.resolved_provider ?? "",
+      row.credential_id ?? "",
+      row.requested_model,
+      row.resolved_model ?? "",
+      row.api_key_id ?? ""
+    ];
+    const id = key.join("\x00");
+    const seen = groups.get(id);
+    const counters = seen?.counters ?? {
+      requests: 0,
+      errors: 0,
+      inputTokens: 0,
+      outputTokens: 0,
+      cacheReadTokens: 0,
+      cacheWriteTokens: 0,
+      rtkSavedTokens: 0,
+      rtkAppliedRequests: 0,
+      costUsd: 0,
+      durationMsSum: 0
+    };
+    counters.requests += 1;
+    counters.errors += row.status >= 400 ? 1 : 0;
+    counters.inputTokens += row.input_tokens;
+    counters.outputTokens += row.output_tokens;
+    counters.cacheReadTokens += row.cache_read_tokens;
+    counters.cacheWriteTokens += row.cache_write_tokens;
+    counters.costUsd += row.cost_usd;
+    counters.durationMsSum += row.duration_ms;
+    if (seen === undefined)
+      groups.set(id, { key, counters });
+  }
+  for (const group of groups.values())
+    upsertPreRtk(db, group.key, group.counters);
+  return groups.size;
+}
+var HOURLY_UPSERT = `
+  INSERT INTO usage_rollup
+    (api_key_id, hour, requests, input_tokens, output_tokens,
+     cache_read_tokens, cache_write_tokens, cost_usd)
+  VALUES (?,?,?,?,?,?,?,?)
+  ON CONFLICT (api_key_id, hour)
+  DO UPDATE SET
+    requests           = requests + excluded.requests,
+    input_tokens       = input_tokens + excluded.input_tokens,
+    output_tokens      = output_tokens + excluded.output_tokens,
+    cache_read_tokens  = cache_read_tokens + excluded.cache_read_tokens,
+    cache_write_tokens = cache_write_tokens + excluded.cache_write_tokens,
+    cost_usd           = cost_usd + excluded.cost_usd`;
+function rollupHour(db, log) {
+  const apiKeyId = log.apiKeyId;
+  if (apiKeyId === null)
+    return;
+  db.run(HOURLY_UPSERT, [
+    apiKeyId,
+    hourOf(log.at),
+    1,
+    log.inputTokens,
+    log.outputTokens,
+    log.cacheReadTokens,
+    log.cacheWriteTokens,
+    log.costUsd
+  ]);
+}
+var REBUILD = `
+  INSERT INTO usage_rollup
+    (api_key_id, hour, requests, input_tokens, output_tokens,
+     cache_read_tokens, cache_write_tokens, cost_usd)
+  SELECT api_key_id,
+         CAST(at / 3600000 AS INTEGER),
+         COUNT(*),
+         COALESCE(SUM(input_tokens), 0),
+         COALESCE(SUM(output_tokens), 0),
+         COALESCE(SUM(cache_read_tokens), 0),
+         COALESCE(SUM(cache_write_tokens), 0),
+         COALESCE(SUM(cost_usd), 0)
+    FROM request_logs
+   WHERE state = 'done' AND api_key_id IS NOT NULL
+   GROUP BY api_key_id, CAST(at / 3600000 AS INTEGER)`;
+function rebuildRollup(db) {
+  db.run("DELETE FROM usage_rollup");
+  db.run(REBUILD);
+}
+function auditRollup(db) {
+  const row = db.query(`WITH truth AS (
+         SELECT api_key_id AS k,
+                CAST(at / 3600000 AS INTEGER) AS h,
+                COUNT(*) AS requests,
+                COALESCE(SUM(input_tokens), 0) AS input_tokens,
+                COALESCE(SUM(output_tokens), 0) AS output_tokens,
+                COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
+                COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
+                COALESCE(SUM(cost_usd), 0) AS cost_usd
+           FROM request_logs
+          WHERE state = 'done' AND api_key_id IS NOT NULL
+          GROUP BY k, h
+       )
+       SELECT (SELECT COUNT(*) FROM truth) AS buckets,
+              (SELECT COUNT(*)
+                 FROM truth
+                 LEFT JOIN usage_rollup r ON r.api_key_id = truth.k AND r.hour = truth.h
+                WHERE r.api_key_id IS NULL
+                   OR r.requests <> truth.requests
+                   OR r.input_tokens <> truth.input_tokens
+                   OR r.output_tokens <> truth.output_tokens
+                   OR r.cache_read_tokens <> truth.cache_read_tokens
+                   OR r.cache_write_tokens <> truth.cache_write_tokens
+                   OR ABS(r.cost_usd - truth.cost_usd) > 1e-9 + ABS(truth.cost_usd) * 1e-9
+              ) AS mismatched,
+              (SELECT COUNT(*)
+                 FROM usage_rollup r
+                 LEFT JOIN truth ON r.api_key_id = truth.k AND r.hour = truth.h
+                WHERE truth.k IS NULL
+              ) AS orphans`).get();
+  const buckets = row?.buckets ?? 0;
+  const mismatched = (row?.mismatched ?? 0) + (row?.orphans ?? 0);
+  return { buckets, mismatched, ok: mismatched === 0 };
+}
+function backfillRtkUsage(db, dayOffsetMinutes) {
+  const groups = new Map;
+  for (const row of db.query(`SELECT at, api_key_id, requested_model, resolved_provider, resolved_model, credential_id,
+              rtk_applied, rtk_estimated_tokens_saved
+         FROM request_logs
+        WHERE state = 'done'`).all()) {
+    const key = [
+      startOfDay(row.at, dayOffsetMinutes),
+      row.resolved_provider ?? "",
+      row.credential_id ?? "",
+      row.requested_model,
+      row.resolved_model ?? "",
+      row.api_key_id ?? ""
+    ];
+    const id = key.join("\x00");
+    const group = groups.get(id) ?? { key, saved: 0, applied: 0 };
+    group.saved += row.rtk_estimated_tokens_saved;
+    group.applied += row.rtk_applied === 1 ? 1 : 0;
+    groups.set(id, group);
+  }
+  for (const { key, saved, applied } of groups.values()) {
+    db.run(`UPDATE usage_daily
+          SET rtk_saved_tokens = ?, rtk_applied_requests = ?
+        WHERE day = ? AND provider = ? AND credential_id = ? AND requested_model = ?
+          AND resolved_model = ? AND api_key_id = ?`, [saved, applied, ...key]);
+  }
+}
+
 // packages/store/src/postgres/db.ts
 var {SQL } = globalThis.Bun;
 
@@ -19809,11 +20067,95 @@ CREATE TRIGGER api_keys_config_version
   FOR EACH STATEMENT EXECUTE FUNCTION bump_config_version();
 `;
 
+// packages/store/src/postgres/migrations/002_health_measurements.sql
+var _002_health_measurements_default = `-- DEPLOY HAZARD \u2014 read before applying to a fleet.
+--
+-- This migration drops two columns that every gateway before it writes on
+-- the success path (\`UPSERT_HEALTH\` names \`ewma_ttft_ms\` and \`last_used_at\`).
+-- The first new replica to boot applies it under the migration lock; from that
+-- moment every OLD replica still running throws on every successful request:
+-- the upstream call has completed and been billed, the client has received its
+-- content frames, and then the connection aborts with no terminal frame. The
+-- \`RollingUpdate\` in \`k8s/deployment.yaml\` does not protect against this \u2014 the
+-- "surviving" replica is the one that breaks.
+--
+-- Required: scale to ONE replica before deploying this release, or accept that
+-- every old replica fails every successful request until it is replaced.
+-- Rollback is unsafe: an old image cannot re-add the columns, and running it
+-- against this schema fails the same way. The only way back is a snapshot
+-- restore taken before the deploy. Deliberate: kept as a drop, not
+-- expand/contract, on the operator's decision \u2014 see the write-path spec.
+--
+-- \`credential_health\` keeps decisions, not measurements.
+--
+-- \`ewma_ttft_ms\` and \`last_used_at\` were written on every successful request,
+-- and a success that changes nothing else now writes nothing. Both live in the
+-- gateway's process-local \`loadRegistry\` instead. The console's "last used"
+-- reads \`request_logs\` through \`usage.lastUsedByCredential\`, served by
+-- \`idx_request_logs_cred\`.
+ALTER TABLE credential_health DROP COLUMN ewma_ttft_ms;
+ALTER TABLE credential_health DROP COLUMN last_used_at;
+
+-- The statement-level trigger bumped \`config_version\` \u2014 one row, locked until
+-- commit, by every writer on every replica \u2014 on every health write, and every
+-- bump makes every replica rebuild its routing snapshot. Only a change to a
+-- column routing *decides* on needs that; a bare \`consecutive_failures\`
+-- increment is patched into the held snapshot from the \`healthSaved\` change.
+--
+-- The INSERT arm must stay \`FOR EACH ROW\`. The write is an upsert, and a
+-- statement-level INSERT trigger fires on an upsert whichever path each row
+-- took, which would bump on every write and make the WHEN clause below moot.
+-- Row-level \`AFTER INSERT\` fires only for rows actually inserted.
+DROP TRIGGER credential_health_config_version ON credential_health;
+
+CREATE TRIGGER credential_health_config_version_upd
+  AFTER UPDATE ON credential_health
+  FOR EACH ROW
+  WHEN (OLD.breaker_state      IS DISTINCT FROM NEW.breaker_state
+     OR OLD.rate_limited_until IS DISTINCT FROM NEW.rate_limited_until
+     OR OLD.opened_at          IS DISTINCT FROM NEW.opened_at)
+  EXECUTE FUNCTION bump_config_version();
+
+CREATE TRIGGER credential_health_config_version_ins
+  AFTER INSERT ON credential_health
+  FOR EACH ROW EXECUTE FUNCTION bump_config_version();
+
+-- DELETE needs no WHEN, so it stays statement-level as in 001: a credential
+-- with M model rows bumps once, not M times.
+CREATE TRIGGER credential_health_config_version_del
+  AFTER DELETE ON credential_health
+  FOR EACH STATEMENT EXECUTE FUNCTION bump_config_version();
+`;
+
+// packages/store/src/postgres/migrations/003_key_expiry.sql
+var _003_key_expiry_default = `-- The Postgres half of the sqlite migration of the same name. \`BIGINT\`, like
+-- every other epoch-ms column in this schema, and read back through \`numOrNull\`.
+--
+-- Nullable rather than \`NOT NULL DEFAULT\`: the column is a deadline, and every
+-- finite default is a date on which somebody's client stops working. NULL is
+-- the only value that says nothing was decided, and every reader maps it to
+-- "never expires".
+--
+-- No backfill, deliberately. Every key on every existing installation was
+-- minted on the promise that it works until revoked, so adding the column and
+-- stopping is what keeps that promise. The absence of an \`UPDATE\` here is the
+-- substance of the migration, not an omission.
+--
+-- Safe to apply under a rolling deploy, unlike migration 2: this adds a
+-- nullable column and drops nothing, so a replica running the previous image
+-- keeps serving \u2014 \`SELECT *\` gains a field its mapper ignores.
+ALTER TABLE api_keys ADD COLUMN expires_at BIGINT;
+`;
+
 // packages/store/src/postgres/db.ts
 var num = (v) => Number(v);
 var numOrNull = (v) => v === null ? null : Number(v);
 var MIGRATION_LOCK = 7140641;
-var MIGRATIONS = [{ id: 1, sql: _001_init_default }];
+var MIGRATIONS = [
+  { id: 1, sql: _001_init_default },
+  { id: 2, sql: _002_health_measurements_default },
+  { id: 3, sql: _003_key_expiry_default }
+];
 async function openPg(url2) {
   const sql = new SQL({ url: url2 });
   const conn = await sql.reserve();
@@ -20010,6 +20352,9 @@ function resolvePin(target, accounts) {
     return;
   return accounts.find((account) => servesTarget(target, account));
 }
+var keyUsable = (key, now) => key.revokedAt === null && (key.expiresAt === null || key.expiresAt > now);
+var credentialPastExpiry = (credential, now) => credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt <= now;
+var credentialExpired = (credential, now) => credentialPastExpiry(credential, now) && !credential.hasRefreshToken;
 var NODE_GRACE_MS = 60000;
 var DEFAULT_SETTINGS = {
   weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
@@ -20137,31 +20482,25 @@ function toHealth(r) {
     breakerState: r.breaker_state,
     consecutiveFailures: r.consecutive_failures,
     openedAt: numOrNull(r.opened_at),
-    rateLimitedUntil: numOrNull(r.rate_limited_until),
-    ewmaTtftMs: r.ewma_ttft_ms,
-    lastUsedAt: numOrNull(r.last_used_at)
+    rateLimitedUntil: numOrNull(r.rate_limited_until)
   };
 }
 var UPSERT_HEALTH = `INSERT INTO credential_health
    (credential_id, model, breaker_state, consecutive_failures, opened_at,
-    rate_limited_until, ewma_ttft_ms, last_used_at)
- VALUES ($1,$2,$3,$4,$5,$6,$7,$8)
+    rate_limited_until)
+ VALUES ($1,$2,$3,$4,$5,$6)
  ON CONFLICT (credential_id, model) DO UPDATE SET
    breaker_state = EXCLUDED.breaker_state,
    consecutive_failures = EXCLUDED.consecutive_failures,
    opened_at = EXCLUDED.opened_at,
-   rate_limited_until = EXCLUDED.rate_limited_until,
-   ewma_ttft_ms = EXCLUDED.ewma_ttft_ms,
-   last_used_at = EXCLUDED.last_used_at`;
+   rate_limited_until = EXCLUDED.rate_limited_until`;
 var healthValues = (r) => [
   r.credentialId,
   r.model,
   r.breakerState,
   r.consecutiveFailures,
   r.openedAt,
-  r.rateLimitedUntil,
-  r.ewmaTtftMs,
-  r.lastUsedAt
+  r.rateLimitedUntil
 ];
 function createCredentialRepo(sql, key, emit2) {
   const open2 = async (v) => v === null ? null : decrypt(key, v);
@@ -20354,13 +20693,6 @@ function createCredentialRepo(sql, key, emit2) {
       const rows = await sql.unsafe("SELECT * FROM credential_health");
       return rows.map(toHealth);
     },
-    async saveHealth(rows) {
-      await sql.begin(async (tx) => {
-        for (const r of rows)
-          await tx.unsafe(UPSERT_HEALTH, healthValues(r));
-      });
-      emit2({ type: "healthSaved", rows });
-    },
     async updateHealth(credentialId, model, apply) {
       const written = await sql.begin(async (tx) => {
         await tx.unsafe("SELECT pg_advisory_xact_lock(hashtext($1))", [`${credentialId}|${model}`]);
@@ -20502,7 +20834,8 @@ var toKey = (r, logger2) => ({
   limits: parseLimits(r.id, r.limits, logger2),
   bodyLoggingOptOut: r.body_logging_opt_out,
   createdAt: num(r.created_at),
-  revokedAt: numOrNull(r.revoked_at)
+  revokedAt: numOrNull(r.revoked_at),
+  expiresAt: numOrNull(r.expires_at)
 });
 function createKeyRepo(sql, logger2) {
   const one = async (where, arg) => {
@@ -20520,8 +20853,8 @@ function createKeyRepo(sql, logger2) {
     async create(input2) {
       const now = Date.now();
       await sql.unsafe(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NULL)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NULL,$9)`, [
         input2.id,
         input2.label,
         input2.prefix,
@@ -20529,7 +20862,8 @@ function createKeyRepo(sql, logger2) {
         input2.modelAllowlist === null ? null : JSON.stringify(input2.modelAllowlist),
         JSON.stringify(parseLimitConfig(input2.limits)),
         input2.bodyLoggingOptOut,
-        now
+        now,
+        input2.expiresAt
       ]);
       return { ...input2, createdAt: now, revokedAt: null };
     },
@@ -20537,8 +20871,8 @@ function createKeyRepo(sql, logger2) {
       if (row.limits === null)
         throw new Error(`api key ${row.id} has unreadable limits`);
       await sql.unsafe(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)`, [
         row.id,
         row.label,
         row.prefix,
@@ -20547,7 +20881,8 @@ function createKeyRepo(sql, logger2) {
         JSON.stringify(parseLimitConfig(row.limits)),
         row.bodyLoggingOptOut,
         row.createdAt,
-        row.revokedAt
+        row.revokedAt,
+        row.expiresAt
       ]);
     },
     async setLimits(id, limits) {
@@ -20562,6 +20897,9 @@ function createKeyRepo(sql, logger2) {
         id
       ]);
     },
+    async setExpiry(id, expiresAt) {
+      await sql.unsafe("UPDATE api_keys SET expires_at = $1 WHERE id = $2", [expiresAt, id]);
+    },
     async revoke(id) {
       await sql.unsafe("UPDATE api_keys SET revoked_at = $1 WHERE id = $2", [Date.now(), id]);
     }
@@ -20860,229 +21198,6 @@ function isRtkFilterId(value) {
   return FILTER_IDS.has(value);
 }
 
-// packages/store/src/sqlite/rollup.ts
-var HOUR_MS = 3600000;
-function hourOf(at) {
-  return Math.floor(at / HOUR_MS);
-}
-function startOfLocalDay(at) {
-  const day = new Date(at);
-  day.setHours(0, 0, 0, 0);
-  return day.getTime();
-}
-var UPSERT = `
-  INSERT INTO usage_daily
-    (day, provider, credential_id, requested_model, resolved_model, api_key_id,
-     requests, errors, input_tokens, output_tokens, cache_read_tokens,
-     cache_write_tokens, rtk_saved_tokens, rtk_applied_requests, cost_usd, duration_ms_sum)
-  VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
-  ON CONFLICT (day, provider, credential_id, requested_model, resolved_model, api_key_id)
-  DO UPDATE SET
-    requests           = requests + excluded.requests,
-    errors             = errors + excluded.errors,
-    input_tokens       = input_tokens + excluded.input_tokens,
-    output_tokens      = output_tokens + excluded.output_tokens,
-    cache_read_tokens  = cache_read_tokens + excluded.cache_read_tokens,
-    cache_write_tokens    = cache_write_tokens + excluded.cache_write_tokens,
-    rtk_saved_tokens      = rtk_saved_tokens + excluded.rtk_saved_tokens,
-    rtk_applied_requests  = rtk_applied_requests + excluded.rtk_applied_requests,
-    cost_usd              = cost_usd + excluded.cost_usd,
-    duration_ms_sum    = duration_ms_sum + excluded.duration_ms_sum`;
-function keyOf(log) {
-  return [
-    startOfLocalDay(log.at),
-    log.resolvedProvider ?? "",
-    log.credentialId ?? "",
-    log.requestedModel,
-    log.resolvedModel ?? "",
-    log.apiKeyId ?? ""
-  ];
-}
-function countersOf(log) {
-  return {
-    requests: 1,
-    errors: log.status >= 400 ? 1 : 0,
-    inputTokens: log.inputTokens,
-    outputTokens: log.outputTokens,
-    cacheReadTokens: log.cacheReadTokens,
-    cacheWriteTokens: log.cacheWriteTokens,
-    rtkSavedTokens: log.rtkEstimatedTokensSaved,
-    rtkAppliedRequests: log.rtkApplied ? 1 : 0,
-    costUsd: log.costUsd,
-    durationMsSum: log.durationMs
-  };
-}
-function upsert(db, key, c) {
-  db.run(UPSERT, [
-    ...key,
-    c.requests,
-    c.errors,
-    c.inputTokens,
-    c.outputTokens,
-    c.cacheReadTokens,
-    c.cacheWriteTokens,
-    c.rtkSavedTokens,
-    c.rtkAppliedRequests,
-    c.costUsd,
-    c.durationMsSum
-  ]);
-}
-function rollupLog(db, log) {
-  upsert(db, keyOf(log), countersOf(log));
-}
-function backfillDaily(db) {
-  const groups = new Map;
-  for (const row of db.query(`SELECT at, api_key_id, requested_model, resolved_provider, resolved_model, credential_id,
-              status, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,
-              duration_ms, cost_usd
-         FROM request_logs`).all()) {
-    const key = [
-      startOfLocalDay(row.at),
-      row.resolved_provider ?? "",
-      row.credential_id ?? "",
-      row.requested_model,
-      row.resolved_model ?? "",
-      row.api_key_id ?? ""
-    ];
-    const id = key.join("\x00");
-    const seen = groups.get(id);
-    const counters = seen?.counters ?? {
-      requests: 0,
-      errors: 0,
-      inputTokens: 0,
-      outputTokens: 0,
-      cacheReadTokens: 0,
-      cacheWriteTokens: 0,
-      rtkSavedTokens: 0,
-      rtkAppliedRequests: 0,
-      costUsd: 0,
-      durationMsSum: 0
-    };
-    counters.requests += 1;
-    counters.errors += row.status >= 400 ? 1 : 0;
-    counters.inputTokens += row.input_tokens;
-    counters.outputTokens += row.output_tokens;
-    counters.cacheReadTokens += row.cache_read_tokens;
-    counters.cacheWriteTokens += row.cache_write_tokens;
-    counters.costUsd += row.cost_usd;
-    counters.durationMsSum += row.duration_ms;
-    if (seen === undefined)
-      groups.set(id, { key, counters });
-  }
-  for (const group of groups.values())
-    upsert(db, group.key, group.counters);
-  return groups.size;
-}
-var HOURLY_UPSERT = `
-  INSERT INTO usage_rollup
-    (api_key_id, hour, requests, input_tokens, output_tokens,
-     cache_read_tokens, cache_write_tokens, cost_usd)
-  VALUES (?,?,?,?,?,?,?,?)
-  ON CONFLICT (api_key_id, hour)
-  DO UPDATE SET
-    requests           = requests + excluded.requests,
-    input_tokens       = input_tokens + excluded.input_tokens,
-    output_tokens      = output_tokens + excluded.output_tokens,
-    cache_read_tokens  = cache_read_tokens + excluded.cache_read_tokens,
-    cache_write_tokens = cache_write_tokens + excluded.cache_write_tokens,
-    cost_usd           = cost_usd + excluded.cost_usd`;
-function rollupHour(db, log) {
-  const apiKeyId = log.apiKeyId;
-  if (apiKeyId === null)
-    return;
-  db.run(HOURLY_UPSERT, [
-    apiKeyId,
-    hourOf(log.at),
-    1,
-    log.inputTokens,
-    log.outputTokens,
-    log.cacheReadTokens,
-    log.cacheWriteTokens,
-    log.costUsd
-  ]);
-}
-var REBUILD = `
-  INSERT INTO usage_rollup
-    (api_key_id, hour, requests, input_tokens, output_tokens,
-     cache_read_tokens, cache_write_tokens, cost_usd)
-  SELECT api_key_id,
-         CAST(at / 3600000 AS INTEGER),
-         COUNT(*),
-         COALESCE(SUM(input_tokens), 0),
-         COALESCE(SUM(output_tokens), 0),
-         COALESCE(SUM(cache_read_tokens), 0),
-         COALESCE(SUM(cache_write_tokens), 0),
-         COALESCE(SUM(cost_usd), 0)
-    FROM request_logs
-   WHERE state = 'done' AND api_key_id IS NOT NULL
-   GROUP BY api_key_id, CAST(at / 3600000 AS INTEGER)`;
-function rebuildRollup(db) {
-  db.run("DELETE FROM usage_rollup");
-  db.run(REBUILD);
-}
-function auditRollup(db) {
-  const row = db.query(`WITH truth AS (
-         SELECT api_key_id AS k,
-                CAST(at / 3600000 AS INTEGER) AS h,
-                COUNT(*) AS requests,
-                COALESCE(SUM(input_tokens), 0) AS input_tokens,
-                COALESCE(SUM(output_tokens), 0) AS output_tokens,
-                COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
-                COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
-                COALESCE(SUM(cost_usd), 0) AS cost_usd
-           FROM request_logs
-          WHERE state = 'done' AND api_key_id IS NOT NULL
-          GROUP BY k, h
-       )
-       SELECT (SELECT COUNT(*) FROM truth) AS buckets,
-              (SELECT COUNT(*)
-                 FROM truth
-                 LEFT JOIN usage_rollup r ON r.api_key_id = truth.k AND r.hour = truth.h
-                WHERE r.api_key_id IS NULL
-                   OR r.requests <> truth.requests
-                   OR r.input_tokens <> truth.input_tokens
-                   OR r.output_tokens <> truth.output_tokens
-                   OR r.cache_read_tokens <> truth.cache_read_tokens
-                   OR r.cache_write_tokens <> truth.cache_write_tokens
-                   OR ABS(r.cost_usd - truth.cost_usd) > 1e-9 + ABS(truth.cost_usd) * 1e-9
-              ) AS mismatched,
-              (SELECT COUNT(*)
-                 FROM usage_rollup r
-                 LEFT JOIN truth ON r.api_key_id = truth.k AND r.hour = truth.h
-                WHERE truth.k IS NULL
-              ) AS orphans`).get();
-  const buckets = row?.buckets ?? 0;
-  const mismatched = (row?.mismatched ?? 0) + (row?.orphans ?? 0);
-  return { buckets, mismatched, ok: mismatched === 0 };
-}
-function backfillRtkUsage(db) {
-  const groups = new Map;
-  for (const row of db.query(`SELECT at, api_key_id, requested_model, resolved_provider, resolved_model, credential_id,
-              rtk_applied, rtk_estimated_tokens_saved
-         FROM request_logs
-        WHERE state = 'done'`).all()) {
-    const key = [
-      startOfLocalDay(row.at),
-      row.resolved_provider ?? "",
-      row.credential_id ?? "",
-      row.requested_model,
-      row.resolved_model ?? "",
-      row.api_key_id ?? ""
-    ];
-    const id = key.join("\x00");
-    const group = groups.get(id) ?? { key, saved: 0, applied: 0 };
-    group.saved += row.rtk_estimated_tokens_saved;
-    group.applied += row.rtk_applied === 1 ? 1 : 0;
-    groups.set(id, group);
-  }
-  for (const { key, saved, applied } of groups.values()) {
-    db.run(`UPDATE usage_daily
-          SET rtk_saved_tokens = ?, rtk_applied_requests = ?
-        WHERE day = ? AND provider = ? AND credential_id = ? AND requested_model = ?
-          AND resolved_model = ? AND api_key_id = ?`, [saved, applied, ...key]);
-  }
-}
-
 // packages/store/src/postgres/rollup.ts
 var DAILY_UPSERT = `
   INSERT INTO usage_daily
@@ -21102,9 +21217,9 @@ var DAILY_UPSERT = `
     rtk_applied_requests = usage_daily.rtk_applied_requests + EXCLUDED.rtk_applied_requests,
     cost_usd             = usage_daily.cost_usd + EXCLUDED.cost_usd,
     duration_ms_sum      = usage_daily.duration_ms_sum + EXCLUDED.duration_ms_sum`;
-async function rollupLog2(conn, log) {
+async function rollupLog2(conn, log, dayOffsetMinutes) {
   await conn.unsafe(DAILY_UPSERT, [
-    startOfLocalDay(log.at),
+    startOfDay(log.at, dayOffsetMinutes),
     log.resolvedProvider ?? "",
     log.credentialId ?? "",
     log.requestedModel,
@@ -21348,7 +21463,7 @@ var sum = (row) => ({
   tokens: row === undefined ? 0 : num(row.tokens),
   costUsd: row === undefined ? 0 : row.cost_usd
 });
-function createUsageRepo(sql, nodeId) {
+function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
   const complete = async (conn, log) => {
     const written = (await conn.unsafe(COMPLETE, values(log, "done", nodeId))).count;
     if (written === 0)
@@ -21356,7 +21471,7 @@ function createUsageRepo(sql, nodeId) {
     const stored = (await conn.unsafe("SELECT * FROM request_logs WHERE id = $1", [log.id]))[0];
     if (stored !== undefined) {
       const restored = toLog(stored);
-      await rollupLog2(conn, restored);
+      await rollupLog2(conn, restored, dayOffsetMinutes);
       await rollupHour2(conn, restored);
     }
   };
@@ -21387,6 +21502,10 @@ function createUsageRepo(sql, nodeId) {
       ]) : await sql.unsafe("SELECT * FROM request_logs WHERE api_key_id = $1 ORDER BY at DESC LIMIT $2", [apiKeyId, limit]);
       return rows.map(toLog);
     },
+    async lastUsedByCredential(credentialId) {
+      const rows = await sql.unsafe("SELECT MAX(at) AS at FROM request_logs WHERE credential_id = $1", [credentialId]);
+      return numOrNull(rows[0]?.at ?? null);
+    },
     async scan(cursor, limit) {
       const rows = cursor === null ? await sql.unsafe("SELECT * FROM request_logs ORDER BY at, id LIMIT $1", [
         limit
@@ -21449,7 +21568,7 @@ function createUsageRepo(sql, nodeId) {
       const daily = grain === "daily";
       const key = columnFor(grain, q.groupBy);
       const split = q.splitBy === undefined ? null : columnFor(grain, q.splitBy);
-      const since = daily ? startOfLocalDay(q.since) : q.since;
+      const since = daily ? startOfDay(q.since, dayOffsetMinutes) : q.since;
       const until = q.until ?? Number.MAX_SAFE_INTEGER;
       const timeColumn = daily ? "day" : "at";
       const scope = q.apiKeyId;
@@ -21525,6 +21644,7 @@ function redacted(url2) {
 async function createPostgresStore(opts) {
   const logger2 = opts.logger ?? noopLogger;
   const nodeId = opts.nodeId ?? crypto.randomUUID();
+  const dayOffsetMinutes = opts.dayOffsetMinutes ?? hostDayOffsetMinutes();
   const listeners = new Set;
   const emit2 = (change) => {
     for (const listener of listeners) {
@@ -21556,7 +21676,7 @@ async function createPostgresStore(opts) {
     credentials: createCredentialRepo(sql, opts.encryptionKey, emit2),
     config: createConfigRepo(sql, emit2),
     keys: createKeyRepo(sql, logger2),
-    usage: createUsageRepo(sql, nodeId),
+    usage: createUsageRepo(sql, nodeId, dayOffsetMinutes),
     bodies: createBodyRepo(sql, opts.encryptionKey),
     maintenance: createMaintenanceRepo(sql, nodeId),
     plugins: createPluginRepo(sql),
@@ -21793,22 +21913,18 @@ function toHealth2(r) {
     breakerState: r.breaker_state,
     consecutiveFailures: r.consecutive_failures,
     openedAt: r.opened_at,
-    rateLimitedUntil: r.rate_limited_until,
-    ewmaTtftMs: r.ewma_ttft_ms,
-    lastUsedAt: r.last_used_at
+    rateLimitedUntil: r.rate_limited_until
   };
 }
 var UPSERT_HEALTH2 = `INSERT INTO credential_health
    (credential_id, model, breaker_state, consecutive_failures, opened_at,
-    rate_limited_until, ewma_ttft_ms, last_used_at)
- VALUES (?,?,?,?,?,?,?,?)
+    rate_limited_until)
+ VALUES (?,?,?,?,?,?)
  ON CONFLICT (credential_id, model) DO UPDATE SET
    breaker_state = excluded.breaker_state,
    consecutive_failures = excluded.consecutive_failures,
    opened_at = excluded.opened_at,
-   rate_limited_until = excluded.rate_limited_until,
-   ewma_ttft_ms = excluded.ewma_ttft_ms,
-   last_used_at = excluded.last_used_at`;
+   rate_limited_until = excluded.rate_limited_until`;
 function createCredentialRepo2(db, key, emit2 = () => {}) {
   const open2 = async (v) => v === null ? null : decrypt(key, v);
   const secretsFrom = async (row) => ({
@@ -21991,22 +22107,13 @@ function createCredentialRepo2(db, key, emit2 = () => {}) {
     async listHealth() {
       return db.query("SELECT * FROM credential_health").all().map(toHealth2);
     },
-    async saveHealth(rows) {
-      const stmt = db.prepare(UPSERT_HEALTH2);
-      db.transaction(() => {
-        for (const r of rows) {
-          stmt.run(r.credentialId, r.model, r.breakerState, r.consecutiveFailures, r.openedAt, r.rateLimitedUntil, r.ewmaTtftMs, r.lastUsedAt);
-        }
-      })();
-      emit2({ type: "healthSaved", rows });
-    },
     async updateHealth(credentialId, model, apply) {
       const current = db.prepare("SELECT * FROM credential_health WHERE credential_id = ? AND model = ?");
       const stmt = db.prepare(UPSERT_HEALTH2);
       const written = db.transaction(() => {
         const row = current.get(credentialId, model);
         const next = apply(row === null ? null : toHealth2(row));
-        stmt.run(next.credentialId, next.model, next.breakerState, next.consecutiveFailures, next.openedAt, next.rateLimitedUntil, next.ewmaTtftMs, next.lastUsedAt);
+        stmt.run(next.credentialId, next.model, next.breakerState, next.consecutiveFailures, next.openedAt, next.rateLimitedUntil);
         return next;
       })();
       emit2({ type: "healthSaved", rows: [written] });
@@ -22569,6 +22676,63 @@ CREATE TABLE nodes (
 ALTER TABLE credentials ADD COLUMN token_version INTEGER NOT NULL DEFAULT 0;
 `;
 
+// packages/store/src/sqlite/migrations/013_health_measurements.sql
+var _013_health_measurements_default = `-- DEPLOY HAZARD \u2014 read before upgrading an install that is still serving.
+--
+-- This migration drops two columns that every gateway before it writes on
+-- the success path (\`UPSERT_HEALTH\` names \`ewma_ttft_ms\` and \`last_used_at\`).
+-- SQLite is single-process, so the hazard is the rollback, not the rollout: an
+-- older gateway started against this database fails every successful request
+-- after the upstream call has completed and been billed \u2014 content frames out,
+-- then an aborted connection with no terminal frame. Rolling back the binary
+-- does not roll back the schema. The only way back is a snapshot taken before
+-- the upgrade. Deliberate: kept as a drop, not expand/contract, on the
+-- operator's decision \u2014 see the write-path spec.
+--
+-- \`credential_health\` keeps decisions, not measurements.
+--
+-- \`ewma_ttft_ms\` and \`last_used_at\` were written on every successful request,
+-- and a success that changes nothing else now writes nothing. Both live in the
+-- gateway's process-local \`loadRegistry\` instead: latency is a property of
+-- *this* process's path to the provider, and the round-robin tiebreak reads
+-- the value the process holds. The console's "last used" reads
+-- \`request_logs\` through \`usage.lastUsedByCredential\`, served by
+-- \`idx_request_logs_cred\`.
+--
+-- Neither column is indexed or constrained, so \`DROP COLUMN\` is permitted.
+ALTER TABLE credential_health DROP COLUMN ewma_ttft_ms;
+ALTER TABLE credential_health DROP COLUMN last_used_at;
+`;
+
+// packages/store/src/sqlite/migrations/014_key_expiry.sql
+var _014_key_expiry_default = `-- An optional expiry on a gateway API key: an absolute epoch-ms instant after
+-- which the key is refused, spelled exactly as \`credentials.expires_at\` is.
+--
+-- Nullable rather than \`NOT NULL DEFAULT\`, which is the opposite of the choice
+-- migration 9 made for \`limits\`, and for the opposite reason. There, every
+-- possible value is a policy and \`{}\` is the one that means "no ceiling", so a
+-- default gives "unlimited" a single spelling. Here the column is a deadline,
+-- and no number means "no deadline" \u2014 every finite default is a date on which
+-- somebody's client stops working. NULL is the only value that says nothing was
+-- decided, so it is the column's own default and every reader maps it to
+-- "never expires".
+--
+-- No backfill, deliberately, and this is the whole substance of the migration.
+-- Every key on every existing installation was minted on the promise that it
+-- works until revoked; an upgrade that attaches an expiry to those rows breaks
+-- clients on a date the operator never chose, and the failure surfaces days
+-- later as an authentication error with nothing in it that names this change.
+-- Adding the column and stopping is what keeps that promise, so the absence of
+-- an \`UPDATE\` here is load-bearing rather than an omission \u2014
+-- \`packages/store/test/migrations.test.ts\` pins it.
+--
+-- No index. The column is read only after a row has already been found by
+-- \`hash\` or by \`id\`, both of which are unique, so there is no scan for an index
+-- to help; and nothing sweeps expired keys, because an expired key stays listed
+-- exactly as a revoked one does so its usage history keeps its attribution.
+ALTER TABLE api_keys ADD COLUMN expires_at INTEGER;
+`;
+
 // packages/store/src/sqlite/db.ts
 var MIGRATIONS2 = [
   { id: 1, sql: _001_init_default2 },
@@ -22582,9 +22746,16 @@ var MIGRATIONS2 = [
   { id: 9, sql: _009_key_limits_default },
   { id: 10, sql: _010_usage_rollup_default, after: rebuildRollup },
   { id: 11, sql: _011_plugin_migrations_default },
-  { id: 12, sql: _012_nodes_default }
+  { id: 12, sql: _012_nodes_default },
+  { id: 13, sql: _013_health_measurements_default },
+  { id: 14, sql: _014_key_expiry_default }
 ];
-function openDb(path) {
+function statements(sql) {
+  return sql.split(`
+`).filter((line) => !line.trimStart().startsWith("--")).join(`
+`).split(/;[ \t]*(?:\n|$)/).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function openDb(path, dayOffsetMinutes = hostDayOffsetMinutes()) {
   const db = new Database(path, { create: true });
   db.run("PRAGMA journal_mode = WAL");
   db.run("PRAGMA synchronous = NORMAL");
@@ -22596,8 +22767,9 @@ function openDb(path) {
     if (done.has(m.id))
       continue;
     db.transaction(() => {
-      db.run(m.sql);
-      m.after?.(db);
+      for (const statement of statements(m.sql))
+        db.run(statement);
+      m.after?.(db, dayOffsetMinutes);
       db.run("INSERT INTO migrations (id, applied_at) VALUES (?, ?)", [m.id, Date.now()]);
     })();
   }
@@ -22632,7 +22804,8 @@ var toKey2 = (r, logger2) => ({
   limits: parseLimits2(r.id, r.limits, logger2),
   bodyLoggingOptOut: r.body_logging_opt_out === 1,
   createdAt: r.created_at,
-  revokedAt: r.revoked_at
+  revokedAt: r.revoked_at,
+  expiresAt: r.expires_at
 });
 function createKeyRepo2(db, logger2 = noopLogger) {
   return {
@@ -22650,8 +22823,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
     async create(input2) {
       const now = Date.now();
       db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,?,NULL)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES (?,?,?,?,?,?,?,?,NULL,?)`, [
         input2.id,
         input2.label,
         input2.prefix,
@@ -22659,7 +22832,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         input2.modelAllowlist === null ? null : JSON.stringify(input2.modelAllowlist),
         JSON.stringify(parseLimitConfig(input2.limits)),
         input2.bodyLoggingOptOut ? 1 : 0,
-        now
+        now,
+        input2.expiresAt
       ]);
       return { ...input2, createdAt: now, revokedAt: null };
     },
@@ -22667,8 +22841,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
       if (row.limits === null)
         throw new Error(`api key ${row.id} has unreadable limits`);
       db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,?,?)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES (?,?,?,?,?,?,?,?,?,?)`, [
         row.id,
         row.label,
         row.prefix,
@@ -22677,7 +22851,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         JSON.stringify(parseLimitConfig(row.limits)),
         row.bodyLoggingOptOut ? 1 : 0,
         row.createdAt,
-        row.revokedAt
+        row.revokedAt,
+        row.expiresAt
       ]);
     },
     async setLimits(id, limits) {
@@ -22692,6 +22867,9 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         id
       ]);
     },
+    async setExpiry(id, expiresAt) {
+      db.run("UPDATE api_keys SET expires_at = ? WHERE id = ?", [expiresAt, id]);
+    },
     async revoke(id) {
       db.run("UPDATE api_keys SET revoked_at = ? WHERE id = ?", [Date.now(), id]);
     }
@@ -23014,14 +23192,14 @@ var COMPLETE2 = `INSERT INTO request_logs ${COLUMNS2} VALUES ${PLACEHOLDERS2}
     rtk_estimated_tokens_saved = excluded.rtk_estimated_tokens_saved,
     rtk_filters = excluded.rtk_filters
   WHERE request_logs.state = 'pending'`;
-function createUsageRepo2(db, nodeId) {
+function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes()) {
   const complete = db.transaction((log) => {
     if (db.run(COMPLETE2, values2(log, "done", nodeId)).changes === 0)
       return;
     const stored = db.query("SELECT * FROM request_logs WHERE id = ?").get(log.id);
     if (stored !== null) {
       const restored = toLog2(stored);
-      rollupLog(db, restored);
+      rollupLog(db, restored, dayOffsetMinutes);
       rollupHour(db, restored);
     }
   });
@@ -23071,6 +23249,10 @@ function createUsageRepo2(db, nodeId) {
       }
       return db.query("SELECT * FROM request_logs WHERE api_key_id = ? ORDER BY at DESC LIMIT ?").all(apiKeyId, limit).map(toLog2);
     },
+    async lastUsedByCredential(credentialId) {
+      const row = db.query("SELECT MAX(at) AS at FROM request_logs WHERE credential_id = ?").get(credentialId);
+      return row?.at ?? null;
+    },
     async scan(cursor, limit) {
       const rows = cursor === null ? db.query("SELECT * FROM request_logs ORDER BY at, id LIMIT ?").all(limit) : db.query(`SELECT * FROM request_logs
                   WHERE at > ? OR (at = ? AND id > ?)
@@ -23132,7 +23314,7 @@ function createUsageRepo2(db, nodeId) {
       const daily = grain === "daily";
       const key = columnFor2(grain, q.groupBy);
       const split = q.splitBy === undefined ? null : columnFor2(grain, q.splitBy);
-      const since = daily ? startOfLocalDay(q.since) : q.since;
+      const since = daily ? startOfDay(q.since, dayOffsetMinutes) : q.since;
       const until = q.until ?? Number.MAX_SAFE_INTEGER;
       const timeColumn = daily ? "day" : "at";
       const scope = q.apiKeyId;
@@ -23183,6 +23365,7 @@ function createUsageRepo2(db, nodeId) {
 async function createStore(opts) {
   const logger2 = opts.logger ?? noopLogger;
   const nodeId = opts.nodeId ?? crypto.randomUUID();
+  const dayOffsetMinutes = opts.dayOffsetMinutes ?? hostDayOffsetMinutes();
   const listeners = new Set;
   const emit2 = (change) => {
     for (const listener of listeners) {
@@ -23192,14 +23375,14 @@ async function createStore(opts) {
     }
   };
   const open2 = () => {
-    const db = openDb(opts.path);
+    const db = openDb(opts.path, dayOffsetMinutes);
     logger2.debug("store opened", { path: opts.path });
     return {
       db,
       credentials: createCredentialRepo2(db, opts.encryptionKey, emit2),
       config: createConfigRepo2(db, emit2),
       keys: createKeyRepo2(db, logger2),
-      usage: createUsageRepo2(db, nodeId),
+      usage: createUsageRepo2(db, nodeId, dayOffsetMinutes),
       bodies: createBodyRepo2(db, opts.encryptionKey, bodiesDirFor(opts.path)),
       maintenance: createMaintenanceRepo2(db, nodeId),
       plugins: createPluginRepo2(db)
@@ -23225,7 +23408,6 @@ async function createStore(opts) {
       updateSecrets: (id, secrets, expiresAt, expectedVersion) => handle.credentials.updateSecrets(id, secrets, expiresAt, expectedVersion),
       remove: (id) => handle.credentials.remove(id),
       listHealth: () => handle.credentials.listHealth(),
-      saveHealth: (rows) => handle.credentials.saveHealth(rows),
       updateHealth: (id, model, apply) => handle.credentials.updateHealth(id, model, apply),
       listQuota: () => handle.credentials.listQuota(),
       saveQuota: (rows) => handle.credentials.saveQuota(rows),
@@ -23252,6 +23434,7 @@ async function createStore(opts) {
       importRow: (row) => handle.keys.importRow(row),
       setLimits: (id, limits) => handle.keys.setLimits(id, limits),
       setModelAllowlist: (id, modelAllowlist) => handle.keys.setModelAllowlist(id, modelAllowlist),
+      setExpiry: (id, expiresAt) => handle.keys.setExpiry(id, expiresAt),
       revoke: (id) => handle.keys.revoke(id)
     },
     usage: {
@@ -23260,6 +23443,7 @@ async function createStore(opts) {
       append: (log) => handle.usage.append(log),
       sweepPending: (now) => handle.usage.sweepPending(now),
       recent: (limit, apiKeyId) => handle.usage.recent(limit, apiKeyId),
+      lastUsedByCredential: (credentialId) => handle.usage.lastUsedByCredential(credentialId),
       scan: (cursor, limit) => handle.usage.scan(cursor, limit),
       aggregate: (q) => handle.usage.aggregate(q),
       sumSince: (apiKeyId, sinceMs) => handle.usage.sumSince(apiKeyId, sinceMs),
@@ -23353,7 +23537,7 @@ function createAdminAuth(store, opts) {
   };
   const keyStillValid = async (apiKeyId) => {
     const key = await store.keys.get(apiKeyId);
-    return key !== null && key.revokedAt === null;
+    return key !== null && keyUsable(key, opts.now());
   };
   const applyPassword = async (password) => {
     if (password.length < MIN_PASSWORD_LENGTH) {
@@ -23407,7 +23591,7 @@ function createAdminAuth(store, opts) {
     },
     async loginClient(rawKey) {
       const key = await store.keys.findByHash(await hashApiKey(rawKey));
-      if (key === null || key.revokedAt !== null)
+      if (key === null || !keyUsable(key, opts.now()))
         return null;
       return issue2({ kind: "client", apiKeyId: key.id });
     },
@@ -24138,6 +24322,7 @@ var PROVIDER_IDS = Object.keys(PROVIDER_DESCRIPTORS);
 var MIN_KEY_LENGTH = 16;
 var TRUTHY = new Set(["1", "true", "yes", "on"]);
 var DECIMAL_INTEGER = /^\d+$/;
+var SIGNED_INTEGER = /^-?\d+$/;
 function optionalText(value, fallback) {
   return value?.trim() || fallback;
 }
@@ -24168,6 +24353,11 @@ function loadConfig(env) {
   } else if (databaseUrl !== undefined || redisUrl !== undefined) {
     throw new Error("OMNI_DATABASE_URL and OMNI_REDIS_URL are cluster-mode settings; set OMNI_CLUSTER_MODE=true or unset them");
   }
+  const rawDayOffset = env.OMNI_DAY_OFFSET_MINUTES?.trim();
+  const parsedDayOffset = rawDayOffset === undefined ? NaN : Number(rawDayOffset);
+  const validDayOffset = rawDayOffset !== undefined && SIGNED_INTEGER.test(rawDayOffset) && Number.isInteger(parsedDayOffset) && parsedDayOffset >= -1440 && parsedDayOffset <= 1440;
+  const dayOffsetMinutes = validDayOffset ? parsedDayOffset : hostDayOffsetMinutes();
+  const dayOffsetFallbackFrom = rawDayOffset !== undefined && !validDayOffset ? rawDayOffset : null;
   const bodyLoggingAllowed = TRUTHY.has((env.OMNI_BODY_LOGGING_ALLOWED ?? "").trim().toLowerCase());
   const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
   const logLevel = parseLogLevel(rawLogLevel);
@@ -24198,6 +24388,8 @@ function loadConfig(env) {
     clusterMode,
     databaseUrl: clusterMode ? databaseUrl ?? null : null,
     redisUrl: clusterMode ? redisUrl ?? null : null,
+    dayOffsetMinutes,
+    dayOffsetFallbackFrom,
     metricsToken,
     metricsMaxSeries,
     otlpEndpoint,
@@ -30874,16 +31066,19 @@ var modelSchema = exports_external.object({
   isAlias: exports_external.boolean(),
   targets: exports_external.array(targetSchema).min(1, "a virtual model needs at least one target")
 });
+var MAX_INSTANT = 8640000000000000;
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable().default(null),
   limits: limitConfigSchema.default({}),
-  bodyLoggingOptOut: exports_external.boolean().default(false)
+  bodyLoggingOptOut: exports_external.boolean().default(false),
+  expiresAt: exports_external.number().int().positive().max(MAX_INSTANT).nullable().default(null)
 }).strict();
 var keyLimitsSchema = exports_external.object({ limits: limitConfigSchema }).strict();
 var keyModelsSchema = exports_external.object({
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable()
 }).strict();
+var keyExpirySchema = exports_external.object({ expiresAt: exports_external.number().int().positive().max(MAX_INSTANT).nullable() }).strict();
 var retentionSchema = exports_external.object({
   keepLatest: exports_external.number().int().min(1).max(100),
   maxAgeDays: exports_external.number().int().min(1).max(3650)
@@ -31181,10 +31376,11 @@ function eligible(input2) {
         drop("disabled");
         continue;
       }
-      if (credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt <= now && !credential.hasRefreshToken) {
+      if (credentialExpired(credential, now)) {
         drop("expired");
         continue;
       }
+      let probe = false;
       const h = snapshot.health.get(healthKey(credential.id, target.model));
       if (h !== undefined) {
         if (h.rateLimitedUntil !== null && h.rateLimitedUntil > now) {
@@ -31197,6 +31393,9 @@ function eligible(input2) {
             drop("breaker:open");
             continue;
           }
+          probe = true;
+        } else if (h.breakerState === "halfOpen") {
+          probe = true;
         }
       }
       const spent = (snapshot.quota.get(credential.id) ?? []).find((w) => w.limit !== null && w.used >= w.limit && (w.resetsAt === null || w.resetsAt > now));
@@ -31204,7 +31403,7 @@ function eligible(input2) {
         drop(`quota:${spent.windowType}`);
         continue;
       }
-      pairs.push({ credential, target });
+      pairs.push({ credential, target, probe });
     }
     if (target.credentialId === undefined && providerSeen && !servedAny) {
       excluded.push({
@@ -31281,7 +31480,7 @@ function healthScore(h) {
   return h?.breakerState === "open" || h?.breakerState === "halfOpen" ? base * 0.5 : base;
 }
 function score(pairs, input2) {
-  const { snapshot, now, load } = input2;
+  const { snapshot, now, load, recent } = input2;
   const w = snapshot.settings.weights;
   const tiers = pairs.map((p) => p.target.tier);
   const minTier = Math.min(...tiers);
@@ -31289,9 +31488,10 @@ function score(pairs, input2) {
   const tokens2 = estimateTokens(input2.request);
   const costs = pairs.map((p) => requestCost(p.target, tokens2));
   const bestCost = bestPositive(costs);
+  const ewmaOf = (key) => recent?.get(key)?.ewmaTtftMs ?? null;
   const bestLatency = bestPositive(pairs.flatMap((p) => {
-    const h = snapshot.health.get(healthKey(p.credential.id, p.target.model));
-    return h?.ewmaTtftMs != null ? [h.ewmaTtftMs] : [];
+    const ewma = ewmaOf(healthKey(p.credential.id, p.target.model));
+    return ewma === null ? [] : [ewma];
   }));
   return pairs.map((pair, i) => {
     const key = healthKey(pair.credential.id, pair.target.model);
@@ -31303,12 +31503,14 @@ function score(pairs, input2) {
     const quota = quotaHeadroom(pair.credential, snapshot.quota.get(pair.credential.id) ?? [], now, snapshot.settings.quotaPollIntervalMs);
     const ownCost = costs[i];
     const cost = ownCost <= 0 || bestCost === null ? UNKNOWN : ratio(ownCost, bestCost);
-    const latency = h?.ewmaTtftMs == null || h.ewmaTtftMs <= 0 || bestLatency === null ? UNKNOWN : ratio(h.ewmaTtftMs, bestLatency);
+    const ewma = ewmaOf(key);
+    const latency = ewma === null || ewma <= 0 || bestLatency === null ? UNKNOWN : ratio(ewma, bestLatency);
     const reasons = { tier, health, quota, cost, latency, load: loadTerm };
     const base = tier * w.tier + health * w.health + quota * w.quota + cost * w.cost + latency * w.latency + loadTerm * w.load;
     return {
       credential: pair.credential,
       target: pair.target,
+      probe: pair.probe,
       score: base * pair.credential.weight * pair.target.weight,
       reasons
     };
@@ -31348,8 +31550,8 @@ function rank(input2) {
       break;
     case "roundRobin": {
       const idle = (c) => {
-        const h = input2.snapshot.health.get(healthKey(c.credential.id, c.target.model));
-        return h?.lastUsedAt == null ? Number.POSITIVE_INFINITY : input2.now - h.lastUsedAt;
+        const at = input2.recent?.get(healthKey(c.credential.id, c.target.model))?.lastReleasedAt;
+        return at === undefined ? Number.POSITIVE_INFINITY : input2.now - at;
       };
       const spent = (c) => headroom(c) < QUOTA_FLOOR ? 1 : 0;
       scored.sort((a, b) => spent(a) - spent(b) || inflight(a) - inflight(b) || idle(b) - idle(a));
@@ -31521,16 +31723,23 @@ async function refreshCredential(deps, id) {
   return getCredential(deps.store, id);
 }
 async function credentialHealth(deps) {
-  const [health, quota, settings] = await Promise.all([
+  const [health, quota, settings, credentials] = await Promise.all([
     deps.store.credentials.listHealth(),
     deps.store.credentials.listQuota(),
-    deps.store.config.getSettings()
+    deps.store.config.getSettings(),
+    deps.store.credentials.list()
   ]);
+  const lastUsed = {};
+  for (const c of credentials) {
+    const at = await deps.store.usage.lastUsedByCredential(c.id);
+    if (at !== null)
+      lastUsed[c.id] = at;
+  }
   const burn = burnEstimates(quota, {
     now: deps.now(),
     pollIntervalMs: settings.quotaPollIntervalMs
   });
-  return { health, quota, burn };
+  return { health, quota, burn, lastUsed };
 }
 async function credentialStatus(store, options) {
   const [credentials, quota, adminConfigured] = await Promise.all([
@@ -31644,14 +31853,14 @@ function listSnapshots(deps) {
   }
   return snapshots.sort((a, b) => b.createdAt - a.createdAt);
 }
-var DAY_MS = 86400000;
+var DAY_MS2 = 86400000;
 var SNAPSHOT_HEADROOM = 1.1;
 function retentionOf(settings) {
   return { keepLatest: settings.snapshotKeepLatest, maxAgeDays: settings.snapshotMaxAgeDays };
 }
 function applyRetention(deps, policy, now) {
   const dir = snapshotsDir(deps);
-  const cutoff = now - policy.maxAgeDays * DAY_MS;
+  const cutoff = now - policy.maxAgeDays * DAY_MS2;
   const snapshots = listSnapshots(deps);
   const undo = snapshots.find((snapshot) => snapshot.reason === "preRestore")?.id;
   let removed = 0;
@@ -31971,7 +32180,8 @@ async function toSummary(store, key, now) {
     limitUsage: await readLimitUsage(store, key.id, key.limits, now),
     bodyLoggingOptOut: key.bodyLoggingOptOut,
     createdAt: key.createdAt,
-    revokedAt: key.revokedAt
+    revokedAt: key.revokedAt,
+    expiresAt: key.expiresAt
   };
 }
 async function listKeys(store, now = Date.now()) {
@@ -31988,7 +32198,8 @@ async function createKey(store, input2) {
     hash: await hashApiKey(raw),
     modelAllowlist: body2.modelAllowlist,
     limits: body2.limits,
-    bodyLoggingOptOut: body2.bodyLoggingOptOut
+    bodyLoggingOptOut: body2.bodyLoggingOptOut,
+    expiresAt: body2.expiresAt
   });
   return { id: created.id, label: created.label, prefix: created.prefix, key: raw };
 }
@@ -32008,6 +32219,14 @@ async function setKeyModels(store, id, input2, now = Date.now()) {
   await store.keys.setModelAllowlist(id, body2.modelAllowlist);
   return toSummary(store, { ...key, modelAllowlist: body2.modelAllowlist }, now);
 }
+async function setKeyExpiry(store, id, input2, now = Date.now()) {
+  const body2 = parseOrThrow(keyExpirySchema, input2);
+  const key = await store.keys.get(id);
+  if (key === null)
+    throw new GatewayError("BAD_REQUEST", "no such api key");
+  await store.keys.setExpiry(id, body2.expiresAt);
+  return toSummary(store, { ...key, expiresAt: body2.expiresAt }, now);
+}
 async function revokeKey(store, id) {
   await store.keys.revoke(id);
 }
@@ -33476,12 +33695,18 @@ function readsNothing(scope) {
   return scope.kind === "none" || scope.kind === "key" && scope.apiKeyId === "";
 }
 // packages/control/src/quota/history.ts
-var DAY_MS2 = 24 * 60 * 60 * 1000;
+var DAY_MS3 = 24 * 60 * 60 * 1000;
 var HOUR_MS3 = 3600000;
+var MAX_SAMPLES = 50000;
+var SAMPLE_QUERY_LIMIT = MAX_SAMPLES + 1;
+function pageSamples(samples) {
+  const truncated = samples.length > MAX_SAMPLES;
+  return { page: truncated ? samples.slice(0, MAX_SAMPLES) : samples, truncated };
+}
 async function retainedSpan(deps, input2, maxSpanMs) {
   const now = deps.now();
   const settings = await deps.store.config.getSettings();
-  const retained = now - settings.logRetentionDays * DAY_MS2;
+  const retained = now - settings.logRetentionDays * DAY_MS3;
   const oldest = maxSpanMs === undefined ? retained : Math.max(retained, now - maxSpanMs);
   return {
     since: Math.max(optionalNumber(input2.since, oldest), oldest),
@@ -33524,12 +33749,14 @@ async function quotaHistory(deps, input2) {
     deps.store.credentials.listQuotaSamples({
       since,
       until,
+      limit: SAMPLE_QUERY_LIMIT,
       ...credentialId === undefined ? {} : { credentialId }
     }),
     deps.store.credentials.listQuota()
   ]);
   const scoped = credentialId === undefined ? quota : quota.filter((w) => w.credentialId === credentialId);
-  return { samples, gatewayRates: await gatewayRatesFor(deps.store, scoped) };
+  const { page, truncated } = pageSamples(samples);
+  return { samples: page, truncated, gatewayRates: await gatewayRatesFor(deps.store, scoped) };
 }
 
 // packages/control/src/quota/clientHistory.ts
@@ -33924,7 +34151,11 @@ function createContext(parsed2, options = {}) {
         const current = config2;
         if (current === null)
           throw new CliError(configError ?? "invalid configuration");
-        opened = deriveKey(current.encryptionKey).then((key) => createStore({ path: databasePath, encryptionKey: key })).then((created) => {
+        opened = deriveKey(current.encryptionKey).then((key) => createStore({
+          path: databasePath,
+          encryptionKey: key,
+          dayOffsetMinutes: current.dayOffsetMinutes
+        })).then((created) => {
           store = created;
           return created;
         });
@@ -34575,12 +34806,13 @@ var console_ = {
 };
 
 // apps/cli/src/commands/credentials.ts
-function condition(credential) {
+function condition(credential, now) {
   if (!credential.enabled)
     return { ok: false, text: credential.disabledReason ?? "disabled" };
-  if (credential.expiresAt !== null && credential.expiresAt <= Date.now()) {
-    return credential.hasRefreshToken ? { ok: true, text: "expired (refreshable)" } : { ok: false, text: "expired" };
-  }
+  if (credentialExpired(credential, now))
+    return { ok: false, text: "expired" };
+  if (credentialPastExpiry(credential, now))
+    return { ok: true, text: "expired (refreshable)" };
   return { ok: true, text: "enabled" };
 }
 var credentialsList = {
@@ -34601,7 +34833,7 @@ var credentialsList = {
         { header: "STATE" },
         { header: "EXPIRES" }
       ], credentials.map((c) => {
-        const status2 = condition(c);
+        const status2 = condition(c, ctx.now());
         return [
           c.id,
           provider(ctx, c.provider),
@@ -34625,7 +34857,7 @@ var credentialsShow = {
   async run(args, { ctx, writer }) {
     const id = requirePositional(args, 0, "credential id");
     const credential = await findCredential(ctx, id);
-    const status2 = condition(credential);
+    const status2 = condition(credential, ctx.now());
     const data = {
       id: credential.id,
       provider: credential.provider,
@@ -34775,17 +35007,17 @@ var credentialsAddKey = {
 };
 var credentialsHealth = {
   usage: "credentials health",
-  summary: "Show breaker state and latency per credential and model",
+  summary: "Show breaker state per credential and model",
   options: { all: { type: "boolean" } },
   async run(args, { ctx, writer }) {
     const store = await ctx.store();
-    const [{ health: rows }, credentials] = await Promise.all([
+    const [{ health: rows, lastUsed }, credentials] = await Promise.all([
       credentialHealth({ store, now: ctx.now }),
       listCredentials(store)
     ]);
     const labels = new Map(credentials.map((c) => [c.id, c.label]));
     const shown = boolFlag(args.values, "all") ? rows : rows.filter((r) => r.breakerState !== "closed" || r.consecutiveFailures > 0);
-    emit(ctx, writer, { health: rows }, () => {
+    emit(ctx, writer, { health: rows, lastUsed }, () => {
       if (shown.length === 0)
         return "every credential is healthy";
       return table([
@@ -34793,15 +35025,13 @@ var credentialsHealth = {
         { header: "MODEL" },
         { header: "BREAKER" },
         { header: "FAILS", align: "right" },
-        { header: "TTFT", align: "right" },
         { header: "LAST USED" }
       ], shown.map((row) => [
         labels.get(row.credentialId) ?? row.credentialId,
         row.model,
         state(ctx, row.breakerState === "closed", row.breakerState),
         String(row.consecutiveFailures),
-        row.ewmaTtftMs === null ? "\u2014" : `${Math.round(row.ewmaTtftMs)}ms`,
-        paint(ctx, "dim", formatTime(row.lastUsedAt))
+        paint(ctx, "dim", formatTime(lastUsed[row.credentialId] ?? null))
       ]));
     });
   }
@@ -34842,7 +35072,8 @@ var dbMigrate = {
       const source = await ctx.store();
       const target = await createPostgresStore({
         url: to,
-        encryptionKey: await deriveKey(ctx.config().encryptionKey)
+        encryptionKey: await deriveKey(ctx.config().encryptionKey),
+        dayOffsetMinutes: ctx.config().dayOffsetMinutes
       });
       try {
         const report = await copyStore(source, target);
@@ -35148,11 +35379,24 @@ function summarizeLimits(limits) {
   }
   return parts.length === 0 ? "\u2014" : parts.join(" ");
 }
+function parseWhen(flag, raw) {
+  const at = Date.parse(raw);
+  if (!Number.isFinite(at)) {
+    throw new UsageError(`${flag} must be a date, e.g. 2030-01-01, got "${raw}"`);
+  }
+  return at;
+}
+function keyState(key, now) {
+  if (key.revokedAt !== null)
+    return "revoked";
+  return keyUsable(key, now) ? "active" : "expired";
+}
 var keysList = {
   usage: "keys list",
   summary: "List gateway API keys",
   async run(_args, { ctx, writer }) {
     const keys = await listKeys(await ctx.store());
+    const now = Date.now();
     emit(ctx, writer, { keys }, () => {
       if (keys.length === 0)
         return "no api keys; create one with: omni keys create";
@@ -35164,6 +35408,7 @@ var keysList = {
         { header: "LIMITS" },
         { header: "BODY CAPTURE" },
         { header: "STATE" },
+        { header: "EXPIRES" },
         { header: "CREATED" }
       ], keys.map((key) => [
         key.id,
@@ -35172,28 +35417,32 @@ var keysList = {
         key.modelAllowlist === null ? "all" : key.modelAllowlist.length === 0 ? "none" : key.modelAllowlist.join(","),
         key.limits === null ? paint(ctx, "red", "unreadable") : summarizeLimits(key.limits),
         key.bodyLoggingOptOut ? "no bodies" : "\u2014",
-        state(ctx, key.revokedAt === null, key.revokedAt === null ? "active" : "revoked"),
+        ((verdict) => state(ctx, verdict === "active", verdict))(keyState(key, now)),
+        formatTime(key.expiresAt),
         formatTime(key.createdAt)
       ]));
     });
   }
 };
 var keysCreate = {
-  usage: "keys create [--label L] [--allow <model> ...] [--limit <d>:<w>=N ...] [--no-bodies]",
+  usage: "keys create [--label L] [--allow <model> ...] [--limit <d>:<w>=N ...] [--expires <when>] [--no-bodies]",
   summary: "Mint a gateway API key, printed once",
   options: {
     label: { type: "string" },
     allow: { type: "string", multiple: true },
     limit: { type: "string", multiple: true },
+    expires: { type: "string" },
     "no-bodies": { type: "boolean" }
   },
   async run(args, { ctx, writer }) {
     const allow = listFlag(args.values, "allow");
+    const expires = stringFlag(args.values, "expires");
     const created = await createKey(await ctx.store(), {
       ...stringFlag(args.values, "label") === undefined ? {} : { label: stringFlag(args.values, "label") },
       modelAllowlist: allow ?? null,
       limits: parseLimitFlags(listFlag(args.values, "limit") ?? [], "--limit"),
-      bodyLoggingOptOut: boolFlag(args.values, "no-bodies")
+      bodyLoggingOptOut: boolFlag(args.values, "no-bodies"),
+      expiresAt: expires === undefined ? null : parseWhen("--expires", expires)
     });
     emit(ctx, writer, created, () => {
       note(ctx, writer, paint(ctx, "yellow", "this key is shown once and stored only as a hash"));
@@ -35260,6 +35509,44 @@ ${paint(ctx, "dim", "usage is counted from completed requests still inside each
     });
   }
 };
+var keysExpiry = {
+  usage: "keys expiry <id> [--at <when>] [--never]",
+  summary: "Show or replace one key's expiry",
+  options: {
+    at: { type: "string" },
+    never: { type: "boolean" }
+  },
+  async run(args, { ctx, writer }) {
+    const id = requirePositional(args, 0, "key id");
+    const at = stringFlag(args.values, "at");
+    const never2 = boolFlag(args.values, "never");
+    const store = await ctx.store();
+    const existing = (await listKeys(store)).find((entry) => entry.id === id);
+    if (existing === undefined)
+      throw new CliError(`no api key "${id}"`);
+    let key = existing;
+    if (never2 || at !== undefined) {
+      if (never2 && at !== undefined) {
+        throw new UsageError("--at and --never cannot be combined");
+      }
+      const next = never2 ? null : parseWhen("--at", at);
+      key = await setKeyExpiry(store, id, { expiresAt: next });
+    }
+    emit(ctx, writer, key, () => {
+      const head = fields([
+        ["id", key.id],
+        ["label", key.label],
+        ["prefix", `${key.prefix}\u2026`]
+      ]);
+      if (key.expiresAt === null)
+        return `${head}
+expires: never`;
+      const verdict = keyState(key, Date.now());
+      return `${head}
+expires: ${formatTime(key.expiresAt)}${verdict === "expired" ? ` ${paint(ctx, "red", "(expired)")}` : ""}`;
+    });
+  }
+};
 var keysRevoke = {
   usage: "keys revoke <id>",
   summary: "Revoke a gateway API key, keeping its usage history",
@@ -35755,7 +36042,7 @@ function createServiceDeps(input2) {
 }
 
 // apps/cli/src/version.ts
-var VERSION = "0.10.3";
+var VERSION = "0.11.1";
 
 // apps/cli/src/commands/service.ts
 function gatewayArgv(root) {
@@ -36355,7 +36642,7 @@ var logs = {
       return;
     let seen = first[0]?.at ?? 0;
     for (;; ) {
-      await Bun.sleep(2000);
+      await Bun.sleep(FOLLOW_INTERVAL_MS);
       const next = (await recentLogs(store, limit)).filter((row) => row.at > seen);
       if (next.length === 0)
         continue;
@@ -36399,6 +36686,7 @@ var COMMANDS = {
   "keys create": keysCreate,
   "keys limits": keysLimits,
   "keys models": keysModels,
+  "keys expiry": keysExpiry,
   "keys revoke": keysRevoke,
   "plugin list": pluginList,
   "plugin verify": pluginVerify,