Marc-André Bombeck de088febe6 Cap the medication-extract budget by the paying credential ...

The route used the enforceBudget + recordSpend read-then-write pair and
passed no cap, so every call measured against the operator ceiling — a
self-hoster on their own key was rationed by the operator's bill while
paying for their own usage. It also left the TOCTOU window the rest of
the codebase closed: concurrent calls could each read a sub-cap total
and all proceed.

Move the gate after the chain resolves and reserve atomically against
resolveDailyCap(chain), matching runStatusCompletion and the document
paths. Reconcile on every exit: the provider's reported count on a
completed call, a full refund when nothing was generated.

2026-07-19 05:31:38 +02:00

..

__tests__

Cap the medication-extract budget by the paying credential

2026-07-19 05:31:38 +02:00

route.ts

Cap the medication-extract budget by the paying credential

2026-07-19 05:31:38 +02:00