paygate-mcp 3.4.0 → 3.6.0

package/dist/groups.js

@@ -0,0 +1,258 @@
+"use strict";
+/**
+ * Key Groups — Policy templates for API keys.
+ *
+ * Groups define shared policies (ACL, rate limits, pricing, quotas, IP rules)
+ * that are inherited by all member keys. Key-level settings override group defaults.
+ *
+ * Unlike Teams (which share budgets), Groups share *policies*:
+ *   - Tool ACL (allowedTools / deniedTools)
+ *   - Rate limit override (calls per minute)
+ *   - Per-tool pricing overrides
+ *   - Quota defaults (daily/monthly limits)
+ *   - IP allowlist
+ *   - Metadata tags
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyGroupManager = void 0;
+const crypto_1 = require("crypto");
+// ─── KeyGroupManager ─────────────────────────────────────────────────────────
+class KeyGroupManager {
+    groups = new Map();
+    /** Reverse index: apiKey → groupId */
+    keyToGroup = new Map();
+    // ─── CRUD ────────────────────────────────────────────────────────────────
+    createGroup(params) {
+        const name = String(params.name || '').trim();
+        if (!name)
+            throw new Error('Group must have a name');
+        // Enforce unique names
+        for (const g of this.groups.values()) {
+            if (g.active && g.name === name) {
+                throw new Error(`Group '${name}' already exists`);
+            }
+        }
+        const id = 'grp_' + (0, crypto_1.randomBytes)(8).toString('hex');
+        const record = {
+            id,
+            name,
+            description: String(params.description || ''),
+            allowedTools: params.allowedTools || [],
+            deniedTools: params.deniedTools || [],
+            rateLimitPerMin: Math.max(0, Math.floor(Number(params.rateLimitPerMin) || 0)),
+            toolPricing: params.toolPricing || {},
+            quota: params.quota,
+            ipAllowlist: params.ipAllowlist || [],
+            defaultCredits: Math.max(0, Math.floor(Number(params.defaultCredits) || 0)),
+            maxSpendingLimit: Math.max(0, Math.floor(Number(params.maxSpendingLimit) || 0)),
+            tags: params.tags || {},
+            createdAt: new Date().toISOString(),
+            active: true,
+        };
+        this.groups.set(id, record);
+        return record;
+    }
+    getGroup(id) {
+        return this.groups.get(id);
+    }
+    getGroupByName(name) {
+        for (const g of this.groups.values()) {
+            if (g.active && g.name === name)
+                return g;
+        }
+        return undefined;
+    }
+    updateGroup(id, updates) {
+        const group = this.groups.get(id);
+        if (!group || !group.active)
+            throw new Error(`Group '${id}' not found`);
+        // Check name uniqueness if name is being changed
+        if (updates.name !== undefined && updates.name !== group.name) {
+            const name = String(updates.name).trim();
+            if (!name)
+                throw new Error('Group must have a name');
+            for (const g of this.groups.values()) {
+                if (g.active && g.id !== id && g.name === name) {
+                    throw new Error(`Group '${name}' already exists`);
+                }
+            }
+            group.name = name;
+        }
+        if (updates.description !== undefined)
+            group.description = String(updates.description);
+        if (updates.allowedTools !== undefined)
+            group.allowedTools = updates.allowedTools;
+        if (updates.deniedTools !== undefined)
+            group.deniedTools = updates.deniedTools;
+        if (updates.rateLimitPerMin !== undefined)
+            group.rateLimitPerMin = Math.max(0, Math.floor(Number(updates.rateLimitPerMin) || 0));
+        if (updates.toolPricing !== undefined)
+            group.toolPricing = updates.toolPricing;
+        if (updates.quota === null)
+            delete group.quota;
+        else if (updates.quota !== undefined)
+            group.quota = updates.quota;
+        if (updates.ipAllowlist !== undefined)
+            group.ipAllowlist = updates.ipAllowlist;
+        if (updates.defaultCredits !== undefined)
+            group.defaultCredits = Math.max(0, Math.floor(Number(updates.defaultCredits) || 0));
+        if (updates.maxSpendingLimit !== undefined)
+            group.maxSpendingLimit = Math.max(0, Math.floor(Number(updates.maxSpendingLimit) || 0));
+        if (updates.tags !== undefined)
+            group.tags = { ...group.tags, ...updates.tags };
+        return group;
+    }
+    deleteGroup(id) {
+        const group = this.groups.get(id);
+        if (!group || !group.active)
+            return false;
+        group.active = false;
+        // Remove all key assignments for this group
+        for (const [key, gid] of this.keyToGroup.entries()) {
+            if (gid === id)
+                this.keyToGroup.delete(key);
+        }
+        return true;
+    }
+    listGroups() {
+        const result = [];
+        for (const g of this.groups.values()) {
+            if (!g.active)
+                continue;
+            const memberCount = this.getGroupMembers(g.id).length;
+            result.push({
+                id: g.id,
+                name: g.name,
+                description: g.description,
+                memberCount,
+                allowedTools: g.allowedTools,
+                deniedTools: g.deniedTools,
+                rateLimitPerMin: g.rateLimitPerMin,
+                quota: g.quota,
+                ipAllowlist: g.ipAllowlist,
+                defaultCredits: g.defaultCredits,
+                maxSpendingLimit: g.maxSpendingLimit,
+                tags: g.tags,
+                createdAt: g.createdAt,
+                active: g.active,
+            });
+        }
+        return result;
+    }
+    // ─── Key Membership ──────────────────────────────────────────────────────
+    assignKey(apiKey, groupId) {
+        const group = this.groups.get(groupId);
+        if (!group || !group.active)
+            throw new Error(`Group '${groupId}' not found`);
+        this.keyToGroup.set(apiKey, groupId);
+    }
+    removeKey(apiKey) {
+        return this.keyToGroup.delete(apiKey);
+    }
+    getKeyGroup(apiKey) {
+        const groupId = this.keyToGroup.get(apiKey);
+        if (!groupId)
+            return undefined;
+        const group = this.groups.get(groupId);
+        if (!group || !group.active) {
+            this.keyToGroup.delete(apiKey);
+            return undefined;
+        }
+        return group;
+    }
+    getKeyGroupId(apiKey) {
+        const groupId = this.keyToGroup.get(apiKey);
+        if (!groupId)
+            return undefined;
+        const group = this.groups.get(groupId);
+        if (!group || !group.active) {
+            this.keyToGroup.delete(apiKey);
+            return undefined;
+        }
+        return groupId;
+    }
+    getGroupMembers(groupId) {
+        const members = [];
+        for (const [key, gid] of this.keyToGroup.entries()) {
+            if (gid === groupId)
+                members.push(key);
+        }
+        return members;
+    }
+    // ─── Policy Resolution ───────────────────────────────────────────────────
+    /**
+     * Resolve the effective policy for a key, merging group defaults with key overrides.
+     *
+     * Resolution rules:
+     *   - allowedTools: key-level wins if non-empty, else group default
+     *   - deniedTools: union of group + key (both applied)
+     *   - rateLimitPerMin: key-level wins if set, else group default
+     *   - quota: key-level wins if set, else group default
+     *   - ipAllowlist: union of group + key (both applied)
+     *   - toolPricing: group pricing is base, key-level (if any) would need external handling
+     *   - maxSpendingLimit: group's maxSpendingLimit is a cap on the key's spending limit
+     */
+    resolvePolicy(apiKey, keyRecord) {
+        const group = this.getKeyGroup(apiKey);
+        if (!group)
+            return null;
+        // Allowed tools: key wins if non-empty, else group
+        const allowedTools = keyRecord.allowedTools.length > 0
+            ? keyRecord.allowedTools
+            : group.allowedTools;
+        // Denied tools: union (both applied)
+        const deniedSet = new Set([...group.deniedTools, ...keyRecord.deniedTools]);
+        const deniedTools = Array.from(deniedSet);
+        // Rate limit: group default (0 = use global)
+        const rateLimitPerMin = group.rateLimitPerMin;
+        // Quota: key wins if set, else group
+        const quota = keyRecord.quota || group.quota;
+        // IP allowlist: union
+        const ipSet = new Set([...group.ipAllowlist, ...keyRecord.ipAllowlist]);
+        const ipAllowlist = Array.from(ipSet);
+        // Tool pricing: group overrides
+        const toolPricing = group.toolPricing;
+        // Spending limit: cap to group's max if group has one set and key's limit is higher (or unlimited)
+        let maxSpendingLimit = group.maxSpendingLimit;
+        return {
+            allowedTools,
+            deniedTools,
+            rateLimitPerMin,
+            quota,
+            ipAllowlist,
+            toolPricing,
+            maxSpendingLimit,
+        };
+    }
+    // ─── Serialization (for state file persistence) ──────────────────────────
+    serialize() {
+        return {
+            groups: Array.from(this.groups.entries()),
+            assignments: Array.from(this.keyToGroup.entries()),
+        };
+    }
+    load(data) {
+        this.groups.clear();
+        this.keyToGroup.clear();
+        if (data.groups) {
+            for (const [id, record] of data.groups) {
+                this.groups.set(id, record);
+            }
+        }
+        if (data.assignments) {
+            for (const [key, groupId] of data.assignments) {
+                this.keyToGroup.set(key, groupId);
+            }
+        }
+    }
+    get count() {
+        let count = 0;
+        for (const g of this.groups.values()) {
+            if (g.active)
+                count++;
+        }
+        return count;
+    }
+}
+exports.KeyGroupManager = KeyGroupManager;
+//# sourceMappingURL=groups.js.map

package/dist/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAEH,mCAAqC;AAgErC,gFAAgF;AAEhF,MAAa,eAAe;IAClB,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,sCAAsC;IAC9B,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,4EAA4E;IAE5E,WAAW,CAAC,MAYX;QACC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAErD,uBAAuB;QACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,MAAM,GAAmB;YAC7B,EAAE;YACF,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YAC7C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/E,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW,CAAC,EAAU,EAAE,OAYvB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAExE,iDAAiD;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC/C,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAClF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC/E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;YAAE,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC/E,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;aAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAClE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC/E,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS;YAAE,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpI,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAEhF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,EAAU;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1C,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;QAErB,4CAA4C;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,EAAE;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU;QACR,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,CAAC,MAAM;gBAAE,SAAS;YACxB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW;gBACX,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4EAA4E;IAE5E,SAAS,CAAC,MAAc,EAAE,OAAe;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,aAAa,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,OAAe;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,MAAc,EAAE,SAM7B;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,mDAAmD;QACnD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC,YAAY;YACxB,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAEvB,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1C,6CAA6C;QAC7C,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAE9C,qCAAqC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;QAE7C,sBAAsB;QACtB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtC,gCAAgC;QAChC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QAEtC,mGAAmG;QACnG,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAE9C,OAAO;YACL,YAAY;YACZ,WAAW;YACX,eAAe;YACf,KAAK;YACL,WAAW;YACX,WAAW;YACX,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAE5E,SAAS;QACP,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAA6E;QAChF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAExB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK;QACP,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAxRD,0CAwRC"}

package/dist/index.d.ts

@@ -57,6 +57,8 @@ export { AdminKeyManager, ROLE_HIERARCHY, VALID_ROLES } from './admin-keys';
 export type { AdminRole, AdminKeyRecord } from './admin-keys';
 export { PluginManager } from './plugin';
 export type { PayGatePlugin, PluginGateContext, PluginToolContext, PluginGateOverride, PluginInfo } from './plugin';
+export { KeyGroupManager } from './groups';
+export type { KeyGroupRecord, KeyGroupInfo, ResolvedPolicy } from './groups';
 export type { PayGateConfig, JsonRpcRequest, JsonRpcResponse, JsonRpcError, ToolCallParams, ToolInfo, ToolPricing, ServerBackendConfig, ApiKeyRecord, UsageEvent, UsageSummary, GateDecision, QuotaConfig, BatchToolCall, BatchGateResult, } from './types';
 export { DEFAULT_CONFIG } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACvD,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC/H,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC7E,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEpH,YAAY,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACvD,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC/H,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC7E,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACpH,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE7E,YAAY,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -16,7 +16,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_CONFIG = exports.PluginManager = exports.VALID_ROLES = exports.ROLE_HIERARCHY = exports.AdminKeyManager = exports.TokenRevocationList = exports.ScopedTokenManager = exports.formatDiagnostics = exports.validateConfig = exports.PayGateError = exports.PayGateClient = exports.RedisSync = exports.RedisSubscriber = exports.parseRedisUrl = exports.RedisClient = exports.TeamManager = exports.AlertEngine = exports.AnalyticsEngine = exports.getDashboardHtml = exports.MetricsCollector = exports.ToolRegistry = exports.maskKeyForAudit = exports.AuditLogger = exports.writeSseKeepAlive = exports.writeSseEvent = exports.writeSseHeaders = exports.SessionManager = exports.OAuthProvider = exports.QuotaTracker = exports.WebhookEmitter = exports.StripeWebhookHandler = exports.RateLimiter = exports.UsageMeter = exports.KeyStore = exports.MultiServerRouter = exports.HttpMcpProxy = exports.McpProxy = exports.Gate = exports.PayGateServer = void 0;
+exports.DEFAULT_CONFIG = exports.KeyGroupManager = exports.PluginManager = exports.VALID_ROLES = exports.ROLE_HIERARCHY = exports.AdminKeyManager = exports.TokenRevocationList = exports.ScopedTokenManager = exports.formatDiagnostics = exports.validateConfig = exports.PayGateError = exports.PayGateClient = exports.RedisSync = exports.RedisSubscriber = exports.parseRedisUrl = exports.RedisClient = exports.TeamManager = exports.AlertEngine = exports.AnalyticsEngine = exports.getDashboardHtml = exports.MetricsCollector = exports.ToolRegistry = exports.maskKeyForAudit = exports.AuditLogger = exports.writeSseKeepAlive = exports.writeSseEvent = exports.writeSseHeaders = exports.SessionManager = exports.OAuthProvider = exports.QuotaTracker = exports.WebhookEmitter = exports.StripeWebhookHandler = exports.RateLimiter = exports.UsageMeter = exports.KeyStore = exports.MultiServerRouter = exports.HttpMcpProxy = exports.McpProxy = exports.Gate = exports.PayGateServer = void 0;
 var server_1 = require("./server");
 Object.defineProperty(exports, "PayGateServer", { enumerable: true, get: function () { return server_1.PayGateServer; } });
 var gate_1 = require("./gate");
@@ -82,6 +82,8 @@ Object.defineProperty(exports, "ROLE_HIERARCHY", { enumerable: true, get: functi
 Object.defineProperty(exports, "VALID_ROLES", { enumerable: true, get: function () { return admin_keys_1.VALID_ROLES; } });
 var plugin_1 = require("./plugin");
 Object.defineProperty(exports, "PluginManager", { enumerable: true, get: function () { return plugin_1.PluginManager; } });
+var groups_1 = require("./groups");
+Object.defineProperty(exports, "KeyGroupManager", { enumerable: true, get: function () { return groups_1.KeyGroupManager; } });
 var types_1 = require("./types");
 Object.defineProperty(exports, "DEFAULT_CONFIG", { enumerable: true, get: function () { return types_1.DEFAULT_CONFIG; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,mCAAyC;AAAhC,uGAAA,aAAa,OAAA;AACtB,+BAA8B;AAArB,4FAAA,IAAI,OAAA;AACb,iCAAmC;AAA1B,iGAAA,QAAQ,OAAA;AACjB,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AACrB,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAC1B,iCAAmC;AAA1B,iGAAA,QAAQ,OAAA;AACjB,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AACnB,+CAA6C;AAApC,2GAAA,WAAW,OAAA;AACpB,mCAAgD;AAAvC,8GAAA,oBAAoB,OAAA;AAC7B,qCAA2C;AAAlC,yGAAA,cAAc,OAAA;AAEvB,iCAAuC;AAA9B,qGAAA,YAAY,OAAA;AACrB,iCAAwC;AAA/B,sGAAA,aAAa,OAAA;AAEtB,qCAA8F;AAArF,yGAAA,cAAc,OAAA;AAAE,0GAAA,eAAe,OAAA;AAAE,wGAAA,aAAa,OAAA;AAAE,4GAAA,iBAAiB,OAAA;AAC1E,iCAAuD;AAA9C,oGAAA,WAAW,OAAA;AAAE,wGAAA,eAAe,OAAA;AAErC,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AACrB,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA;AAIzB,yCAA+C;AAAtC,6GAAA,gBAAgB,OAAA;AACzB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AAExB,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AAEpB,iCAAsC;AAA7B,oGAAA,WAAW,OAAA;AAEpB,+CAA6E;AAApE,2GAAA,WAAW,OAAA;AAAE,6GAAA,aAAa,OAAA;AAAE,+GAAA,eAAe,OAAA;AAEpD,2CAAyC;AAAhC,uGAAA,SAAS,OAAA;AAElB,mCAAuD;AAA9C,uGAAA,aAAa,OAAA;AAAE,sGAAA,YAAY,OAAA;AAEpC,uDAAuE;AAA9D,kHAAA,cAAc,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAE1C,mCAAmE;AAA1D,4GAAA,kBAAkB,OAAA;AAAE,6GAAA,mBAAmB,OAAA;AAEhD,2CAA4E;AAAnE,6GAAA,eAAe,OAAA;AAAE,4GAAA,cAAc,OAAA;AAAE,yGAAA,WAAW,OAAA;AAErD,mCAAyC;AAAhC,uGAAA,aAAa,OAAA;AAqBtB,iCAAyC;AAAhC,uGAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,mCAAyC;AAAhC,uGAAA,aAAa,OAAA;AACtB,+BAA8B;AAArB,4FAAA,IAAI,OAAA;AACb,iCAAmC;AAA1B,iGAAA,QAAQ,OAAA;AACjB,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AACrB,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAC1B,iCAAmC;AAA1B,iGAAA,QAAQ,OAAA;AACjB,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AACnB,+CAA6C;AAApC,2GAAA,WAAW,OAAA;AACpB,mCAAgD;AAAvC,8GAAA,oBAAoB,OAAA;AAC7B,qCAA2C;AAAlC,yGAAA,cAAc,OAAA;AAEvB,iCAAuC;AAA9B,qGAAA,YAAY,OAAA;AACrB,iCAAwC;AAA/B,sGAAA,aAAa,OAAA;AAEtB,qCAA8F;AAArF,yGAAA,cAAc,OAAA;AAAE,0GAAA,eAAe,OAAA;AAAE,wGAAA,aAAa,OAAA;AAAE,4GAAA,iBAAiB,OAAA;AAC1E,iCAAuD;AAA9C,oGAAA,WAAW,OAAA;AAAE,wGAAA,eAAe,OAAA;AAErC,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AACrB,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA;AAIzB,yCAA+C;AAAtC,6GAAA,gBAAgB,OAAA;AACzB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AAExB,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AAEpB,iCAAsC;AAA7B,oGAAA,WAAW,OAAA;AAEpB,+CAA6E;AAApE,2GAAA,WAAW,OAAA;AAAE,6GAAA,aAAa,OAAA;AAAE,+GAAA,eAAe,OAAA;AAEpD,2CAAyC;AAAhC,uGAAA,SAAS,OAAA;AAElB,mCAAuD;AAA9C,uGAAA,aAAa,OAAA;AAAE,sGAAA,YAAY,OAAA;AAEpC,uDAAuE;AAA9D,kHAAA,cAAc,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAE1C,mCAAmE;AAA1D,4GAAA,kBAAkB,OAAA;AAAE,6GAAA,mBAAmB,OAAA;AAEhD,2CAA4E;AAAnE,6GAAA,eAAe,OAAA;AAAE,4GAAA,cAAc,OAAA;AAAE,yGAAA,WAAW,OAAA;AAErD,mCAAyC;AAAhC,uGAAA,aAAa,OAAA;AAEtB,mCAA2C;AAAlC,yGAAA,eAAe,OAAA;AAqBxB,iCAAyC;AAAhC,uGAAA,cAAc,OAAA"}

package/dist/redis-sync.d.ts

@@ -18,10 +18,11 @@ import { RedisClient } from './redis-client';
 import type { RedisClientOptions } from './redis-client';
 import { KeyStore } from './store';
 import { ApiKeyRecord, UsageEvent } from './types';
+import { KeyGroupManager, KeyGroupRecord } from './groups';
 export interface PubSubEvent {
     /** Event type */
-    type: 'key_updated' | 'key_revoked' | 'credits_changed' | 'key_created' | 'token_revoked';
-    /** API key affected */
+    type: 'key_updated' | 'key_revoked' | 'credits_changed' | 'key_created' | 'token_revoked' | 'group_updated' | 'group_deleted' | 'group_assignment_changed';
+    /** API key or group ID affected */
     key: string;
     /** Originating instance ID (for self-message filtering) */
     instanceId: string;
@@ -53,6 +54,8 @@ export declare class RedisSync {
     onPubSubEvent?: (event: PubSubEvent) => void;
     /** Callback for token revocation events (wired to ScopedTokenManager by server) */
     onTokenRevoked?: (fingerprint: string, expiresAt: string, revokedAt: string, reason?: string) => void;
+    /** Optional KeyGroupManager for group sync (wired by server when groups are used) */
+    groupManager?: KeyGroupManager;
     constructor(redis: RedisClient, store: KeyStore, syncIntervalMs?: number);
     /**
      * Initialize: connect to Redis, load existing state, and start pub/sub listener.
@@ -143,5 +146,28 @@ export declare class RedisSync {
     private pushLocalToRedis;
     private recordToHash;
     private hashToRecord;
+    /**
+     * Save a group record to Redis. Fire-and-forget.
+     */
+    saveGroup(group: KeyGroupRecord): Promise<void>;
+    /**
+     * Delete a group from Redis. Fire-and-forget.
+     */
+    deleteGroup(groupId: string): Promise<void>;
+    /**
+     * Save all group assignments to Redis as a single hash (apiKey → groupId).
+     * Fire-and-forget.
+     */
+    saveGroupAssignments(): Promise<void>;
+    /**
+     * Load all groups and assignments from Redis into the local KeyGroupManager.
+     */
+    loadGroupsFromRedis(): Promise<void>;
+    /**
+     * Push local groups to Redis (used when Redis is empty on first connect).
+     */
+    private pushGroupsToRedis;
+    private groupToHash;
+    private hashToGroup;
 }
 //# sourceMappingURL=redis-sync.d.ts.map

package/dist/redis-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-sync.d.ts","sourceRoot":"","sources":["../src/redis-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAe,UAAU,EAAE,MAAM,SAAS,CAAC;AAYhE,MAAM,WAAW,WAAW;IAC1B,iBAAiB;IACjB,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,iBAAiB,GAAG,aAAa,GAAG,eAAe,CAAC;IAC1F,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAwDD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,OAAO,CAAC,UAAU,CAAgC;IAClD,0EAA0E;IAC1E,OAAO,CAAC,SAAS,CAAmC;IACpD,4CAA4C;IAC5C,OAAO,CAAC,YAAY,CAAS;IAC7B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IAC7C,mFAAmF;IACnF,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;gBAE1F,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,SAAO;IAStE;;OAEG;IACG,IAAI,CAAC,cAAc,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB9B;;;OAGG;YACW,WAAW;IAezB;;;OAGG;IACG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IASzE;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAsD3B;;OAEG;YACW,gBAAgB;IAa9B,iDAAiD;IACjD,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,4CAA4C;IAC5C,IAAI,cAAc,IAAI,OAAO,CAE5B;IAID;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB9B;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsCpE;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BnE;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnD;;OAEG;IACG,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAa3D;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAWtC;;;;;;;;OAQG;IACG,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,OAAO,CAAC;QAC9E,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IA8CF;;;OAGG;YACW,aAAa;IA+B3B;;OAEG;YACW,gBAAgB;IAc9B,OAAO,CAAC,YAAY;IA8BpB,OAAO,CAAC,YAAY;CA8BrB"}
+{"version":3,"file":"redis-sync.d.ts","sourceRoot":"","sources":["../src/redis-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAe,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAe3D,MAAM,WAAW,WAAW;IAC1B,iBAAiB;IACjB,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,iBAAiB,GAAG,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,0BAA0B,CAAC;IAC3J,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAwDD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,OAAO,CAAC,UAAU,CAAgC;IAClD,0EAA0E;IAC1E,OAAO,CAAC,SAAS,CAAmC;IACpD,4CAA4C;IAC5C,OAAO,CAAC,YAAY,CAAS;IAC7B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IAC7C,mFAAmF;IACnF,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACtG,qFAAqF;IACrF,YAAY,CAAC,EAAE,eAAe,CAAC;gBAEnB,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,SAAO;IAStE;;OAEG;IACG,IAAI,CAAC,cAAc,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB9B;;;OAGG;YACW,WAAW;IAezB;;;OAGG;IACG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IASzE;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IA6D3B;;OAEG;YACW,gBAAgB;IAa9B,iDAAiD;IACjD,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,4CAA4C;IAC5C,IAAI,cAAc,IAAI,OAAO,CAE5B;IAID;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB9B;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsCpE;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BnE;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnD;;OAEG;IACG,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAa3D;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAWtC;;;;;;;;OAQG;IACG,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,OAAO,CAAC;QAC9E,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IA8CF;;;OAGG;YACW,aAAa;IA+B3B;;OAEG;YACW,gBAAgB;IAc9B,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,YAAY;IAkCpB;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3C;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAyC1C;;OAEG;YACW,iBAAiB;IAwB/B,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,WAAW;CAmBpB"}

package/dist/redis-sync.js

@@ -24,6 +24,9 @@ const KEY_SET = 'pg:keys';
 const META_KEY = 'pg:meta';
 const USAGE_LIST = 'pg:usage';
 const RATE_PREFIX = 'pg:rate:';
+const GROUP_PREFIX = 'pg:group:';
+const GROUP_SET = 'pg:groups';
+const GROUP_ASSIGN_KEY = 'pg:group_assignments';
 const PG_CHANNEL = 'pg:events';
 /** Lua: atomic credit deduction — check + deduct + increment in one round trip */
 const DEDUCT_LUA = `
@@ -93,6 +96,8 @@ class RedisSync {
     onPubSubEvent;
     /** Callback for token revocation events (wired to ScopedTokenManager by server) */
     onTokenRevoked;
+    /** Optional KeyGroupManager for group sync (wired by server when groups are used) */
+    groupManager;
     constructor(redis, store, syncIntervalMs = 5000) {
         this.redis = redis;
         this.store = store;
@@ -108,11 +113,15 @@ class RedisSync {
         await this.redis.ping();
         console.log('[paygate:redis] Connected to Redis');
         await this.loadFromRedis();
+        await this.loadGroupsFromRedis();
         // Start periodic refresh (fallback for missed pub/sub messages)
         this.syncInterval = setInterval(() => {
             this.loadFromRedis().catch(err => {
                 console.error('[paygate:redis] Sync error:', err.message);
             });
+            this.loadGroupsFromRedis().catch(err => {
+                console.error('[paygate:redis] Group sync error:', err.message);
+            });
         }, this.syncMs);
         // Start pub/sub subscriber if connection options available
         if (subscriberOpts) {
@@ -215,6 +224,13 @@ class RedisSync {
                     }
                     break;
                 }
+                case 'group_updated':
+                case 'group_deleted':
+                case 'group_assignment_changed': {
+                    // Reload all groups from Redis (groups are small, full reload is fine)
+                    this.loadGroupsFromRedis().catch(() => { });
+                    break;
+                }
             }
         }
         catch {
@@ -526,6 +542,7 @@ class RedisSync {
         fields.push('autoTopup', record.autoTopup ? JSON.stringify(record.autoTopup) : '');
         fields.push('autoTopupTodayCount', String(record.autoTopupTodayCount));
         fields.push('autoTopupLastResetDay', record.autoTopupLastResetDay);
+        fields.push('group', record.group || '');
         return fields;
     }
     hashToRecord(hash) {
@@ -557,6 +574,165 @@ class RedisSync {
             autoTopup: hash.autoTopup ? JSON.parse(hash.autoTopup) : undefined,
             autoTopupTodayCount: parseInt(hash.autoTopupTodayCount, 10) || 0,
             autoTopupLastResetDay: hash.autoTopupLastResetDay || new Date().toISOString().slice(0, 10),
+            group: hash.group || undefined,
+        };
+    }
+    // ─── Group Sync Operations ─────────────────────────────────────────────────
+    /**
+     * Save a group record to Redis. Fire-and-forget.
+     */
+    async saveGroup(group) {
+        try {
+            const redisKey = GROUP_PREFIX + group.id;
+            await this.redis.hset(redisKey, ...this.groupToHash(group));
+            await this.redis.command('SADD', GROUP_SET, group.id);
+            await this.publishEvent({ type: 'group_updated', key: group.id });
+        }
+        catch (err) {
+            console.error(`[paygate:redis] Save group error: ${err.message}`);
+        }
+    }
+    /**
+     * Delete a group from Redis. Fire-and-forget.
+     */
+    async deleteGroup(groupId) {
+        try {
+            await this.redis.command('DEL', GROUP_PREFIX + groupId);
+            await this.redis.command('SREM', GROUP_SET, groupId);
+            await this.publishEvent({ type: 'group_deleted', key: groupId });
+        }
+        catch (err) {
+            console.error(`[paygate:redis] Delete group error: ${err.message}`);
+        }
+    }
+    /**
+     * Save all group assignments to Redis as a single hash (apiKey → groupId).
+     * Fire-and-forget.
+     */
+    async saveGroupAssignments() {
+        if (!this.groupManager)
+            return;
+        try {
+            // Clear existing assignments
+            await this.redis.command('DEL', GROUP_ASSIGN_KEY);
+            // Rebuild from group manager
+            const serialized = this.groupManager.serialize();
+            if (serialized.assignments.length > 0) {
+                const fields = [];
+                for (const [apiKey, groupId] of serialized.assignments) {
+                    fields.push(apiKey, groupId);
+                }
+                await this.redis.hset(GROUP_ASSIGN_KEY, ...fields);
+            }
+            await this.publishEvent({ type: 'group_assignment_changed', key: '' });
+        }
+        catch (err) {
+            console.error(`[paygate:redis] Save assignments error: ${err.message}`);
+        }
+    }
+    /**
+     * Load all groups and assignments from Redis into the local KeyGroupManager.
+     */
+    async loadGroupsFromRedis() {
+        if (!this.groupManager)
+            return;
+        try {
+            const groupIds = await this.redis.command('SMEMBERS', GROUP_SET);
+            if (!groupIds || groupIds.length === 0) {
+                // No groups in Redis — push local state up if we have any
+                if (this.groupManager.count > 0) {
+                    await this.pushGroupsToRedis();
+                }
+                return;
+            }
+            // Load all group records as [id, record] tuples (matches serialize() format)
+            const groups = [];
+            for (const id of groupIds) {
+                const hash = await this.redis.hgetall(GROUP_PREFIX + id);
+                if (!hash || !hash.id)
+                    continue;
+                const record = this.hashToGroup(hash);
+                if (record)
+                    groups.push([id, record]);
+            }
+            // Load assignments
+            const assignHash = await this.redis.hgetall(GROUP_ASSIGN_KEY);
+            const assignments = [];
+            if (assignHash) {
+                for (const [apiKey, groupId] of Object.entries(assignHash)) {
+                    assignments.push([apiKey, groupId]);
+                }
+            }
+            // Load into group manager
+            this.groupManager.load({ groups, assignments });
+            if (groups.length > 0) {
+                console.log(`[paygate:redis] Synced ${groups.length} group(s) from Redis`);
+            }
+        }
+        catch (err) {
+            console.error(`[paygate:redis] Load groups error: ${err.message}`);
+        }
+    }
+    /**
+     * Push local groups to Redis (used when Redis is empty on first connect).
+     */
+    async pushGroupsToRedis() {
+        if (!this.groupManager)
+            return;
+        const serialized = this.groupManager.serialize();
+        if (serialized.groups.length === 0)
+            return;
+        for (const [id, group] of serialized.groups) {
+            const redisKey = GROUP_PREFIX + id;
+            await this.redis.hset(redisKey, ...this.groupToHash(group));
+            await this.redis.command('SADD', GROUP_SET, id);
+        }
+        if (serialized.assignments.length > 0) {
+            const fields = [];
+            for (const [apiKey, groupId] of serialized.assignments) {
+                fields.push(apiKey, groupId);
+            }
+            await this.redis.hset(GROUP_ASSIGN_KEY, ...fields);
+        }
+        console.log(`[paygate:redis] Pushed ${serialized.groups.length} local group(s) to Redis`);
+    }
+    // ─── Group Serialization ───────────────────────────────────────────────────
+    groupToHash(group) {
+        return [
+            'id', group.id,
+            'name', group.name,
+            'description', group.description,
+            'allowedTools', JSON.stringify(group.allowedTools),
+            'deniedTools', JSON.stringify(group.deniedTools),
+            'rateLimitPerMin', String(group.rateLimitPerMin),
+            'toolPricing', JSON.stringify(group.toolPricing),
+            'quota', group.quota ? JSON.stringify(group.quota) : '',
+            'ipAllowlist', JSON.stringify(group.ipAllowlist),
+            'defaultCredits', String(group.defaultCredits),
+            'maxSpendingLimit', String(group.maxSpendingLimit),
+            'tags', JSON.stringify(group.tags),
+            'createdAt', group.createdAt,
+            'active', group.active ? '1' : '0',
+        ];
+    }
+    hashToGroup(hash) {
+        if (!hash.id)
+            return null;
+        return {
+            id: hash.id,
+            name: hash.name || '',
+            description: hash.description || '',
+            allowedTools: hash.allowedTools ? JSON.parse(hash.allowedTools) : [],
+            deniedTools: hash.deniedTools ? JSON.parse(hash.deniedTools) : [],
+            rateLimitPerMin: parseInt(hash.rateLimitPerMin, 10) || 0,
+            toolPricing: hash.toolPricing ? JSON.parse(hash.toolPricing) : {},
+            quota: hash.quota ? JSON.parse(hash.quota) : undefined,
+            ipAllowlist: hash.ipAllowlist ? JSON.parse(hash.ipAllowlist) : [],
+            defaultCredits: parseInt(hash.defaultCredits, 10) || 0,
+            maxSpendingLimit: parseInt(hash.maxSpendingLimit, 10) || 0,
+            tags: hash.tags ? JSON.parse(hash.tags) : {},
+            createdAt: hash.createdAt || new Date().toISOString(),
+            active: hash.active !== '0',
         };
     }
 }