paygate-mcp 2.6.0 → 2.8.0

package/dist/config-validator.js

@@ -0,0 +1,290 @@
+"use strict";
+/**
+ * Config Validator — Validates PayGate config files and CLI flags before starting.
+ *
+ * Returns a list of diagnostic messages (errors and warnings) so operators can
+ * catch misconfigurations before the server starts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateConfig = validateConfig;
+exports.formatDiagnostics = formatDiagnostics;
+/**
+ * Validate a PayGate config object. Returns an array of diagnostics.
+ * Empty array = valid config.
+ */
+function validateConfig(config) {
+    const diags = [];
+    // ─── Backend source validation ──────────────────────────────────────────
+    const hasServer = !!(config.serverCommand);
+    const hasRemote = !!(config.remoteUrl);
+    const hasMulti = !!(config.servers && config.servers.length > 0);
+    if (!hasServer && !hasRemote && !hasMulti) {
+        diags.push({
+            level: 'error',
+            field: 'serverCommand | remoteUrl | servers',
+            message: 'No backend configured. Provide serverCommand, remoteUrl, or servers[].',
+        });
+    }
+    if (hasMulti && (hasServer || hasRemote)) {
+        diags.push({
+            level: 'error',
+            field: 'servers',
+            message: 'Cannot combine servers[] with serverCommand or remoteUrl. Use one or the other.',
+        });
+    }
+    if (hasServer && hasRemote) {
+        diags.push({
+            level: 'error',
+            field: 'serverCommand | remoteUrl',
+            message: 'Cannot specify both serverCommand and remoteUrl. Use one or the other.',
+        });
+    }
+    // ─── Multi-server validation ────────────────────────────────────────────
+    if (hasMulti && config.servers) {
+        const prefixes = new Set();
+        for (let i = 0; i < config.servers.length; i++) {
+            const s = config.servers[i];
+            if (!s.prefix) {
+                diags.push({
+                    level: 'error',
+                    field: `servers[${i}].prefix`,
+                    message: `Server at index ${i} is missing required "prefix" field.`,
+                });
+            }
+            else {
+                if (prefixes.has(s.prefix)) {
+                    diags.push({
+                        level: 'error',
+                        field: `servers[${i}].prefix`,
+                        message: `Duplicate prefix "${s.prefix}". Each server must have a unique prefix.`,
+                    });
+                }
+                prefixes.add(s.prefix);
+                if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(s.prefix)) {
+                    diags.push({
+                        level: 'warning',
+                        field: `servers[${i}].prefix`,
+                        message: `Prefix "${s.prefix}" contains special characters. Recommended: alphanumeric, hyphens, underscores.`,
+                    });
+                }
+            }
+            if (!s.serverCommand && !s.remoteUrl) {
+                diags.push({
+                    level: 'error',
+                    field: `servers[${i}]`,
+                    message: `Server "${s.prefix || i}" has no serverCommand or remoteUrl.`,
+                });
+            }
+            if (s.serverCommand && s.remoteUrl) {
+                diags.push({
+                    level: 'error',
+                    field: `servers[${i}]`,
+                    message: `Server "${s.prefix || i}" has both serverCommand and remoteUrl. Use one.`,
+                });
+            }
+        }
+    }
+    // ─── Port validation ────────────────────────────────────────────────────
+    if (config.port !== undefined) {
+        if (!Number.isInteger(config.port) || config.port < 0 || config.port > 65535) {
+            diags.push({
+                level: 'error',
+                field: 'port',
+                message: `Invalid port ${config.port}. Must be 0–65535.`,
+            });
+        }
+    }
+    // ─── Numeric field validation ──────────────────────────────────────────
+    if (config.defaultCreditsPerCall !== undefined) {
+        if (!Number.isFinite(config.defaultCreditsPerCall) || config.defaultCreditsPerCall < 0) {
+            diags.push({
+                level: 'error',
+                field: 'defaultCreditsPerCall',
+                message: `Invalid defaultCreditsPerCall: ${config.defaultCreditsPerCall}. Must be >= 0.`,
+            });
+        }
+    }
+    if (config.globalRateLimitPerMin !== undefined) {
+        if (!Number.isFinite(config.globalRateLimitPerMin) || config.globalRateLimitPerMin < 0) {
+            diags.push({
+                level: 'error',
+                field: 'globalRateLimitPerMin',
+                message: `Invalid globalRateLimitPerMin: ${config.globalRateLimitPerMin}. Must be >= 0.`,
+            });
+        }
+    }
+    if (config.webhookMaxRetries !== undefined) {
+        if (!Number.isInteger(config.webhookMaxRetries) || config.webhookMaxRetries < 0) {
+            diags.push({
+                level: 'error',
+                field: 'webhookMaxRetries',
+                message: `Invalid webhookMaxRetries: ${config.webhookMaxRetries}. Must be a non-negative integer.`,
+            });
+        }
+    }
+    // ─── Webhook validation ────────────────────────────────────────────────
+    if (config.webhookSecret && !config.webhookUrl) {
+        diags.push({
+            level: 'warning',
+            field: 'webhookSecret',
+            message: 'webhookSecret is set but webhookUrl is not. Secret will be ignored.',
+        });
+    }
+    if (config.webhookUrl) {
+        try {
+            new URL(config.webhookUrl);
+        }
+        catch {
+            diags.push({
+                level: 'error',
+                field: 'webhookUrl',
+                message: `Invalid webhookUrl: "${config.webhookUrl}". Must be a valid URL.`,
+            });
+        }
+    }
+    // ─── Redis URL validation ──────────────────────────────────────────────
+    if (config.redisUrl) {
+        try {
+            const url = new URL(config.redisUrl);
+            if (url.protocol !== 'redis:' && url.protocol !== 'rediss:') {
+                diags.push({
+                    level: 'error',
+                    field: 'redisUrl',
+                    message: `Invalid redisUrl protocol "${url.protocol}". Expected "redis://" or "rediss://".`,
+                });
+            }
+        }
+        catch {
+            diags.push({
+                level: 'error',
+                field: 'redisUrl',
+                message: `Invalid redisUrl: "${config.redisUrl}". Must be a valid redis:// URL.`,
+            });
+        }
+    }
+    // ─── Tool pricing validation ───────────────────────────────────────────
+    if (config.toolPricing) {
+        for (const [tool, pricing] of Object.entries(config.toolPricing)) {
+            if (pricing.creditsPerCall !== undefined && (!Number.isFinite(pricing.creditsPerCall) || pricing.creditsPerCall < 0)) {
+                diags.push({
+                    level: 'error',
+                    field: `toolPricing.${tool}.creditsPerCall`,
+                    message: `Invalid creditsPerCall for "${tool}": ${pricing.creditsPerCall}. Must be >= 0.`,
+                });
+            }
+            if (pricing.rateLimitPerMin !== undefined && (!Number.isFinite(pricing.rateLimitPerMin) || pricing.rateLimitPerMin < 0)) {
+                diags.push({
+                    level: 'error',
+                    field: `toolPricing.${tool}.rateLimitPerMin`,
+                    message: `Invalid rateLimitPerMin for "${tool}": ${pricing.rateLimitPerMin}. Must be >= 0.`,
+                });
+            }
+        }
+    }
+    // ─── Quota validation ──────────────────────────────────────────────────
+    if (config.globalQuota) {
+        const q = config.globalQuota;
+        for (const field of ['dailyCallLimit', 'monthlyCallLimit', 'dailyCreditLimit', 'monthlyCreditLimit']) {
+            const val = q[field];
+            if (val !== undefined && (!Number.isFinite(val) || val < 0)) {
+                diags.push({
+                    level: 'error',
+                    field: `globalQuota.${field}`,
+                    message: `Invalid ${field}: ${val}. Must be >= 0.`,
+                });
+            }
+        }
+    }
+    // ─── Import keys validation ────────────────────────────────────────────
+    if (config.importKeys) {
+        for (const [key, credits] of Object.entries(config.importKeys)) {
+            if (!Number.isFinite(credits) || credits < 0) {
+                diags.push({
+                    level: 'error',
+                    field: `importKeys.${key}`,
+                    message: `Invalid credits for imported key "${key}": ${credits}. Must be >= 0.`,
+                });
+            }
+        }
+    }
+    // ─── OAuth validation ─────────────────────────────────────────────────
+    if (config.oauth) {
+        if (config.oauth.accessTokenTtl !== undefined) {
+            if (!Number.isFinite(config.oauth.accessTokenTtl) || config.oauth.accessTokenTtl <= 0) {
+                diags.push({
+                    level: 'error',
+                    field: 'oauth.accessTokenTtl',
+                    message: `Invalid accessTokenTtl: ${config.oauth.accessTokenTtl}. Must be > 0.`,
+                });
+            }
+        }
+        if (config.oauth.refreshTokenTtl !== undefined) {
+            if (!Number.isFinite(config.oauth.refreshTokenTtl) || config.oauth.refreshTokenTtl <= 0) {
+                diags.push({
+                    level: 'error',
+                    field: 'oauth.refreshTokenTtl',
+                    message: `Invalid refreshTokenTtl: ${config.oauth.refreshTokenTtl}. Must be > 0.`,
+                });
+            }
+        }
+    }
+    // ─── Warnings ──────────────────────────────────────────────────────────
+    if (config.shadowMode) {
+        diags.push({
+            level: 'warning',
+            field: 'shadowMode',
+            message: 'Shadow mode is enabled. Payment will not be enforced.',
+        });
+    }
+    if (config.stateFile && config.redisUrl) {
+        diags.push({
+            level: 'warning',
+            field: 'stateFile + redisUrl',
+            message: 'Both stateFile and redisUrl are configured. Redis is the source of truth; stateFile is redundant.',
+        });
+    }
+    if (config.remoteUrl) {
+        try {
+            const url = new URL(config.remoteUrl);
+            if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+                diags.push({
+                    level: 'error',
+                    field: 'remoteUrl',
+                    message: `Invalid remoteUrl protocol "${url.protocol}". Expected "http://" or "https://".`,
+                });
+            }
+        }
+        catch {
+            diags.push({
+                level: 'error',
+                field: 'remoteUrl',
+                message: `Invalid remoteUrl: "${config.remoteUrl}". Must be a valid URL.`,
+            });
+        }
+    }
+    return diags;
+}
+/**
+ * Format diagnostics for human-readable console output.
+ */
+function formatDiagnostics(diags) {
+    if (diags.length === 0)
+        return '✓ Config is valid.';
+    const errors = diags.filter(d => d.level === 'error');
+    const warnings = diags.filter(d => d.level === 'warning');
+    const lines = [];
+    if (errors.length > 0) {
+        lines.push(`✗ ${errors.length} error(s):`);
+        for (const e of errors) {
+            lines.push(`  ERROR  [${e.field}] ${e.message}`);
+        }
+    }
+    if (warnings.length > 0) {
+        lines.push(`⚠ ${warnings.length} warning(s):`);
+        for (const w of warnings) {
+            lines.push(`  WARN   [${w.field}] ${w.message}`);
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=config-validator.js.map

package/dist/config-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-validator.js","sourceRoot":"","sources":["../src/config-validator.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA6CH,wCA6QC;AAKD,8CAqBC;AA3SD;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAyB;IACtD,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,2EAA2E;IAC3E,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEjE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,qCAAqC;YAC5C,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,iFAAiF;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,WAAW,CAAC,UAAU;oBAC7B,OAAO,EAAE,mBAAmB,CAAC,sCAAsC;iBACpE,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,KAAK,CAAC,IAAI,CAAC;wBACT,KAAK,EAAE,OAAO;wBACd,KAAK,EAAE,WAAW,CAAC,UAAU;wBAC7B,OAAO,EAAE,qBAAqB,CAAC,CAAC,MAAM,2CAA2C;qBAClF,CAAC,CAAC;gBACL,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAEvB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,KAAK,CAAC,IAAI,CAAC;wBACT,KAAK,EAAE,SAAS;wBAChB,KAAK,EAAE,WAAW,CAAC,UAAU;wBAC7B,OAAO,EAAE,WAAW,CAAC,CAAC,MAAM,iFAAiF;qBAC9G,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,WAAW,CAAC,GAAG;oBACtB,OAAO,EAAE,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,sCAAsC;iBACxE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,WAAW,CAAC,GAAG;oBACtB,OAAO,EAAE,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,kDAAkD;iBACpF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,gBAAgB,MAAM,CAAC,IAAI,oBAAoB;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACvF,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,kCAAkC,MAAM,CAAC,qBAAqB,iBAAiB;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACvF,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,kCAAkC,MAAM,CAAC,qBAAqB,iBAAiB;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAChF,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,8BAA8B,MAAM,CAAC,iBAAiB,mCAAmC;aACnG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,qEAAqE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,wBAAwB,MAAM,CAAC,UAAU,yBAAyB;aAC5E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,UAAU;oBACjB,OAAO,EAAE,8BAA8B,GAAG,CAAC,QAAQ,wCAAwC;iBAC5F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,sBAAsB,MAAM,CAAC,QAAQ,kCAAkC;aACjF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrH,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,eAAe,IAAI,iBAAiB;oBAC3C,OAAO,EAAE,+BAA+B,IAAI,MAAM,OAAO,CAAC,cAAc,iBAAiB;iBAC1F,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxH,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,eAAe,IAAI,kBAAkB;oBAC5C,OAAO,EAAE,gCAAgC,IAAI,MAAM,OAAO,CAAC,eAAe,iBAAiB;iBAC5F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB,CAAU,EAAE,CAAC;YAC9G,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,eAAe,KAAK,EAAE;oBAC7B,OAAO,EAAE,WAAW,KAAK,KAAK,GAAG,iBAAiB;iBACnD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,cAAc,GAAG,EAAE;oBAC1B,OAAO,EAAE,qCAAqC,GAAG,MAAM,OAAO,iBAAiB;iBAChF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;gBACtF,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,sBAAsB;oBAC7B,OAAO,EAAE,2BAA2B,MAAM,CAAC,KAAK,CAAC,cAAc,gBAAgB;iBAChF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,uBAAuB;oBAC9B,OAAO,EAAE,4BAA4B,MAAM,CAAC,KAAK,CAAC,eAAe,gBAAgB;iBAClF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,mGAAmG;SAC7G,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,OAAO;oBACd,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,+BAA+B,GAAG,CAAC,QAAQ,sCAAsC;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,uBAAuB,MAAM,CAAC,SAAS,yBAAyB;aACxE,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAEpD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,YAAY,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/gate.d.ts

@@ -10,7 +10,7 @@
  * Fail-closed: any check failure => DENY.
  * Shadow mode: log but don't enforce (always ALLOW).
  */
-import { PayGateConfig, GateDecision, UsageEvent, ToolCallParams, ApiKeyRecord } from './types';
+import { PayGateConfig, GateDecision, UsageEvent, ToolCallParams, ApiKeyRecord, BatchToolCall, BatchGateResult } from './types';
 import { KeyStore } from './store';
 import { RateLimiter } from './rate-limiter';
 import { UsageMeter } from './meter';
@@ -39,6 +39,18 @@ export declare class Gate {
      * Evaluate a tool call request.
      */
     evaluate(apiKey: string | null, toolCall: ToolCallParams, clientIp?: string): GateDecision;
+    /**
+     * Evaluate a batch of tool calls atomically (all-or-nothing).
+     *
+     * Pre-validates all calls (auth, ACL, rate limits, credits, quotas, spending limits)
+     * before executing any. If any call would be denied, the entire batch is rejected
+     * and no credits are deducted.
+     *
+     * On success, deducts credits for all calls at once.
+     */
+    evaluateBatch(apiKey: string | null, calls: BatchToolCall[], clientIp?: string): BatchGateResult;
+    /** Build a shadow-mode batch result (all allowed, zero charges). */
+    private shadowBatchResult;
     /**
      * Check if a tool call is allowed by the key's ACL.
      */

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAe,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,qBAAa,IAAI;IACf,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,mEAAmE;IACnE,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,iFAAiF;IACjF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC3C,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;gBAEjD,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM;IAYrD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY;IAoJ1F;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI;IAmBpJ;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIrC;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAetE;;OAEG;IACH,SAAS;;;;;;;;;;;;;;;;;;IAkBT;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAa/D,2CAA2C;IAC3C,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,WAAW;CAiBpB"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAe,aAAa,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC7I,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,qBAAa,IAAI;IACf,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,mEAAmE;IACnE,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,iFAAiF;IACjF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC3C,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;gBAEjD,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM;IAYrD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY;IAoJ1F;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe;IAkQhG,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI;IAmBpJ;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIrC;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAetE;;OAEG;IACH,SAAS;;;;;;;;;;;;;;;;;;IAkBT;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAa/D,2CAA2C;IAC3C,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,WAAW;CAiBpB"}

package/dist/gate.js

@@ -181,6 +181,264 @@ class Gate {
         this.recordEvent(apiKey, keyRecord.name, toolName, creditsRequired, true);
         return { allowed: true, creditsCharged: creditsRequired, remainingCredits: remaining };
     }
+    /**
+     * Evaluate a batch of tool calls atomically (all-or-nothing).
+     *
+     * Pre-validates all calls (auth, ACL, rate limits, credits, quotas, spending limits)
+     * before executing any. If any call would be denied, the entire batch is rejected
+     * and no credits are deducted.
+     *
+     * On success, deducts credits for all calls at once.
+     */
+    evaluateBatch(apiKey, calls, clientIp) {
+        if (calls.length === 0) {
+            return { allAllowed: true, totalCredits: 0, decisions: [], remainingCredits: 0, failedIndex: -1 };
+        }
+        // Step 1: API key present?
+        if (!apiKey) {
+            if (this.config.shadowMode) {
+                return this.shadowBatchResult(calls, 'shadow:missing_api_key');
+            }
+            return {
+                allAllowed: false,
+                totalCredits: 0,
+                decisions: calls.map(() => ({ allowed: false, reason: 'missing_api_key', creditsCharged: 0, remainingCredits: 0 })),
+                remainingCredits: 0,
+                reason: 'missing_api_key',
+                failedIndex: 0,
+            };
+        }
+        // Step 2: Valid key?
+        const keyRecord = this.store.getKey(apiKey);
+        if (!keyRecord) {
+            const isExpired = this.store.isExpired(apiKey);
+            const reason = isExpired ? 'api_key_expired' : 'invalid_api_key';
+            if (this.config.shadowMode) {
+                return this.shadowBatchResult(calls, `shadow:${reason}`);
+            }
+            return {
+                allAllowed: false,
+                totalCredits: 0,
+                decisions: calls.map(() => ({ allowed: false, reason, creditsCharged: 0, remainingCredits: 0 })),
+                remainingCredits: 0,
+                reason,
+                failedIndex: 0,
+            };
+        }
+        // Step 3: IP allowlist check
+        if (clientIp && keyRecord.ipAllowlist.length > 0) {
+            if (!this.store.checkIp(apiKey, clientIp)) {
+                const reason = `ip_not_allowed: ${clientIp} not in allowlist`;
+                if (this.config.shadowMode) {
+                    return this.shadowBatchResult(calls, `shadow:${reason}`);
+                }
+                return {
+                    allAllowed: false,
+                    totalCredits: 0,
+                    decisions: calls.map(() => ({ allowed: false, reason, creditsCharged: 0, remainingCredits: keyRecord.credits })),
+                    remainingCredits: keyRecord.credits,
+                    reason,
+                    failedIndex: 0,
+                };
+            }
+        }
+        // Step 4: Per-call pre-validation (ACL, per-tool rate limits) + aggregate credits
+        let totalCreditsNeeded = 0;
+        const perCallCredits = [];
+        // Track per-tool occurrence counts within the batch for rate limit checking
+        const batchToolCounts = new Map();
+        for (let i = 0; i < calls.length; i++) {
+            const call = calls[i];
+            // ACL check
+            const aclResult = this.checkToolAcl(keyRecord, call.name);
+            if (!aclResult.allowed) {
+                if (this.config.shadowMode) {
+                    perCallCredits.push(this.getToolPrice(call.name, call.arguments));
+                    continue;
+                }
+                return {
+                    allAllowed: false,
+                    totalCredits: 0,
+                    decisions: calls.map((_, j) => ({
+                        allowed: false,
+                        reason: j === i ? aclResult.reason : 'batch_rejected',
+                        creditsCharged: 0,
+                        remainingCredits: keyRecord.credits,
+                    })),
+                    remainingCredits: keyRecord.credits,
+                    reason: aclResult.reason,
+                    failedIndex: i,
+                };
+            }
+            // Per-tool rate limit check (batch-aware: count occurrences in batch)
+            const toolPricing = this.config.toolPricing[call.name];
+            if (toolPricing?.rateLimitPerMin && toolPricing.rateLimitPerMin > 0) {
+                const compositeKey = `${apiKey}:tool:${call.name}`;
+                const batchCount = (batchToolCounts.get(call.name) || 0) + 1;
+                batchToolCounts.set(call.name, batchCount);
+                // Check existing window usage + batch occurrences
+                const existingCount = this.rateLimiter.getCurrentCount(compositeKey);
+                if (existingCount + batchCount > toolPricing.rateLimitPerMin) {
+                    const reason = `tool_rate_limited: ${call.name} limited to ${toolPricing.rateLimitPerMin} calls/min`;
+                    if (this.config.shadowMode) {
+                        perCallCredits.push(this.getToolPrice(call.name, call.arguments));
+                        continue;
+                    }
+                    return {
+                        allAllowed: false,
+                        totalCredits: 0,
+                        decisions: calls.map((_, j) => ({
+                            allowed: false,
+                            reason: j === i ? reason : 'batch_rejected',
+                            creditsCharged: 0,
+                            remainingCredits: keyRecord.credits,
+                        })),
+                        remainingCredits: keyRecord.credits,
+                        reason,
+                        failedIndex: i,
+                    };
+                }
+            }
+            const price = this.getToolPrice(call.name, call.arguments);
+            perCallCredits.push(price);
+            totalCreditsNeeded += price;
+        }
+        // Step 5: Global rate limit — check once for the batch
+        const rateResult = this.rateLimiter.check(apiKey);
+        if (!rateResult.allowed) {
+            if (!this.config.shadowMode) {
+                return {
+                    allAllowed: false,
+                    totalCredits: 0,
+                    decisions: calls.map(() => ({ allowed: false, reason: rateResult.reason, creditsCharged: 0, remainingCredits: keyRecord.credits })),
+                    remainingCredits: keyRecord.credits,
+                    reason: rateResult.reason,
+                    failedIndex: 0,
+                };
+            }
+        }
+        // Step 6: Aggregate credit check
+        if (!this.store.hasCredits(apiKey, totalCreditsNeeded)) {
+            if (!this.config.shadowMode) {
+                return {
+                    allAllowed: false,
+                    totalCredits: 0,
+                    decisions: calls.map(() => ({
+                        allowed: false,
+                        reason: `insufficient_credits: need ${totalCreditsNeeded}, have ${keyRecord.credits}`,
+                        creditsCharged: 0,
+                        remainingCredits: keyRecord.credits,
+                    })),
+                    remainingCredits: keyRecord.credits,
+                    reason: `insufficient_credits: need ${totalCreditsNeeded}, have ${keyRecord.credits}`,
+                    failedIndex: 0,
+                };
+            }
+        }
+        // Step 7: Spending limit check (aggregate)
+        if (keyRecord.spendingLimit > 0) {
+            const wouldSpend = keyRecord.totalSpent + totalCreditsNeeded;
+            if (wouldSpend > keyRecord.spendingLimit) {
+                if (!this.config.shadowMode) {
+                    return {
+                        allAllowed: false,
+                        totalCredits: 0,
+                        decisions: calls.map(() => ({
+                            allowed: false,
+                            reason: `spending_limit_exceeded: limit ${keyRecord.spendingLimit}, spent ${keyRecord.totalSpent}, need ${totalCreditsNeeded}`,
+                            creditsCharged: 0,
+                            remainingCredits: keyRecord.credits,
+                        })),
+                        remainingCredits: keyRecord.credits,
+                        reason: `spending_limit_exceeded: limit ${keyRecord.spendingLimit}, spent ${keyRecord.totalSpent}, need ${totalCreditsNeeded}`,
+                        failedIndex: 0,
+                    };
+                }
+            }
+        }
+        // Step 8: Quota check (aggregate, batch-aware)
+        const quotaResult = this.quotaTracker.checkBatch(keyRecord, calls.length, totalCreditsNeeded, this.config.globalQuota);
+        if (!quotaResult.allowed) {
+            if (!this.config.shadowMode) {
+                return {
+                    allAllowed: false,
+                    totalCredits: 0,
+                    decisions: calls.map(() => ({
+                        allowed: false,
+                        reason: quotaResult.reason,
+                        creditsCharged: 0,
+                        remainingCredits: keyRecord.credits,
+                    })),
+                    remainingCredits: keyRecord.credits,
+                    reason: quotaResult.reason,
+                    failedIndex: 0,
+                };
+            }
+        }
+        // Step 9: Team budget check (aggregate)
+        if (this.teamChecker) {
+            const teamResult = this.teamChecker(apiKey, totalCreditsNeeded);
+            if (!teamResult.allowed) {
+                if (!this.config.shadowMode) {
+                    return {
+                        allAllowed: false,
+                        totalCredits: 0,
+                        decisions: calls.map(() => ({
+                            allowed: false,
+                            reason: teamResult.reason,
+                            creditsCharged: 0,
+                            remainingCredits: keyRecord.credits,
+                        })),
+                        remainingCredits: keyRecord.credits,
+                        reason: teamResult.reason,
+                        failedIndex: 0,
+                    };
+                }
+            }
+        }
+        // Step 10: ALL ALLOWED — deduct credits atomically
+        this.store.deductCredits(apiKey, totalCreditsNeeded);
+        this.onCreditsDeducted?.(apiKey, totalCreditsNeeded);
+        // Record rate limits and quota for each call
+        this.rateLimiter.record(apiKey);
+        for (const call of calls) {
+            const toolPricing = this.config.toolPricing[call.name];
+            if (toolPricing?.rateLimitPerMin && toolPricing.rateLimitPerMin > 0) {
+                this.rateLimiter.recordCustom(`${apiKey}:tool:${call.name}`);
+            }
+        }
+        this.quotaTracker.recordBatch(keyRecord, calls.length, totalCreditsNeeded);
+        if (this.teamRecorder) {
+            this.teamRecorder(apiKey, totalCreditsNeeded);
+        }
+        this.store.save();
+        const remaining = this.store.getKey(apiKey)?.credits ?? 0;
+        // Record usage events for each call
+        for (let i = 0; i < calls.length; i++) {
+            this.recordEvent(apiKey, keyRecord.name, calls[i].name, perCallCredits[i], true);
+        }
+        return {
+            allAllowed: true,
+            totalCredits: totalCreditsNeeded,
+            decisions: calls.map((_, i) => ({
+                allowed: true,
+                creditsCharged: perCallCredits[i],
+                remainingCredits: remaining,
+            })),
+            remainingCredits: remaining,
+            failedIndex: -1,
+        };
+    }
+    /** Build a shadow-mode batch result (all allowed, zero charges). */
+    shadowBatchResult(calls, reason) {
+        return {
+            allAllowed: true,
+            totalCredits: 0,
+            decisions: calls.map(() => ({ allowed: true, reason, creditsCharged: 0, remainingCredits: 0 })),
+            remainingCredits: 0,
+            failedIndex: -1,
+        };
+    }
     /**
      * Check if a tool call is allowed by the key's ACL.
      */