hive-intelligence 1.16.1 → 1.17.1

package/build/server.js

@@ -8,7 +8,7 @@ import {
   getWalletStatus,
   refundCredits,
   refundSettled
-} from "./chunk-6M6O3DZM.js";
+} from "./chunk-TLADUAUA.js";
 import {
   CategoryEndpoints,
   HERO_TOOL_NAMES,
@@ -97,7 +97,7 @@ import {
   validateEndpointArgs,
   verifyApiKey,
   waitForRedisAvailability
-} from "./chunk-757ZNB6W.js";
+} from "./chunk-UP47NKED.js";
 import {
   HIVE_AGENT_SKILLS
 } from "./chunk-QYK3EWTE.js";
@@ -754,7 +754,7 @@ function resolveTrustedProxies(raw = getEnvVar("TRUSTED_PROXY_ADDRESSES")) {
 }
 
 // src/server.ts
-import { randomUUID as randomUUID4, timingSafeEqual as timingSafeEqual6 } from "crypto";
+import { randomUUID as randomUUID4, timingSafeEqual as timingSafeEqual5 } from "crypto";
 import { resolve } from "path";
 import { fileURLToPath } from "url";
 import express2 from "express";
@@ -1774,7 +1774,7 @@ function buildCatalogIntegrityDimension(history) {
     }
   };
 }
-var RATE_LIMITER_SCOPE = "This instance's shared rate-limit store, upstream response cache, and idempotency keys.";
+var RATE_LIMITER_SCOPE = "This instance's shared rate-limit store and idempotency keys.";
 function buildRateLimiterDimension(signal) {
   const observedAt = (/* @__PURE__ */ new Date()).toISOString();
   if (!signal.configured) {
@@ -3745,181 +3745,17 @@ import {
 } from "express";
 import { z as z2 } from "zod";
 
-// src/services/stripe-service.ts
+// src/services/llamapay-service.ts
 import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
-var STRIPE_API_BASE = "https://api.stripe.com";
-var STRIPE_SIGNATURE_TOLERANCE_SECONDS = 300;
+var LLAMAPAY_API_BASE = "https://api.llamapay.io";
 var PAID_PLAN_ID = "analyst";
 var FREE_PLAN_ID = "demo";
-function getStripeSecretKey() {
-  return getEnvVar("STRIPE_SECRET_KEY");
-}
-function getStripeWebhookSecret() {
-  return getEnvVar("STRIPE_WEBHOOK_SECRET");
-}
-function isStripeCheckoutConfigured() {
-  return Boolean(getStripeSecretKey());
-}
-var STRIPE_PRICE_ENV = {
-  starter: {
-    monthly: "STRIPE_PRICE_STARTER_MONTHLY",
-    yearly: "STRIPE_PRICE_STARTER_YEARLY"
-  },
-  analyst: {
-    monthly: "STRIPE_PRICE_PRO_MONTHLY",
-    yearly: "STRIPE_PRICE_PRO_YEARLY"
-  }
-};
-function priceIdForPlanCycle(planId, cycle) {
-  const row = STRIPE_PRICE_ENV[planId];
-  if (!row) return void 0;
-  return getEnvVar(row[cycle]);
-}
-function planIdForPrice(priceId) {
-  if (!priceId) return null;
-  for (const [planId, cycles] of Object.entries(STRIPE_PRICE_ENV)) {
-    for (const envName of Object.values(cycles)) {
-      if (priceId === getEnvVar(envName)) return planId;
-    }
-  }
-  return null;
-}
-var STRIPE_SUBSCRIPTION_STATUSES = [
-  "incomplete",
-  "incomplete_expired",
-  "trialing",
-  "active",
-  "past_due",
-  "canceled",
-  "unpaid",
-  "paused"
-];
-function registrySubscriptionStatus(status) {
-  if (!status) return null;
-  return STRIPE_SUBSCRIPTION_STATUSES.includes(status) ? status : null;
-}
 function getBillingSuccessUrl() {
   return getEnvVar("BILLING_SUCCESS_URL") ?? "https://www.hiveintelligence.xyz/dashboard?checkout=success";
 }
 function getBillingCancelUrl() {
   return getEnvVar("BILLING_CANCEL_URL") ?? "https://www.hiveintelligence.xyz/dashboard?checkout=cancelled";
 }
-function verifyStripeSignature(args) {
-  const {
-    payload,
-    header,
-    secret,
-    toleranceSeconds = STRIPE_SIGNATURE_TOLERANCE_SECONDS,
-    nowSeconds = Math.floor(Date.now() / 1e3)
-  } = args;
-  if (typeof header !== "string" || header.length === 0) {
-    return { valid: false, reason: "missing_header" };
-  }
-  let timestamp = null;
-  const candidates = [];
-  for (const part of header.split(",")) {
-    const eq = part.indexOf("=");
-    if (eq <= 0) continue;
-    const key = part.slice(0, eq).trim();
-    const value = part.slice(eq + 1).trim();
-    if (key === "t") {
-      const parsed = Number.parseInt(value, 10);
-      if (Number.isFinite(parsed)) timestamp = parsed;
-    } else if (key === "v1" && /^[0-9a-f]+$/i.test(value)) {
-      candidates.push(value);
-    }
-  }
-  if (timestamp === null || candidates.length === 0) {
-    return { valid: false, reason: "malformed_header" };
-  }
-  if (Math.abs(nowSeconds - timestamp) > toleranceSeconds) {
-    return { valid: false, reason: "timestamp_out_of_tolerance" };
-  }
-  const expected = createHmac("sha256", secret).update(`${timestamp}.`).update(payload).digest();
-  for (const candidate of candidates) {
-    const provided = Buffer.from(candidate, "hex");
-    if (provided.length === expected.length && timingSafeEqual3(provided, expected)) {
-      return { valid: true };
-    }
-  }
-  return { valid: false, reason: "signature_mismatch" };
-}
-var StripeApiError = class extends Error {
-  constructor(status, message) {
-    super(message);
-    this.status = status;
-    this.name = "StripeApiError";
-  }
-  status;
-};
-async function stripePost(path, params) {
-  const key = getStripeSecretKey();
-  if (!key) {
-    throw new StripeApiError(503, "STRIPE_SECRET_KEY is not configured");
-  }
-  const response = await fetch(`${STRIPE_API_BASE}${path}`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${key}`,
-      "content-type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams(params).toString()
-  });
-  let json = {};
-  try {
-    json = await response.json();
-  } catch {
-    json = {};
-  }
-  if (!response.ok) {
-    const error = json.error;
-    throw new StripeApiError(
-      response.status,
-      error?.message ?? `Stripe API request to ${path} failed`
-    );
-  }
-  return json;
-}
-async function createStripeCustomer(args) {
-  const params = {
-    "metadata[user_id]": args.userId
-  };
-  if (args.email) params.email = args.email;
-  const customer = await stripePost("/v1/customers", params);
-  const id = customer.id;
-  if (typeof id !== "string" || !id) {
-    throw new StripeApiError(502, "Stripe customer creation returned no id");
-  }
-  return id;
-}
-async function createStripeCheckoutSession(args) {
-  const session = await stripePost("/v1/checkout/sessions", {
-    mode: "subscription",
-    customer: args.customerId,
-    "line_items[0][price]": args.priceId,
-    "line_items[0][quantity]": "1",
-    success_url: getBillingSuccessUrl(),
-    cancel_url: getBillingCancelUrl(),
-    client_reference_id: args.userId,
-    "metadata[user_id]": args.userId,
-    "metadata[plan_id]": args.planId,
-    "subscription_data[metadata][user_id]": args.userId,
-    "subscription_data[metadata][plan_id]": args.planId
-  });
-  const id = session.id;
-  const url = session.url;
-  if (typeof id !== "string" || typeof url !== "string" || !url) {
-    throw new StripeApiError(
-      502,
-      "Stripe checkout session creation returned no URL"
-    );
-  }
-  return { id, url };
-}
-
-// src/services/llamapay-service.ts
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual4 } from "crypto";
-var LLAMAPAY_API_BASE = "https://api.llamapay.io";
 var LLAMAPAY_SIGNATURE_HEADER = "x-cc-webhook-signature";
 function getLlamaPayApiKey() {
   const key = process.env.LLAMAPAY_API_KEY?.trim();
@@ -4069,13 +3905,13 @@ function verifyLlamaPaySignature(args) {
   if (!/^[0-9a-f]+$/.test(received)) {
     return { valid: false, reason: "malformed_header" };
   }
-  const expected = createHmac2("sha256", args.secret).update(args.payload).digest("hex");
+  const expected = createHmac("sha256", args.secret).update(args.payload).digest("hex");
   const receivedBuf = Buffer.from(received, "utf8");
   const expectedBuf = Buffer.from(expected, "utf8");
   if (receivedBuf.length !== expectedBuf.length) {
     return { valid: false, reason: "no_match" };
   }
-  if (!timingSafeEqual4(receivedBuf, expectedBuf)) {
+  if (!timingSafeEqual3(receivedBuf, expectedBuf)) {
     return { valid: false, reason: "no_match" };
   }
   return { valid: true };
@@ -4103,7 +3939,7 @@ function requireBillingPrincipal(req, res, next) {
     verifyApiKey(apiKeyHeader, [
       "service=hive",
       "transport=rest",
-      "route=/api/v1/billing/checkout-session"
+      "route=/api/v1/billing"
     ]).then((result) => {
       if (!result.valid || !result.userId) {
         res.status(401).json(
@@ -4135,13 +3971,6 @@ function requireBillingPrincipal(req, res, next) {
     next();
   });
 }
-var CheckoutSchema = z2.object({
-  // Was absent, and the route hardcoded PAID_PLAN_ID. The crypto lane sold
-  // Starter and this one did not, so the two processors sold different
-  // catalogues -- with Starter the emphasised middle card on /pricing.
-  plan_id: z2.string().min(1).default(PAID_PLAN_ID),
-  billing_cycle: z2.enum(["monthly", "yearly"]).default("monthly")
-});
 var OCCUPYING_BILLING_STATUSES = /* @__PURE__ */ new Set(["active", "past_due", "unpaid"]);
 var CHECKOUT_LOCK_TTL_MS = 6e4;
 var CHECKOUT_LOCK_PREFIX = "billing:checkout:";
@@ -4230,24 +4059,6 @@ async function findOpenCharge(userId) {
   const row = Array.isArray(data) ? data[0] : void 0;
   return typeof row?.charge_id === "string" ? row.charge_id : null;
 }
-async function settleChargeRecord(chargeId, status, eventType) {
-  if (!chargeId || !isSupabaseConfigured()) return;
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  try {
-    const { error } = await getSupabaseAdmin().from("billing_charges").update({
-      status,
-      settled_at: now,
-      last_event_at: now,
-      last_event_type: eventType
-    }).eq("charge_id", chargeId);
-    if (error) throw new Error(error.message);
-  } catch (err) {
-    secureLogger.error("Failed to settle billing charge record", err, {
-      chargeId,
-      eventType
-    });
-  }
-}
 async function recordChargeCreated(charge) {
   const { error } = await getSupabaseAdmin().from("billing_charges").insert({
     charge_id: charge.chargeId,
@@ -4264,452 +4075,15 @@ async function recordChargeCreated(charge) {
   }
 }
 var billingRouter = Router6();
-billingRouter.post(
-  "/checkout-session",
-  requireBillingPrincipal,
-  withCheckoutLock,
-  asyncHandler(async (req, res) => {
-    const userId = req.billingUserId;
-    if (!isStripeCheckoutConfigured()) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
-    }
-    if (!isSupabaseConfigured()) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
-    }
-    const parsed = CheckoutSchema.safeParse(req.body ?? {});
-    if (!parsed.success) {
-      return res.status(400).json(
-        apiError(
-          "invalid_request_error",
-          "VALIDATION_ERROR",
-          'billing_cycle must be "monthly" or "yearly".'
-        )
-      );
-    }
-    const { plan_id: planId, billing_cycle: cycle } = parsed.data;
-    if (!isSellablePlan(planId)) {
-      return res.status(400).json(
-        apiError(
-          "invalid_request_error",
-          "PLAN_NOT_SELLABLE",
-          `Plan "${planId}" is not sold self-serve. Next action: choose starter or ${PAID_PLAN_ID}, or contact support for Enterprise.`
-        )
-      );
-    }
-    const priceId = priceIdForPlanCycle(planId, cycle);
-    if (!priceId) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
-    }
-    const { data: profile } = await getSupabaseAdmin().from("user_profiles").select(
-      "plan_id, billing_customer_id, billing_subscription_id, billing_status"
-    ).eq("id", userId).maybeSingle();
-    if (profile?.billing_subscription_id && typeof profile.billing_status === "string" && OCCUPYING_BILLING_STATUSES.has(profile.billing_status)) {
-      return res.status(409).json(
-        apiError(
-          "invalid_request_error",
-          "SUBSCRIPTION_EXISTS",
-          "This account already has an active subscription. Next action: manage it from the dashboard billing tab instead of creating a new checkout."
-        )
-      );
-    }
-    const openChargeId = await findOpenCharge(userId);
-    if (openChargeId) {
-      return res.status(409).json(checkoutAlreadyOpen(openChargeId));
-    }
-    try {
-      let customerId = profile?.billing_customer_id ?? null;
-      if (!customerId) {
-        customerId = await createStripeCustomer({
-          userId,
-          email: req.billingUserEmail
-        });
-        const { error: bindError } = await getSupabaseAdmin().from("user_profiles").update({ billing_customer_id: customerId }).eq("id", userId);
-        if (bindError) {
-          throw new Error(
-            `failed to store billing_customer_id: ${bindError.message}`
-          );
-        }
-      }
-      const session = await createStripeCheckoutSession({
-        customerId,
-        priceId,
-        userId,
-        planId
-      });
-      await recordChargeCreated({
-        chargeId: session.id,
-        processor: "stripe",
-        userId,
-        planId,
-        cycle,
-        amountUsd: priceForPlanCycle(planId, cycle) ?? 0,
-        planIdBefore: asString(profile?.plan_id)
-      });
-      return res.json({
-        ok: true,
-        data: {
-          url: session.url,
-          session_id: session.id,
-          plan_id: planId,
-          billing_cycle: cycle
-        }
-      });
-    } catch (err) {
-      if (err instanceof StripeApiError) {
-        secureLogger.error("Stripe checkout-session creation failed", err, {
-          userId,
-          status: err.status
-        });
-        return res.status(502).json(
-          apiError(
-            "provider_error",
-            "BILLING_PROVIDER_ERROR",
-            "Stripe rejected the checkout request. Next action: retry; if it persists, contact support@hiveintelligence.xyz."
-          )
-        );
-      }
-      throw err;
-    }
-  })
-);
 function asString(value) {
   return typeof value === "string" && value.length > 0 ? value : null;
 }
-function refId(value) {
-  if (typeof value === "string") return value || null;
-  if (value && typeof value === "object") {
-    return asString(value.id);
-  }
-  return null;
-}
 function metadataOf(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) {
     return value;
   }
   return {};
 }
-function isoFromUnixSeconds(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return null;
-  return new Date(value * 1e3).toISOString();
-}
-async function resolveUserIdByCustomer(customerId) {
-  if (!customerId || !isSupabaseConfigured()) return null;
-  const { data, error } = await getSupabaseAdmin().from("user_profiles").select("id").eq("billing_customer_id", customerId).limit(1);
-  if (error || !data || data.length === 0) return null;
-  return asString(data[0]?.id);
-}
-function mapSubscriptionStatusToBilling(status) {
-  switch (status) {
-    case "active":
-    case "trialing":
-      return "active";
-    case "past_due":
-      return "past_due";
-    case "unpaid":
-      return "unpaid";
-    case "canceled":
-    case "incomplete_expired":
-      return "canceled";
-    default:
-      return null;
-  }
-}
-function invoiceSubscriptionContext(invoice) {
-  const parent = metadataOf(invoice.parent);
-  const parentDetails = metadataOf(parent.subscription_details);
-  const details = metadataOf(invoice.subscription_details);
-  return {
-    subscriptionId: refId(invoice.subscription) ?? refId(parentDetails.subscription),
-    metadata: {
-      ...metadataOf(parentDetails.metadata),
-      ...metadataOf(details.metadata)
-    }
-  };
-}
-function invoicePeriod(invoice) {
-  const lines = metadataOf(invoice.lines);
-  const data = Array.isArray(lines.data) ? lines.data : [];
-  let best = null;
-  let bestEnd = -Infinity;
-  for (const raw of data) {
-    const line = metadataOf(raw);
-    const period2 = metadataOf(line.period);
-    const end = typeof period2.end === "number" ? period2.end : null;
-    if (end !== null && end > bestEnd) {
-      bestEnd = end;
-      best = line;
-    }
-  }
-  if (!best) return { cycleStart: null, cycleEnd: null, priceId: null };
-  const period = metadataOf(best.period);
-  const price = metadataOf(best.price);
-  const pricing = metadataOf(best.pricing);
-  const priceDetails = metadataOf(pricing.price_details);
-  return {
-    cycleStart: isoFromUnixSeconds(period.start),
-    cycleEnd: isoFromUnixSeconds(period.end),
-    priceId: asString(price.id) ?? asString(priceDetails.price)
-  };
-}
-function cappedCreditCycleEnd(cycleStart, cycleEnd) {
-  if (!cycleStart) return cycleEnd;
-  const start = new Date(cycleStart);
-  if (Number.isNaN(start.getTime())) return cycleEnd;
-  const monthly = creditCycleEndFrom(start);
-  if (!cycleEnd) return monthly.toISOString();
-  const end = new Date(cycleEnd);
-  if (Number.isNaN(end.getTime())) return monthly.toISOString();
-  return (end < monthly ? end : monthly).toISOString();
-}
-async function decideWebhookAction(event) {
-  const object = metadataOf(event.data?.object);
-  switch (event.type) {
-    case "checkout.session.completed": {
-      const mode = asString(object.mode);
-      if (mode !== null && mode !== "subscription") {
-        return { kind: "ignore", note: "non-subscription checkout" };
-      }
-      const metadata = metadataOf(object.metadata);
-      const userId = asString(metadata.user_id) ?? asString(object.client_reference_id);
-      if (!userId) {
-        return { kind: "ignore", note: "checkout session without user_id" };
-      }
-      return {
-        kind: "apply",
-        args: {
-          eventId: event.id,
-          eventType: event.type,
-          userId,
-          newPlanId: asString(metadata.plan_id) ?? PAID_PLAN_ID,
-          grantCredits: true,
-          billingStatus: "active",
-          customerId: refId(object.customer),
-          subscriptionId: refId(object.subscription),
-          subscriptionStatus: "active",
-          ledgerReason: "plan_change"
-        }
-      };
-    }
-    case "customer.subscription.updated":
-    case "customer.subscription.deleted": {
-      const metadata = metadataOf(object.metadata);
-      const customerId = refId(object.customer);
-      const userId = asString(metadata.user_id) ?? await resolveUserIdByCustomer(customerId);
-      if (!userId) {
-        return {
-          kind: "unresolved_user",
-          note: `no user binding for customer ${customerId ?? "<none>"}`
-        };
-      }
-      if (event.type === "customer.subscription.deleted") {
-        return {
-          kind: "apply",
-          args: {
-            eventId: event.id,
-            eventType: event.type,
-            userId,
-            newPlanId: FREE_PLAN_ID,
-            grantCredits: true,
-            billingStatus: "canceled",
-            customerId,
-            subscriptionId: refId(object.id),
-            subscriptionStatus: "canceled",
-            ledgerReason: "plan_change"
-          }
-        };
-      }
-      const status = asString(object.status);
-      const items = metadataOf(object.items);
-      const firstItem = metadataOf(
-        Array.isArray(items.data) ? items.data[0] : void 0
-      );
-      const priceId = asString(metadataOf(firstItem.price).id);
-      return {
-        kind: "apply",
-        args: {
-          eventId: event.id,
-          eventType: event.type,
-          userId,
-          // Tier/status sync only — credits ride the money event
-          // (invoice.paid), which is the one wallet clock.
-          newPlanId: planIdForPrice(priceId) ?? asString(metadata.plan_id) ?? null,
-          grantCredits: false,
-          billingStatus: mapSubscriptionStatusToBilling(status),
-          customerId,
-          subscriptionId: refId(object.id),
-          // Whitelisted, never forwarded raw. stripe_subscriptions.status has
-          // a CHECK over eight literals; a status Stripe adds later raises
-          // 23514 *inside* apply_plan_change, which rolls back the dedupe
-          // claim and the wallet grant with it, 500s, and leaves Stripe
-          // retrying forever. Null here means "skip the registry upsert",
-          // which still applies the tier and still acks 200.
-          subscriptionStatus: registrySubscriptionStatus(status),
-          priceId,
-          ledgerReason: "plan_change"
-        }
-      };
-    }
-    case "invoice.paid":
-    case "invoice.payment_failed": {
-      const { subscriptionId, metadata } = invoiceSubscriptionContext(object);
-      if (!subscriptionId) {
-        return { kind: "ignore", note: "invoice without a subscription" };
-      }
-      const customerId = refId(object.customer);
-      const userId = asString(metadata.user_id) ?? await resolveUserIdByCustomer(customerId);
-      if (!userId) {
-        return {
-          kind: "unresolved_user",
-          note: `no user binding for customer ${customerId ?? "<none>"}`
-        };
-      }
-      if (event.type === "invoice.payment_failed") {
-        return {
-          kind: "apply",
-          args: {
-            eventId: event.id,
-            eventType: event.type,
-            userId,
-            billingStatus: "past_due",
-            customerId,
-            subscriptionId,
-            ledgerReason: "plan_change"
-          }
-        };
-      }
-      const period = invoicePeriod(object);
-      const creditCycleEnd = cappedCreditCycleEnd(
-        period.cycleStart,
-        period.cycleEnd
-      );
-      return {
-        kind: "apply",
-        args: {
-          eventId: event.id,
-          eventType: event.type,
-          userId,
-          newPlanId: planIdForPrice(period.priceId) ?? asString(metadata.plan_id) ?? null,
-          grantCredits: true,
-          cycleStart: period.cycleStart,
-          cycleEnd: creditCycleEnd,
-          termEnd: period.cycleEnd,
-          billingStatus: "active",
-          customerId,
-          subscriptionId,
-          priceId: period.priceId,
-          ledgerReason: "refill"
-        }
-      };
-    }
-    default:
-      return { kind: "ignore", note: `unhandled event type ${event.type}` };
-  }
-}
-var stripeWebhookHandler = asyncHandler(
-  async (req, res) => {
-    const secret = getStripeWebhookSecret();
-    if (!secret) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
-    }
-    const raw = req.body;
-    if (!Buffer.isBuffer(raw)) {
-      secureLogger.error(
-        "Stripe webhook received a non-raw body \u2014 express.raw must mount before the JSON parser",
-        void 0,
-        { path: req.path }
-      );
-      return res.status(500).json(
-        apiError(
-          "internal_error",
-          "WEBHOOK_BODY_NOT_RAW",
-          "Webhook raw body unavailable; server middleware misconfigured."
-        )
-      );
-    }
-    const verification = verifyStripeSignature({
-      payload: raw,
-      header: req.headers["stripe-signature"],
-      secret
-    });
-    if (!verification.valid) {
-      secureLogger.warn("Stripe webhook signature rejected", {
-        reason: verification.reason
-      });
-      return res.status(400).json(
-        apiError(
-          "authentication_error",
-          "INVALID_WEBHOOK_SIGNATURE",
-          `Stripe signature verification failed (${verification.reason}).`
-        )
-      );
-    }
-    let event;
-    try {
-      event = JSON.parse(raw.toString("utf8"));
-    } catch {
-      return res.status(400).json(
-        apiError(
-          "invalid_request_error",
-          "INVALID_JSON",
-          "Webhook payload is not valid JSON."
-        )
-      );
-    }
-    if (!asString(event?.id) || !asString(event?.type)) {
-      return res.status(400).json(
-        apiError(
-          "invalid_request_error",
-          "INVALID_EVENT",
-          "Webhook payload is missing event id or type."
-        )
-      );
-    }
-    try {
-      const decision = await decideWebhookAction(event);
-      if (decision.kind === "ignore") {
-        return res.json({ received: true, handled: false });
-      }
-      if (decision.kind === "unresolved_user") {
-        secureLogger.warn("Stripe webhook user unresolved \u2014 asking for retry", {
-          eventType: event.type,
-          note: decision.note
-        });
-        return res.status(500).json(
-          apiError(
-            "internal_error",
-            "WEBHOOK_USER_UNRESOLVED",
-            "Could not resolve the Hive user for this event yet; Stripe should retry."
-          )
-        );
-      }
-      const result = await applyPlanChange(decision.args);
-      if (event.type === "checkout.session.completed") {
-        await settleChargeRecord(
-          asString(metadataOf(event.data?.object).id),
-          "confirmed",
-          event.type
-        );
-      }
-      return res.json({
-        received: true,
-        handled: true,
-        outcome: result.outcome,
-        replayed: result.replayed
-      });
-    } catch (err) {
-      secureLogger.error("Stripe webhook processing failed", err, {
-        eventType: event.type
-      });
-      return res.status(500).json(
-        apiError(
-          "internal_error",
-          "WEBHOOK_PROCESSING_FAILED",
-          "Webhook processing failed; Stripe should retry. Processing is idempotent by event id."
-        )
-      );
-    }
-  }
-);
 var LLAMAPAY_UNAVAILABLE = apiError(
   "internal_error",
   "BILLING_UNAVAILABLE",
@@ -5879,7 +5253,7 @@ function buildServerCard() {
 }
 
 // src/auth/oauth/router.ts
-import { timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { timingSafeEqual as timingSafeEqual4 } from "crypto";
 import express from "express";
 import rateLimit2 from "express-rate-limit";
 import { z as z4 } from "zod";
@@ -5932,7 +5306,7 @@ function monitorSecretAuthorized(req) {
   if (!expected || typeof supplied !== "string") return false;
   const left = Buffer.from(supplied);
   const right = Buffer.from(expected);
-  return left.length === right.length && timingSafeEqual5(left, right);
+  return left.length === right.length && timingSafeEqual4(left, right);
 }
 function deploymentCanaryUserId() {
   const userId = getEnvVar("HIVE_CANARY_USER_ID");
@@ -6774,11 +6148,6 @@ app.use(
     type: "application/json"
   })
 );
-app.post(
-  "/api/v1/billing/webhook",
-  express2.raw({ type: "application/json", limit: "1mb" }),
-  stripeWebhookHandler
-);
 app.post(
   "/api/v1/billing/webhook/llamapay",
   express2.raw({ type: "application/json", limit: "1mb" }),
@@ -7334,7 +6703,7 @@ function isMonitorSecretRequest(req) {
   if (!secret || typeof provided !== "string") return false;
   const a = Buffer.from(provided);
   const b = Buffer.from(secret);
-  return a.length === b.length && timingSafeEqual6(a, b);
+  return a.length === b.length && timingSafeEqual5(a, b);
 }
 function getValidatedMcpHiveToolName(scope, body) {
   if (body?.method !== "tools/call") return void 0;
@@ -8058,7 +7427,7 @@ app.post(
     if (monitorSecret && typeof authToken === "string") {
       const a = Buffer.from(authToken);
       const b = Buffer.from(monitorSecret);
-      isAuthorized = a.length === b.length && timingSafeEqual6(a, b);
+      isAuthorized = a.length === b.length && timingSafeEqual5(a, b);
     }
     secureLogger.authEvent("monitor-tests-access", isAuthorized, {
       hasToken: !!authToken,