omnigateway 0.11.0 → 0.11.2

package/README.md

@@ -174,6 +174,22 @@ pair is unlimited. Windows slide, `tokens` and `spend` are debited on
 completion, and limits are editable afterwards with `omni keys limits`; the
 semantics are in [docs/operations.md](docs/operations.md#key-limits).
 
+A key can also carry an expiry, which is optional and off by default — a key
+with none works until it is revoked, and no upgrade ever attaches one:
+
+```bash
+omni keys create --label contractor --expires 2027-01-01
+omni keys expiry <id> --at 2027-06-01T12:00:00Z   # move it
+omni keys expiry <id> --never                     # take it away
+```
+
+Past the instant, every request the key makes is refused with the same answer a
+revoked or unknown key gets — deliberately indistinguishable. Unlike
+`omni keys revoke` this is reversible: a date already behind the clock is
+accepted and means "stop it now", and `--never` brings the key back. Expired
+keys stay listed, with their own state in `omni keys list` and on the console's
+keys board, so a client that stopped working can be found rather than guessed at.
+
 Now use it:
 
 ```bash
@@ -265,23 +281,6 @@ Several replicas behind a load balancer are **cluster mode** on Postgres and
 Redis. All of it, with the nginx block and the Kubernetes base, is in
 [docs/deploying.md](docs/deploying.md).
 
-### Upgrading past v0.10.3 — action required
-
-The first release after v0.10.3 drops two columns from `credential_health`
-that every earlier gateway writes on **every successful request**. The moment
-the new version migrates the database, every older gateway still running fails
-each request *after* the upstream call has completed and been billed: the
-client gets its content and then an aborted connection with no terminal frame.
-
-- **Cluster mode:** a rolling deploy does not protect you — the surviving old
-  replica is the one that breaks. Scale to **one replica** before deploying
-  this release, then scale back up, or accept that every old replica serves
-  only failures until it is replaced.
-- **Single process (SQLite):** the upgrade itself is safe; the rollback is not.
-- **Rollback is unsafe on both.** An older version cannot re-add the columns
-  and fails the same way against the new schema. Take a snapshot **before** the
-  deploy; restoring it is the only way back.
-
 ## Configuration
 
 Configuration is environment variables, read from the installation's `.env`:

package/bin/omni.js

@@ -75,7 +75,10 @@ function note(ctx, writer, message) {
 function formatTime(at) {
   if (at === null || !Number.isFinite(at))
     return "\u2014";
-  return new Date(at).toISOString().replace("T", " ").slice(0, 19);
+  const date = new Date(at);
+  if (Number.isNaN(date.getTime()))
+    return "out of range";
+  return date.toISOString().replace("T", " ").slice(0, 19);
 }
 function formatAge(from, now) {
   if (from === null || !Number.isFinite(from))
@@ -20124,13 +20127,34 @@ CREATE TRIGGER credential_health_config_version_del
   FOR EACH STATEMENT EXECUTE FUNCTION bump_config_version();
 `;
 
+// packages/store/src/postgres/migrations/003_key_expiry.sql
+var _003_key_expiry_default = `-- The Postgres half of the sqlite migration of the same name. \`BIGINT\`, like
+-- every other epoch-ms column in this schema, and read back through \`numOrNull\`.
+--
+-- Nullable rather than \`NOT NULL DEFAULT\`: the column is a deadline, and every
+-- finite default is a date on which somebody's client stops working. NULL is
+-- the only value that says nothing was decided, and every reader maps it to
+-- "never expires".
+--
+-- No backfill, deliberately. Every key on every existing installation was
+-- minted on the promise that it works until revoked, so adding the column and
+-- stopping is what keeps that promise. The absence of an \`UPDATE\` here is the
+-- substance of the migration, not an omission.
+--
+-- Safe to apply under a rolling deploy, unlike migration 2: this adds a
+-- nullable column and drops nothing, so a replica running the previous image
+-- keeps serving \u2014 \`SELECT *\` gains a field its mapper ignores.
+ALTER TABLE api_keys ADD COLUMN expires_at BIGINT;
+`;
+
 // packages/store/src/postgres/db.ts
 var num = (v) => Number(v);
 var numOrNull = (v) => v === null ? null : Number(v);
 var MIGRATION_LOCK = 7140641;
 var MIGRATIONS = [
   { id: 1, sql: _001_init_default },
-  { id: 2, sql: _002_health_measurements_default }
+  { id: 2, sql: _002_health_measurements_default },
+  { id: 3, sql: _003_key_expiry_default }
 ];
 async function openPg(url2) {
   const sql = new SQL({ url: url2 });
@@ -20328,6 +20352,9 @@ function resolvePin(target, accounts) {
     return;
   return accounts.find((account) => servesTarget(target, account));
 }
+var keyUsable = (key, now) => key.revokedAt === null && (key.expiresAt === null || key.expiresAt > now);
+var credentialPastExpiry = (credential, now) => credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt <= now;
+var credentialExpired = (credential, now) => credentialPastExpiry(credential, now) && !credential.hasRefreshToken;
 var NODE_GRACE_MS = 60000;
 var DEFAULT_SETTINGS = {
   weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
@@ -20807,7 +20834,8 @@ var toKey = (r, logger2) => ({
   limits: parseLimits(r.id, r.limits, logger2),
   bodyLoggingOptOut: r.body_logging_opt_out,
   createdAt: num(r.created_at),
-  revokedAt: numOrNull(r.revoked_at)
+  revokedAt: numOrNull(r.revoked_at),
+  expiresAt: numOrNull(r.expires_at)
 });
 function createKeyRepo(sql, logger2) {
   const one = async (where, arg) => {
@@ -20825,8 +20853,8 @@ function createKeyRepo(sql, logger2) {
     async create(input2) {
       const now = Date.now();
       await sql.unsafe(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NULL)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NULL,$9)`, [
         input2.id,
         input2.label,
         input2.prefix,
@@ -20834,7 +20862,8 @@ function createKeyRepo(sql, logger2) {
         input2.modelAllowlist === null ? null : JSON.stringify(input2.modelAllowlist),
         JSON.stringify(parseLimitConfig(input2.limits)),
         input2.bodyLoggingOptOut,
-        now
+        now,
+        input2.expiresAt
       ]);
       return { ...input2, createdAt: now, revokedAt: null };
     },
@@ -20842,8 +20871,8 @@ function createKeyRepo(sql, logger2) {
       if (row.limits === null)
         throw new Error(`api key ${row.id} has unreadable limits`);
       await sql.unsafe(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)`, [
         row.id,
         row.label,
         row.prefix,
@@ -20852,7 +20881,8 @@ function createKeyRepo(sql, logger2) {
         JSON.stringify(parseLimitConfig(row.limits)),
         row.bodyLoggingOptOut,
         row.createdAt,
-        row.revokedAt
+        row.revokedAt,
+        row.expiresAt
       ]);
     },
     async setLimits(id, limits) {
@@ -20867,6 +20897,9 @@ function createKeyRepo(sql, logger2) {
         id
       ]);
     },
+    async setExpiry(id, expiresAt) {
+      await sql.unsafe("UPDATE api_keys SET expires_at = $1 WHERE id = $2", [expiresAt, id]);
+    },
     async revoke(id) {
       await sql.unsafe("UPDATE api_keys SET revoked_at = $1 WHERE id = $2", [Date.now(), id]);
     }
@@ -22671,6 +22704,35 @@ ALTER TABLE credential_health DROP COLUMN ewma_ttft_ms;
 ALTER TABLE credential_health DROP COLUMN last_used_at;
 `;
 
+// packages/store/src/sqlite/migrations/014_key_expiry.sql
+var _014_key_expiry_default = `-- An optional expiry on a gateway API key: an absolute epoch-ms instant after
+-- which the key is refused, spelled exactly as \`credentials.expires_at\` is.
+--
+-- Nullable rather than \`NOT NULL DEFAULT\`, which is the opposite of the choice
+-- migration 9 made for \`limits\`, and for the opposite reason. There, every
+-- possible value is a policy and \`{}\` is the one that means "no ceiling", so a
+-- default gives "unlimited" a single spelling. Here the column is a deadline,
+-- and no number means "no deadline" \u2014 every finite default is a date on which
+-- somebody's client stops working. NULL is the only value that says nothing was
+-- decided, so it is the column's own default and every reader maps it to
+-- "never expires".
+--
+-- No backfill, deliberately, and this is the whole substance of the migration.
+-- Every key on every existing installation was minted on the promise that it
+-- works until revoked; an upgrade that attaches an expiry to those rows breaks
+-- clients on a date the operator never chose, and the failure surfaces days
+-- later as an authentication error with nothing in it that names this change.
+-- Adding the column and stopping is what keeps that promise, so the absence of
+-- an \`UPDATE\` here is load-bearing rather than an omission \u2014
+-- \`packages/store/test/migrations.test.ts\` pins it.
+--
+-- No index. The column is read only after a row has already been found by
+-- \`hash\` or by \`id\`, both of which are unique, so there is no scan for an index
+-- to help; and nothing sweeps expired keys, because an expired key stays listed
+-- exactly as a revoked one does so its usage history keeps its attribution.
+ALTER TABLE api_keys ADD COLUMN expires_at INTEGER;
+`;
+
 // packages/store/src/sqlite/db.ts
 var MIGRATIONS2 = [
   { id: 1, sql: _001_init_default2 },
@@ -22685,7 +22747,8 @@ var MIGRATIONS2 = [
   { id: 10, sql: _010_usage_rollup_default, after: rebuildRollup },
   { id: 11, sql: _011_plugin_migrations_default },
   { id: 12, sql: _012_nodes_default },
-  { id: 13, sql: _013_health_measurements_default }
+  { id: 13, sql: _013_health_measurements_default },
+  { id: 14, sql: _014_key_expiry_default }
 ];
 function statements(sql) {
   return sql.split(`
@@ -22741,7 +22804,8 @@ var toKey2 = (r, logger2) => ({
   limits: parseLimits2(r.id, r.limits, logger2),
   bodyLoggingOptOut: r.body_logging_opt_out === 1,
   createdAt: r.created_at,
-  revokedAt: r.revoked_at
+  revokedAt: r.revoked_at,
+  expiresAt: r.expires_at
 });
 function createKeyRepo2(db, logger2 = noopLogger) {
   return {
@@ -22759,8 +22823,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
     async create(input2) {
       const now = Date.now();
       db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,?,NULL)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES (?,?,?,?,?,?,?,?,NULL,?)`, [
         input2.id,
         input2.label,
         input2.prefix,
@@ -22768,7 +22832,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         input2.modelAllowlist === null ? null : JSON.stringify(input2.modelAllowlist),
         JSON.stringify(parseLimitConfig(input2.limits)),
         input2.bodyLoggingOptOut ? 1 : 0,
-        now
+        now,
+        input2.expiresAt
       ]);
       return { ...input2, createdAt: now, revokedAt: null };
     },
@@ -22776,8 +22841,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
       if (row.limits === null)
         throw new Error(`api key ${row.id} has unreadable limits`);
       db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,?,?)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES (?,?,?,?,?,?,?,?,?,?)`, [
         row.id,
         row.label,
         row.prefix,
@@ -22786,7 +22851,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         JSON.stringify(parseLimitConfig(row.limits)),
         row.bodyLoggingOptOut ? 1 : 0,
         row.createdAt,
-        row.revokedAt
+        row.revokedAt,
+        row.expiresAt
       ]);
     },
     async setLimits(id, limits) {
@@ -22801,6 +22867,9 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         id
       ]);
     },
+    async setExpiry(id, expiresAt) {
+      db.run("UPDATE api_keys SET expires_at = ? WHERE id = ?", [expiresAt, id]);
+    },
     async revoke(id) {
       db.run("UPDATE api_keys SET revoked_at = ? WHERE id = ?", [Date.now(), id]);
     }
@@ -23365,6 +23434,7 @@ async function createStore(opts) {
       importRow: (row) => handle.keys.importRow(row),
       setLimits: (id, limits) => handle.keys.setLimits(id, limits),
       setModelAllowlist: (id, modelAllowlist) => handle.keys.setModelAllowlist(id, modelAllowlist),
+      setExpiry: (id, expiresAt) => handle.keys.setExpiry(id, expiresAt),
       revoke: (id) => handle.keys.revoke(id)
     },
     usage: {
@@ -23467,7 +23537,7 @@ function createAdminAuth(store, opts) {
   };
   const keyStillValid = async (apiKeyId) => {
     const key = await store.keys.get(apiKeyId);
-    return key !== null && key.revokedAt === null;
+    return key !== null && keyUsable(key, opts.now());
   };
   const applyPassword = async (password) => {
     if (password.length < MIN_PASSWORD_LENGTH) {
@@ -23521,7 +23591,7 @@ function createAdminAuth(store, opts) {
     },
     async loginClient(rawKey) {
       const key = await store.keys.findByHash(await hashApiKey(rawKey));
-      if (key === null || key.revokedAt !== null)
+      if (key === null || !keyUsable(key, opts.now()))
         return null;
       return issue2({ kind: "client", apiKeyId: key.id });
     },
@@ -30996,16 +31066,19 @@ var modelSchema = exports_external.object({
   isAlias: exports_external.boolean(),
   targets: exports_external.array(targetSchema).min(1, "a virtual model needs at least one target")
 });
+var MAX_INSTANT = 8640000000000000;
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable().default(null),
   limits: limitConfigSchema.default({}),
-  bodyLoggingOptOut: exports_external.boolean().default(false)
+  bodyLoggingOptOut: exports_external.boolean().default(false),
+  expiresAt: exports_external.number().int().positive().max(MAX_INSTANT).nullable().default(null)
 }).strict();
 var keyLimitsSchema = exports_external.object({ limits: limitConfigSchema }).strict();
 var keyModelsSchema = exports_external.object({
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable()
 }).strict();
+var keyExpirySchema = exports_external.object({ expiresAt: exports_external.number().int().positive().max(MAX_INSTANT).nullable() }).strict();
 var retentionSchema = exports_external.object({
   keepLatest: exports_external.number().int().min(1).max(100),
   maxAgeDays: exports_external.number().int().min(1).max(3650)
@@ -31303,7 +31376,7 @@ function eligible(input2) {
         drop("disabled");
         continue;
       }
-      if (credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt <= now && !credential.hasRefreshToken) {
+      if (credentialExpired(credential, now)) {
         drop("expired");
         continue;
       }
@@ -32107,7 +32180,8 @@ async function toSummary(store, key, now) {
     limitUsage: await readLimitUsage(store, key.id, key.limits, now),
     bodyLoggingOptOut: key.bodyLoggingOptOut,
     createdAt: key.createdAt,
-    revokedAt: key.revokedAt
+    revokedAt: key.revokedAt,
+    expiresAt: key.expiresAt
   };
 }
 async function listKeys(store, now = Date.now()) {
@@ -32124,7 +32198,8 @@ async function createKey(store, input2) {
     hash: await hashApiKey(raw),
     modelAllowlist: body2.modelAllowlist,
     limits: body2.limits,
-    bodyLoggingOptOut: body2.bodyLoggingOptOut
+    bodyLoggingOptOut: body2.bodyLoggingOptOut,
+    expiresAt: body2.expiresAt
   });
   return { id: created.id, label: created.label, prefix: created.prefix, key: raw };
 }
@@ -32144,6 +32219,14 @@ async function setKeyModels(store, id, input2, now = Date.now()) {
   await store.keys.setModelAllowlist(id, body2.modelAllowlist);
   return toSummary(store, { ...key, modelAllowlist: body2.modelAllowlist }, now);
 }
+async function setKeyExpiry(store, id, input2, now = Date.now()) {
+  const body2 = parseOrThrow(keyExpirySchema, input2);
+  const key = await store.keys.get(id);
+  if (key === null)
+    throw new GatewayError("BAD_REQUEST", "no such api key");
+  await store.keys.setExpiry(id, body2.expiresAt);
+  return toSummary(store, { ...key, expiresAt: body2.expiresAt }, now);
+}
 async function revokeKey(store, id) {
   await store.keys.revoke(id);
 }
@@ -33614,6 +33697,12 @@ function readsNothing(scope) {
 // packages/control/src/quota/history.ts
 var DAY_MS3 = 24 * 60 * 60 * 1000;
 var HOUR_MS3 = 3600000;
+var MAX_SAMPLES = 50000;
+var SAMPLE_QUERY_LIMIT = MAX_SAMPLES + 1;
+function pageSamples(samples) {
+  const truncated = samples.length > MAX_SAMPLES;
+  return { page: truncated ? samples.slice(0, MAX_SAMPLES) : samples, truncated };
+}
 async function retainedSpan(deps, input2, maxSpanMs) {
   const now = deps.now();
   const settings = await deps.store.config.getSettings();
@@ -33660,12 +33749,14 @@ async function quotaHistory(deps, input2) {
     deps.store.credentials.listQuotaSamples({
       since,
       until,
+      limit: SAMPLE_QUERY_LIMIT,
       ...credentialId === undefined ? {} : { credentialId }
     }),
     deps.store.credentials.listQuota()
   ]);
   const scoped = credentialId === undefined ? quota : quota.filter((w) => w.credentialId === credentialId);
-  return { samples, gatewayRates: await gatewayRatesFor(deps.store, scoped) };
+  const { page, truncated } = pageSamples(samples);
+  return { samples: page, truncated, gatewayRates: await gatewayRatesFor(deps.store, scoped) };
 }
 
 // packages/control/src/quota/clientHistory.ts
@@ -34715,12 +34806,13 @@ var console_ = {
 };
 
 // apps/cli/src/commands/credentials.ts
-function condition(credential) {
+function condition(credential, now) {
   if (!credential.enabled)
     return { ok: false, text: credential.disabledReason ?? "disabled" };
-  if (credential.expiresAt !== null && credential.expiresAt <= Date.now()) {
-    return credential.hasRefreshToken ? { ok: true, text: "expired (refreshable)" } : { ok: false, text: "expired" };
-  }
+  if (credentialExpired(credential, now))
+    return { ok: false, text: "expired" };
+  if (credentialPastExpiry(credential, now))
+    return { ok: true, text: "expired (refreshable)" };
   return { ok: true, text: "enabled" };
 }
 var credentialsList = {
@@ -34741,7 +34833,7 @@ var credentialsList = {
         { header: "STATE" },
         { header: "EXPIRES" }
       ], credentials.map((c) => {
-        const status2 = condition(c);
+        const status2 = condition(c, ctx.now());
         return [
           c.id,
           provider(ctx, c.provider),
@@ -34765,7 +34857,7 @@ var credentialsShow = {
   async run(args, { ctx, writer }) {
     const id = requirePositional(args, 0, "credential id");
     const credential = await findCredential(ctx, id);
-    const status2 = condition(credential);
+    const status2 = condition(credential, ctx.now());
     const data = {
       id: credential.id,
       provider: credential.provider,
@@ -35287,11 +35379,24 @@ function summarizeLimits(limits) {
   }
   return parts.length === 0 ? "\u2014" : parts.join(" ");
 }
+function parseWhen(flag, raw) {
+  const at = Date.parse(raw);
+  if (!Number.isFinite(at)) {
+    throw new UsageError(`${flag} must be a date, e.g. 2030-01-01, got "${raw}"`);
+  }
+  return at;
+}
+function keyState(key, now) {
+  if (key.revokedAt !== null)
+    return "revoked";
+  return keyUsable(key, now) ? "active" : "expired";
+}
 var keysList = {
   usage: "keys list",
   summary: "List gateway API keys",
   async run(_args, { ctx, writer }) {
     const keys = await listKeys(await ctx.store());
+    const now = Date.now();
     emit(ctx, writer, { keys }, () => {
       if (keys.length === 0)
         return "no api keys; create one with: omni keys create";
@@ -35303,6 +35408,7 @@ var keysList = {
         { header: "LIMITS" },
         { header: "BODY CAPTURE" },
         { header: "STATE" },
+        { header: "EXPIRES" },
         { header: "CREATED" }
       ], keys.map((key) => [
         key.id,
@@ -35311,28 +35417,32 @@ var keysList = {
         key.modelAllowlist === null ? "all" : key.modelAllowlist.length === 0 ? "none" : key.modelAllowlist.join(","),
         key.limits === null ? paint(ctx, "red", "unreadable") : summarizeLimits(key.limits),
         key.bodyLoggingOptOut ? "no bodies" : "\u2014",
-        state(ctx, key.revokedAt === null, key.revokedAt === null ? "active" : "revoked"),
+        ((verdict) => state(ctx, verdict === "active", verdict))(keyState(key, now)),
+        formatTime(key.expiresAt),
         formatTime(key.createdAt)
       ]));
     });
   }
 };
 var keysCreate = {
-  usage: "keys create [--label L] [--allow <model> ...] [--limit <d>:<w>=N ...] [--no-bodies]",
+  usage: "keys create [--label L] [--allow <model> ...] [--limit <d>:<w>=N ...] [--expires <when>] [--no-bodies]",
   summary: "Mint a gateway API key, printed once",
   options: {
     label: { type: "string" },
     allow: { type: "string", multiple: true },
     limit: { type: "string", multiple: true },
+    expires: { type: "string" },
     "no-bodies": { type: "boolean" }
   },
   async run(args, { ctx, writer }) {
     const allow = listFlag(args.values, "allow");
+    const expires = stringFlag(args.values, "expires");
     const created = await createKey(await ctx.store(), {
       ...stringFlag(args.values, "label") === undefined ? {} : { label: stringFlag(args.values, "label") },
       modelAllowlist: allow ?? null,
       limits: parseLimitFlags(listFlag(args.values, "limit") ?? [], "--limit"),
-      bodyLoggingOptOut: boolFlag(args.values, "no-bodies")
+      bodyLoggingOptOut: boolFlag(args.values, "no-bodies"),
+      expiresAt: expires === undefined ? null : parseWhen("--expires", expires)
     });
     emit(ctx, writer, created, () => {
       note(ctx, writer, paint(ctx, "yellow", "this key is shown once and stored only as a hash"));
@@ -35399,6 +35509,44 @@ ${paint(ctx, "dim", "usage is counted from completed requests still inside each
     });
   }
 };
+var keysExpiry = {
+  usage: "keys expiry <id> [--at <when>] [--never]",
+  summary: "Show or replace one key's expiry",
+  options: {
+    at: { type: "string" },
+    never: { type: "boolean" }
+  },
+  async run(args, { ctx, writer }) {
+    const id = requirePositional(args, 0, "key id");
+    const at = stringFlag(args.values, "at");
+    const never2 = boolFlag(args.values, "never");
+    const store = await ctx.store();
+    const existing = (await listKeys(store)).find((entry) => entry.id === id);
+    if (existing === undefined)
+      throw new CliError(`no api key "${id}"`);
+    let key = existing;
+    if (never2 || at !== undefined) {
+      if (never2 && at !== undefined) {
+        throw new UsageError("--at and --never cannot be combined");
+      }
+      const next = never2 ? null : parseWhen("--at", at);
+      key = await setKeyExpiry(store, id, { expiresAt: next });
+    }
+    emit(ctx, writer, key, () => {
+      const head = fields([
+        ["id", key.id],
+        ["label", key.label],
+        ["prefix", `${key.prefix}\u2026`]
+      ]);
+      if (key.expiresAt === null)
+        return `${head}
+expires: never`;
+      const verdict = keyState(key, Date.now());
+      return `${head}
+expires: ${formatTime(key.expiresAt)}${verdict === "expired" ? ` ${paint(ctx, "red", "(expired)")}` : ""}`;
+    });
+  }
+};
 var keysRevoke = {
   usage: "keys revoke <id>",
   summary: "Revoke a gateway API key, keeping its usage history",
@@ -35894,7 +36042,7 @@ function createServiceDeps(input2) {
 }
 
 // apps/cli/src/version.ts
-var VERSION = "0.11.0";
+var VERSION = "0.11.2";
 
 // apps/cli/src/commands/service.ts
 function gatewayArgv(root) {
@@ -36494,7 +36642,7 @@ var logs = {
       return;
     let seen = first[0]?.at ?? 0;
     for (;; ) {
-      await Bun.sleep(2000);
+      await Bun.sleep(FOLLOW_INTERVAL_MS);
       const next = (await recentLogs(store, limit)).filter((row) => row.at > seen);
       if (next.length === 0)
         continue;
@@ -36538,6 +36686,7 @@ var COMMANDS = {
   "keys create": keysCreate,
   "keys limits": keysLimits,
   "keys models": keysModels,
+  "keys expiry": keysExpiry,
   "keys revoke": keysRevoke,
   "plugin list": pluginList,
   "plugin verify": pluginVerify,