hive-intelligence 1.3.0 → 1.5.0

package/build/server.js

@@ -6,7 +6,7 @@ import {
   ensureWallet,
   executeToolByName,
   getWalletStatus
-} from "./chunk-I5Z6FZRL.js";
+} from "./chunk-XQPEFCSY.js";
 import {
   CategoryEndpoints,
   HERO_TOOL_NAMES,
@@ -26,6 +26,7 @@ import {
   TASK_TOOLSETS,
   ToolRegistry,
   buildAuthCompatibility,
+  buildStatefulWriteAuditEvent,
   buildSubjectBodyDigest,
   buildToolCatalogEntry,
   clientProfileFromName,
@@ -38,6 +39,7 @@ import {
   getAnalyticsWriter,
   getAvailableApis,
   getCorsAllowedOrigins,
+  getCredentialedRateLimitMax,
   getCsvEnv,
   getEnvVar,
   getMcpCreditCost,
@@ -53,12 +55,10 @@ import {
   getRootVisibleToolCount,
   getSharedClients,
   getSupabaseAdmin,
-  getSupabaseAuthClient,
   getTaskCanaryCatalog,
   getTaskCanaryHistory,
   getWorkflowRegressionCatalog,
   getWorkflowRegressionHistory,
-  hasEnvVars,
   hasSubjectSigningSecret,
   heroTools,
   isB2BSubjectsEnabled,
@@ -66,6 +66,7 @@ import {
   isHiveOAuthAccessToken,
   isProduction,
   isRedisAvailable,
+  isRedisConfigured,
   isSupabaseConfigured,
   isUnkeyConfigured,
   isUnkeyRequired,
@@ -92,8 +93,9 @@ import {
   trackOAuthFirstMaterialReceipt,
   trackServerEvent,
   validateEndpointArgs,
-  verifyApiKey
-} from "./chunk-W2QL7LYI.js";
+  verifyApiKey,
+  waitForRedisAvailability
+} from "./chunk-AGM2CIRL.js";
 import {
   HIVE_AGENT_SKILLS
 } from "./chunk-L326MQZP.js";
@@ -733,7 +735,16 @@ var require_ipaddr = __commonJS({
 
 // src/server.ts
 import dotenv from "dotenv";
-import { randomUUID as randomUUID4, timingSafeEqual as timingSafeEqual5 } from "crypto";
+
+// src/config/trustProxy.ts
+var DEFAULT_TRUSTED_PROXY_ADDRESSES = "34.102.187.55";
+function resolveTrustedProxies(raw = getEnvVar("TRUSTED_PROXY_ADDRESSES")) {
+  const addresses = (raw ?? DEFAULT_TRUSTED_PROXY_ADDRESSES).split(",").map((entry) => entry.trim()).filter(Boolean);
+  return [...addresses, "loopback", "uniquelocal", "169.254.0.0/16"];
+}
+
+// src/server.ts
+import { randomUUID as randomUUID4, timingSafeEqual as timingSafeEqual6 } from "crypto";
 import { resolve } from "path";
 import { fileURLToPath } from "url";
 import { createRequire as createNodeRequire } from "module";
@@ -741,7 +752,7 @@ import express2 from "express";
 import compression from "compression";
 import cors from "cors";
 import helmet from "helmet";
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
 // src/middleware/rate-limit.ts
@@ -805,8 +816,43 @@ function ipRateLimitKeyFromRequest(req) {
 }
 
 // src/middleware/rate-limit.ts
-var createIpRateLimiter = () => {
-  const maxRequests = getRateLimitMax();
+var STORE_ERROR_LOG_INTERVAL_MS = 6e4;
+var lastStoreErrorLoggedAt = 0;
+var suppressedStoreErrors = 0;
+function noteRateLimitStoreError(error) {
+  suppressedStoreErrors += 1;
+  const now = Date.now();
+  if (now - lastStoreErrorLoggedAt < STORE_ERROR_LOG_INTERVAL_MS) return;
+  lastStoreErrorLoggedAt = now;
+  const suppressed = suppressedStoreErrors;
+  suppressedStoreErrors = 0;
+  secureLogger.error(
+    "[rate-limit] Redis store error \u2014 requests are passing UNLIMITED until it recovers",
+    {
+      errorMessage: error instanceof Error ? error.message : String(error),
+      occurrencesSinceLastLog: suppressed
+    }
+  );
+}
+function isRateLimiterDegraded() {
+  return lastStoreErrorLoggedAt > 0 && Date.now() - lastStoreErrorLoggedAt < STORE_ERROR_LOG_INTERVAL_MS * 2;
+}
+function hasValidMonitorSecret(req) {
+  const secret = getEnvVar("MONITOR_SECRET");
+  const provided = req.headers["x-monitor-secret"];
+  if (!secret || typeof provided !== "string") return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(secret);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function hasCredential(req) {
+  if (typeof req.headers["x-api-key"] === "string") return true;
+  const auth = req.headers.authorization;
+  return typeof auth === "string" && auth.startsWith("Bearer ");
+}
+var createIpRateLimiter = (opts = {}) => {
+  const lane = opts.lane ?? "anonymous";
+  const maxRequests = lane === "credentialed" ? getCredentialedRateLimitMax() : getRateLimitMax();
   const redisClient = getRedisClient();
   const isProduction2 = getNodeEnv() === "production";
   if (isProduction2 && !redisClient) {
@@ -824,11 +870,11 @@ var createIpRateLimiter = () => {
   }
   const storeConfig = redisClient ? {
     store: new RedisStore({
-      sendCommand: ((...args) => redisClient.call(
-        args[0],
-        ...args.slice(1)
-      )),
-      prefix: "rl:ip:"
+      sendCommand: ((...args) => redisClient.call(args[0], ...args.slice(1)).catch((error) => {
+        noteRateLimitStoreError(error);
+        throw error;
+      })),
+      prefix: lane === "credentialed" ? "rl:ip:cred:" : "rl:ip:"
     })
   } : {};
   return rateLimit({
@@ -837,14 +883,15 @@ var createIpRateLimiter = () => {
     max: maxRequests,
     standardHeaders: true,
     legacyHeaders: false,
+    // Availability over enforcement. A Redis outage or an exhausted provider
+    // quota must degrade to unlimited traffic, never to a 500 on every route.
+    // On 2026-08-19 an Upstash quota exhaustion took the whole service down
+    // for ~16h because the store error propagated to Express.
+    passOnStoreError: true,
     keyGenerator: (req) => ipRateLimitKeyFromRequest(req),
     skip: (req) => {
-      const secret = getEnvVar("MONITOR_SECRET");
-      const provided = req.headers["x-monitor-secret"];
-      if (!secret || typeof provided !== "string") return false;
-      const a = Buffer.from(provided);
-      const b = Buffer.from(secret);
-      return a.length === b.length && timingSafeEqual(a, b);
+      if (hasValidMonitorSecret(req)) return true;
+      return lane === "credentialed" ? !hasCredential(req) : hasCredential(req);
     },
     handler: (_req, res) => {
       res.setHeader("Retry-After", "60");
@@ -858,6 +905,24 @@ var createIpRateLimiter = () => {
     }
   });
 };
+var createLocalRateLimiter = (maxPerMinute = 120) => rateLimit({
+  windowMs: 60 * 1e3,
+  max: maxPerMinute,
+  standardHeaders: true,
+  legacyHeaders: false,
+  keyGenerator: (req) => ipRateLimitKeyFromRequest(req),
+  skip: hasValidMonitorSecret,
+  handler: (_req, res) => {
+    res.setHeader("Retry-After", "60");
+    res.status(429).json(
+      apiError(
+        "rate_limit_error",
+        "RATE_LIMITED",
+        `Rate limit exceeded. Maximum ${maxPerMinute} requests per minute.`
+      )
+    );
+  }
+});
 
 // src/health/index.ts
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -1521,8 +1586,16 @@ var PUBLIC_STATUS_DIMENSIONS = [
   "taskCanaries",
   "workflowRouting",
   "mcpProtocol",
-  "catalogIntegrity"
+  "catalogIntegrity",
+  "rateLimiter"
 ];
+function readRateLimiterSignal() {
+  return {
+    configured: isRedisConfigured(),
+    available: isRedisAvailable(),
+    degraded: isRateLimiterDegraded()
+  };
+}
 var CATALOG_CHECK_NAMES = [
   "mcp_initialize",
   "tools_list_root_surface",
@@ -1646,6 +1719,56 @@ function buildCatalogIntegrityDimension(history) {
     }
   };
 }
+var RATE_LIMITER_SCOPE = "This instance's shared rate-limit store, upstream response cache, and idempotency keys.";
+function buildRateLimiterDimension(signal) {
+  const observedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (!signal.configured) {
+    return {
+      status: "healthy",
+      scope: RATE_LIMITER_SCOPE,
+      evidence: {
+        state: "absent",
+        source: "serving_instance_redis",
+        observedAt,
+        message: "No REDIS_URL on this instance, so limits, cache and idempotency are per-instance and in memory by design."
+      }
+    };
+  }
+  if (!signal.available) {
+    return {
+      status: "unhealthy",
+      scope: RATE_LIMITER_SCOPE,
+      evidence: {
+        state: "storage_unavailable",
+        source: "serving_instance_redis",
+        observedAt,
+        message: "Redis is configured but this instance has no live connection: IP and per-user rate limits are passing UNLIMITED, and the upstream cache and idempotency store are bypassed."
+      }
+    };
+  }
+  if (signal.degraded) {
+    return {
+      status: "degraded",
+      scope: RATE_LIMITER_SCOPE,
+      evidence: {
+        state: "observed",
+        source: "serving_instance_redis",
+        observedAt,
+        message: "The rate-limit store returned errors recently; those requests failed open and were not counted."
+      }
+    };
+  }
+  return {
+    status: "healthy",
+    scope: RATE_LIMITER_SCOPE,
+    evidence: {
+      state: "observed",
+      source: "serving_instance_redis",
+      observedAt,
+      message: "This instance holds a live connection to the rate-limit store."
+    }
+  };
+}
 function overallStatus(dimensions) {
   const required = [
     dimensions.providers,
@@ -1653,7 +1776,8 @@ function overallStatus(dimensions) {
     dimensions.workflowRouting,
     dimensions.mcpProtocol,
     dimensions.oauthLifecycle,
-    dimensions.catalogIntegrity
+    dimensions.catalogIntegrity,
+    dimensions.rateLimiter
   ];
   if (required.some((dimension) => dimension.status === "unhealthy")) {
     return "unhealthy";
@@ -1666,7 +1790,7 @@ function overallStatus(dimensions) {
   }
   return "healthy";
 }
-function buildPublicHealthSnapshot(providers, taskCanaries, workflowRouting, protocol, oauthLifecycle) {
+function buildPublicHealthSnapshot(providers, taskCanaries, workflowRouting, protocol, oauthLifecycle, rateLimiter = readRateLimiterSignal()) {
   const results = providers.latest ?? {
     status: "unknown",
     totalApis: 0,
@@ -1725,7 +1849,8 @@ function buildPublicHealthSnapshot(providers, taskCanaries, workflowRouting, pro
     },
     mcpProtocol: buildMcpProtocolDimension(protocol),
     oauthLifecycle: buildOAuthLifecycleDimension(oauthLifecycle),
-    catalogIntegrity: buildCatalogIntegrityDimension(protocol)
+    catalogIntegrity: buildCatalogIntegrityDimension(protocol),
+    rateLimiter: buildRateLimiterDimension(rateLimiter)
   };
   return {
     ...results,
@@ -1749,7 +1874,8 @@ function buildPublicHealthSnapshot(providers, taskCanaries, workflowRouting, pro
         "workflowRouting",
         "mcpProtocol",
         "oauthLifecycle",
-        "catalogIntegrity"
+        "catalogIntegrity",
+        "rateLimiter"
       ],
       rule: "Any unhealthy dimension makes overall status unhealthy; otherwise degraded wins, missing evidence remains unknown, and healthy requires every required dimension to be healthy."
     }
@@ -2353,8 +2479,91 @@ var getCorsConfig = () => {
 
 // src/middleware/api-key.ts
 import { createHash, randomUUID } from "crypto";
+
+// src/services/user-rate-limit.ts
+var WINDOW_MS = 6e4;
+var WINDOW_SECONDS = 60;
+var PLAN_CACHE_TTL_MS = 6e4;
+var planCache = /* @__PURE__ */ new Map();
+var FALLBACK_LIMIT_PER_MIN = 100;
+var localCounters = /* @__PURE__ */ new Map();
+async function resolveUserRateLimit(userId) {
+  const cached = planCache.get(userId);
+  if (cached && cached.expiresAt > Date.now()) return cached.limit;
+  let limit = FALLBACK_LIMIT_PER_MIN;
+  try {
+    const supabase = getSupabaseAdmin();
+    const { data: profile } = await supabase.from("user_profiles").select("plan_id").eq("id", userId).single();
+    const planId = profile?.plan_id ?? "demo";
+    const { data: plan } = await supabase.from("plans").select("rate_limit_per_min").eq("id", planId).single();
+    if (typeof plan?.rate_limit_per_min === "number") {
+      limit = plan.rate_limit_per_min;
+    }
+  } catch (error) {
+    secureLogger.warn("Plan rate lookup failed \u2014 using the free-tier rate", {
+      errorMessage: error instanceof Error ? error.message : String(error)
+    });
+  }
+  planCache.set(userId, { limit, expiresAt: Date.now() + PLAN_CACHE_TTL_MS });
+  return limit;
+}
+function consumeLocal(key, limit) {
+  const now = Date.now();
+  const existing = localCounters.get(key);
+  const entry = existing && existing.expiresAt > now ? existing : { count: 0, expiresAt: now + WINDOW_MS };
+  entry.count += 1;
+  localCounters.set(key, entry);
+  const resetSeconds = Math.max(1, Math.ceil((entry.expiresAt - now) / 1e3));
+  return {
+    allowed: entry.count <= limit,
+    limit,
+    remaining: Math.max(0, limit - entry.count),
+    resetSeconds,
+    degraded: false
+  };
+}
+async function consumeUserRateLimit(userId, limitPerMin) {
+  const window = Math.floor(Date.now() / WINDOW_MS);
+  const key = `rl:user:${userId}:${window}`;
+  const redis = getRedisClient();
+  if (!redis) return consumeLocal(key, limitPerMin);
+  try {
+    const count = await redis.incr(key);
+    if (count === 1) await redis.expire(key, WINDOW_SECONDS);
+    const resetSeconds = Math.max(
+      1,
+      WINDOW_SECONDS - Math.floor(Date.now() % WINDOW_MS / 1e3)
+    );
+    return {
+      allowed: count <= limitPerMin,
+      limit: limitPerMin,
+      remaining: Math.max(0, limitPerMin - count),
+      resetSeconds,
+      degraded: false
+    };
+  } catch (error) {
+    secureLogger.warn(
+      "[user-rate-limit] store error \u2014 request passed UNLIMITED",
+      { errorMessage: error instanceof Error ? error.message : String(error) }
+    );
+    return {
+      allowed: true,
+      limit: limitPerMin,
+      remaining: limitPerMin,
+      resetSeconds: WINDOW_SECONDS,
+      degraded: true
+    };
+  }
+}
+async function enforceUserRateLimit(userId) {
+  const limit = await resolveUserRateLimit(userId);
+  return consumeUserRateLimit(userId, limit);
+}
+
+// src/middleware/api-key.ts
 var REQUEST_COST = 1;
-function attachVerifiedContext(req, res, key, result, quotaRemaining) {
+var REST_QUOTA_EXHAUSTED_MESSAGE = "Monthly credit quota exhausted. Upgrade at https://www.hiveintelligence.xyz/pricing to raise the limit now, or wait for the next cycle.";
+function attachVerifiedContext(req, res, key, result, quotaRemaining, rateDecision) {
   const authReq = req;
   authReq.apiKey = key;
   authReq.apiKeyEnvironment = getKeyEnvironment(key);
@@ -2362,7 +2571,7 @@ function attachVerifiedContext(req, res, key, result, quotaRemaining) {
   authReq.planId = result.planId;
   authReq.unkeyKeyId = result.keyId;
   authReq.quotaRemaining = quotaRemaining ?? void 0;
-  authReq.ratelimitRemaining = result.ratelimit?.remaining;
+  authReq.ratelimitRemaining = rateDecision?.remaining ?? result.ratelimit?.remaining;
   authReq.unkeyResult = result;
   if (quotaRemaining !== void 0) {
     res.setHeader(
@@ -2370,9 +2579,11 @@ function attachVerifiedContext(req, res, key, result, quotaRemaining) {
       quotaRemaining === null ? "unlimited" : String(quotaRemaining)
     );
   }
-  if (result.ratelimit) {
-    res.setHeader("X-RateLimit-Remaining", String(result.ratelimit.remaining));
-    res.setHeader("X-RateLimit-Limit", String(result.ratelimit.limit));
+  const limit = rateDecision?.limit ?? result.ratelimit?.limit;
+  const remaining = rateDecision?.remaining ?? result.ratelimit?.remaining;
+  if (limit !== void 0 && remaining !== void 0) {
+    res.setHeader("X-RateLimit-Remaining", String(remaining));
+    res.setHeader("X-RateLimit-Limit", String(limit));
   }
 }
 function deferApiKeyCreditDebit(req, _res, next) {
@@ -2397,7 +2608,7 @@ async function debitApiKeyCreditForExecution(req, res) {
       return {
         type: "rate_limit_error",
         code: "QUOTA_EXCEEDED",
-        message: "Monthly credit quota exhausted. Upgrade your plan or wait for the next cycle.",
+        message: REST_QUOTA_EXHAUSTED_MESSAGE,
         runtimeStatus: "rate_limited"
       };
     }
@@ -2529,8 +2740,25 @@ function requireApiKey(req, res, next) {
         );
         return;
       }
+      const rateDecision = await enforceUserRateLimit(result.userId);
+      res.setHeader("RateLimit-Limit", String(rateDecision.limit));
+      res.setHeader("RateLimit-Remaining", String(rateDecision.remaining));
+      res.setHeader("RateLimit-Reset", String(rateDecision.resetSeconds));
+      res.setHeader("RateLimit-Policy", `${rateDecision.limit};w=60`);
+      if (!rateDecision.allowed) {
+        res.setHeader("Retry-After", String(rateDecision.resetSeconds));
+        res.status(429).json(
+          apiError(
+            "rate_limit_error",
+            "RATE_LIMITED",
+            `Rate limit exceeded: ${rateDecision.limit} requests per minute on your plan. This limit is shared across all of your API keys and connected clients.`,
+            { requestId: req.requestId }
+          )
+        );
+        return;
+      }
       if (req.deferCreditDebit) {
-        attachVerifiedContext(req, res, key, result);
+        attachVerifiedContext(req, res, key, result, void 0, rateDecision);
         next();
         return;
       }
@@ -2552,7 +2780,7 @@ function requireApiKey(req, res, next) {
             apiError(
               "rate_limit_error",
               "QUOTA_EXCEEDED",
-              "Monthly credit quota exhausted. Upgrade your plan or wait for the next cycle.",
+              REST_QUOTA_EXHAUSTED_MESSAGE,
               { requestId: req.requestId }
             )
           );
@@ -2573,7 +2801,14 @@ function requireApiKey(req, res, next) {
           );
           return;
         }
-        attachVerifiedContext(req, res, key, result, consumeResult.balance);
+        attachVerifiedContext(
+          req,
+          res,
+          key,
+          result,
+          consumeResult.balance,
+          rateDecision
+        );
         next();
       } catch (err) {
         secureLogger.error("consume_credits threw \u2014 rejecting request", err, {
@@ -2666,9 +2901,6 @@ function requireApiKey(req, res, next) {
 
 // src/routes/auth.ts
 import { Router as Router2 } from "express";
-import rateLimit2 from "express-rate-limit";
-import RedisStore2 from "rate-limit-redis";
-import { z } from "zod";
 
 // src/middleware/supabase-auth.ts
 function requireSupabaseAuth(req, res, next) {
@@ -2728,136 +2960,6 @@ var asyncHandler = (fn) => (req, res, next) => {
 
 // src/routes/auth.ts
 var router2 = Router2();
-function buildAuthRateLimiter(maxPerHour, prefix) {
-  const redisClient = getRedisClient();
-  const storeConfig = redisClient ? {
-    store: new RedisStore2({
-      sendCommand: ((...args) => redisClient.call(
-        args[0],
-        ...args.slice(1)
-      )),
-      prefix
-    })
-  } : {};
-  return rateLimit2({
-    ...storeConfig,
-    windowMs: 60 * 60 * 1e3,
-    max: maxPerHour,
-    standardHeaders: true,
-    legacyHeaders: false,
-    keyGenerator: (req) => ipRateLimitKeyFromRequest(req),
-    handler: (_req, res) => {
-      res.setHeader("Retry-After", "3600");
-      res.status(429).json(
-        apiError(
-          "rate_limit_error",
-          "RATE_LIMITED",
-          "Too many auth attempts. Try again in an hour."
-        )
-      );
-    }
-  });
-}
-var signupRateLimit = buildAuthRateLimiter(10, "rl:auth:signup:");
-var loginRateLimit = buildAuthRateLimiter(30, "rl:auth:login:");
-var AuthSchema = z.object({
-  email: z.string().email("Invalid email format"),
-  password: z.string().min(8, "Password must be at least 8 characters")
-});
-router2.post(
-  "/signup",
-  signupRateLimit,
-  asyncHandler(async (req, res) => {
-    if (!isSupabaseConfigured() || !hasEnvVars("SUPABASE_ANON_KEY")) {
-      return res.status(503).json(
-        apiError(
-          "internal_error",
-          "AUTH_NOT_CONFIGURED",
-          "Auth not configured."
-        )
-      );
-    }
-    const parseResult = AuthSchema.safeParse(req.body);
-    if (!parseResult.success) {
-      return res.status(400).json(
-        apiError(
-          "invalid_request_error",
-          "VALIDATION_ERROR",
-          parseResult.error.issues.map((e) => e.message).join("; ")
-        )
-      );
-    }
-    const { email, password } = parseResult.data;
-    const { data, error } = await getSupabaseAuthClient().auth.signUp({
-      email,
-      password
-    });
-    if (error || !data.user) {
-      return res.status(400).json(
-        apiError(
-          "authentication_error",
-          "SIGNUP_FAILED",
-          "Signup failed. Please try again or use a different email."
-        )
-      );
-    }
-    return res.status(201).json({
-      ok: true,
-      user: { id: data.user.id, email: data.user.email },
-      requires_email_confirmation: true,
-      session: null,
-      api_key: null
-    });
-  })
-);
-router2.post(
-  "/login",
-  loginRateLimit,
-  asyncHandler(async (req, res) => {
-    if (!isSupabaseConfigured() || !hasEnvVars("SUPABASE_ANON_KEY")) {
-      return res.status(503).json(
-        apiError(
-          "internal_error",
-          "AUTH_NOT_CONFIGURED",
-          "Auth not configured."
-        )
-      );
-    }
-    const parseResult = AuthSchema.safeParse(req.body);
-    if (!parseResult.success) {
-      return res.status(400).json(
-        apiError(
-          "invalid_request_error",
-          "VALIDATION_ERROR",
-          parseResult.error.issues.map((e) => e.message).join("; ")
-        )
-      );
-    }
-    const { email, password } = parseResult.data;
-    const { data, error } = await getSupabaseAuthClient().auth.signInWithPassword({
-      email,
-      password
-    });
-    if (error || !data.session) {
-      return res.status(401).json(
-        apiError(
-          "authentication_error",
-          "LOGIN_FAILED",
-          error?.message ?? "Invalid credentials."
-        )
-      );
-    }
-    return res.json({
-      ok: true,
-      user: { id: data.user.id, email: data.user.email },
-      session: {
-        access_token: data.session.access_token,
-        refresh_token: data.session.refresh_token,
-        expires_at: data.session.expires_at
-      }
-    });
-  })
-);
 router2.get(
   "/me",
   requireSupabaseAuth,
@@ -2875,7 +2977,7 @@ var auth_default = router2;
 
 // src/routes/keys.ts
 import { Router as Router3 } from "express";
-import { z as z2 } from "zod";
+import { z } from "zod";
 
 // src/middleware/idempotency.ts
 import { createHash as createHash2 } from "crypto";
@@ -3092,7 +3194,7 @@ function replayResponse(res, cached) {
       error: {
         type: "invalid_request_error",
         code: "SECRET_ALREADY_ISSUED",
-        message: "This request was already completed and its one-time secret was returned only in the original response. It cannot be retrieved again \u2014 create a new key if you no longer have it."
+        message: "This request was already completed and its one-time secret was returned only in the original response. It cannot be retrieved again; create a new key if you no longer have it."
       }
     });
     return;
@@ -3208,9 +3310,9 @@ async function handleRedisLookup(key, requestFingerprint, req, res, next) {
 
 // src/routes/keys.ts
 var router3 = Router3();
-var CreateKeySchema = z2.object({
-  name: z2.string().min(1).max(100).optional(),
-  b2b_subjects_enabled: z2.boolean().optional()
+var CreateKeySchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  b2b_subjects_enabled: z.boolean().optional()
 });
 router3.post(
   "/",
@@ -3248,7 +3350,7 @@ router3.post(
           plan: planId,
           b2b_subjects_enabled: b2b_subjects_enabled ?? false,
           ...result.subjectSigningSecret ? { subject_signing_secret: result.subjectSigningSecret } : {},
-          warning: "Save this key \u2014 it will not be shown again."
+          warning: "Save this key; it will not be shown again."
         }
       });
     } catch (err) {
@@ -3375,6 +3477,7 @@ router4.get(
     const { data: plan } = await getSupabaseAdmin().from("plans").select("*").eq("id", resolvedPlanId).single();
     await ensureWallet(userId, resolvedPlanId);
     const wallet = await getWalletStatus(userId);
+    const { data: subscription } = await getSupabaseAdmin().from("stripe_subscriptions").select("status, current_period_start, current_period_end").eq("user_id", userId).in("status", ["trialing", "active", "past_due", "unpaid"]).order("current_period_end", { ascending: false }).limit(1).maybeSingle();
     const keys = await listKeys(userId);
     const keyEntries = keys.map((k) => ({
       key_id: k.keyId,
@@ -3398,6 +3501,11 @@ router4.get(
           cycle_start: wallet.cycleStart,
           cycle_end: wallet.cycleEnd
         } : null,
+        subscription: subscription ? {
+          status: subscription.status,
+          current_period_start: subscription.current_period_start,
+          current_period_end: subscription.current_period_end
+        } : null,
         keys: keyEntries,
         total_keys: keys.length
       }
@@ -3588,13 +3696,13 @@ var b2b_default = router5;
 import {
   Router as Router6
 } from "express";
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 
 // src/services/stripe-service.ts
 import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var STRIPE_API_BASE = "https://api.stripe.com";
 var STRIPE_SIGNATURE_TOLERANCE_SECONDS = 300;
-var PAID_PLAN_ID = "pro";
+var PAID_PLAN_ID = "analyst";
 var FREE_PLAN_ID = "demo";
 function getStripeSecretKey() {
   return getEnvVar("STRIPE_SECRET_KEY");
@@ -3605,16 +3713,44 @@ function getStripeWebhookSecret() {
 function isStripeCheckoutConfigured() {
   return Boolean(getStripeSecretKey());
 }
-function priceIdForCycle(cycle) {
-  return cycle === "yearly" ? getEnvVar("STRIPE_PRICE_PRO_YEARLY") : getEnvVar("STRIPE_PRICE_PRO_MONTHLY");
+var STRIPE_PRICE_ENV = {
+  starter: {
+    monthly: "STRIPE_PRICE_STARTER_MONTHLY",
+    yearly: "STRIPE_PRICE_STARTER_YEARLY"
+  },
+  analyst: {
+    monthly: "STRIPE_PRICE_PRO_MONTHLY",
+    yearly: "STRIPE_PRICE_PRO_YEARLY"
+  }
+};
+function priceIdForPlanCycle(planId, cycle) {
+  const row = STRIPE_PRICE_ENV[planId];
+  if (!row) return void 0;
+  return getEnvVar(row[cycle]);
 }
 function planIdForPrice(priceId) {
   if (!priceId) return null;
-  if (priceId === getEnvVar("STRIPE_PRICE_PRO_MONTHLY") || priceId === getEnvVar("STRIPE_PRICE_PRO_YEARLY")) {
-    return PAID_PLAN_ID;
+  for (const [planId, cycles] of Object.entries(STRIPE_PRICE_ENV)) {
+    for (const envName of Object.values(cycles)) {
+      if (priceId === getEnvVar(envName)) return planId;
+    }
   }
   return null;
 }
+var STRIPE_SUBSCRIPTION_STATUSES = [
+  "incomplete",
+  "incomplete_expired",
+  "trialing",
+  "active",
+  "past_due",
+  "canceled",
+  "unpaid",
+  "paused"
+];
+function registrySubscriptionStatus(status) {
+  if (!status) return null;
+  return STRIPE_SUBSCRIPTION_STATUSES.includes(status) ? status : null;
+}
 function getBillingSuccessUrl() {
   return getEnvVar("BILLING_SUCCESS_URL") ?? "https://www.hiveintelligence.xyz/dashboard?checkout=success";
 }
@@ -3734,6 +3870,164 @@ async function createStripeCheckoutSession(args) {
   return { id, url };
 }
 
+// src/services/llamapay-service.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual4 } from "crypto";
+var LLAMAPAY_API_BASE = "https://api.llamapay.io";
+var LLAMAPAY_SIGNATURE_HEADER = "x-cc-webhook-signature";
+function getLlamaPayApiKey() {
+  const key = process.env.LLAMAPAY_API_KEY?.trim();
+  return key && key.length > 0 ? key : void 0;
+}
+function getLlamaPayWebhookSecret() {
+  const secret = process.env.LLAMAPAY_WEBHOOK_SECRET?.trim();
+  return secret && secret.length > 0 ? secret : void 0;
+}
+function isLlamaPayCheckoutConfigured() {
+  return getLlamaPayApiKey() !== void 0;
+}
+var PLAN_PRICES_USD = {
+  starter: { monthly: 49, yearly: 490 },
+  analyst: { monthly: 149, yearly: 1490 }
+};
+var PLAN_TIER_ORDER = [
+  "demo",
+  "starter",
+  "analyst",
+  "enterprise"
+];
+function isSellablePlan(planId) {
+  return Object.prototype.hasOwnProperty.call(PLAN_PRICES_USD, planId);
+}
+function priceForPlanCycle(planId, cycle) {
+  const row = PLAN_PRICES_USD[planId];
+  if (!row) return void 0;
+  return cycle === "yearly" ? row.yearly : row.monthly;
+}
+function canUpgradeTo(current, target) {
+  const currentIndex = PLAN_TIER_ORDER.indexOf(current ?? "demo");
+  const targetIndex = PLAN_TIER_ORDER.indexOf(target);
+  if (targetIndex < 0) return false;
+  return targetIndex > (currentIndex < 0 ? 0 : currentIndex);
+}
+var RENEWAL_WINDOW_DAYS = 30;
+function canPurchasePlan(current, target, termEnd, now = /* @__PURE__ */ new Date()) {
+  if (canUpgradeTo(current, target)) return true;
+  if (current !== target) return false;
+  if (!termEnd) return false;
+  const end = termEnd instanceof Date ? termEnd : new Date(termEnd);
+  if (Number.isNaN(end.getTime())) return false;
+  const windowOpens = new Date(
+    end.getTime() - RENEWAL_WINDOW_DAYS * 24 * 60 * 60 * 1e3
+  );
+  return now.getTime() >= windowOpens.getTime();
+}
+function pricingTypeFor(cycle) {
+  return cycle === "yearly" ? "fixed_price" : "subscription";
+}
+function addUtcMonths(start, months) {
+  const end = new Date(start.getTime());
+  const day = end.getUTCDate();
+  end.setUTCDate(1);
+  end.setUTCMonth(end.getUTCMonth() + months);
+  const daysInTargetMonth = new Date(
+    Date.UTC(end.getUTCFullYear(), end.getUTCMonth() + 1, 0)
+  ).getUTCDate();
+  end.setUTCDate(Math.min(day, daysInTargetMonth));
+  return end;
+}
+function creditCycleEndFrom(start) {
+  return addUtcMonths(start, 1);
+}
+function termEndFrom(start, cycle) {
+  return addUtcMonths(start, cycle === "yearly" ? 12 : 1);
+}
+var LlamaPayApiError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "LlamaPayApiError";
+  }
+  status;
+};
+async function createLlamaPayCharge(args) {
+  const apiKey = getLlamaPayApiKey();
+  if (!apiKey) {
+    throw new LlamaPayApiError(503, "LlamaPay API key is not configured");
+  }
+  let response;
+  try {
+    response = await fetch(`${LLAMAPAY_API_BASE}/charges`, {
+      method: "POST",
+      headers: {
+        Authorization: apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        pricing_type: pricingTypeFor(args.cycle),
+        local_price: {
+          amount: args.amountUsd.toFixed(2),
+          currency: "USD"
+        },
+        metadata: {
+          user_id: args.userId,
+          plan_id: args.planId,
+          billing_cycle: args.cycle,
+          ...args.email ? { email: args.email } : {}
+        },
+        redirect_url: getBillingSuccessUrl(),
+        cancel_url: getBillingCancelUrl()
+      })
+    });
+  } catch (err) {
+    throw new LlamaPayApiError(
+      502,
+      `LlamaPay request failed: ${err instanceof Error ? err.message : "unknown"}`
+    );
+  }
+  const text = await response.text();
+  if (!response.ok) {
+    throw new LlamaPayApiError(
+      response.status,
+      `LlamaPay charge creation failed (${response.status}): ${text.slice(0, 300)}`
+    );
+  }
+  let payload;
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    throw new LlamaPayApiError(502, "LlamaPay returned a non-JSON response");
+  }
+  const id = payload.data?.id;
+  const hostedUrl = payload.data?.hosted_url;
+  if (typeof id !== "string" || typeof hostedUrl !== "string" || !hostedUrl) {
+    throw new LlamaPayApiError(
+      502,
+      "LlamaPay charge creation returned no hosted_url"
+    );
+  }
+  return { id, hostedUrl };
+}
+function verifyLlamaPaySignature(args) {
+  const header = args.header;
+  if (typeof header !== "string" || header.length === 0) {
+    return { valid: false, reason: "missing_header" };
+  }
+  const received = header.trim().toLowerCase();
+  if (!/^[0-9a-f]+$/.test(received)) {
+    return { valid: false, reason: "malformed_header" };
+  }
+  const expected = createHmac2("sha256", args.secret).update(args.payload).digest("hex");
+  const receivedBuf = Buffer.from(received, "utf8");
+  const expectedBuf = Buffer.from(expected, "utf8");
+  if (receivedBuf.length !== expectedBuf.length) {
+    return { valid: false, reason: "no_match" };
+  }
+  if (!timingSafeEqual4(receivedBuf, expectedBuf)) {
+    return { valid: false, reason: "no_match" };
+  }
+  return { valid: true };
+}
+
 // src/routes/billing.ts
 var BILLING_UNAVAILABLE = apiError(
   "internal_error",
@@ -3788,46 +4082,187 @@ function requireBillingPrincipal(req, res, next) {
     next();
   });
 }
-var CheckoutSchema = z3.object({
-  billing_cycle: z3.enum(["monthly", "yearly"]).default("monthly")
+var CheckoutSchema = z2.object({
+  // Was absent, and the route hardcoded PAID_PLAN_ID. The crypto lane sold
+  // Starter and this one did not, so the two processors sold different
+  // catalogues -- with Starter the emphasised middle card on /pricing.
+  plan_id: z2.string().min(1).default(PAID_PLAN_ID),
+  billing_cycle: z2.enum(["monthly", "yearly"]).default("monthly")
 });
 var OCCUPYING_BILLING_STATUSES = /* @__PURE__ */ new Set(["active", "past_due", "unpaid"]);
-var billingRouter = Router6();
-billingRouter.post(
-  "/checkout-session",
-  requireBillingPrincipal,
-  asyncHandler(async (req, res) => {
-    const userId = req.billingUserId;
-    if (!isStripeCheckoutConfigured()) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
-    }
-    if (!isSupabaseConfigured()) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
-    }
-    const parsed = CheckoutSchema.safeParse(req.body ?? {});
-    if (!parsed.success) {
-      return res.status(400).json(
-        apiError(
-          "invalid_request_error",
-          "VALIDATION_ERROR",
-          'billing_cycle must be "monthly" or "yearly".'
-        )
+var CHECKOUT_LOCK_TTL_MS = 6e4;
+var CHECKOUT_LOCK_PREFIX = "billing:checkout:";
+var localCheckoutLocks = /* @__PURE__ */ new Map();
+async function acquireCheckoutLock(userId) {
+  const key = `${CHECKOUT_LOCK_PREFIX}${userId}`;
+  const redis = isRedisAvailable() ? getRedisClient() : null;
+  if (redis) {
+    try {
+      const claimed = await redis.set(
+        key,
+        "1",
+        "PX",
+        CHECKOUT_LOCK_TTL_MS,
+        "NX"
       );
+      return claimed === "OK";
+    } catch (err) {
+      secureLogger.warn("Checkout lock fell back to process memory", {
+        reason: err instanceof Error ? err.message : "unknown"
+      });
     }
-    const priceId = priceIdForCycle(parsed.data.billing_cycle);
-    if (!priceId) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
-    }
-    const { data: profile } = await getSupabaseAdmin().from("user_profiles").select("billing_customer_id, billing_subscription_id, billing_status").eq("id", userId).maybeSingle();
-    if (profile?.billing_subscription_id && typeof profile.billing_status === "string" && OCCUPYING_BILLING_STATUSES.has(profile.billing_status)) {
-      return res.status(409).json(
-        apiError(
-          "invalid_request_error",
-          "SUBSCRIPTION_EXISTS",
-          "This account already has an active subscription. Next action: manage it from the dashboard billing tab instead of creating a new checkout."
-        )
+  }
+  const now = Date.now();
+  const heldUntil = localCheckoutLocks.get(key);
+  if (heldUntil !== void 0 && heldUntil > now) return false;
+  localCheckoutLocks.set(key, now + CHECKOUT_LOCK_TTL_MS);
+  return true;
+}
+async function releaseCheckoutLock(userId) {
+  const key = `${CHECKOUT_LOCK_PREFIX}${userId}`;
+  localCheckoutLocks.delete(key);
+  const redis = isRedisAvailable() ? getRedisClient() : null;
+  if (!redis) return;
+  try {
+    await redis.del(key);
+  } catch {
+  }
+}
+var CHECKOUT_RACE_LOST = apiError(
+  "invalid_request_error",
+  "CHECKOUT_IN_PROGRESS",
+  "Another checkout request for this account is still being created. Next action: wait a couple of seconds and retry; two simultaneous requests can only ever produce one charge."
+);
+function checkoutAlreadyOpen(chargeId) {
+  return apiError(
+    "invalid_request_error",
+    "CHECKOUT_IN_PROGRESS",
+    `A payment page for this account is already open${chargeId ? ` (charge ${chargeId})` : ""}. Next action: finish that payment, or release the hold with POST /api/v1/billing/checkout/abandon if that page was abandoned; otherwise it clears on its own ${OPEN_CHARGE_WINDOW_MINUTES} minutes after the page was opened.`
+  );
+}
+function withCheckoutLock(req, res, next) {
+  const userId = req.billingUserId;
+  if (!userId) {
+    next();
+    return;
+  }
+  void acquireCheckoutLock(userId).then((claimed) => {
+    if (!claimed) {
+      res.status(409).json(CHECKOUT_RACE_LOST);
+      return;
+    }
+    const sendJson = res.json.bind(res);
+    res.json = ((body) => {
+      void releaseCheckoutLock(userId);
+      return sendJson(body);
+    });
+    next();
+  });
+}
+var OPEN_CHARGE_WINDOW_MINUTES = 15;
+var OPEN_CHARGE_WINDOW_MS = OPEN_CHARGE_WINDOW_MINUTES * 60 * 1e3;
+var ABANDONED_EVENT_TYPE = "checkout:abandoned";
+function openChargeCutoff() {
+  return new Date(Date.now() - OPEN_CHARGE_WINDOW_MS).toISOString();
+}
+async function findOpenCharge(userId) {
+  const { data, error } = await getSupabaseAdmin().from("billing_charges").select("charge_id").eq("user_id", userId).is("settled_at", null).neq("status", "canceled").gte("created_at", openChargeCutoff()).limit(1);
+  if (error) {
+    secureLogger.warn("Open-charge lookup failed; allowing checkout", {
+      userId,
+      errorMessage: error.message
+    });
+    return null;
+  }
+  const row = Array.isArray(data) ? data[0] : void 0;
+  return typeof row?.charge_id === "string" ? row.charge_id : null;
+}
+async function settleChargeRecord(chargeId, status, eventType) {
+  if (!chargeId || !isSupabaseConfigured()) return;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const { error } = await getSupabaseAdmin().from("billing_charges").update({
+      status,
+      settled_at: now,
+      last_event_at: now,
+      last_event_type: eventType
+    }).eq("charge_id", chargeId);
+    if (error) throw new Error(error.message);
+  } catch (err) {
+    secureLogger.error("Failed to settle billing charge record", err, {
+      chargeId,
+      eventType
+    });
+  }
+}
+async function recordChargeCreated(charge) {
+  const { error } = await getSupabaseAdmin().from("billing_charges").insert({
+    charge_id: charge.chargeId,
+    processor: charge.processor,
+    user_id: charge.userId,
+    plan_id: charge.planId,
+    billing_cycle: charge.cycle,
+    amount_usd: charge.amountUsd,
+    plan_id_before: charge.planIdBefore,
+    status: "created"
+  });
+  if (error) {
+    throw new Error(`failed to record billing charge: ${error.message}`);
+  }
+}
+var billingRouter = Router6();
+billingRouter.post(
+  "/checkout-session",
+  requireBillingPrincipal,
+  withCheckoutLock,
+  asyncHandler(async (req, res) => {
+    const userId = req.billingUserId;
+    if (!isStripeCheckoutConfigured()) {
+      return res.status(503).json(BILLING_UNAVAILABLE);
+    }
+    if (!isSupabaseConfigured()) {
+      return res.status(503).json(BILLING_UNAVAILABLE);
+    }
+    const parsed = CheckoutSchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+      return res.status(400).json(
+        apiError(
+          "invalid_request_error",
+          "VALIDATION_ERROR",
+          'billing_cycle must be "monthly" or "yearly".'
+        )
       );
     }
+    const { plan_id: planId, billing_cycle: cycle } = parsed.data;
+    if (!isSellablePlan(planId)) {
+      return res.status(400).json(
+        apiError(
+          "invalid_request_error",
+          "PLAN_NOT_SELLABLE",
+          `Plan "${planId}" is not sold self-serve. Next action: choose starter or ${PAID_PLAN_ID}, or contact support for Enterprise.`
+        )
+      );
+    }
+    const priceId = priceIdForPlanCycle(planId, cycle);
+    if (!priceId) {
+      return res.status(503).json(BILLING_UNAVAILABLE);
+    }
+    const { data: profile } = await getSupabaseAdmin().from("user_profiles").select(
+      "plan_id, billing_customer_id, billing_subscription_id, billing_status"
+    ).eq("id", userId).maybeSingle();
+    if (profile?.billing_subscription_id && typeof profile.billing_status === "string" && OCCUPYING_BILLING_STATUSES.has(profile.billing_status)) {
+      return res.status(409).json(
+        apiError(
+          "invalid_request_error",
+          "SUBSCRIPTION_EXISTS",
+          "This account already has an active subscription. Next action: manage it from the dashboard billing tab instead of creating a new checkout."
+        )
+      );
+    }
+    const openChargeId = await findOpenCharge(userId);
+    if (openChargeId) {
+      return res.status(409).json(checkoutAlreadyOpen(openChargeId));
+    }
     try {
       let customerId = profile?.billing_customer_id ?? null;
       if (!customerId) {
@@ -3846,11 +4281,25 @@ billingRouter.post(
         customerId,
         priceId,
         userId,
-        planId: PAID_PLAN_ID
+        planId
+      });
+      await recordChargeCreated({
+        chargeId: session.id,
+        processor: "stripe",
+        userId,
+        planId,
+        cycle,
+        amountUsd: priceForPlanCycle(planId, cycle) ?? 0,
+        planIdBefore: asString(profile?.plan_id)
       });
       return res.json({
         ok: true,
-        data: { url: session.url, session_id: session.id }
+        data: {
+          url: session.url,
+          session_id: session.id,
+          plan_id: planId,
+          billing_cycle: cycle
+        }
       });
     } catch (err) {
       if (err instanceof StripeApiError) {
@@ -3922,176 +4371,566 @@ function invoiceSubscriptionContext(invoice) {
       ...metadataOf(parentDetails.metadata),
       ...metadataOf(details.metadata)
     }
-  };
-}
-function invoicePeriod(invoice) {
-  const lines = metadataOf(invoice.lines);
-  const data = Array.isArray(lines.data) ? lines.data : [];
-  let best = null;
-  let bestEnd = -Infinity;
-  for (const raw of data) {
-    const line = metadataOf(raw);
-    const period2 = metadataOf(line.period);
-    const end = typeof period2.end === "number" ? period2.end : null;
-    if (end !== null && end > bestEnd) {
-      bestEnd = end;
-      best = line;
+  };
+}
+function invoicePeriod(invoice) {
+  const lines = metadataOf(invoice.lines);
+  const data = Array.isArray(lines.data) ? lines.data : [];
+  let best = null;
+  let bestEnd = -Infinity;
+  for (const raw of data) {
+    const line = metadataOf(raw);
+    const period2 = metadataOf(line.period);
+    const end = typeof period2.end === "number" ? period2.end : null;
+    if (end !== null && end > bestEnd) {
+      bestEnd = end;
+      best = line;
+    }
+  }
+  if (!best) return { cycleStart: null, cycleEnd: null, priceId: null };
+  const period = metadataOf(best.period);
+  const price = metadataOf(best.price);
+  const pricing = metadataOf(best.pricing);
+  const priceDetails = metadataOf(pricing.price_details);
+  return {
+    cycleStart: isoFromUnixSeconds(period.start),
+    cycleEnd: isoFromUnixSeconds(period.end),
+    priceId: asString(price.id) ?? asString(priceDetails.price)
+  };
+}
+function cappedCreditCycleEnd(cycleStart, cycleEnd) {
+  if (!cycleStart) return cycleEnd;
+  const start = new Date(cycleStart);
+  if (Number.isNaN(start.getTime())) return cycleEnd;
+  const monthly = creditCycleEndFrom(start);
+  if (!cycleEnd) return monthly.toISOString();
+  const end = new Date(cycleEnd);
+  if (Number.isNaN(end.getTime())) return monthly.toISOString();
+  return (end < monthly ? end : monthly).toISOString();
+}
+async function decideWebhookAction(event) {
+  const object = metadataOf(event.data?.object);
+  switch (event.type) {
+    case "checkout.session.completed": {
+      const mode = asString(object.mode);
+      if (mode !== null && mode !== "subscription") {
+        return { kind: "ignore", note: "non-subscription checkout" };
+      }
+      const metadata = metadataOf(object.metadata);
+      const userId = asString(metadata.user_id) ?? asString(object.client_reference_id);
+      if (!userId) {
+        return { kind: "ignore", note: "checkout session without user_id" };
+      }
+      return {
+        kind: "apply",
+        args: {
+          eventId: event.id,
+          eventType: event.type,
+          userId,
+          newPlanId: asString(metadata.plan_id) ?? PAID_PLAN_ID,
+          grantCredits: true,
+          billingStatus: "active",
+          customerId: refId(object.customer),
+          subscriptionId: refId(object.subscription),
+          subscriptionStatus: "active",
+          ledgerReason: "plan_change"
+        }
+      };
+    }
+    case "customer.subscription.updated":
+    case "customer.subscription.deleted": {
+      const metadata = metadataOf(object.metadata);
+      const customerId = refId(object.customer);
+      const userId = asString(metadata.user_id) ?? await resolveUserIdByCustomer(customerId);
+      if (!userId) {
+        return {
+          kind: "unresolved_user",
+          note: `no user binding for customer ${customerId ?? "<none>"}`
+        };
+      }
+      if (event.type === "customer.subscription.deleted") {
+        return {
+          kind: "apply",
+          args: {
+            eventId: event.id,
+            eventType: event.type,
+            userId,
+            newPlanId: FREE_PLAN_ID,
+            grantCredits: true,
+            billingStatus: "canceled",
+            customerId,
+            subscriptionId: refId(object.id),
+            subscriptionStatus: "canceled",
+            ledgerReason: "plan_change"
+          }
+        };
+      }
+      const status = asString(object.status);
+      const items = metadataOf(object.items);
+      const firstItem = metadataOf(
+        Array.isArray(items.data) ? items.data[0] : void 0
+      );
+      const priceId = asString(metadataOf(firstItem.price).id);
+      return {
+        kind: "apply",
+        args: {
+          eventId: event.id,
+          eventType: event.type,
+          userId,
+          // Tier/status sync only — credits ride the money event
+          // (invoice.paid), which is the one wallet clock.
+          newPlanId: planIdForPrice(priceId) ?? asString(metadata.plan_id) ?? null,
+          grantCredits: false,
+          billingStatus: mapSubscriptionStatusToBilling(status),
+          customerId,
+          subscriptionId: refId(object.id),
+          // Whitelisted, never forwarded raw. stripe_subscriptions.status has
+          // a CHECK over eight literals; a status Stripe adds later raises
+          // 23514 *inside* apply_plan_change, which rolls back the dedupe
+          // claim and the wallet grant with it, 500s, and leaves Stripe
+          // retrying forever. Null here means "skip the registry upsert",
+          // which still applies the tier and still acks 200.
+          subscriptionStatus: registrySubscriptionStatus(status),
+          priceId,
+          ledgerReason: "plan_change"
+        }
+      };
+    }
+    case "invoice.paid":
+    case "invoice.payment_failed": {
+      const { subscriptionId, metadata } = invoiceSubscriptionContext(object);
+      if (!subscriptionId) {
+        return { kind: "ignore", note: "invoice without a subscription" };
+      }
+      const customerId = refId(object.customer);
+      const userId = asString(metadata.user_id) ?? await resolveUserIdByCustomer(customerId);
+      if (!userId) {
+        return {
+          kind: "unresolved_user",
+          note: `no user binding for customer ${customerId ?? "<none>"}`
+        };
+      }
+      if (event.type === "invoice.payment_failed") {
+        return {
+          kind: "apply",
+          args: {
+            eventId: event.id,
+            eventType: event.type,
+            userId,
+            billingStatus: "past_due",
+            customerId,
+            subscriptionId,
+            ledgerReason: "plan_change"
+          }
+        };
+      }
+      const period = invoicePeriod(object);
+      const creditCycleEnd = cappedCreditCycleEnd(
+        period.cycleStart,
+        period.cycleEnd
+      );
+      return {
+        kind: "apply",
+        args: {
+          eventId: event.id,
+          eventType: event.type,
+          userId,
+          newPlanId: planIdForPrice(period.priceId) ?? asString(metadata.plan_id) ?? null,
+          grantCredits: true,
+          cycleStart: period.cycleStart,
+          cycleEnd: creditCycleEnd,
+          termEnd: period.cycleEnd,
+          billingStatus: "active",
+          customerId,
+          subscriptionId,
+          priceId: period.priceId,
+          ledgerReason: "refill"
+        }
+      };
+    }
+    default:
+      return { kind: "ignore", note: `unhandled event type ${event.type}` };
+  }
+}
+var stripeWebhookHandler = asyncHandler(
+  async (req, res) => {
+    const secret = getStripeWebhookSecret();
+    if (!secret) {
+      return res.status(503).json(BILLING_UNAVAILABLE);
+    }
+    const raw = req.body;
+    if (!Buffer.isBuffer(raw)) {
+      secureLogger.error(
+        "Stripe webhook received a non-raw body \u2014 express.raw must mount before the JSON parser",
+        void 0,
+        { path: req.path }
+      );
+      return res.status(500).json(
+        apiError(
+          "internal_error",
+          "WEBHOOK_BODY_NOT_RAW",
+          "Webhook raw body unavailable; server middleware misconfigured."
+        )
+      );
+    }
+    const verification = verifyStripeSignature({
+      payload: raw,
+      header: req.headers["stripe-signature"],
+      secret
+    });
+    if (!verification.valid) {
+      secureLogger.warn("Stripe webhook signature rejected", {
+        reason: verification.reason
+      });
+      return res.status(400).json(
+        apiError(
+          "authentication_error",
+          "INVALID_WEBHOOK_SIGNATURE",
+          `Stripe signature verification failed (${verification.reason}).`
+        )
+      );
+    }
+    let event;
+    try {
+      event = JSON.parse(raw.toString("utf8"));
+    } catch {
+      return res.status(400).json(
+        apiError(
+          "invalid_request_error",
+          "INVALID_JSON",
+          "Webhook payload is not valid JSON."
+        )
+      );
+    }
+    if (!asString(event?.id) || !asString(event?.type)) {
+      return res.status(400).json(
+        apiError(
+          "invalid_request_error",
+          "INVALID_EVENT",
+          "Webhook payload is missing event id or type."
+        )
+      );
+    }
+    try {
+      const decision = await decideWebhookAction(event);
+      if (decision.kind === "ignore") {
+        return res.json({ received: true, handled: false });
+      }
+      if (decision.kind === "unresolved_user") {
+        secureLogger.warn("Stripe webhook user unresolved \u2014 asking for retry", {
+          eventType: event.type,
+          note: decision.note
+        });
+        return res.status(500).json(
+          apiError(
+            "internal_error",
+            "WEBHOOK_USER_UNRESOLVED",
+            "Could not resolve the Hive user for this event yet; Stripe should retry."
+          )
+        );
+      }
+      const result = await applyPlanChange(decision.args);
+      if (event.type === "checkout.session.completed") {
+        await settleChargeRecord(
+          asString(metadataOf(event.data?.object).id),
+          "confirmed",
+          event.type
+        );
+      }
+      return res.json({
+        received: true,
+        handled: true,
+        outcome: result.outcome,
+        replayed: result.replayed
+      });
+    } catch (err) {
+      secureLogger.error("Stripe webhook processing failed", err, {
+        eventType: event.type
+      });
+      return res.status(500).json(
+        apiError(
+          "internal_error",
+          "WEBHOOK_PROCESSING_FAILED",
+          "Webhook processing failed; Stripe should retry. Processing is idempotent by event id."
+        )
+      );
+    }
+  }
+);
+var LLAMAPAY_UNAVAILABLE = apiError(
+  "internal_error",
+  "BILLING_UNAVAILABLE",
+  "Crypto checkout is not configured on this deployment. Next action: contact support@hiveintelligence.xyz to upgrade, or retry once billing is enabled."
+);
+var CryptoCheckoutSchema = z2.object({
+  plan_id: z2.string().min(1).default(PAID_PLAN_ID),
+  billing_cycle: z2.enum(["monthly", "yearly"]).default("monthly")
+});
+billingRouter.post(
+  "/checkout",
+  requireBillingPrincipal,
+  withCheckoutLock,
+  asyncHandler(async (req, res) => {
+    const userId = req.billingUserId;
+    if (!isLlamaPayCheckoutConfigured() || !isSupabaseConfigured()) {
+      return res.status(503).json(LLAMAPAY_UNAVAILABLE);
+    }
+    const parsed = CryptoCheckoutSchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+      return res.status(400).json(
+        apiError(
+          "invalid_request_error",
+          "VALIDATION_ERROR",
+          'billing_cycle must be "monthly" or "yearly", and plan_id must be a sold plan.'
+        )
+      );
+    }
+    const { plan_id: planId, billing_cycle: cycle } = parsed.data;
+    if (!isSellablePlan(planId)) {
+      return res.status(400).json(
+        apiError(
+          "invalid_request_error",
+          "PLAN_NOT_SELLABLE",
+          `Plan "${planId}" is not sold self-serve. Next action: choose starter or ${PAID_PLAN_ID}, or contact support for Enterprise.`
+        )
+      );
+    }
+    const amountUsd = priceForPlanCycle(planId, cycle);
+    if (amountUsd === void 0) {
+      return res.status(503).json(LLAMAPAY_UNAVAILABLE);
+    }
+    const { data: profile } = await getSupabaseAdmin().from("user_profiles").select("plan_id, billing_subscription_id, billing_status").eq("id", userId).maybeSingle();
+    const hasOccupyingSubscription = Boolean(profile?.billing_subscription_id) && typeof profile?.billing_status === "string" && OCCUPYING_BILLING_STATUSES.has(profile.billing_status);
+    const { data: liveSubscription } = await getSupabaseAdmin().from("stripe_subscriptions").select("current_period_end").eq("user_id", userId).in("status", [...OCCUPYING_BILLING_STATUSES]).order("current_period_end", { ascending: false }).limit(1).maybeSingle();
+    if (!canPurchasePlan(
+      profile?.plan_id ?? null,
+      planId,
+      liveSubscription?.current_period_end ?? null
+    )) {
+      const sameTier = profile?.plan_id === planId;
+      return res.status(409).json(
+        apiError(
+          "invalid_request_error",
+          hasOccupyingSubscription ? "SUBSCRIPTION_EXISTS" : "PLAN_NOT_AN_UPGRADE",
+          sameTier ? `This account is already on ${planId} and the current term still has more than ${RENEWAL_WINDOW_DAYS} days left, so renewing now would replace time you have already paid for. Next action: renew inside the last ${RENEWAL_WINDOW_DAYS} days, pick a higher tier to upgrade immediately, or message us at https://t.me/HiveIntelligence.` : `This account is already on ${profile?.plan_id ?? "a paid plan"}. Next action: pick a higher tier to upgrade now, or message us at https://t.me/HiveIntelligence to change or cancel the current plan.`
+        )
+      );
+    }
+    const openChargeId = await findOpenCharge(userId);
+    if (openChargeId) {
+      return res.status(409).json(checkoutAlreadyOpen(openChargeId));
+    }
+    try {
+      const charge = await createLlamaPayCharge({
+        userId,
+        planId,
+        cycle,
+        amountUsd,
+        email: req.billingUserEmail
+      });
+      await recordChargeCreated({
+        chargeId: charge.id,
+        processor: "llamapay",
+        userId,
+        planId,
+        cycle,
+        amountUsd,
+        planIdBefore: asString(profile?.plan_id)
+      });
+      return res.json({
+        ok: true,
+        data: {
+          url: charge.hostedUrl,
+          charge_id: charge.id,
+          plan_id: planId,
+          billing_cycle: cycle,
+          amount_usd: amountUsd,
+          processor: "llamapay"
+        }
+      });
+    } catch (err) {
+      if (err instanceof LlamaPayApiError) {
+        secureLogger.error("LlamaPay charge creation failed", err, {
+          userId,
+          status: err.status
+        });
+        return res.status(502).json(
+          apiError(
+            "provider_error",
+            "BILLING_PROVIDER_ERROR",
+            "LlamaPay rejected the checkout request. Next action: retry; if it persists, contact support@hiveintelligence.xyz."
+          )
+        );
+      }
+      throw err;
+    }
+  })
+);
+var AbandonSchema = z2.object({
+  charge_id: z2.string().min(1).optional()
+});
+billingRouter.post(
+  "/checkout/abandon",
+  requireBillingPrincipal,
+  asyncHandler(async (req, res) => {
+    const userId = req.billingUserId;
+    if (!isSupabaseConfigured()) {
+      return res.status(503).json(BILLING_UNAVAILABLE);
+    }
+    const parsed = AbandonSchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+      return res.status(400).json(
+        apiError(
+          "invalid_request_error",
+          "VALIDATION_ERROR",
+          "charge_id must be a non-empty string when provided. Next action: omit it to release every checkout this account has open."
+        )
+      );
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    let query = getSupabaseAdmin().from("billing_charges").update({
+      status: "canceled",
+      last_event_at: now,
+      last_event_type: ABANDONED_EVENT_TYPE
+    }).eq("user_id", userId).eq("status", "created").is("settled_at", null).gte("created_at", openChargeCutoff());
+    if (parsed.data.charge_id) {
+      query = query.eq("charge_id", parsed.data.charge_id);
+    }
+    const { data, error } = await query.select("charge_id");
+    if (error) {
+      secureLogger.error("Failed to mark checkout abandoned", error, {
+        userId
+      });
+      return res.status(500).json(
+        apiError(
+          "internal_error",
+          "CHECKOUT_ABANDON_FAILED",
+          `Could not release the open checkout. Next action: retry, or wait ${OPEN_CHARGE_WINDOW_MINUTES} minutes for it to clear on its own.`
+        )
+      );
+    }
+    const abandoned = (Array.isArray(data) ? data : []).map((row) => row.charge_id).filter((id) => typeof id === "string");
+    return res.json({ ok: true, data: { abandoned } });
+  })
+);
+billingRouter.get(
+  "/charges",
+  requireBillingPrincipal,
+  asyncHandler(async (req, res) => {
+    const userId = req.billingUserId;
+    if (!isSupabaseConfigured()) {
+      return res.status(503).json(BILLING_UNAVAILABLE);
+    }
+    const { data, error } = await getSupabaseAdmin().from("billing_charges").select(
+      "charge_id, processor, plan_id, billing_cycle, amount_usd, status, created_at, settled_at"
+    ).eq("user_id", userId).order("created_at", { ascending: false }).limit(50);
+    if (error) {
+      secureLogger.error("Failed to read billing charges", error, { userId });
+      return res.status(500).json(
+        apiError(
+          "internal_error",
+          "BILLING_HISTORY_UNAVAILABLE",
+          "Could not load your billing history. Next action: retry shortly, or contact support@hiveintelligence.xyz with the date of the charge."
+        )
+      );
     }
+    return res.json({ ok: true, data: { charges: data ?? [] } });
+  })
+);
+var LLAMAPAY_EVENT_TYPES = [
+  "charge:pending",
+  "charge:confirmed",
+  "subscription:expired"
+];
+function localChargeAmountUsd(pricing) {
+  const local = metadataOf(metadataOf(pricing).local);
+  const currency = asString(local.currency);
+  if (currency !== null && currency.toUpperCase() !== "USD") {
+    return Number.NaN;
+  }
+  const raw = local.amount;
+  const amount = typeof raw === "number" ? raw : typeof raw === "string" ? Number.parseFloat(raw) : void 0;
+  if (amount === void 0 || !Number.isFinite(amount)) return void 0;
+  return amount;
+}
+function decideLlamaPayAction(event) {
+  const data = metadataOf(event.data);
+  const metadata = metadataOf(data.metadata);
+  const userId = asString(metadata.user_id);
+  const chargeId = asString(data.id);
+  if (!userId) {
+    return { kind: "ignore", note: "charge without user_id metadata" };
   }
-  if (!best) return { cycleStart: null, cycleEnd: null, priceId: null };
-  const period = metadataOf(best.period);
-  const price = metadataOf(best.price);
-  const pricing = metadataOf(best.pricing);
-  const priceDetails = metadataOf(pricing.price_details);
-  return {
-    cycleStart: isoFromUnixSeconds(period.start),
-    cycleEnd: isoFromUnixSeconds(period.end),
-    priceId: asString(price.id) ?? asString(priceDetails.price)
-  };
-}
-async function decideWebhookAction(event) {
-  const object = metadataOf(event.data?.object);
   switch (event.type) {
-    case "checkout.session.completed": {
-      const mode = asString(object.mode);
-      if (mode !== null && mode !== "subscription") {
-        return { kind: "ignore", note: "non-subscription checkout" };
-      }
-      const metadata = metadataOf(object.metadata);
-      const userId = asString(metadata.user_id) ?? asString(object.client_reference_id);
-      if (!userId) {
-        return { kind: "ignore", note: "checkout session without user_id" };
+    case "charge:pending":
+    case "charge:confirmed": {
+      const planId = asString(metadata.plan_id) ?? PAID_PLAN_ID;
+      const cycle = metadata.billing_cycle === "yearly" ? "yearly" : "monthly";
+      const expected = priceForPlanCycle(planId, cycle);
+      const paid = localChargeAmountUsd(data.pricing);
+      if (expected !== void 0 && paid !== void 0 && paid !== expected) {
+        return {
+          kind: "ignore",
+          note: `charge ${chargeId ?? "<no id>"} paid ${Number.isNaN(paid) ? "a non-USD amount" : paid} against ${expected} for ${planId}/${cycle} \u2014 entitlement withheld`
+        };
       }
+      const start = event.created_at ? new Date(event.created_at) : /* @__PURE__ */ new Date();
+      const cycleStart = Number.isNaN(start.getTime()) ? /* @__PURE__ */ new Date() : start;
       return {
         kind: "apply",
         args: {
           eventId: event.id,
           eventType: event.type,
           userId,
-          newPlanId: asString(metadata.plan_id) ?? PAID_PLAN_ID,
+          newPlanId: planId,
           grantCredits: true,
+          cycleStart: cycleStart.toISOString(),
+          // Two clocks, deliberately. Credits are sold monthly on every term,
+          // so the wallet cycle is always a month; the term is what the charge
+          // actually bought. Passing the annual date as the credit cycle gave
+          // a $1,490 buyer one month's credits to last a year.
+          cycleEnd: creditCycleEndFrom(cycleStart).toISOString(),
+          termEnd: termEndFrom(cycleStart, cycle).toISOString(),
           billingStatus: "active",
-          customerId: refId(object.customer),
-          subscriptionId: refId(object.subscription),
+          subscriptionId: chargeId,
           subscriptionStatus: "active",
           ledgerReason: "plan_change"
         }
       };
     }
-    case "customer.subscription.updated":
-    case "customer.subscription.deleted": {
-      const metadata = metadataOf(object.metadata);
-      const customerId = refId(object.customer);
-      const userId = asString(metadata.user_id) ?? await resolveUserIdByCustomer(customerId);
-      if (!userId) {
-        return {
-          kind: "unresolved_user",
-          note: `no user binding for customer ${customerId ?? "<none>"}`
-        };
-      }
-      if (event.type === "customer.subscription.deleted") {
-        return {
-          kind: "apply",
-          args: {
-            eventId: event.id,
-            eventType: event.type,
-            userId,
-            newPlanId: FREE_PLAN_ID,
-            grantCredits: true,
-            billingStatus: "canceled",
-            customerId,
-            subscriptionId: refId(object.id),
-            subscriptionStatus: "canceled",
-            ledgerReason: "plan_change"
-          }
-        };
-      }
-      const status = asString(object.status);
-      const items = metadataOf(object.items);
-      const firstItem = metadataOf(
-        Array.isArray(items.data) ? items.data[0] : void 0
-      );
-      const priceId = asString(metadataOf(firstItem.price).id);
+    case "subscription:expired": {
       return {
         kind: "apply",
         args: {
           eventId: event.id,
           eventType: event.type,
           userId,
-          // Tier/status sync only — credits ride the money event
-          // (invoice.paid), which is the one wallet clock.
-          newPlanId: planIdForPrice(priceId) ?? asString(metadata.plan_id) ?? null,
-          grantCredits: false,
-          billingStatus: mapSubscriptionStatusToBilling(status),
-          customerId,
-          subscriptionId: refId(object.id),
-          subscriptionStatus: status,
-          priceId,
+          newPlanId: FREE_PLAN_ID,
+          grantCredits: true,
+          billingStatus: "canceled",
+          subscriptionId: chargeId,
+          subscriptionStatus: "canceled",
           ledgerReason: "plan_change"
         }
       };
     }
-    case "invoice.paid":
-    case "invoice.payment_failed": {
-      const { subscriptionId, metadata } = invoiceSubscriptionContext(object);
-      if (!subscriptionId) {
-        return { kind: "ignore", note: "invoice without a subscription" };
-      }
-      const customerId = refId(object.customer);
-      const userId = asString(metadata.user_id) ?? await resolveUserIdByCustomer(customerId);
-      if (!userId) {
-        return {
-          kind: "unresolved_user",
-          note: `no user binding for customer ${customerId ?? "<none>"}`
-        };
-      }
-      if (event.type === "invoice.payment_failed") {
-        return {
-          kind: "apply",
-          args: {
-            eventId: event.id,
-            eventType: event.type,
-            userId,
-            billingStatus: "past_due",
-            customerId,
-            subscriptionId,
-            ledgerReason: "plan_change"
-          }
-        };
-      }
-      const period = invoicePeriod(object);
+    default:
       return {
-        kind: "apply",
-        args: {
-          eventId: event.id,
-          eventType: event.type,
-          userId,
-          newPlanId: planIdForPrice(period.priceId) ?? asString(metadata.plan_id) ?? null,
-          grantCredits: true,
-          cycleStart: period.cycleStart,
-          cycleEnd: period.cycleEnd,
-          billingStatus: "active",
-          customerId,
-          subscriptionId,
-          priceId: period.priceId,
-          ledgerReason: "refill"
-        }
+        kind: "ignore",
+        note: `unhandled event type ${event.type} (known: ${LLAMAPAY_EVENT_TYPES.join(", ")})`
       };
-    }
-    default:
-      return { kind: "ignore", note: `unhandled event type ${event.type}` };
   }
 }
-var stripeWebhookHandler = asyncHandler(
+var llamapayWebhookHandler = asyncHandler(
   async (req, res) => {
-    const secret = getStripeWebhookSecret();
+    const secret = getLlamaPayWebhookSecret();
     if (!secret) {
-      return res.status(503).json(BILLING_UNAVAILABLE);
+      return res.status(503).json(LLAMAPAY_UNAVAILABLE);
     }
     const raw = req.body;
     if (!Buffer.isBuffer(raw)) {
       secureLogger.error(
-        "Stripe webhook received a non-raw body \u2014 express.raw must mount before the JSON parser",
+        "LlamaPay webhook received a non-raw body \u2014 express.raw must mount before the JSON parser",
         void 0,
         { path: req.path }
       );
@@ -4103,26 +4942,26 @@ var stripeWebhookHandler = asyncHandler(
         )
       );
     }
-    const verification = verifyStripeSignature({
+    const verification = verifyLlamaPaySignature({
       payload: raw,
-      header: req.headers["stripe-signature"],
+      header: req.headers[LLAMAPAY_SIGNATURE_HEADER],
       secret
     });
     if (!verification.valid) {
-      secureLogger.warn("Stripe webhook signature rejected", {
+      secureLogger.warn("LlamaPay webhook signature rejected", {
         reason: verification.reason
       });
       return res.status(400).json(
         apiError(
           "authentication_error",
           "INVALID_WEBHOOK_SIGNATURE",
-          `Stripe signature verification failed (${verification.reason}).`
+          `LlamaPay signature verification failed (${verification.reason}).`
         )
       );
     }
-    let event;
+    let envelope;
     try {
-      event = JSON.parse(raw.toString("utf8"));
+      envelope = JSON.parse(raw.toString("utf8"));
     } catch {
       return res.status(400).json(
         apiError(
@@ -4132,6 +4971,7 @@ var stripeWebhookHandler = asyncHandler(
         )
       );
     }
+    const event = envelope.event ?? envelope;
     if (!asString(event?.id) || !asString(event?.type)) {
       return res.status(400).json(
         apiError(
@@ -4142,20 +4982,20 @@ var stripeWebhookHandler = asyncHandler(
       );
     }
     try {
-      const decision = await decideWebhookAction(event);
+      const decision = decideLlamaPayAction(event);
       if (decision.kind === "ignore") {
-        return res.json({ received: true, handled: false });
-      }
-      if (decision.kind === "unresolved_user") {
-        secureLogger.warn("Stripe webhook user unresolved \u2014 asking for retry", {
+        secureLogger.warn("LlamaPay webhook ignored", {
           eventType: event.type,
           note: decision.note
         });
+        return res.json({ received: true, handled: false });
+      }
+      if (decision.kind === "unresolved_user") {
         return res.status(500).json(
           apiError(
             "internal_error",
             "WEBHOOK_USER_UNRESOLVED",
-            "Could not resolve the Hive user for this event yet; Stripe should retry."
+            "Could not resolve the Hive user for this event yet; LlamaPay should retry."
           )
         );
       }
@@ -4167,14 +5007,14 @@ var stripeWebhookHandler = asyncHandler(
         replayed: result.replayed
       });
     } catch (err) {
-      secureLogger.error("Stripe webhook processing failed", err, {
+      secureLogger.error("LlamaPay webhook processing failed", err, {
         eventType: event.type
       });
       return res.status(500).json(
         apiError(
           "internal_error",
           "WEBHOOK_PROCESSING_FAILED",
-          "Webhook processing failed; Stripe should retry. Processing is idempotent by event id."
+          "Webhook processing failed; LlamaPay should retry. Processing is idempotent by event id."
         )
       );
     }
@@ -4183,20 +5023,39 @@ var stripeWebhookHandler = asyncHandler(
 
 // src/middleware/request-id.ts
 import { randomUUID as randomUUID2 } from "crypto";
+function isUnstampedApiError(body) {
+  if (typeof body !== "object" || body === null) return false;
+  const candidate = body;
+  if (candidate.ok !== false) return false;
+  if (typeof candidate.error !== "object" || candidate.error === null) {
+    return false;
+  }
+  return !("request_id" in candidate.error);
+}
 function requestIdMiddleware(req, res, next) {
   const id = req.headers["x-request-id"] || `req_${randomUUID2().replace(/-/g, "")}`;
   req.requestId = id;
   res.setHeader("x-request-id", id);
+  const json = res.json.bind(res);
+  res.json = (body) => {
+    if (isUnstampedApiError(body)) {
+      body.error.request_id = id;
+    }
+    return json(body);
+  };
   next();
 }
 
 // src/middleware/rate-limit-headers.ts
 function rateLimitInfoHeaders(opts) {
   const windowSec = Math.round(opts.windowMs / 1e3);
-  return (_req, res, next) => {
+  return (req, res, next) => {
     if (!res.getHeader("RateLimit-Limit")) {
-      res.setHeader("RateLimit-Limit", String(opts.limit));
-      res.setHeader("RateLimit-Policy", `${opts.limit};w=${windowSec}`);
+      const headers = req.headers ?? {};
+      const hasCredential2 = typeof headers["x-api-key"] === "string" || typeof headers.authorization === "string" && headers.authorization.startsWith("Bearer ");
+      const limit = hasCredential2 && opts.credentialedLimit !== void 0 ? opts.credentialedLimit : opts.limit;
+      res.setHeader("RateLimit-Limit", String(limit));
+      res.setHeader("RateLimit-Policy", `${limit};w=${windowSec}`);
     }
     next();
   };
@@ -4600,12 +5459,13 @@ import { LATEST_PROTOCOL_VERSION } from "@modelcontextprotocol/sdk/types.js";
 
 // src/services/anon-quota.ts
 import { createHash as createHash4 } from "crypto";
-import { z as z4 } from "zod";
-var ANON_QUOTA_EXHAUSTED_MESSAGE = "Anonymous free quota reached (resets 00:00 UTC). For continued access set HIVE_API_KEY \u2014 create one free at https://hiveintelligence.xyz/dashboard/keys \u2014 or sign in via OAuth.";
-var ANON_QUOTA_UNAVAILABLE_MESSAGE = "Anonymous access is temporarily unavailable because the quota backend is unreachable. Retry in a moment, or set HIVE_API_KEY \u2014 create one free at https://hiveintelligence.xyz/dashboard/keys \u2014 for keyed access now.";
+import { z as z3 } from "zod";
+var ANON_QUOTA_EXHAUSTED_MESSAGE = "Anonymous free quota reached (resets 00:00 UTC). For continued access set HIVE_API_KEY (create one free at https://hiveintelligence.xyz/dashboard/keys) or sign in via OAuth.";
+var ANON_GLOBAL_CAP_MESSAGE = "Hive's shared anonymous allowance for today is spent (resets 00:00 UTC). This is a service-wide cap, not your personal one, and a key is not rate-limited by it: set HIVE_API_KEY (create one free at https://hiveintelligence.xyz/dashboard/keys) or sign in via OAuth.";
+var ANON_QUOTA_UNAVAILABLE_MESSAGE = "Anonymous access is temporarily unavailable because the quota backend is unreachable. Retry in a moment, or set HIVE_API_KEY (create one free at https://hiveintelligence.xyz/dashboard/keys) for keyed access now.";
 var ANON_IP_HASH_DOMAIN = "hive-anon-lane-v1";
-var capSchema = z4.coerce.number().int().min(1).max(1e4);
-var globalCapSchema = z4.coerce.number().int().min(1).max(1e6);
+var capSchema = z3.coerce.number().int().min(1).max(1e4);
+var globalCapSchema = z3.coerce.number().int().min(1).max(1e6);
 function isAnonLaneEnabled() {
   return getEnvVar("ANON_LANE_ENABLED")?.toLowerCase() !== "false";
 }
@@ -4620,6 +5480,27 @@ function getAnonGlobalDailyCap() {
 function anonymousIpHash(ipKey) {
   return createHash4("sha256").update(`${ANON_IP_HASH_DOMAIN}\0${ipKey}`).digest("hex");
 }
+var GLOBAL_CAP_LOG_INTERVAL_MS = 6e4;
+var lastGlobalCapLoggedAt = 0;
+var globalCapRejections = 0;
+var globalCapRejectionsAtLastLog = 0;
+function noteGlobalCapTripped(limit, resetSeconds) {
+  globalCapRejections += 1;
+  const now = Date.now();
+  if (now - lastGlobalCapLoggedAt < GLOBAL_CAP_LOG_INTERVAL_MS) return;
+  lastGlobalCapLoggedAt = now;
+  const rejected = globalCapRejections - globalCapRejectionsAtLastLog;
+  globalCapRejectionsAtLastLog = globalCapRejections;
+  secureLogger.error(
+    "[anon-lane] GLOBAL daily breaker tripped \u2014 every anonymous caller is blocked until the UTC day rolls",
+    void 0,
+    {
+      globalDailyCap: limit,
+      resetSeconds,
+      rejectionsSinceLastLog: rejected
+    }
+  );
+}
 async function defaultConsume(args) {
   const { data, error } = await getSupabaseAdmin().rpc(
     "consume_anon_daily_quota",
@@ -4660,11 +5541,12 @@ async function consumeAnonMaterialQuota(ipHash, overrides = {}) {
         resetSeconds: Math.max(1, row.reset_seconds ?? 1)
       };
     }
-    return {
-      allowed: false,
-      reason: row.scope === "global" ? "global_cap" : "ip_cap",
-      resetSeconds: Math.max(1, row.reset_seconds ?? 1)
-    };
+    const resetSeconds = Math.max(1, row.reset_seconds ?? 1);
+    if (row.scope === "global") {
+      noteGlobalCapTripped(getAnonGlobalDailyCap(), resetSeconds);
+      return { allowed: false, reason: "global_cap", resetSeconds };
+    }
+    return { allowed: false, reason: "ip_cap", resetSeconds };
   } catch (err) {
     secureLogger.warn("Anonymous quota backend unavailable; failing closed", {
       error: err instanceof Error ? err.message : String(err)
@@ -4693,7 +5575,7 @@ function buildServerCard() {
       email: "support@hiveintelligence.xyz"
     },
     homepage: "https://www.hiveintelligence.xyz",
-    documentation: "https://www.hiveintelligence.xyz/crypto-mcp",
+    documentation: "https://docs.hiveintelligence.xyz/concepts/how-it-works",
     repository: {
       type: "git",
       url: "https://github.com/hive-intel/hive-sdk"
@@ -4809,7 +5691,7 @@ function buildServerCard() {
       freeTier: {
         monthlyCredits: 1e4,
         requestsPerMinute: 30,
-        description: "Demo tier \u2014 no credit card required"
+        description: "Demo tier, no credit card required"
       }
     },
     authCompatibility,
@@ -4926,33 +5808,33 @@ function buildServerCard() {
 }
 
 // src/auth/oauth/router.ts
-import { timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { timingSafeEqual as timingSafeEqual5 } from "crypto";
 import express from "express";
-import rateLimit3 from "express-rate-limit";
-import RedisStore3 from "rate-limit-redis";
-import { z as z5 } from "zod";
+import rateLimit2 from "express-rate-limit";
+import RedisStore2 from "rate-limit-redis";
+import { z as z4 } from "zod";
 import {
   createOAuthMetadata,
   getOAuthProtectedResourceMetadataUrl,
   mcpAuthRouter
 } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { OAuthError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-var consentDecisionSchema = z5.object({
-  approved: z5.boolean(),
-  scopes: z5.array(z5.enum(OAUTH_SCOPES)).max(OAUTH_SCOPES.length).optional()
+var consentDecisionSchema = z4.object({
+  approved: z4.boolean(),
+  scopes: z4.array(z4.enum(OAUTH_SCOPES)).max(OAUTH_SCOPES.length).optional()
 }).strict();
-var consentRequestIdSchema = z5.string().min(40).max(100).regex(/^hvoq_[A-Za-z0-9_-]+$/);
-var connectedAppDisconnectSchema = z5.object({
-  client_id: z5.string().min(1).max(2048).refine((value) => value.trim() === value, {
+var consentRequestIdSchema = z4.string().min(40).max(100).regex(/^hvoq_[A-Za-z0-9_-]+$/);
+var connectedAppDisconnectSchema = z4.object({
+  client_id: z4.string().min(1).max(2048).refine((value) => value.trim() === value, {
     message: "client_id must not contain leading or trailing whitespace."
   })
 }).strict();
-var deploymentCanaryClientIdSchema = z5.string().regex(/^hive_oauth_client_[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);
-var deploymentCanaryConsentSchema = z5.object({
+var deploymentCanaryClientIdSchema = z4.string().regex(/^hive_oauth_client_[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);
+var deploymentCanaryConsentSchema = z4.object({
   request_id: consentRequestIdSchema,
   client_id: deploymentCanaryClientIdSchema
 }).strict();
-var deploymentCanaryDisconnectSchema = z5.object({ client_id: deploymentCanaryClientIdSchema }).strict();
+var deploymentCanaryDisconnectSchema = z4.object({ client_id: deploymentCanaryClientIdSchema }).strict();
 var OAUTH_RATE_LIMITS = {
   authorize: { windowMs: 15 * 60 * 1e3, max: 300 },
   token: { windowMs: 15 * 60 * 1e3, max: 3e3 },
@@ -4971,7 +5853,7 @@ function oauthRateLimitOptions(prefix) {
   const redis = getRedisClient();
   return {
     ...redis ? {
-      store: new RedisStore3({
+      store: new RedisStore2({
         sendCommand: ((...args) => redis.call(
           args[0],
           ...args.slice(1)
@@ -4988,11 +5870,11 @@ function monitorSecretAuthorized(req) {
   if (!expected || typeof supplied !== "string") return false;
   const left = Buffer.from(supplied);
   const right = Buffer.from(expected);
-  return left.length === right.length && timingSafeEqual4(left, right);
+  return left.length === right.length && timingSafeEqual5(left, right);
 }
 function deploymentCanaryUserId() {
   const userId = getEnvVar("HIVE_CANARY_USER_ID");
-  return userId && z5.string().uuid().safeParse(userId).success ? userId : void 0;
+  return userId && z4.string().uuid().safeParse(userId).success ? userId : void 0;
 }
 async function verifyDeploymentCanaryUser(userId) {
   const { data, error } = await getSupabaseAdmin().auth.admin.getUserById(userId);
@@ -5010,7 +5892,7 @@ function createMcpOAuthRuntime(options = {}) {
     { fetcher: options.fetcher }
   );
   const serviceDocumentationUrl = new URL(
-    "https://www.hiveintelligence.xyz/crypto-mcp"
+    "https://docs.hiveintelligence.xyz/concepts/how-it-works"
   );
   const oauthMetadata = {
     ...createOAuthMetadata({
@@ -5081,7 +5963,7 @@ function createMcpOAuthRuntime(options = {}) {
       res.json(resourceMetadata);
     }
   );
-  const consentRateLimit = rateLimit3({
+  const consentRateLimit = rateLimit2({
     ...oauthRateLimitOptions("rl:oauth:consent:"),
     ...OAUTH_RATE_LIMITS.account,
     standardHeaders: true,
@@ -5107,7 +5989,7 @@ function createMcpOAuthRuntime(options = {}) {
   ).href;
   const deploymentCanaryJsonParser = express.json({ limit: "8kb" });
   const deploymentCanaryUserVerifier = options.deploymentCanaryUserVerifier ?? verifyDeploymentCanaryUser;
-  const deploymentCanaryRateLimit = rateLimit3({
+  const deploymentCanaryRateLimit = rateLimit2({
     ...oauthRateLimitOptions("rl:oauth:deployment-canary:"),
     ...OAUTH_RATE_LIMITS.deploymentCanary,
     standardHeaders: true,
@@ -5723,7 +6605,7 @@ var port = getPort();
 function createHttpApp() {
   return app;
 }
-app.set("trust proxy", 1);
+app.set("trust proxy", resolveTrustedProxies());
 app.use(requestIdMiddleware);
 app.use((_req, res, next) => {
   if (isShuttingDown) {
@@ -5739,10 +6621,12 @@ app.use((_req, res, next) => {
   return next();
 });
 var RATE_LIMIT_MAX = getRateLimitMax();
+var CREDENTIALED_RATE_LIMIT_MAX = getCredentialedRateLimitMax();
 var RATE_LIMIT_WINDOW_MS = 6e4;
 app.use(
   rateLimitInfoHeaders({
     limit: RATE_LIMIT_MAX,
+    credentialedLimit: CREDENTIALED_RATE_LIMIT_MAX,
     windowMs: RATE_LIMIT_WINDOW_MS
   })
 );
@@ -5829,6 +6713,11 @@ app.post(
   express2.raw({ type: "application/json", limit: "1mb" }),
   stripeWebhookHandler
 );
+app.post(
+  "/api/v1/billing/webhook/llamapay",
+  express2.raw({ type: "application/json", limit: "1mb" }),
+  llamapayWebhookHandler
+);
 app.use(
   express2.json({
     limit: "1mb",
@@ -5982,10 +6871,20 @@ function pingHandler(_req, res) {
 }
 app.get("/ping", pingHandler);
 app.get("/health", pingHandler);
-var mcpIpRateLimiter = createIpRateLimiter();
-var restIpRateLimiter = createIpRateLimiter();
-var authIpRateLimiter = createIpRateLimiter();
-app.use(["/status", "/api/health"], restIpRateLimiter);
+var mcpIpRateLimiter = [
+  createIpRateLimiter({ lane: "anonymous" }),
+  createIpRateLimiter({ lane: "credentialed" })
+];
+var restIpRateLimiter = [
+  createIpRateLimiter({ lane: "anonymous" }),
+  createIpRateLimiter({ lane: "credentialed" })
+];
+var authIpRateLimiter = [
+  createIpRateLimiter({ lane: "anonymous" }),
+  createIpRateLimiter({ lane: "credentialed" })
+];
+var healthRateLimiter = createLocalRateLimiter();
+app.use(["/status", "/api/health"], healthRateLimiter);
 app.use(health_default);
 app.use("/auth", authIpRateLimiter);
 app.use("/api/v1", restIpRateLimiter);
@@ -5994,7 +6893,7 @@ app.use("/api/v1/keys", keys_default);
 app.use("/api/v1/usage", usage_default);
 app.use("/api/v1/b2b", b2b_default);
 app.use("/api/v1/billing", billingRouter);
-var mcpMiddlewares = [mcpIpRateLimiter];
+var mcpMiddlewares = [...mcpIpRateLimiter];
 function withTimeout(p, ms) {
   return new Promise((resolve2, reject) => {
     const timer = setTimeout(() => {
@@ -6012,6 +6911,16 @@ function withTimeout(p, ms) {
     );
   });
 }
+var PRICING_URL = "https://www.hiveintelligence.xyz/pricing";
+function buildMcpQuotaExhaustedCopy(args) {
+  const plan = args.planId ? `${args.planId} plan` : "current plan";
+  const reset = args.cycleEnd ? `Credits refill at ${args.cycleEnd}.` : "Credits refill at the start of the next billing cycle.";
+  return {
+    message: `Monthly credit quota exhausted on the ${plan}. ${reset} Upgrade at ${PRICING_URL} to raise the limit now, or wait for the cycle to reset.`,
+    cause: `The ${plan} has no monthly credits left, so this material call cannot be debited.`,
+    next_action: `Upgrade at ${PRICING_URL} to raise the monthly allowance, or retry after the cycle resets${args.cycleEnd ? ` at ${args.cycleEnd}` : ""}. Discovery calls (tools/list, search_tools, schema lookup) cost no credits and still work.`
+  };
+}
 async function debitMcpCredits(args) {
   try {
     const debit = await consumeCredits({
@@ -6025,13 +6934,19 @@ async function debitMcpCredits(args) {
       return {
         ok: false,
         noWallet: true,
-        error: "This account has no credit wallet provisioned. This is an account setup issue, not a quota limit \u2014 visit https://hiveintelligence.xyz/dashboard to initialize billing or contact support."
+        error: "This account has no credit wallet provisioned. This is an account setup issue, not a quota limit. Visit https://hiveintelligence.xyz/dashboard to initialize billing or contact support."
       };
     }
     if (debit.code === "insufficient") {
+      const copy = buildMcpQuotaExhaustedCopy({
+        planId: args.planId,
+        cycleEnd: debit.cycleEnd
+      });
       return {
         ok: false,
-        error: "Credit quota exceeded. Add credits or upgrade your plan to continue.",
+        error: copy.message,
+        cause: copy.cause,
+        next_action: copy.next_action,
         rateLimited: true
       };
     }
@@ -6250,6 +7165,16 @@ function getMcpHiveToolName(body) {
   }
   return toolName.startsWith("hive_") ? toolName : void 0;
 }
+function resolveMcpClientName(req, body) {
+  const fromBody = body?.params?.clientInfo?.name;
+  if (typeof fromBody === "string" && fromBody.trim()) return fromBody.trim();
+  const header = req.headers["x-hive-client"];
+  if (typeof header === "string" && header.trim()) return header.trim();
+  const userAgent = req.headers["user-agent"];
+  if (typeof userAgent !== "string") return void 0;
+  const product = userAgent.trim().split(/[\s\/]/, 1)[0];
+  return product || void 0;
+}
 function mcpCredentialPresented(req) {
   return typeof req.headers["x-api-key"] === "string" || Boolean(req.headers.authorization?.startsWith("Bearer "));
 }
@@ -6288,7 +7213,11 @@ async function authorizeAnonymousMcpRequest(req) {
     };
   }
   if (quota.reason === "unavailable") return { kind: "quota_unavailable" };
-  return { kind: "quota_exhausted", resetSeconds: quota.resetSeconds };
+  return {
+    kind: "quota_exhausted",
+    scope: quota.reason === "global_cap" ? "global" : "ip",
+    resetSeconds: quota.resetSeconds
+  };
 }
 function isMonitorSecretRequest(req) {
   const secret = getEnvVar("MONITOR_SECRET");
@@ -6296,7 +7225,7 @@ function isMonitorSecretRequest(req) {
   if (!secret || typeof provided !== "string") return false;
   const a = Buffer.from(provided);
   const b = Buffer.from(secret);
-  return a.length === b.length && timingSafeEqual5(a, b);
+  return a.length === b.length && timingSafeEqual6(a, b);
 }
 function getValidatedMcpHiveToolName(scope, body) {
   if (body?.method !== "tools/call") return void 0;
@@ -6482,6 +7411,7 @@ function createStatelessMcpHandler(scope) {
         }
       } else if (decision.kind === "quota_exhausted") {
         res.setHeader("Retry-After", String(decision.resetSeconds));
+        const exhaustedMessage = decision.scope === "global" ? ANON_GLOBAL_CAP_MESSAGE : ANON_QUOTA_EXHAUSTED_MESSAGE;
         if (mcpOAuth.status === "ready") {
           const requiredScopes = getRequiredMcpScopes(req.body);
           res.setHeader(
@@ -6493,7 +7423,7 @@ function createStatelessMcpHandler(scope) {
           );
           res.status(401).json({
             error: "authorization_required",
-            error_description: ANON_QUOTA_EXHAUSTED_MESSAGE
+            error_description: exhaustedMessage
           });
           return;
         }
@@ -6501,9 +7431,9 @@ function createStatelessMcpHandler(scope) {
           jsonrpc: "2.0",
           error: {
             code: -32001,
-            message: ANON_QUOTA_EXHAUSTED_MESSAGE,
+            message: exhaustedMessage,
             data: {
-              code: "ANON_QUOTA_EXCEEDED",
+              code: decision.scope === "global" ? "ANON_GLOBAL_CAP_EXCEEDED" : "ANON_QUOTA_EXCEEDED",
               retryable: true,
               retry_after: decision.resetSeconds
             }
@@ -6601,6 +7531,30 @@ function createStatelessMcpHandler(scope) {
         return;
       }
     }
+    if (keyedAuth?.userId) {
+      const decision = await enforceUserRateLimit(keyedAuth.userId);
+      res.setHeader("RateLimit-Limit", String(decision.limit));
+      res.setHeader("RateLimit-Remaining", String(decision.remaining));
+      res.setHeader("RateLimit-Reset", String(decision.resetSeconds));
+      res.setHeader("RateLimit-Policy", `${decision.limit};w=60`);
+      if (!decision.allowed) {
+        res.setHeader("Retry-After", String(decision.resetSeconds));
+        res.status(200).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32001,
+            message: `Rate limit exceeded: ${decision.limit} requests per minute on your plan. This limit is shared across all of your API keys and connected clients.`,
+            data: {
+              code: "RATE_LIMITED",
+              retryable: true,
+              retry_after: decision.resetSeconds
+            }
+          },
+          id: req.body?.id ?? null
+        });
+        return;
+      }
+    }
     try {
       const body = req.body;
       const rawHiveToolName = getMcpHiveToolName(body);
@@ -6651,11 +7605,10 @@ function createStatelessMcpHandler(scope) {
         subjectContext = subject.data;
       }
       sanitizeMcpAuthContext(body);
-      const clientInfoName = body?.params?.clientInfo?.name;
       const analytics = {
         principalRaw: keyedAuth?.userId ?? anonymousLane?.principalRaw,
         authLane: keyedAuth ? keyedAuth.authMethod : "anonymous",
-        clientName: typeof clientInfoName === "string" ? clientInfoName : void 0,
+        clientName: resolveMcpClientName(req, body),
         isInternal: isMonitorSecretRequest(req)
       };
       const server = createHiveMcpServer(scope, {
@@ -6719,7 +7672,8 @@ function createStatelessMcpHandler(scope) {
             const debit = await debitMcpCredits({
               userId: keyedAuth.userId,
               keyId: keyedAuth.keyId,
-              requestId: req.requestId
+              requestId: req.requestId,
+              planId: typeof keyedAuth.keyMeta?.plan === "string" ? keyedAuth.keyMeta.plan : void 0
             });
             if (!debit.ok) {
               if (debit.noWallet) {
@@ -6737,7 +7691,9 @@ function createStatelessMcpHandler(scope) {
                 type: debit.rateLimited ? "rate_limit_error" : "internal_error",
                 code: debit.rateLimited ? "QUOTA_EXCEEDED" : "QUOTA_SERVICE_UNAVAILABLE",
                 message: debit.error,
-                runtimeStatus: debit.rateLimited ? "rate_limited" : "failing"
+                runtimeStatus: debit.rateLimited ? "rate_limited" : "failing",
+                ...debit.cause ? { cause: debit.cause } : {},
+                ...debit.next_action ? { next_action: debit.next_action } : {}
               };
             }
             res.setHeader(
@@ -6756,16 +7712,18 @@ function createStatelessMcpHandler(scope) {
               };
             }
           }
-          if (subjectContext && isHiveStatefulWriteTool(executedToolName)) {
-            recordSubjectAuditEvent({
-              userId: subjectContext.userId,
-              subjectId: subjectContext.subjectId,
-              keyId: keyedAuth.keyId,
-              transport: "mcp",
-              toolName: executedToolName,
-              requestId: req.requestId
-            });
-          }
+          const auditEvent = buildStatefulWriteAuditEvent({
+            isStatefulWrite: isHiveStatefulWriteTool(executedToolName),
+            transport: "mcp",
+            toolName: executedToolName,
+            userId: keyedAuth.userId,
+            subjectContext,
+            keyId: keyedAuth.keyId,
+            authMethod: keyedAuth.authMethod,
+            oauthClientId: keyedAuth.oauthClientId,
+            requestId: req.requestId
+          });
+          if (auditEvent) recordSubjectAuditEvent(auditEvent);
           return void 0;
         } : anonymousLane ? async (executedToolName) => {
           const creditCost = getMcpCreditCost(executedToolName);
@@ -6775,7 +7733,7 @@ function createStatelessMcpHandler(scope) {
             return {
               type: "authentication_error",
               code: "ANON_AUTH_REQUIRED",
-              message: "This tool requires authentication. Set HIVE_API_KEY \u2014 create one free at https://hiveintelligence.xyz/dashboard/keys \u2014 or sign in via OAuth.",
+              message: "This tool requires authentication. Set HIVE_API_KEY (create one free at https://hiveintelligence.xyz/dashboard/keys) or sign in via OAuth.",
               runtimeStatus: "failing"
             };
           }
@@ -6868,7 +7826,7 @@ var requireMcpTransportCredential = async (req, res, next) => {
 };
 app.get(
   mcpPaths,
-  mcpIpRateLimiter,
+  ...mcpIpRateLimiter,
   requireMcpTransportCredential,
   (_req, res) => {
     res.writeHead(405, { Allow: "POST" }).end();
@@ -6876,7 +7834,7 @@ app.get(
 );
 app.delete(
   mcpPaths,
-  mcpIpRateLimiter,
+  ...mcpIpRateLimiter,
   requireMcpTransportCredential,
   (_req, res) => {
     res.writeHead(405, { Allow: "POST" }).end();
@@ -6884,7 +7842,7 @@ app.delete(
 );
 app.post(
   "/api/run-tests",
-  restIpRateLimiter,
+  ...restIpRateLimiter,
   asyncHandler(async (req, res) => {
     const authToken = req.headers["x-monitor-secret"];
     const monitorSecret = getEnvVar("MONITOR_SECRET");
@@ -6892,7 +7850,7 @@ app.post(
     if (monitorSecret && typeof authToken === "string") {
       const a = Buffer.from(authToken);
       const b = Buffer.from(monitorSecret);
-      isAuthorized = a.length === b.length && timingSafeEqual5(a, b);
+      isAuthorized = a.length === b.length && timingSafeEqual6(a, b);
     }
     secureLogger.authEvent("monitor-tests-access", isAuthorized, {
       hasToken: !!authToken,
@@ -7041,15 +7999,50 @@ function getRestHeroEndpoint(toolName) {
   }
   return restHeroEndpointsByName.get(toolName);
 }
+var knownRestToolNames = null;
+function isKnownRestToolName(toolName) {
+  if (!knownRestToolNames) {
+    knownRestToolNames = new Set(
+      getAllWrappedEndpoints().map((endpoint) => endpoint.tool.name)
+    );
+  }
+  return knownRestToolNames.has(toolName);
+}
 var anonymousHeroExecuteMiddleware = asyncHandler(
   async (req, res, next) => {
+    const rawBody = req.body;
+    if (rawBody && typeof rawBody === "object" && rawBody.args === void 0 && rawBody.arguments !== void 0) {
+      rawBody.args = rawBody.arguments;
+    }
     if (mcpCredentialPresented(req)) {
       next();
       return;
     }
-    const body = req.body;
+    const body = rawBody;
     const toolName = typeof body?.tool === "string" ? body.tool : void 0;
-    if (!toolName || !HERO_TOOL_NAMES.has(toolName)) {
+    if (!toolName) {
+      res.status(400).json({
+        ok: false,
+        error: {
+          type: "invalid_request",
+          code: "TOOL_REQUIRED",
+          message: `Missing required field "tool". Send {"tool":"<name>","args":{...}}. The keyless lane serves ${[...HERO_TOOL_NAMES].join(", ")}; every other tool needs an API key.`
+        }
+      });
+      return;
+    }
+    if (!HERO_TOOL_NAMES.has(toolName) && !isKnownRestToolName(toolName)) {
+      res.status(404).json({
+        ok: false,
+        error: {
+          type: "invalid_request",
+          code: "TOOL_NOT_FOUND",
+          message: `Unknown tool "${toolName}". Browse the catalog at /api/v1/tools, or call search_tools over MCP.`
+        }
+      });
+      return;
+    }
+    if (!HERO_TOOL_NAMES.has(toolName)) {
       next();
       return;
     }
@@ -7077,12 +8070,13 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
         );
         return;
       }
+      const globalCap = quota.reason === "global_cap";
       res.setHeader("Retry-After", String(quota.resetSeconds));
       res.status(429).json(
         apiError(
           "rate_limit_error",
-          "ANON_QUOTA_EXCEEDED",
-          ANON_QUOTA_EXHAUSTED_MESSAGE,
+          globalCap ? "ANON_GLOBAL_CAP_EXCEEDED" : "ANON_QUOTA_EXCEEDED",
+          globalCap ? ANON_GLOBAL_CAP_MESSAGE : ANON_QUOTA_EXHAUSTED_MESSAGE,
           { requestId: req.requestId }
         )
       );
@@ -7096,6 +8090,7 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
       analytics: {
         principalRaw: `anon:${ipHash}`,
         authLane: "anonymous",
+        clientName: resolveMcpClientName(req, body),
         isInternal: isMonitorSecretRequest(req)
       }
     });
@@ -7168,16 +8163,18 @@ app.post(
           };
         }
       }
-      if (authReq.hiveSubjectContext && isHiveStatefulWriteTool(endpoint.tool.name)) {
-        recordSubjectAuditEvent({
-          userId: authReq.hiveSubjectContext.userId,
-          subjectId: authReq.hiveSubjectContext.subjectId,
-          keyId: authReq.unkeyKeyId,
-          transport: "rest",
-          toolName: endpoint.tool.name,
-          requestId: req.requestId
-        });
-      }
+      const restAuditEvent = buildStatefulWriteAuditEvent({
+        isStatefulWrite: isHiveStatefulWriteTool(endpoint.tool.name),
+        transport: "rest",
+        toolName: endpoint.tool.name,
+        userId: authReq.userId,
+        subjectContext: authReq.hiveSubjectContext,
+        keyId: authReq.unkeyKeyId,
+        // REST is the API-key transport; OAuth tokens are MCP-only.
+        authMethod: "api_key",
+        requestId: req.requestId
+      });
+      if (restAuditEvent) recordSubjectAuditEvent(restAuditEvent);
       return void 0;
     };
     const heroEndpoint = HERO_TOOL_NAMES.has(executionToolName) ? getRestHeroEndpoint(executionToolName) : void 0;
@@ -7229,13 +8226,13 @@ app.post(
     });
   })
 );
-var cliTelemetrySchema = z6.object({
-  command: z6.string().trim().min(1).max(80).regex(/^[a-zA-Z0-9:_-]+$/),
-  durationMs: z6.number().int().min(0).max(6e5),
-  errorCode: z6.string().trim().min(1).max(80).regex(/^[a-zA-Z0-9:_-]+$/).optional(),
-  cliVersion: z6.string().trim().min(1).max(40),
-  os: z6.string().trim().min(1).max(120),
-  nodeVersion: z6.string().trim().min(1).max(40)
+var cliTelemetrySchema = z5.object({
+  command: z5.string().trim().min(1).max(80).regex(/^[a-zA-Z0-9:_-]+$/),
+  durationMs: z5.number().int().min(0).max(6e5),
+  errorCode: z5.string().trim().min(1).max(80).regex(/^[a-zA-Z0-9:_-]+$/).optional(),
+  cliVersion: z5.string().trim().min(1).max(40),
+  os: z5.string().trim().min(1).max(120),
+  nodeVersion: z5.string().trim().min(1).max(40)
 }).strict();
 app.post("/api/v1/telemetry", (req, res) => {
   const parsed = cliTelemetrySchema.safeParse(req.body);
@@ -7324,6 +8321,10 @@ async function setupServer() {
       `OAuth configuration is incomplete: ${mcpOAuth.config.issues.join(" ")}`
     );
   }
+  const redisReady = await waitForRedisAvailability(3e3);
+  secureLogger.info("[startup] Redis readiness settled", {
+    ready: redisReady
+  });
   secureLogger.info("Setting up Hive MCP server...", {
     server: SERVER_NAME,
     version: SERVER_VERSION,
@@ -7420,21 +8421,41 @@ async function startHttpServer() {
   });
   httpServer.keepAliveTimeout = 65e3;
   httpServer.headersTimeout = 7e4;
+  const ANALYTICS_FLUSH_TIMEOUT_MS = 2e3;
+  const flushAnalytics = async () => {
+    const writer = getAnalyticsWriter();
+    await Promise.race([
+      writer.flush(),
+      new Promise((resolve2) => {
+        setTimeout(resolve2, ANALYTICS_FLUSH_TIMEOUT_MS).unref();
+      })
+    ]);
+    const stats = writer.getStats();
+    secureLogger.info("Analytics queue flushed on shutdown", {
+      stillQueued: stats.queued,
+      droppedTotal: stats.dropped
+    });
+  };
+  const exitAfterAnalyticsFlush = (code) => {
+    getAnalyticsWriter().stop();
+    void flushAnalytics().finally(() => process.exit(code));
+  };
   const shutdown = (signal) => {
     if (isShuttingDown) return;
     isShuttingDown = true;
     secureLogger.info(
       `${signal} received \u2014 draining ${activeRequests} active requests`
     );
+    void flushAnalytics();
     httpServer.close(() => {
       secureLogger.info("HTTP server closed", { activeRequests });
-      process.exit(0);
+      exitAfterAnalyticsFlush(0);
     });
     const drainInterval = setInterval(() => {
       if (activeRequests <= 0) {
         clearInterval(drainInterval);
         secureLogger.info("All requests drained, closing");
-        httpServer.close(() => process.exit(0));
+        httpServer.close(() => exitAfterAnalyticsFlush(0));
       }
     }, 500);
     drainInterval.unref();
@@ -7443,7 +8464,7 @@ async function startHttpServer() {
       secureLogger.warn("Force shutdown after 10s timeout", {
         activeRequests
       });
-      process.exit(1);
+      exitAfterAnalyticsFlush(1);
     }, 1e4);
     forceTimer.unref();
   };
@@ -7466,9 +8487,11 @@ if (isMainModule()) {
 }
 var server_default = app;
 export {
+  buildMcpQuotaExhaustedCopy,
   classifyAnonymousMcpRequest,
   createHttpApp,
   server_default as default,
   getRequiredMcpScopes,
+  resolveMcpClientName,
   startHttpServer
 };