hive-intelligence 1.15.0 → 1.16.1

package/build/{chunk-GNZGLVFE.js → chunk-757ZNB6W.js}

@@ -5,63 +5,20 @@ import {
 import {
   OAUTH_FIRST_MATERIAL_RECEIPT_EVENT
 } from "./chunk-EPF36Q3Z.js";
+import {
+  getCsvEnv,
+  getEnvVar,
+  getLogLevel,
+  getNodeEnv,
+  getRequiredEnvVar,
+  hasEnvVars,
+  loadEnvFile
+} from "./chunk-MYSS5SBE.js";
 import {
   SERVER_NAME,
   SERVER_VERSION
 } from "./chunk-ZXKFJQDE.js";
 
-// src/mcpServer.ts
-import dotenv from "dotenv";
-
-// src/config/env.ts
-import { z } from "zod";
-var nodeEnvSchema = z.enum(["development", "production", "test"]).catch("development");
-var logLevelSchema = z.enum(["debug", "info", "warn", "error"]).catch("info");
-var portSchema = z.coerce.number().int().min(1).max(65535);
-var rateLimitMaxSchema = z.coerce.number().int().min(1).max(1e4);
-function getEnvVar(name) {
-  const value = process.env[name]?.trim();
-  return value ? value : void 0;
-}
-function getRequiredEnvVar(name, message) {
-  const value = getEnvVar(name);
-  if (!value) {
-    throw new Error(message ?? `Missing required environment variable: ${name}`);
-  }
-  return value;
-}
-function hasEnvVars(...names) {
-  return names.every((name) => Boolean(getEnvVar(name)));
-}
-function getCsvEnv(name) {
-  const value = getEnvVar(name);
-  if (!value) return [];
-  return value.split(",").map((part) => part.trim()).filter(Boolean);
-}
-function getNodeEnv() {
-  return nodeEnvSchema.parse(process.env.NODE_ENV);
-}
-function isProduction() {
-  return getNodeEnv() === "production";
-}
-function getLogLevel() {
-  return logLevelSchema.parse(process.env.LOG_LEVEL);
-}
-function getPort() {
-  return portSchema.parse(process.env.PORT ?? 8080);
-}
-function getRateLimitMax() {
-  return rateLimitMaxSchema.parse(process.env.RATE_LIMIT_MAX ?? 30);
-}
-function getCredentialedRateLimitMax() {
-  return rateLimitMaxSchema.parse(
-    process.env.CREDENTIALED_RATE_LIMIT_MAX ?? 1500
-  );
-}
-function getCorsAllowedOrigins() {
-  return getCsvEnv("CORS_ALLOWED_ORIGINS");
-}
-
 // src/tools/types.ts
 function asTextContentResult(result2, isError = false) {
   const jsonString = JSON.stringify(result2);
@@ -18634,65 +18591,161 @@ var wrapper = {
   ]
 };
 
-// src/tools/defillamaTools/api/defillama.ts
-import axios from "axios";
-
-// src/tools/defillamaTools/utils/logger.ts
-import winston from "winston";
-var loggerInstance = null;
-function setupLogger() {
-  if (loggerInstance) {
-    return loggerInstance;
-  }
-  const logFormat = winston.format.combine(
-    winston.format.timestamp({ format: "YYYY-MM-DD HH:mm:ss" }),
-    winston.format.errors({ stack: true }),
-    winston.format.splat(),
-    winston.format.json()
-  );
-  const consoleFormat = winston.format.combine(
-    winston.format.colorize(),
-    winston.format.timestamp({ format: "YYYY-MM-DD HH:mm:ss" }),
-    winston.format.printf(({ timestamp, level, message, ...metadata103 }) => {
-      let msg = `${timestamp} [${level}]: ${message}`;
-      if (Object.keys(metadata103).length > 0) {
-        msg += ` ${JSON.stringify(metadata103)}`;
-      }
-      return msg;
-    })
-  );
-  const logger = winston.createLogger({
-    level: process.env.LOG_LEVEL || "info",
-    format: logFormat,
-    transports: [
-      // Console transport for development
-      new winston.transports.Console({
-        format: consoleFormat,
-        handleExceptions: true
-      })
-    ]
-  });
-  if (process.env.NODE_ENV === "production" && !process.env.VERCEL) {
-    logger.add(
-      new winston.transports.File({
-        filename: "logs/error.log",
-        level: "error",
-        maxsize: 5242880,
-        // 5MB
-        maxFiles: 5
-      })
-    );
-    logger.add(
-      new winston.transports.File({
-        filename: "logs/combined.log",
-        maxsize: 5242880,
-        // 5MB
-        maxFiles: 5
-      })
-    );
+// src/utils/fetchClient.ts
+var HttpError = class extends Error {
+  config;
+  constructor(message, config2, code, response) {
+    super(message);
+    this.name = "HttpError";
+    this.config = config2;
+    if (code) this.code = code;
+    if (response) this.response = response;
+  }
+};
+function encode(value) {
+  return encodeURIComponent(value).replace(/%3A/gi, ":").replace(/%24/g, "$").replace(/%2C/gi, ",").replace(/%20/g, "+");
+}
+function appendParam(pairs, key, value) {
+  if (value === null || value === void 0) return;
+  if (Array.isArray(value)) {
+    for (const item of value) appendParam(pairs, `${key}[]`, item);
+  } else if (value instanceof Date) {
+    pairs.push(`${encode(key)}=${encode(value.toISOString())}`);
+  } else if (typeof value === "object") {
+    for (const [sub, item] of Object.entries(value)) {
+      appendParam(pairs, `${key}[${sub}]`, item);
+    }
+  } else {
+    pairs.push(`${encode(key)}=${encode(String(value))}`);
+  }
+}
+function buildUrl(baseURL, url, params) {
+  const full = !baseURL || /^[a-z][a-z\d+.-]*:\/\//i.test(url) ? url : url ? `${baseURL.replace(/\/+$/, "")}/${url.replace(/^\/+/, "")}` : baseURL;
+  const pairs = [];
+  for (const [key, value] of Object.entries(params ?? {})) {
+    appendParam(pairs, key, value);
+  }
+  if (pairs.length === 0) return full;
+  return `${full}${full.includes("?") ? "&" : "?"}${pairs.join("&")}`;
+}
+var UNDICI_CODES = {
+  UND_ERR_CONNECT_TIMEOUT: "ETIMEDOUT",
+  UND_ERR_HEADERS_TIMEOUT: "ETIMEDOUT",
+  UND_ERR_BODY_TIMEOUT: "ETIMEDOUT",
+  UND_ERR_SOCKET: "ECONNRESET"
+};
+function networkError(error, timedOut, timeout, config2) {
+  if (timedOut) {
+    return new HttpError(`timeout of ${timeout}ms exceeded`, config2, "ECONNABORTED");
+  }
+  const cause = error?.cause;
+  const rawCode = cause?.code;
+  const code = (rawCode && UNDICI_CODES[rawCode]) ?? rawCode ?? "ERR_NETWORK";
+  return new HttpError(cause?.message || rawCode || "Network Error", config2, code);
+}
+async function readBody(response, maxContentLength, config2, onChunk) {
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    onChunk();
+    size += value.byteLength;
+    if (maxContentLength && size > maxContentLength) {
+      await reader.cancel();
+      throw new HttpError(
+        `maxContentLength size of ${maxContentLength} exceeded`,
+        config2,
+        "ERR_BAD_RESPONSE"
+      );
+    }
+    chunks.push(value);
   }
-  loggerInstance = logger;
-  return loggerInstance;
+  return new TextDecoder().decode(Buffer.concat(chunks));
+}
+function parseBody(text) {
+  if (!text) return text;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function createFetchClient(options = {}) {
+  async function request(method, url, data, config2 = {}) {
+    const info = { method, url };
+    const timeout = config2.timeout ?? options.timeout ?? 0;
+    const controller = new AbortController();
+    let timedOut = false;
+    let timer;
+    const armTimeout = () => {
+      clearTimeout(timer);
+      if (timeout <= 0) return;
+      timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+      }, timeout);
+    };
+    armTimeout();
+    try {
+      options.onRequest?.({ method, url, data });
+      const headers = {
+        Accept: "application/json, text/plain, */*",
+        ...options.headers,
+        ...config2.headers
+      };
+      let body;
+      if (data !== void 0) {
+        body = typeof data === "string" ? data : JSON.stringify(data);
+        const hasContentType = Object.keys(headers).some(
+          (name) => name.toLowerCase() === "content-type"
+        );
+        if (!hasContentType) headers["Content-Type"] = "application/json";
+      }
+      let text;
+      let res;
+      try {
+        res = await fetch(buildUrl(options.baseURL, url, config2.params), {
+          method: method.toUpperCase(),
+          headers,
+          body,
+          signal: controller.signal
+        });
+        armTimeout();
+        text = await readBody(res, options.maxContentLength, info, armTimeout);
+      } catch (error) {
+        if (error instanceof HttpError) throw error;
+        throw networkError(error, timedOut, timeout, info);
+      }
+      const response = {
+        data: parseBody(text),
+        status: res.status,
+        headers: Object.fromEntries(res.headers)
+      };
+      if (res.status < 200 || res.status >= 300) {
+        throw new HttpError(
+          `Request failed with status code ${res.status}`,
+          info,
+          res.status < 500 ? "ERR_BAD_REQUEST" : "ERR_BAD_RESPONSE",
+          response
+        );
+      }
+      return response;
+    } catch (error) {
+      options.onError?.(error);
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return {
+    get: (url, config2) => request("get", url, void 0, config2),
+    post: (url, data, config2) => request("post", url, data, config2),
+    put: (url, data, config2) => request("put", url, data, config2),
+    delete: (url, config2) => request("delete", url, void 0, config2)
+  };
 }
 
 // src/tools/defillamaTools/api/defillama.ts
@@ -18701,69 +18754,60 @@ var DeFiLlamaAPI = class {
   stablecoinsClient;
   yieldsClient;
   coinsClient;
-  logger = setupLogger();
+  logger = secureLogger;
   baseURL = "https://api.llama.fi";
   stablecoinsURL = "https://stablecoins.llama.fi";
   yieldsURL = "https://yields.llama.fi";
   coinsURL = "https://coins.llama.fi";
   constructor() {
-    this.client = axios.create({
+    const errorHandler = (error) => {
+      const status = error.response?.status;
+      const message = error.response?.data?.message || error.message;
+      if (status === 402) {
+        throw new Error(
+          `DeFiLlama API Error: this endpoint requires a DeFiLlama Pro plan subscription (HTTP 402); retrying on the free API will not succeed. ${message}`
+        );
+      }
+      throw new Error(`DeFiLlama API Error: ${message}`);
+    };
+    this.client = createFetchClient({
       baseURL: this.baseURL,
       timeout: 6e4,
       // Increased from 30s to 60s for large responses
       headers: {
         "Content-Type": "application/json",
         "User-Agent": "defillama-mcp-server/1.0.0"
-      }
+      },
+      onError: errorHandler
     });
-    this.stablecoinsClient = axios.create({
+    this.stablecoinsClient = createFetchClient({
       baseURL: this.stablecoinsURL,
       timeout: 3e4,
       // Reduced to 30s for MCP production
       headers: {
         "Content-Type": "application/json",
         "User-Agent": "defillama-mcp-server/1.0.0"
-      }
+      },
+      onError: errorHandler
     });
-    this.yieldsClient = axios.create({
+    this.yieldsClient = createFetchClient({
       baseURL: this.yieldsURL,
       timeout: 6e4,
       headers: {
         "Content-Type": "application/json",
         "User-Agent": "defillama-mcp-server/1.0.0"
-      }
+      },
+      onError: errorHandler
     });
-    this.coinsClient = axios.create({
+    this.coinsClient = createFetchClient({
       baseURL: this.coinsURL,
       timeout: 3e4,
       headers: {
         "Content-Type": "application/json",
         "User-Agent": "defillama-mcp-server/1.0.0"
-      }
+      },
+      onError: errorHandler
     });
-    const errorHandler = (error) => {
-      const status = error.response?.status;
-      const message = error.response?.data?.message || error.message;
-      if (status === 402) {
-        throw new Error(
-          `DeFiLlama API Error: this endpoint requires a DeFiLlama Pro plan subscription (HTTP 402); retrying on the free API will not succeed. ${message}`
-        );
-      }
-      throw new Error(`DeFiLlama API Error: ${message}`);
-    };
-    this.client.interceptors.response.use((response) => response, errorHandler);
-    this.stablecoinsClient.interceptors.response.use(
-      (response) => response,
-      errorHandler
-    );
-    this.yieldsClient.interceptors.response.use(
-      (response) => response,
-      errorHandler
-    );
-    this.coinsClient.interceptors.response.use(
-      (response) => response,
-      errorHandler
-    );
   }
   /**
    * Helper method to log API calls with timing and response details
@@ -19424,7 +19468,7 @@ var DeFiLlamaAPI = class {
       });
       return response.data;
     } catch (error) {
-      if (axios.isAxiosError(error)) {
+      if (error instanceof HttpError) {
         if (error.code === "ECONNABORTED" || error.code === "ETIMEDOUT") {
           throw new Error(
             `Timeout while fetching DEX volume data for ${dexName}. The response may be too large.`
@@ -31492,9 +31536,6 @@ function getAllCCXTEndpoints() {
 }
 
 // src/utils/httpClient.ts
-import axios2, {
-  AxiosError
-} from "axios";
 var circuitBreakers = /* @__PURE__ */ new Map();
 function getCircuitBreaker(serviceName) {
   if (!circuitBreakers.has(serviceName)) {
@@ -31526,7 +31567,7 @@ function upstreamDetail(error) {
   return compact ? compact.slice(0, 240) : null;
 }
 function withUpstreamDetail(error) {
-  if (!(error instanceof AxiosError)) return error;
+  if (!(error instanceof HttpError)) return error;
   const detail = upstreamDetail(error);
   if (detail && !error.message.includes(detail)) {
     error.message = `${error.message}: ${detail}`;
@@ -31535,7 +31576,7 @@ function withUpstreamDetail(error) {
 }
 function failureMessage(error) {
   let message = "";
-  if (error instanceof AxiosError) {
+  if (error instanceof HttpError) {
     message = upstreamDetail(error) ?? error.message;
   } else if (error instanceof Error) {
     message = error.message;
@@ -31568,7 +31609,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 var ResilientHttpClient = class {
-  axiosInstance;
+  http;
   config;
   circuitBreaker;
   constructor(config2) {
@@ -31584,10 +31625,10 @@ var ResilientHttpClient = class {
       circuitBreakerThreshold: config2.circuitBreakerThreshold ?? 5,
       circuitBreakerResetTimeout: config2.circuitBreakerResetTimeout ?? 3e4
     };
-    this.axiosInstance = axios2.create({
+    this.http = createFetchClient({
       baseURL: this.config.baseURL,
       timeout: this.config.timeout,
-      ...config2.maxContentLength ? { maxContentLength: config2.maxContentLength } : {},
+      maxContentLength: config2.maxContentLength,
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json",
@@ -31595,35 +31636,28 @@ var ResilientHttpClient = class {
       }
     });
     this.circuitBreaker = getCircuitBreaker(this.config.serviceName);
-    this.axiosInstance.interceptors.request.use(
-      (requestConfig) => {
-        secureLogger.debug(`[${this.config.serviceName}] Request`, {
-          method: requestConfig.method?.toUpperCase(),
-          url: requestConfig.url,
-          params: requestConfig.params
-        });
-        return requestConfig;
-      },
-      (error) => {
-        secureLogger.error(
-          `[${this.config.serviceName}] Request setup failed`,
-          error
-        );
-        return Promise.reject(error);
-      }
-    );
-    this.axiosInstance.interceptors.response.use(
-      (response) => {
-        secureLogger.debug(`[${this.config.serviceName}] Response`, {
-          status: response.status,
-          url: response.config.url
-        });
-        return response;
-      },
-      (error) => {
-        return Promise.reject(error);
-      }
-    );
+  }
+  /**
+   * Send one request, with debug logging on either side. Failures are logged
+   * by the retry logic.
+   */
+  async send(method, endpoint, options) {
+    secureLogger.debug(`[${this.config.serviceName}] Request`, {
+      method: method.toUpperCase(),
+      url: endpoint,
+      params: options.params
+    });
+    const config2 = {
+      params: options.params,
+      timeout: options.timeout ?? this.config.timeout,
+      headers: options.headers
+    };
+    const response = method === "get" || method === "delete" ? await this.http[method](endpoint, config2) : await this.http[method](endpoint, options.body, config2);
+    secureLogger.debug(`[${this.config.serviceName}] Response`, {
+      status: response.status,
+      url: endpoint
+    });
+    return response;
   }
   /**
    * Check if the circuit breaker allows the request
@@ -31706,7 +31740,7 @@ var ResilientHttpClient = class {
         return response.data;
       } catch (error) {
         lastError = error;
-        if (error instanceof AxiosError && isRetryableError(error)) {
+        if (error instanceof HttpError && isRetryableError(error)) {
           this.recordFailure(error);
           if (attempt < maxRetries) {
             const delay2 = calculateBackoffDelay(
@@ -31727,7 +31761,7 @@ var ResilientHttpClient = class {
             continue;
           }
         } else {
-          if (error instanceof AxiosError) {
+          if (error instanceof HttpError) {
             const status = error.response?.status ?? 0;
             const oversized = error.message.includes("maxContentLength");
             if (!status && !oversized || status >= 500 || status === 429) {
@@ -31735,7 +31769,7 @@ var ResilientHttpClient = class {
             }
           }
         }
-        const errorDetails = error instanceof AxiosError ? {
+        const errorDetails = error instanceof HttpError ? {
           status: error.response?.status,
           code: error.code,
           message: error.message,
@@ -31757,13 +31791,8 @@ var ResilientHttpClient = class {
    * Perform a GET request
    */
   async get(endpoint, options = {}) {
-    const config2 = {
-      params: options.params,
-      timeout: options.timeout ?? this.config.timeout,
-      headers: options.headers
-    };
     return this.executeWithRetry(
-      () => this.axiosInstance.get(endpoint, config2),
+      () => this.send("get", endpoint, options),
       options
     );
   }
@@ -31771,13 +31800,8 @@ var ResilientHttpClient = class {
    * Perform a POST request
    */
   async post(endpoint, options = {}) {
-    const config2 = {
-      params: options.params,
-      timeout: options.timeout ?? this.config.timeout,
-      headers: options.headers
-    };
     return this.executeWithRetry(
-      () => this.axiosInstance.post(endpoint, options.body, config2),
+      () => this.send("post", endpoint, options),
       options
     );
   }
@@ -31785,13 +31809,8 @@ var ResilientHttpClient = class {
    * Perform a PUT request
    */
   async put(endpoint, options = {}) {
-    const config2 = {
-      params: options.params,
-      timeout: options.timeout ?? this.config.timeout,
-      headers: options.headers
-    };
     return this.executeWithRetry(
-      () => this.axiosInstance.put(endpoint, options.body, config2),
+      () => this.send("put", endpoint, options),
       options
     );
   }
@@ -31799,13 +31818,8 @@ var ResilientHttpClient = class {
    * Perform a DELETE request
    */
   async delete(endpoint, options = {}) {
-    const config2 = {
-      params: options.params,
-      timeout: options.timeout ?? this.config.timeout,
-      headers: options.headers
-    };
     return this.executeWithRetry(
-      () => this.axiosInstance.delete(endpoint, config2),
+      () => this.send("delete", endpoint, options),
       options
     );
   }
@@ -38764,7 +38778,6 @@ function removedVenueMessage(venue) {
 }
 
 // src/tools/hyperliquid/api/hyperliquid.ts
-import axios3 from "axios";
 var HYPERLIQUID_API_URL = "https://api.hyperliquid.xyz";
 var DEFAULT_LEADERBOARD_LIMIT = 20;
 var MAX_LEADERBOARD_LIMIT = 500;
@@ -38785,30 +38798,27 @@ var HyperliquidAPI = class {
   now;
   constructor(now = Date.now) {
     this.now = now;
-    this.client = axios3.create({
+    this.client = createFetchClient({
       baseURL: HYPERLIQUID_API_URL,
       timeout: 3e4,
       headers: {
         "Content-Type": "application/json",
         "User-Agent": "hive-mcp-server/1.0.0"
-      }
-    });
-    this.client.interceptors.request.use((config2) => {
-      const dex = config2.data?.dex;
-      if (typeof dex === "string" && REMOVED_HYPERLIQUID_DEXES.has(dex)) {
-        throw new Error(removedVenueMessage(`hyperliquid:${dex}`));
-      }
-      return config2;
-    });
-    this.client.interceptors.response.use(
-      (response) => response,
-      (error) => {
+      },
+      // One gate for every /info read that scopes to a builder dex.
+      onRequest: ({ data }) => {
+        const dex = data?.dex;
+        if (typeof dex === "string" && REMOVED_HYPERLIQUID_DEXES.has(dex)) {
+          throw new Error(removedVenueMessage(`hyperliquid:${dex}`));
+        }
+      },
+      onError: (error) => {
         const err = error;
         const message = err?.response?.data?.message || err?.message || "request failed";
         secureLogger.warn("Hyperliquid API error", { message });
         throw new Error(`Hyperliquid API Error: ${message}`);
       }
-    );
+    });
   }
   /**
    * Per-pair 24h notional volume leaderboard for a Hyperliquid perp DEX.
@@ -41736,7 +41746,7 @@ async function probeExtremes(query, dataset, baseCoin) {
   const where = baseCoin ? " WHERE base_coin = {base_coin:String}" : "";
   try {
     const [row] = await query(
-      `SELECT minOrNull(${spec.tsColumn}) AS earliest_at, maxOrNull(${spec.tsColumn}) AS latest_at FROM ${spec.table} FINAL${where}`,
+      `SELECT minOrNull(${spec.tsColumn}) AS earliest_at, maxOrNull(${spec.tsColumn}) AS latest_at FROM ${spec.table}${where}`,
       baseCoin ? { base_coin: baseCoin } : {}
     );
     return {
@@ -41753,7 +41763,7 @@ async function probeExtremes(query, dataset, baseCoin) {
 async function listFundingVenues(query) {
   try {
     const rows = await query(
-      `SELECT DISTINCT venue FROM ${HISTORY_TABLES.funding.table} FINAL ORDER BY venue LIMIT ${VENUE_LIST_MAX + 1}`
+      `SELECT DISTINCT venue FROM ${HISTORY_TABLES.funding.table} ORDER BY venue LIMIT ${VENUE_LIST_MAX + 1}`
     );
     const venues = rows.map((row) => row.venue).filter((venue) => typeof venue === "string");
     return {
@@ -42164,7 +42174,7 @@ var PolymarketNotFoundError = class extends Error {
   }
   url;
 };
-function buildUrl(base, path, params = {}) {
+function buildUrl2(base, path, params = {}) {
   const url = new URL(path, base);
   for (const [key, value] of Object.entries(params)) {
     if (value === void 0) continue;
@@ -42803,7 +42813,7 @@ function toActivityRow(raw) {
 }
 async function fetchGammaKeyset(resource, params) {
   const label = `Gamma /${resource}/keyset`;
-  const url = buildUrl(GAMMA_BASE_URL, `/${resource}/keyset`, params);
+  const url = buildUrl2(GAMMA_BASE_URL, `/${resource}/keyset`, params);
   const page = asRecord(await fetchPolymarketJson(url, label));
   return {
     url,
@@ -42831,7 +42841,7 @@ function parseDataPage(value, label) {
   };
 }
 async function searchGammaMarkets(query, closed) {
-  const url = buildUrl(GAMMA_BASE_URL, "/public-search", {
+  const url = buildUrl2(GAMMA_BASE_URL, "/public-search", {
     q: query,
     limit_per_type: SEARCH_EVENT_LIMIT,
     events_status: closed ? "closed" : "active"
@@ -42869,7 +42879,7 @@ async function resolveMarket(selector) {
   if (gamma.rows.length > 0) {
     return { url: gamma.url, market: normalizeGammaMarket(gamma.rows[0]) };
   }
-  const clobUrl = buildUrl(
+  const clobUrl = buildUrl2(
     CLOB_BASE_URL,
     `/clob-markets/${selector.conditionId}`
   );
@@ -42895,7 +42905,7 @@ async function resolveMarket(selector) {
   }
 }
 async function fetchOrderbook(tokenId) {
-  const url = buildUrl(CLOB_BASE_URL, "/book", { token_id: tokenId });
+  const url = buildUrl2(CLOB_BASE_URL, "/book", { token_id: tokenId });
   try {
     const data = await fetchPolymarketJson(url, "CLOB /book");
     const raw = asRecord(data);
@@ -42921,11 +42931,11 @@ async function fetchPriceHistory(tokenId, interval, fidelity) {
     interval,
     bucket_seconds: fidelity * 60
   };
-  const url = buildUrl(DATA_API_BASE_URL, "/v2/prices-history", params);
+  const url = buildUrl2(DATA_API_BASE_URL, "/v2/prices-history", params);
   const rows = [];
   let cursor = null;
   for (let page = 0; page < MAX_HISTORY_PAGES; page++) {
-    const pageUrl = cursor ? buildUrl(DATA_API_BASE_URL, "/v2/prices-history", {
+    const pageUrl = cursor ? buildUrl2(DATA_API_BASE_URL, "/v2/prices-history", {
       ...params,
       cursor
     }) : url;
@@ -42943,7 +42953,7 @@ async function fetchPriceHistory(tokenId, interval, fidelity) {
 }
 async function fetchPositions(user, limit, cursor) {
   const label = "Data API /v2/positions";
-  const url = buildUrl(DATA_API_BASE_URL, "/v2/positions", {
+  const url = buildUrl2(DATA_API_BASE_URL, "/v2/positions", {
     user,
     limit,
     cursor: cursor ?? void 0
@@ -42957,7 +42967,7 @@ async function fetchPositions(user, limit, cursor) {
 }
 async function fetchActivity(user, limit, cursor) {
   const label = "Data API /v2/activity";
-  const url = buildUrl(DATA_API_BASE_URL, "/v2/activity", {
+  const url = buildUrl2(DATA_API_BASE_URL, "/v2/activity", {
     user,
     limit,
     cursor: cursor ?? void 0
@@ -43633,7 +43643,7 @@ var KalshiNotFoundError = class extends Error {
   }
   url;
 };
-function buildUrl2(path, params = {}, base = KALSHI_BASE_URL) {
+function buildUrl3(path, params = {}, base = KALSHI_BASE_URL) {
   const url = new URL(`${base}${path}`);
   for (const [key, value] of Object.entries(params)) {
     if (value === void 0) continue;
@@ -44208,7 +44218,7 @@ function readCursor(record) {
   return cursor;
 }
 async function fetchMarketsPage(params) {
-  const url = buildUrl2("/markets", params);
+  const url = buildUrl3("/markets", params);
   const data = await fetchKalshiJson(url, "GET /markets");
   const record = asRecord2(data);
   return {
@@ -44268,7 +44278,7 @@ async function searchMarkets(filters) {
   };
 }
 async function fetchMarket(ticker) {
-  const url = buildUrl2(`/markets/${encodeURIComponent(ticker)}`);
+  const url = buildUrl3(`/markets/${encodeURIComponent(ticker)}`);
   try {
     const data = await fetchKalshiJson(url, "GET /markets/{ticker}");
     const record = asRecord2(asRecord2(data)?.market);
@@ -44288,7 +44298,7 @@ async function fetchMarket(ticker) {
   }
 }
 async function fetchEventsPage(params) {
-  const url = buildUrl2("/events", {
+  const url = buildUrl3("/events", {
     status: params.status ?? void 0,
     series_ticker: params.seriesTicker ?? void 0,
     limit: params.limit,
@@ -44303,7 +44313,7 @@ async function fetchEventsPage(params) {
   return { url, rows, nextCursor: readCursor(record) };
 }
 async function fetchEvent(eventTicker, withNested) {
-  const url = buildUrl2(`/events/${encodeURIComponent(eventTicker)}`, {
+  const url = buildUrl3(`/events/${encodeURIComponent(eventTicker)}`, {
     with_nested_markets: withNested ? true : void 0
   });
   try {
@@ -44326,7 +44336,7 @@ async function fetchEvent(eventTicker, withNested) {
   }
 }
 async function fetchOrderbook2(ticker, depth) {
-  const url = buildUrl2(`/markets/${encodeURIComponent(ticker)}/orderbook`);
+  const url = buildUrl3(`/markets/${encodeURIComponent(ticker)}/orderbook`);
   try {
     const data = await fetchKalshiJson(
       url,
@@ -44349,7 +44359,7 @@ async function fetchOrderbook2(ticker, depth) {
   }
 }
 async function fetchTrades(ticker, limit, cursor) {
-  const url = buildUrl2("/markets/trades", {
+  const url = buildUrl3("/markets/trades", {
     ticker,
     limit,
     cursor: cursor ?? void 0
@@ -44366,7 +44376,7 @@ async function assertMarketExists(ticker) {
   await fetchMarket(ticker);
 }
 async function fetchCandlesticks(seriesTicker, ticker, window) {
-  const url = buildUrl2(
+  const url = buildUrl3(
     `/series/${encodeURIComponent(seriesTicker)}/markets/${encodeURIComponent(ticker)}/candlesticks`,
     {
       start_ts: window.start_ts,
@@ -47811,7 +47821,7 @@ async function assertHostResolvesPublic(host) {
     }
   }
 }
-function buildUrl3(entry2, path, query) {
+function buildUrl4(entry2, path, query) {
   if (/^[a-z]+:\/\//i.test(path) || path.includes("@")) {
     throw new FetchInputError(
       `Invalid argument: path "${path}" must be a path on the host, not a full URL.`
@@ -47844,7 +47854,7 @@ async function fetchPublicApi(params) {
       `Method "${method}" is not supported for host "${entry2.host}" (allowed: ${entry2.methods.join(", ")}).`
     );
   }
-  const url = buildUrl3(entry2, params.path, params.query);
+  const url = buildUrl4(entry2, params.path, params.query);
   await assertHostResolvesPublic(entry2.host);
   const headers = { Accept: "application/json" };
   let payload;
@@ -51409,11 +51419,11 @@ import { fileURLToPath } from "url";
 import Coingecko5 from "@coingecko/coingecko-typescript";
 
 // src/tools/dynamic-tools.ts
-import { z as z4 } from "zod";
+import { z as z3 } from "zod";
 import { isDeepStrictEqual } from "util";
 
 // src/tools/heroTools.ts
-import { z as z2 } from "zod";
+import { z } from "zod";
 
 // src/services/tool-execution-pipeline.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -53940,7 +53950,7 @@ var HERO_TOOL_NAMES = /* @__PURE__ */ new Set([
   "check_token_safety",
   "get_wallet_portfolio"
 ]);
-var RESPONSE_FORMAT = z2.enum(["concise", "detailed", "json", "markdown"]).optional().describe(
+var RESPONSE_FORMAT = z.enum(["concise", "detailed", "json", "markdown"]).optional().describe(
   "concise (default) returns the trimmed essentials; detailed returns the full provider payload. json and markdown, the platform-wide values every other tool advertises, are accepted and treated as concise."
 );
 function heroFormat(value) {
@@ -54203,15 +54213,15 @@ function heroTools(endpoints, options = {}) {
       source_receipt: sourceReceipt(result2)
     });
   };
-  const tokenPriceSchema = z2.object({
-    token: z2.string().trim().min(1).max(100).optional().describe(
+  const tokenPriceSchema = z.object({
+    token: z.string().trim().min(1).max(100).optional().describe(
       'CoinGecko coin id or ticker symbol, for example "bitcoin" or "BTC". Omit when passing chain + address.'
     ),
-    chain: z2.string().trim().max(40).optional().describe(
+    chain: z.string().trim().max(40).optional().describe(
       'Chain name for the contract-address variant, for example "eth", "base", "bsc", or "solana".'
     ),
-    address: z2.string().trim().max(100).optional().describe("Token contract address; requires chain."),
-    vs_currency: z2.string().trim().max(20).optional().describe('Quote currency. Default "usd".'),
+    address: z.string().trim().max(100).optional().describe("Token contract address; requires chain."),
+    vs_currency: z.string().trim().max(20).optional().describe('Quote currency. Default "usd".'),
     response_format: RESPONSE_FORMAT
   });
   const trimSimplePrice = (query, vsCurrency) => (payload) => {
@@ -54318,11 +54328,11 @@ function heroTools(endpoints, options = {}) {
       );
     }
   };
-  const tokenSafetySchema = z2.object({
-    address: z2.string().trim().min(1).max(100).describe(
+  const tokenSafetySchema = z.object({
+    address: z.string().trim().min(1).max(100).describe(
       "Required. Token contract address (0x\u2026 for EVM, base58 for Solana)."
     ),
-    chain: z2.string().trim().max(40).optional().describe(
+    chain: z.string().trim().max(40).optional().describe(
       'Chain name or EVM chain id, for example "eth", "bsc", "8453", or "solana". Defaults to eth for 0x addresses; Solana is auto-detected.'
     ),
     response_format: RESPONSE_FORMAT
@@ -54410,12 +54420,12 @@ function heroTools(endpoints, options = {}) {
       return respond(result2, format, trimTokenSafety(address, normalized));
     }
   };
-  const walletPortfolioSchema = z2.object({
-    address: z2.string().trim().min(1).max(100).describe("Required. Wallet address (0x\u2026 for EVM, base58 for Solana)."),
-    chain: z2.string().trim().max(40).optional().describe(
+  const walletPortfolioSchema = z.object({
+    address: z.string().trim().min(1).max(100).describe("Required. Wallet address (0x\u2026 for EVM, base58 for Solana)."),
+    chain: z.string().trim().max(40).optional().describe(
       'Chain name, for example "eth", "base", "arbitrum", or "solana". Defaults to eth for 0x addresses; Solana is auto-detected.'
     ),
-    include_spam: z2.boolean().optional().describe(
+    include_spam: z.boolean().optional().describe(
       "Show likely spam airdrops (tokens with a URL or claim lure in the name, and on EVM chains tokens with no market price). Default false; the response says how many were hidden."
     ),
     response_format: RESPONSE_FORMAT
@@ -57754,7 +57764,7 @@ function canonicalResource(value) {
 
 // src/auth/oauth/clients.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 import { InvalidClientMetadataError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 var OAUTH_DEPLOYMENT_CANARY_SOFTWARE_ID = "xyz.hiveintelligence/deployment-canary";
 var OAUTH_DEPLOYMENT_CANARY_CLIENT_NAME = "Hive deployment OAuth canary";
@@ -57834,21 +57844,21 @@ var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]
 var EXACT_NATIVE_REDIRECT_URIS = /* @__PURE__ */ new Set([
   CURSOR_DESKTOP_OAUTH_REDIRECT_URI
 ]);
-var cimdDocumentSchema = z3.object({
-  client_id: z3.string().url(),
-  client_name: z3.string().trim().min(1).max(200),
-  redirect_uris: z3.array(z3.string().url()).min(1).max(20),
-  token_endpoint_auth_method: z3.literal("none").optional(),
-  grant_types: z3.array(z3.string()).max(4).optional(),
-  response_types: z3.array(z3.string()).max(4).optional(),
-  client_uri: z3.string().url().optional(),
-  logo_uri: z3.string().url().optional(),
-  scope: z3.string().max(1e3).optional(),
-  contacts: z3.array(z3.string().max(320)).max(10).optional(),
-  tos_uri: z3.string().url().optional(),
-  policy_uri: z3.string().url().optional(),
-  software_id: z3.string().max(200).optional(),
-  software_version: z3.string().max(100).optional()
+var cimdDocumentSchema = z2.object({
+  client_id: z2.string().url(),
+  client_name: z2.string().trim().min(1).max(200),
+  redirect_uris: z2.array(z2.string().url()).min(1).max(20),
+  token_endpoint_auth_method: z2.literal("none").optional(),
+  grant_types: z2.array(z2.string()).max(4).optional(),
+  response_types: z2.array(z2.string()).max(4).optional(),
+  client_uri: z2.string().url().optional(),
+  logo_uri: z2.string().url().optional(),
+  scope: z2.string().max(1e3).optional(),
+  contacts: z2.array(z2.string().max(320)).max(10).optional(),
+  tos_uri: z2.string().url().optional(),
+  policy_uri: z2.string().url().optional(),
+  software_id: z2.string().max(200).optional(),
+  software_version: z2.string().max(100).optional()
 }).strip();
 function registeredClientTtlSeconds(client2, configuredTtlSeconds) {
   return client2.software_id === OAUTH_DEPLOYMENT_CANARY_SOFTWARE_ID ? Math.min(
@@ -58270,41 +58280,41 @@ var HIVE_PROMPTS = [
   }
 ];
 
-// src/services/unkey-service.ts
-import { randomUUID as randomUUID4 } from "crypto";
-var _unkey = null;
+// src/services/api-key-service.ts
+import { createHash as createHash6, randomInt, randomUUID as randomUUID4 } from "crypto";
 function getAuthBackendMode() {
   const mode = (getEnvVar("HIVE_AUTH_BACKEND") ?? "auto").toLowerCase();
-  if (mode === "unkey" || mode === "static" || mode === "auto") {
-    return mode;
-  }
+  if (mode === "hosted" || mode === "unkey") return "hosted";
+  if (mode === "static") return "static";
   return "auto";
 }
-function isUnkeyRequired() {
-  return getAuthBackendMode() === "unkey";
+function isHostedKeysRequired() {
+  return getAuthBackendMode() === "hosted";
 }
-function hasUnkeyCredentials() {
-  return hasEnvVars("UNKEY_ROOT_KEY", "UNKEY_API_ID");
+function isHostedKeysConfigured() {
+  return getAuthBackendMode() !== "static" && isSupabaseConfigured();
 }
-function isUnkeyConfigured() {
-  return getAuthBackendMode() !== "static" && hasUnkeyCredentials();
+function isLegacyUnkeyConfigured() {
+  return hasEnvVars("UNKEY_ROOT_KEY");
 }
-async function getUnkey() {
-  if (!_unkey) {
-    if (!isUnkeyConfigured()) {
-      throw new Error(
-        "Unkey not configured. Set UNKEY_ROOT_KEY and UNKEY_API_ID."
-      );
-    }
-    const { Unkey: UnkeyClient } = await import("@unkey/api");
-    _unkey ??= new UnkeyClient({
-      rootKey: getRequiredEnvVar("UNKEY_ROOT_KEY")
-    });
-  }
+var _unkey = null;
+function legacyUnkey() {
+  _unkey ??= createFetchClient({
+    baseURL: "https://api.unkey.com/v2",
+    timeout: 5e3,
+    headers: { Authorization: `Bearer ${getEnvVar("UNKEY_ROOT_KEY")}` }
+  });
   return _unkey;
 }
-function getApiId() {
-  return getRequiredEnvVar("UNKEY_API_ID");
+var KEY_PREFIX = "hive_live_";
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var START_LENGTH = KEY_PREFIX.length + 4;
+var BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function randomBase58(length) {
+  return Array.from({ length }, () => BASE58[randomInt(BASE58.length)]).join("");
+}
+function hashKey(key) {
+  return createHash6("sha256").update(key).digest("hex");
 }
 function normalizeAnalyticsTags(tags) {
   const normalized = /* @__PURE__ */ new Set();
@@ -58317,6 +58327,24 @@ function normalizeAnalyticsTags(tags) {
   }
   return [...normalized];
 }
+function withoutStalePlan(meta2) {
+  if (!meta2) return void 0;
+  const { plan: _stalePlan, ...rest } = meta2;
+  return rest;
+}
+var VERIFY_CACHE_TTL_MS = 3e4;
+var VERIFY_CACHE_MAX = 1e4;
+var verifyCache = /* @__PURE__ */ new Map();
+function cacheVerified(keyHash, result2) {
+  if (verifyCache.size >= VERIFY_CACHE_MAX) {
+    const oldest = verifyCache.keys().next().value;
+    if (oldest !== void 0) verifyCache.delete(oldest);
+  }
+  verifyCache.set(keyHash, {
+    result: result2,
+    expiresAt: Date.now() + VERIFY_CACHE_TTL_MS
+  });
+}
 async function getPlan(planId) {
   const supabase = getSupabaseAdmin();
   const { data, error } = await supabase.from("plans").select("*").eq("id", planId).single();
@@ -58325,32 +58353,10 @@ async function getPlan(planId) {
   }
   return data;
 }
-var KEYS_PAGE_LIMIT = 100;
-var KEYS_MAX_PAGES = 100;
-async function listAllUserKeysRaw(userId) {
-  const apiId = getApiId();
-  const all = [];
-  let cursor;
-  for (let page = 0; page < KEYS_MAX_PAGES; page += 1) {
-    const unkey = await getUnkey();
-    const result2 = await unkey.apis.listKeys({
-      apiId,
-      externalId: userId,
-      limit: KEYS_PAGE_LIMIT,
-      revalidateKeysCache: true,
-      ...cursor ? { cursor } : {}
-    });
-    const keys = Array.isArray(result2.result.data) ? result2.result.data : [];
-    all.push(...keys);
-    const pagination = result2.result.pagination;
-    if (!pagination?.hasMore || !pagination.cursor) break;
-    cursor = pagination.cursor;
-  }
-  return all;
-}
 async function countActiveUserKeys(userId) {
-  const keys = await listAllUserKeysRaw(userId);
-  return keys.filter((k) => k.enabled !== false).length;
+  const { count, error } = await getSupabaseAdmin().from("api_keys").select("id", { count: "exact", head: true }).eq("user_id", userId).eq("enabled", true);
+  if (error) throw new Error(`Counting API keys failed: ${error.message}`);
+  return count ?? 0;
 }
 var KEY_CREATION_LEASE_TTL_SECONDS = 120;
 var KEY_CREATION_LEASE_WAIT_MS = 1e4;
@@ -58406,82 +58412,114 @@ async function createApiKey(opts) {
         subject_signing_secret: subjectSigningSecret
       } : {}
     };
-    const unkey = await getUnkey();
-    const result2 = await unkey.keys.createKey({
-      apiId: getApiId(),
-      prefix: "hive_live",
+    const key = KEY_PREFIX + randomBase58(33);
+    const keyId = `key_${randomBase58(16)}`;
+    const { error } = await getSupabaseAdmin().from("api_keys").insert({
+      id: keyId,
+      user_id: opts.userId,
       name: opts.name,
-      byteLength: 24,
-      externalId: opts.userId,
-      meta: meta2,
-      enabled: true
+      start: key.slice(0, START_LENGTH),
+      key_hash: hashKey(key),
+      meta: meta2
     });
-    if (!result2.data) {
-      secureLogger.error("Unkey createKey failed", null, {
-        error: "No data in response"
+    if (error) {
+      secureLogger.error("API key insert failed", error, {
+        userId: opts.userId
       });
       throw new Error("Failed to create API key");
     }
-    return {
-      keyId: result2.data.keyId,
-      key: result2.data.key,
-      subjectSigningSecret
-    };
+    return { keyId, key, subjectSigningSecret };
   } finally {
     await releaseKeyCreationLease(opts.userId, leaseToken);
   }
 }
-async function verifyApiKey(rawKey, analyticsTags = []) {
+async function verifyLegacyUnkeyKey(rawKey, keyHash, analyticsTags) {
   const tags = normalizeAnalyticsTags(analyticsTags);
-  const unkey = await getUnkey();
-  const result2 = await unkey.keys.verifyKey({
+  const { data: body } = await legacyUnkey().post("/keys.verifyKey", {
     key: rawKey,
     ...tags.length > 0 ? { tags } : {}
   });
-  if (!result2.data) {
-    secureLogger.warn("Unkey verifyKey call failed", {
-      error: "No data in response"
-    });
-    return { valid: false, code: "VERIFICATION_FAILED" };
+  const d = body?.data;
+  if (!d) throw new Error("Unkey verifyKey answered without a result");
+  if (!d.valid) return { valid: false, code: d.code ?? "UNKNOWN" };
+  const userId = d.identity?.externalId;
+  if (!d.keyId || !userId || !UUID_PATTERN.test(userId)) {
+    return { valid: false, code: "NOT_FOUND" };
+  }
+  const { data: enabled, error } = await getSupabaseAdmin().rpc(
+    "migrate_unkey_api_key",
+    {
+      p_id: d.keyId,
+      p_user_id: userId,
+      p_key_hash: keyHash,
+      p_name: d.name ?? "Unnamed",
+      p_start: rawKey.slice(0, START_LENGTH),
+      p_meta: withoutStalePlan(d.meta) ?? {}
+    }
+  );
+  if (error) {
+    throw new Error(`Recording a legacy API key failed: ${error.message}`);
+  }
+  if (enabled !== true) {
+    return { valid: false, code: "DISABLED", keyId: d.keyId };
   }
-  const d = result2.data;
   return {
-    valid: d.valid,
-    code: d.code ?? (d.valid ? "VALID" : "UNKNOWN"),
+    valid: true,
+    code: "VALID",
     keyId: d.keyId,
-    userId: d.identity?.externalId,
+    userId,
     name: d.name,
-    credits: d.credits ?? void 0,
-    meta: d.meta ?? void 0
+    meta: withoutStalePlan(d.meta)
   };
 }
+async function verifyApiKey(rawKey, analyticsTags = []) {
+  const keyHash = hashKey(rawKey);
+  const cached = verifyCache.get(keyHash);
+  if (cached && cached.expiresAt > Date.now()) return cached.result;
+  const { data: row, error } = await getSupabaseAdmin().from("api_keys").select("id, user_id, name, meta, enabled").eq("key_hash", keyHash).maybeSingle();
+  if (error) throw new Error(`API key lookup failed: ${error.message}`);
+  let result2;
+  if (row) {
+    result2 = row.enabled ? {
+      valid: true,
+      code: "VALID",
+      keyId: row.id,
+      userId: row.user_id,
+      name: row.name,
+      meta: row.meta ?? void 0
+    } : { valid: false, code: "DISABLED", keyId: row.id };
+  } else if (isLegacyUnkeyConfigured()) {
+    result2 = await verifyLegacyUnkeyKey(rawKey, keyHash, analyticsTags);
+  } else {
+    result2 = { valid: false, code: "NOT_FOUND" };
+  }
+  if (result2.valid) cacheVerified(keyHash, result2);
+  return result2;
+}
 async function listKeys(userId) {
-  const keys = await listAllUserKeysRaw(userId);
-  if (keys.length === 0) return [];
-  return keys.map((k) => ({
-    keyId: k.keyId ?? "",
+  const { data, error } = await getSupabaseAdmin().from("api_keys").select("id, name, start, enabled, meta, created_at").eq("user_id", userId).order("created_at", { ascending: true });
+  if (error) throw new Error(`Listing API keys failed: ${error.message}`);
+  return (data ?? []).map((k) => ({
+    keyId: k.id,
     name: k.name ?? "Unnamed",
     prefix: k.start ?? "",
-    createdAt: k.createdAt ? new Date(k.createdAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    createdAt: new Date(k.created_at).toISOString(),
     enabled: k.enabled ?? true,
-    credits: k.credits?.remaining ?? void 0,
-    externalId: k.identity?.externalId ?? void 0,
-    meta: withoutStalePlan(
-      sanitizeKeyMeta(k.meta ?? void 0)
-    )
+    externalId: userId,
+    meta: withoutStalePlan(sanitizeKeyMeta(k.meta ?? void 0))
   }));
 }
-function withoutStalePlan(meta2) {
-  if (!meta2) return void 0;
-  const { plan: _stalePlan, ...rest } = meta2;
-  return rest;
-}
 async function revokeKey(keyId) {
-  const unkey = await getUnkey();
-  await unkey.keys.updateKey({
-    keyId,
-    enabled: false
-  });
+  const { data, error } = await getSupabaseAdmin().from("api_keys").update({ enabled: false }).eq("id", keyId).select("key_hash, source").maybeSingle();
+  if (error) throw new Error(`Revoking API key failed: ${error.message}`);
+  if (data?.key_hash) verifyCache.delete(data.key_hash);
+  if (data?.source === "unkey" && isLegacyUnkeyConfigured()) {
+    await legacyUnkey().post("/keys.updateKey", { keyId, enabled: false }).catch(
+      (err) => secureLogger.error("Unkey disable failed; the key stays revoked in Hive", err, {
+        keyId
+      })
+    );
+  }
 }
 
 // src/health/mcpProtocol.ts
@@ -58491,28 +58529,28 @@ function getStaticApiKeys() {
 function getHttpMcpAuthReadiness() {
   const backend = getAuthBackendMode();
   const staticKeyCount = getStaticApiKeys().length;
-  if (isUnkeyRequired()) {
-    if (!isUnkeyConfigured()) {
+  if (isHostedKeysRequired()) {
+    if (!isHostedKeysConfigured()) {
       return {
         status: "missing_key",
         backend,
         configured: false,
-        detail: "Unkey authentication is selected but UNKEY_ROOT_KEY or UNKEY_API_ID is missing."
+        detail: "Hosted API key authentication is selected but SUPABASE_URL or SUPABASE_SERVICE_ROLE_KEY is missing."
       };
     }
     return {
       status: "ok",
       backend,
       configured: true,
-      detail: "Unkey authentication is configured for HTTP MCP."
+      detail: "Hosted API key authentication is configured for HTTP MCP."
     };
   }
-  if (isUnkeyConfigured()) {
+  if (isHostedKeysConfigured()) {
     return {
       status: "ok",
       backend,
       configured: true,
-      detail: "Unkey authentication is configured for HTTP MCP."
+      detail: "Hosted API key authentication is configured for HTTP MCP."
     };
   }
   if (staticKeyCount > 0) {
@@ -58527,7 +58565,7 @@ function getHttpMcpAuthReadiness() {
     status: "missing_key",
     backend,
     configured: false,
-    detail: "HTTP MCP authentication is not configured. Set Unkey credentials or HIVE_AUTH_BACKEND=static with HIVE_API_KEYS."
+    detail: "HTTP MCP authentication is not configured. Set SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY for hosted keys, or HIVE_AUTH_BACKEND=static with HIVE_API_KEYS."
   };
 }
 async function timedCheck(name, fn) {
@@ -58912,7 +58950,7 @@ async function runMcpProtocolHealth(options = {}) {
 }
 
 // src/health/oauthLifecycle.ts
-import { createHash as createHash7, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash8, randomBytes as randomBytes3 } from "crypto";
 
 // src/auth/oauth/provider.ts
 import { randomBytes as randomBytes2 } from "crypto";
@@ -59288,10 +59326,10 @@ function isHiveOAuthAccessToken(token) {
 }
 
 // src/auth/oauth/store.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 var REVOKED_FAMILY_TTL_SECONDS = 7776e3;
 function digest(value) {
-  return createHash6("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
 function parseJson(raw) {
   if (!raw) return void 0;
@@ -59700,7 +59738,7 @@ var OAUTH_LIFECYCLE_CHECK_NAMES = [
   "token_revocation",
   "connected_app_cleanup"
 ];
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function elapsed(started) {
   return Math.max(0, Date.now() - started);
 }
@@ -59743,7 +59781,7 @@ async function operationRejects(operation) {
 }
 async function issueCanaryFamily(args) {
   const verifier = randomBytes3(48).toString("base64url");
-  const challenge = createHash7("sha256").update(verifier).digest("base64url");
+  const challenge = createHash8("sha256").update(verifier).digest("base64url");
   let consentLocation;
   const response = {
     redirect(status, location) {
@@ -59863,7 +59901,7 @@ async function runOAuthLifecycleHealth(overrides = {}) {
   }
   const userStarted = Date.now();
   const canaryUserId = dependencies.canaryUserId;
-  if (!canaryUserId || !UUID_PATTERN.test(canaryUserId)) {
+  if (!canaryUserId || !UUID_PATTERN2.test(canaryUserId)) {
     checks.push(
       check(
         "canary_identity",
@@ -60055,7 +60093,7 @@ async function runOAuthLifecycleHealth(overrides = {}) {
 import Coingecko4 from "@coingecko/coingecko-typescript";
 
 // src/tools/goplus/goplusClient.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function parsePositiveInteger(value, fallback) {
   const parsed = Number.parseInt(value || "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
@@ -60149,7 +60187,7 @@ var GoPlusClient = class {
     const time = Math.floor(Date.now() / 1e3);
     const timeStr = time.toString();
     const signInput = this.appKey + timeStr + this.appSecret;
-    const sign = createHash8("sha1").update(signInput).digest("hex");
+    const sign = createHash9("sha1").update(signInput).digest("hex");
     secureLogger.info("GoPlus: requesting access token", {
       appKeyLength: this.appKey.length,
       appSecretLength: this.appSecret.length,
@@ -66033,32 +66071,32 @@ function dynamicTools(endpoints, options = {}) {
   const taskToolsetCatalogEntries = TASK_TOOLSETS.map(
     (toolset) => toolsetCatalogEntry(toolset, providerByToolName)
   );
-  const searchToolsSchema = z4.object({
-    query: z4.string().max(512).optional().describe(
+  const searchToolsSchema = z3.object({
+    query: z3.string().max(512).optional().describe(
       "Search text matched against tool name, title, category, provider, and summary."
     ),
-    provider: z4.string().max(128).optional().describe(
+    provider: z3.string().max(128).optional().describe(
       "Optional provider filter such as CoinGecko, Tenderly, Helius, GoPlus, CCXT, Alchemy, DeFiLlama, Hyperliquid, or Open Data Fetch."
     ),
-    category: z4.string().max(128).optional().describe("Optional category filter, for example Portfolio & Wallet."),
-    limit: z4.number().int().min(1).max(MAX_SEARCH_LIMIT).optional().describe(`Maximum tools to return. Default ${DEFAULT_SEARCH_LIMIT}.`),
-    cursor: z4.string().optional().describe("Pagination cursor from the previous response."),
-    toolset_id: z4.string().max(100).optional().describe(
+    category: z3.string().max(128).optional().describe("Optional category filter, for example Portfolio & Wallet."),
+    limit: z3.number().int().min(1).max(MAX_SEARCH_LIMIT).optional().describe(`Maximum tools to return. Default ${DEFAULT_SEARCH_LIMIT}.`),
+    cursor: z3.string().optional().describe("Pagination cursor from the previous response."),
+    toolset_id: z3.string().max(100).optional().describe(
       "Optional exact canonical task toolset id. Use this after an initial compact result to inspect one workflow."
     ),
-    route_id: z4.string().max(100).optional().describe(
+    route_id: z3.string().max(100).optional().describe(
       "Optional exact task-shaped route id. Use the matched route's ordered calls and conditional fallbacks instead of choosing from the coverage catalog."
     ),
-    evidence_phase: z4.string().max(100).optional().describe(
+    evidence_phase: z3.string().max(100).optional().describe(
       `Optional exact workflow evidence phase. Supported values: ${CANONICAL_EVIDENCE_PHASES.join(", ")}.`
     ),
-    detail: z4.enum(["compact", "standard", "full"]).optional().describe(
+    detail: z3.enum(["compact", "standard", "full"]).optional().describe(
       "Toolset detail level. Defaults to compact. Use full only when the task output schema is needed."
     ),
-    toolset_limit: z4.number().int().min(1).max(MAX_TOOLSET_LIMIT).optional().describe(
+    toolset_limit: z3.number().int().min(1).max(MAX_TOOLSET_LIMIT).optional().describe(
       `Maximum matching task toolsets to return. Default ${DEFAULT_TOOLSET_LIMIT}, max ${MAX_TOOLSET_LIMIT}.`
     ),
-    toolset_cursor: z4.string().optional().describe("Pagination cursor for task toolset matches.")
+    toolset_cursor: z3.string().optional().describe("Pagination cursor for task toolset matches.")
   });
   const searchToolsTool = {
     metadata: {
@@ -66192,9 +66230,9 @@ function dynamicTools(endpoints, options = {}) {
       });
     }
   };
-  const getEndpointSchema = z4.object({
-    endpoint: z4.string().optional().describe("The name of the endpoint to get the schema for."),
-    endpoint_name: z4.string().optional().describe(
+  const getEndpointSchema = z3.object({
+    endpoint: z3.string().optional().describe("The name of the endpoint to get the schema for."),
+    endpoint_name: z3.string().optional().describe(
       "Alias for 'endpoint', accepted for symmetry with invoke_api_endpoint. Provide one of the two."
     )
   });
@@ -66272,12 +66310,12 @@ function dynamicTools(endpoints, options = {}) {
       });
     }
   };
-  const invokeEndpointSchema = z4.object({
-    endpoint_name: z4.string().optional().describe("The name of the endpoint to invoke."),
-    endpoint: z4.string().optional().describe(
+  const invokeEndpointSchema = z3.object({
+    endpoint_name: z3.string().optional().describe("The name of the endpoint to invoke."),
+    endpoint: z3.string().optional().describe(
       "Alias for 'endpoint_name', accepted by both root invokers. Provide one of the two."
     ),
-    args: z4.record(z4.string(), z4.any()).optional().describe(
+    args: z3.record(z3.string(), z3.any()).optional().describe(
       "The arguments to pass to the endpoint. This must match the schema returned by the `get_api_endpoint_schema` tool. You may also pass arguments as flat top-level keys alongside endpoint_name."
     )
   }).passthrough();
@@ -66348,9 +66386,9 @@ function dynamicTools(endpoints, options = {}) {
     },
     handler: async (client2, args) => invokeWithPolicy(STATEFUL_WRITE_ENDPOINT_INVOKER, client2, args)
   };
-  const validateTaskResultSchema = z4.object({
-    task_toolset_id: z4.string().describe("Canonical task toolset id returned by search_tools."),
-    result: z4.record(z4.string(), z4.any()).describe(
+  const validateTaskResultSchema = z3.object({
+    task_toolset_id: z3.string().describe("Canonical task toolset id returned by search_tools."),
+    result: z3.record(z3.string(), z3.any()).describe(
       "The proposed task result envelope. Each receipt.calls entry must be copied exactly from a material call's _hive object."
     )
   });
@@ -66642,10 +66680,10 @@ function dynamicTools(endpoints, options = {}) {
     }
   };
   const categoryTools = ToolRegistry.map((category, categoryIndex) => {
-    const categorySchema = z4.object({
-      search: z4.string().optional().describe("Ignored; retained for 1.2.0 compatibility."),
-      limit: z4.number().int().optional().describe("Ignored; retained for 1.2.0 compatibility."),
-      cursor: z4.string().optional().describe("Ignored; retained for 1.2.0 compatibility.")
+    const categorySchema = z3.object({
+      search: z3.string().optional().describe("Ignored; retained for 1.2.0 compatibility."),
+      limit: z3.number().int().optional().describe("Ignored; retained for 1.2.0 compatibility."),
+      cursor: z3.string().optional().describe("Ignored; retained for 1.2.0 compatibility.")
     });
     const categoryEndpointName = category.name;
     const categoryPath = CategoryEndpoints[categoryIndex] ?? "";
@@ -66724,7 +66762,7 @@ function dynamicTools(endpoints, options = {}) {
 }
 
 // src/utils/jsonSchemaToZod.ts
-import { z as z5 } from "zod";
+import { z as z4 } from "zod";
 var TOP_LEVEL_COMBINATORS = /* @__PURE__ */ new Set([
   "allOf",
   "anyOf",
@@ -66806,10 +66844,10 @@ function zodPath(field) {
   });
 }
 function jsonSchemaToZodInputSchema(schema) {
-  const base = z5.fromJSONSchema(
+  const base = z4.fromJSONSchema(
     zodBaseSchema(schema)
   );
-  if (!(base instanceof z5.ZodObject)) {
+  if (!(base instanceof z4.ZodObject)) {
     throw new Error("Tool input schema must compile to a Zod object");
   }
   const properties = schema.properties ?? {};
@@ -66856,34 +66894,34 @@ function jsonSchemaToZodShape(schema) {
   return shape;
 }
 function jsonSchemaToZodObject(schema, options = {}) {
-  const objectSchema = z5.object(jsonSchemaToZodShape(schema));
+  const objectSchema = z4.object(jsonSchemaToZodShape(schema));
   return options.passthrough ? objectSchema.passthrough() : objectSchema;
 }
 function buildZodType(prop) {
   const type = prop.type;
   const enumValues = prop.enum;
   if (enumValues && enumValues.length > 0) {
-    return z5.enum(enumValues);
+    return z4.enum(enumValues);
   }
   switch (type) {
     case "string":
-      return z5.string();
+      return z4.string();
     case "number":
     case "integer":
-      return z5.number();
+      return z4.number();
     case "boolean":
-      return z5.boolean();
+      return z4.boolean();
     case "array":
-      return z5.array(z5.unknown());
+      return z4.array(z4.unknown());
     case "object":
-      return z5.record(z5.string(), z5.unknown());
+      return z4.record(z4.string(), z4.unknown());
     default:
-      return z5.unknown();
+      return z4.unknown();
   }
 }
 
 // src/mcpServer.ts
-dotenv.config({ quiet: true });
+loadEnvFile();
 var ROOT_META_TOOL_COUNT = getRootVisibleToolCount();
 var ROOT_VISIBLE_TOOL_ORDER = [
   "get_token_price",
@@ -67629,12 +67667,6 @@ var HiveMCPServer = class {
                         "/api/health/toolsets/quick",
                         "/api/health/toolsets/history"
                       ],
-                      unkeyAnalyticsTags: [
-                        "service=hive",
-                        "transport=rest",
-                        "route=<route>",
-                        "endpoint=<tool_name>"
-                      ],
                       mcpToolCallLogFields: [
                         "tool",
                         "success",
@@ -67811,14 +67843,6 @@ function createHiveMcpServer(scope, options) {
 }
 
 export {
-  getEnvVar,
-  getCsvEnv,
-  getNodeEnv,
-  isProduction,
-  getPort,
-  getRateLimitMax,
-  getCredentialedRateLimitMax,
-  getCorsAllowedOrigins,
   isSupabaseConfigured,
   getSupabaseAdmin,
   getUserPlanId,
@@ -67881,8 +67905,8 @@ export {
   OAUTH_CLIENT_REDIRECT_PROFILES,
   MAX_DCR_CLIENT_METADATA_BYTES,
   buildAuthCompatibility,
-  isUnkeyRequired,
-  isUnkeyConfigured,
+  isHostedKeysRequired,
+  isHostedKeysConfigured,
   createApiKey,
   verifyApiKey,
   listKeys,