feat(account-config): hasSpendingRules flag + multicall view (lambda-parity PR 3)

The on-chain zero-latency gate for per-key spending rules. All additive and
storage-safe: a new mapping appended to the END of root AccountConfigStorage
(not a field on the inline-embedded UsageApiKey struct, which would shift the
Account layout).

- AppStorage: append `mapping(uint256 => bool) usageKeyHasSpendingRules`.
- ViewsFacet: `getSpendingRulesFlag(apiKeyHash)` and
  `canExecuteActionWithSpendingRules(apiKeyHash, cidHash) -> (canExecute,
  hasSpendingRules)` so the gateway reads both in one RPC.
- WritesFacet: `setSpendingRulesFlag(accountApiKeyHash, usageApiKeyHash, bool)`
  + event, same account-access control as setUsageApiKey.

Source only; `forge build` passes. Regenerate the Rust bindings + diamond ABI
with `make generate` on the canonical toolchain, then deploy via Safe diamond-cut
on Base (both ops steps). The gateway reads the new view through a scoped sol!
interface, so it does not depend on the regenerated giant binding.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glitch003

lit-api-server/blockchain/lit_node_express/contracts/AccountConfigFacets/AppStorage.sol

@@ -119,6 +119,13 @@ library AppStorage {
         EnumerableSet.StringSet nodeConfigurationKeys;
         mapping(string => string) nodeConfigurationValues;
         uint256 serverTriggerValue;
+        // Lambda-parity: per-usage-key flag gating off-hot-path spending-rule
+        // enforcement (rolling spend cap, rate/concurrency limits, origin
+        // allowlist) stored off-chain. False for every existing key, so the
+        // gateway does zero extra work unless it is explicitly set. Appended at
+        // the end of root storage so the existing layout is untouched.
+        // See plans/chipotle-lambda-parity.md.
+        mapping(uint256 => bool) usageKeyHasSpendingRules;
     }
 
     function getStorage()

lit-api-server/blockchain/lit_node_express/contracts/AccountConfigFacets/ViewsFacet.sol

@@ -405,6 +405,29 @@ contract ViewsFacet {
         return apiKeyCanExecuteForAnyGroup(apiKeyHash, groupIds);
     }
 
+    /// @notice Whether a usage API key has off-chain spending rules the gateway
+    ///         must enforce. False for every key that never set it, so the
+    ///         gateway's hot path stays free for keys without rules.
+    function getSpendingRulesFlag(
+        uint256 apiKeyHash
+    ) public view returns (bool) {
+        return AppStorage.getStorage().usageKeyHasSpendingRules[apiKeyHash];
+    }
+
+    /// @notice Combined hot-path check: returns (canExecute, hasSpendingRules)
+    ///         in a single call so the gateway reads both in one RPC and pays no
+    ///         extra round trip for the spending-rules gate.
+    ///         See plans/chipotle-lambda-parity.md.
+    function canExecuteActionWithSpendingRules(
+        uint256 apiKeyHash,
+        uint256 cidHash
+    ) public view returns (bool canExecute, bool hasSpendingRules) {
+        canExecute = canExecuteAction(apiKeyHash, cidHash);
+        hasSpendingRules = AppStorage.getStorage().usageKeyHasSpendingRules[
+            apiKeyHash
+        ];
+    }
+
     function canUseWalletInAction(
         uint256 apiKeyHash,
         uint256 cidHash,

lit-api-server/blockchain/lit_node_express/contracts/AccountConfigFacets/WritesFacet.sol

@@ -25,6 +25,11 @@ contract WritesFacet {
         uint256 indexed accountApiKeyHash,
         uint256 indexed usageApiKeyHash
     );
+    event SpendingRulesFlagSet(
+        uint256 indexed accountApiKeyHash,
+        uint256 indexed usageApiKeyHash,
+        bool hasSpendingRules
+    );
     event GroupAdded(uint256 indexed apiKeyHash, uint256 indexed groupId);
     event GroupUpdated(
         uint256 indexed accountApiKeyHash,
@@ -321,6 +326,28 @@ contract WritesFacet {
         emit UsageApiKeySet(masterAccountApiKeyHash, usageApiKeyHash);
     }
 
+    /// @notice Set the off-chain spending-rules flag for a usage API key.
+    /// @dev When true, the gateway enforces this key's off-chain spending rules
+    ///      (rolling spend cap, rate/concurrency limits, origin allowlist); when
+    ///      false it skips all of that on the hot path. Same account-access
+    ///      control as setUsageApiKey. The detailed rules live off-chain (see
+    ///      lit-payments); this only flips the gate. See
+    ///      plans/chipotle-lambda-parity.md.
+    function setSpendingRulesFlag(
+        uint256 accountApiKeyHash,
+        uint256 usageApiKeyHash,
+        bool hasSpendingRules
+    ) public {
+        SecurityLib.revertIfNoAccountAccess(accountApiKeyHash, msg.sender);
+        AppStorage.AccountConfigStorage storage s = AppStorage.getStorage();
+        s.usageKeyHasSpendingRules[usageApiKeyHash] = hasSpendingRules;
+        emit SpendingRulesFlagSet(
+            accountApiKeyHash,
+            usageApiKeyHash,
+            hasSpendingRules
+        );
+    }
+
     function addGroup(
         uint256 apiKeyHash,
         string memory name,