hive-intelligence 1.7.3 → 1.9.0

package/build/{chunk-QKVI3YHQ.js → chunk-WQE3B64R.js}

@@ -7,7 +7,7 @@ import {
   getSupabaseAdmin,
   resolveEndpoint,
   secureLogger
-} from "./chunk-WDF56OFL.js";
+} from "./chunk-MVO6LL3H.js";
 
 // src/services/wallet-service.ts
 async function consumeCredits(args) {
@@ -34,6 +34,29 @@ async function consumeCredits(args) {
     cycleEnd: row.cycle_end ?? null
   };
 }
+async function refundCredits(args) {
+  const { userId, debitIdempotencyKey, detail } = args;
+  const { data, error } = await getSupabaseAdmin().rpc("refund_credits", {
+    p_user_id: userId,
+    p_debit_idempotency_key: debitIdempotencyKey,
+    p_detail: detail ?? {}
+  });
+  if (error) {
+    secureLogger.error("refund_credits RPC failed", error, { userId });
+    throw new Error(`refund_credits failed: ${error.message}`);
+  }
+  const row = Array.isArray(data) ? data[0] : data;
+  if (!row) {
+    throw new Error("refund_credits returned no row");
+  }
+  return {
+    code: row.code,
+    balance: row.balance ?? null
+  };
+}
+function refundSettled(code) {
+  return code === "ok" || code === "unlimited" || code === "already_refunded";
+}
 async function ensureWallet(userId, planId) {
   const { error } = await getSupabaseAdmin().rpc("ensure_wallet", {
     p_user_id: userId,
@@ -175,6 +198,8 @@ async function executeToolByName(toolName, args, options) {
 
 export {
   consumeCredits,
+  refundCredits,
+  refundSettled,
   ensureWallet,
   getWalletStatus,
   applyPlanChange,

package/build/cli.js

@@ -3453,7 +3453,7 @@ program2.hook("preAction", (thisCommand) => {
   setCliFlags({ apiKey: opts.apiKey, noRetry: opts.retry === false });
 });
 program2.action(async () => {
-  const { startStdio } = await import("./serve-MGOPELHF.js");
+  const { startStdio } = await import("./serve-BCKB6DMI.js");
   await startStdio(program2.opts().envFile);
 });
 program2.command("serve").description("Start the MCP server").option("--http", "Start HTTP server instead of stdio").option("--port <number>", "HTTP server port", "8080").action(async (opts) => {
@@ -3466,10 +3466,10 @@ program2.command("serve").description("Start the MCP server").option("--http", "
       );
       process.exit(ExitCode.INVALID_ARGS);
     }
-    const { startHttp } = await import("./serve-MGOPELHF.js");
+    const { startHttp } = await import("./serve-BCKB6DMI.js");
     await startHttp(port, program2.opts().envFile);
   } else {
-    const { startStdio } = await import("./serve-MGOPELHF.js");
+    const { startStdio } = await import("./serve-BCKB6DMI.js");
     await startStdio(program2.opts().envFile);
   }
 });
@@ -3734,7 +3734,7 @@ program2.command("feedback <message>").description(
   await runFeedback(message, { tool: opts.tool, receipt: opts.receipt });
 });
 program2.command("doctor").description("Diagnose environment and server connectivity").option("--probe", "Run live API probes (slower)").action(async (opts) => {
-  const { runDoctor } = await import("./doctor-KCSYB4QG.js");
+  const { runDoctor } = await import("./doctor-O2OQX6EX.js");
   await runDoctor(opts);
 });
 program2.command("upgrade").description("Update Hive to the latest published version").action(async () => {
@@ -3782,7 +3782,7 @@ program2.command("usage").description("Show your API usage and plan limits").act
   await runUsage();
 });
 program2.command("status").description("Quick health and version check").action(async () => {
-  const { runStatus } = await import("./doctor-KCSYB4QG.js");
+  const { runStatus } = await import("./doctor-O2OQX6EX.js");
   await runStatus();
 });
 program2.command("open [target]").description("Open Hive dashboard, docs, status, or GitHub in browser").action(async (target) => {

package/build/{doctor-KCSYB4QG.js → doctor-O2OQX6EX.js}

@@ -240,7 +240,7 @@ ${fails === 0 ? "All checks passed" : `${fails} issues found`}${warns ? ` (${war
   if (fails > 0) process.exit(1);
 }
 async function runStatus() {
-  const { SERVER_VERSION } = await import("./mcpServer-2OCMJW2T.js");
+  const { SERVER_VERSION } = await import("./mcpServer-FXQPSDDC.js");
   const { resolveApiKey, resolveApiUrl } = await import("./config-dir-2QLA5PXD.js");
   const { getActiveProfile, maskKey } = await import("./auth-6XVL5CE3.js");
   const apiUrl = resolveApiUrl();

package/build/{mcpServer-2OCMJW2T.js → mcpServer-FXQPSDDC.js}

@@ -9,7 +9,7 @@ import {
   getToolsForScope,
   memoizedJsonSchemaToZodInputSchema,
   memoizedJsonSchemaToZodOutputSchema
-} from "./chunk-WDF56OFL.js";
+} from "./chunk-MVO6LL3H.js";
 import "./chunk-4QDGA6GP.js";
 import "./chunk-EPF36Q3Z.js";
 import {

package/build/monitor-worker.js

@@ -1,8 +1,10 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
 import {
   consumeCredits,
-  executeToolByName
-} from "./chunk-QKVI3YHQ.js";
+  executeToolByName,
+  refundCredits,
+  refundSettled
+} from "./chunk-WQE3B64R.js";
 import {
   HyperliquidAPI,
   MIN_MONITOR_CADENCE_MS,
@@ -15,7 +17,7 @@ import {
   monitorCadenceIntervalMs,
   runScheduledHealthCanaries,
   secureLogger
-} from "./chunk-WDF56OFL.js";
+} from "./chunk-MVO6LL3H.js";
 import "./chunk-4QDGA6GP.js";
 import "./chunk-EPF36Q3Z.js";
 import "./chunk-ZXKFJQDE.js";
@@ -640,6 +642,29 @@ async function defaultConsumeCredit(args) {
     requestId: args.runId
   });
 }
+async function defaultRefundCredit(args) {
+  const refund = await refundCredits({
+    userId: args.userId,
+    debitIdempotencyKey: `monitor-run:${args.runId}`,
+    detail: { monitor_run: args.runId, reason: args.reason }
+  });
+  return refundSettled(refund.code);
+}
+async function refundMonitorRunCredit(args) {
+  try {
+    return await args.refundCredit({
+      userId: args.monitor.user_id,
+      runId: args.runId,
+      reason: args.reason
+    });
+  } catch (error) {
+    secureLogger.error("Monitor run credit refund failed", error, {
+      monitorId: args.monitor.id,
+      runId: args.runId
+    });
+    return false;
+  }
+}
 async function debitMonitorRunCredit(args) {
   try {
     const debit = await args.consumeCredit({
@@ -976,6 +1001,7 @@ async function processMonitor(monitor, options) {
   });
   const completedAt = options.now.toISOString();
   const nextRunAt = computeNextRunAt(monitor.cadence, options.now);
+  let charged = false;
   try {
     const debit = await debitMonitorRunCredit({
       monitor,
@@ -1007,6 +1033,7 @@ async function processMonitor(monitor, options) {
         alerts: 0
       };
     }
+    charged = true;
     const previous = await options.store.getLatestSnapshot(monitor.id);
     const workflow = await executeMonitorWorkflow(
       monitor,
@@ -1101,6 +1128,13 @@ async function processMonitor(monitor, options) {
       });
       observations++;
     }
+    const everyCallFailed = workflow.toolCalls.length > 0 && workflow.failedCalls.length === workflow.toolCalls.length;
+    const creditRefunded = everyCallFailed ? await refundMonitorRunCredit({
+      monitor,
+      runId: run.id,
+      reason: "every tool call failed",
+      refundCredit: options.refundCredit
+    }) : false;
     await options.store.finishRun({
       runId: run.id,
       status: "completed",
@@ -1109,7 +1143,8 @@ async function processMonitor(monitor, options) {
       metadata: {
         fingerprint: workflow.fingerprint,
         failed_call_count: workflow.failedCalls.length,
-        rule_evaluation_count: ruleEvaluations.length
+        rule_evaluation_count: ruleEvaluations.length,
+        ...creditRefunded && { credit_refunded: true }
       }
     });
     await options.store.releaseMonitor({
@@ -1129,6 +1164,14 @@ async function processMonitor(monitor, options) {
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
+    if (charged) {
+      await refundMonitorRunCredit({
+        monitor,
+        runId: run.id,
+        reason: "run failed",
+        refundCredit: options.refundCredit
+      });
+    }
     await options.store.finishRun({
       runId: run.id,
       status: "failed",
@@ -1165,6 +1208,7 @@ async function runDueMonitors(options = {}) {
   const now = options.now ?? /* @__PURE__ */ new Date();
   const executeTool = options.executeTool ?? executeToolByName;
   const consumeCredit = options.consumeCredit ?? defaultConsumeCredit;
+  const refundCredit = options.refundCredit ?? defaultRefundCredit;
   const source = options.source ?? "scheduled";
   const claimed = await store.claimDueMonitors({
     batchSize,
@@ -1191,7 +1235,8 @@ async function runDueMonitors(options = {}) {
         now,
         source,
         executeTool,
-        consumeCredit
+        consumeCredit,
+        refundCredit
       })
     );
   }

package/build/release.json

@@ -1,8 +1,8 @@
 {
   "package": "hive-intelligence",
-  "version": "1.7.3",
-  "buildSha": "540c6eaec6539e8a8b09b3f0d9bff4efa592f4d5",
-  "imageDigest": "sha256:de6599072579cc25854052f2cb99393129d9363c36f6abf1454a39efdcee0bb0",
+  "version": "1.9.0",
+  "buildSha": "b157f6642120d33dd3c241c366731f0174a56902",
+  "imageDigest": "sha256:103576df07830e955af1f472dc39b365862c8b5a6965d2a944be363ea4e8b976",
   "deployedUrl": "https://mcp.hiveintelligence.xyz",
-  "manifest": "https://raw.githubusercontent.com/hive-intel/hive-sdk/v1.7.3/releases/v1.7.3.json"
+  "manifest": "https://raw.githubusercontent.com/hive-intel/hive-sdk/v1.9.0/releases/v1.9.0.json"
 }

package/build/{serve-MGOPELHF.js → serve-BCKB6DMI.js}

@@ -7,7 +7,7 @@ async function startStdio(envFile) {
   dotenv.config({ path: envFile || ".env", quiet: true });
   console.log = (...args) => console.error("[LOG]", ...args);
   const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const { createHiveMcpServer, SERVER_NAME, SERVER_VERSION } = await import("./mcpServer-2OCMJW2T.js");
+  const { createHiveMcpServer, SERVER_NAME, SERVER_VERSION } = await import("./mcpServer-FXQPSDDC.js");
   const { getPendingUpdateVersion } = await import("./update-check-36QU6PKA.js");
   const transport = new StdioServerTransport();
   const pendingUpdate = getPendingUpdateVersion();

package/build/server.js

@@ -5,8 +5,10 @@ import {
   consumeCredits,
   ensureWallet,
   executeToolByName,
-  getWalletStatus
-} from "./chunk-QKVI3YHQ.js";
+  getWalletStatus,
+  refundCredits,
+  refundSettled
+} from "./chunk-WQE3B64R.js";
 import {
   CategoryEndpoints,
   HERO_TOOL_NAMES,
@@ -102,7 +104,7 @@ import {
   validateEndpointArgs,
   verifyApiKey,
   waitForRedisAvailability
-} from "./chunk-WDF56OFL.js";
+} from "./chunk-MVO6LL3H.js";
 import {
   HIVE_AGENT_SKILLS
 } from "./chunk-4QDGA6GP.js";
@@ -2598,10 +2600,11 @@ async function debitApiKeyCreditForExecution(req, res) {
   const result = authReq.unkeyResult;
   if (!result || !authReq.userId) return;
   try {
+    const idempotencyKey = authReq.creditDebitIdempotencyKey ?? randomUUID();
     const consumeResult = await consumeCredits({
       userId: authReq.userId,
       cost: REQUEST_COST,
-      idempotencyKey: authReq.creditDebitIdempotencyKey ?? randomUUID(),
+      idempotencyKey,
       requestId: req.requestId,
       keyId: authReq.unkeyKeyId
     });
@@ -2627,6 +2630,7 @@ async function debitApiKeyCreditForExecution(req, res) {
       };
     }
     authReq.quotaRemaining = consumeResult.balance ?? void 0;
+    authReq.creditDebitedKey = idempotencyKey;
     authReq.idempotencyExecutionStarted = true;
     res.setHeader(
       "X-Quota-Remaining",
@@ -5556,6 +5560,23 @@ async function consumeAnonMaterialQuota(ipHash, overrides = {}) {
     return { allowed: false, reason: "unavailable" };
   }
 }
+async function refundAnonMaterialQuota(ipHash) {
+  try {
+    if (!isSupabaseConfigured()) return void 0;
+    const { data, error } = await getSupabaseAdmin().rpc(
+      "refund_anon_daily_quota",
+      { p_ip_hash: ipHash, p_ip_limit: getAnonDailyMaterialCap() }
+    );
+    if (error) throw new Error(error.message);
+    const row = Array.isArray(data) ? data[0] : data;
+    return typeof row?.remaining === "number" ? row.remaining : void 0;
+  } catch (err) {
+    secureLogger.warn("Anonymous quota refund failed", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return void 0;
+  }
+}
 
 // src/serverCard.ts
 function buildServerCard() {
@@ -6925,10 +6946,11 @@ function buildMcpQuotaExhaustedCopy(args) {
 }
 async function debitMcpCredits(args) {
   try {
+    const idempotencyKey = randomUUID4();
     const debit = await consumeCredits({
       userId: args.userId,
       cost: 1,
-      idempotencyKey: randomUUID4(),
+      idempotencyKey,
       requestId: args.requestId,
       keyId: args.keyId
     });
@@ -6952,7 +6974,7 @@ async function debitMcpCredits(args) {
         rateLimited: true
       };
     }
-    return { ok: true, balance: debit.balance };
+    return { ok: true, balance: debit.balance, idempotencyKey };
   } catch (err) {
     secureLogger.warn("MCP consume_credits debit failed", {
       error: err instanceof Error ? err.message : String(err)
@@ -6963,6 +6985,32 @@ async function debitMcpCredits(args) {
     };
   }
 }
+async function refundKeyedCredit(res, args) {
+  const refund = await refundCredits({
+    userId: args.userId,
+    debitIdempotencyKey: args.debitIdempotencyKey,
+    detail: {
+      tool: args.toolName,
+      runtime_status: args.runtimeStatus,
+      transport: args.transport
+    }
+  });
+  if (!refundSettled(refund.code)) return { refunded: false };
+  if (!res.headersSent) {
+    res.setHeader(
+      "X-Quota-Remaining",
+      refund.balance === null ? "unlimited" : String(refund.balance)
+    );
+  }
+  return { refunded: true, creditsRemaining: refund.balance };
+}
+async function refundAnonCall(res, ipHash) {
+  const remaining = await refundAnonMaterialQuota(ipHash);
+  if (remaining !== void 0 && !res.headersSent) {
+    res.setHeader("X-Quota-Remaining", String(remaining));
+  }
+  return remaining;
+}
 function extractApiKey(req) {
   return req.headers["x-api-key"] ?? (req.headers.authorization?.startsWith("Bearer ") ? req.headers.authorization.slice(7) : void 0);
 }
@@ -7412,10 +7460,10 @@ function createStatelessMcpHandler(scope) {
     if (!auth.ok && !mcpCredentialPresented(req)) {
       const decision = await authorizeAnonymousMcpRequest(req);
       if (decision.kind === "allow") {
+        const ipHash = anonymousIpHash(ipRateLimitKeyFromRequest(req));
         anonymousLane = {
-          principalRaw: `anon:${anonymousIpHash(
-            ipRateLimitKeyFromRequest(req)
-          )}`,
+          principalRaw: `anon:${ipHash}`,
+          ipHash,
           materialGranted: decision.materialGranted,
           quotaRemaining: decision.quotaRemaining
         };
@@ -7641,6 +7689,8 @@ function createStatelessMcpHandler(scope) {
         clientName: resolveMcpClientName(req, body),
         isInternal: isMonitorSecretRequest(req)
       };
+      let anonCallHeld = anonymousLane?.materialGranted === true;
+      let anonCallBilled = false;
       const server = createHiveMcpServer(scope, {
         requestId: req.requestId,
         analytics,
@@ -7698,6 +7748,7 @@ function createStatelessMcpHandler(scope) {
         beforeToolExecution: keyedAuth?.userId ? async (executedToolName) => {
           const creditCost = getMcpCreditCost(executedToolName);
           let keyedBalance;
+          let debitKey;
           res.setHeader("X-Hive-Credit-Cost", String(creditCost));
           if (creditCost > 0) {
             const debit = await debitMcpCredits({
@@ -7741,10 +7792,22 @@ function createStatelessMcpHandler(scope) {
               debit.balance === null ? "unlimited" : String(debit.balance)
             );
             keyedBalance = debit.balance;
+            debitKey = debit.idempotencyKey;
           }
+          const refund = debitKey ? (reason) => refundKeyedCredit(res, {
+            userId: keyedAuth.userId,
+            debitIdempotencyKey: debitKey,
+            toolName: reason.toolName,
+            runtimeStatus: reason.runtimeStatus,
+            transport: "mcp"
+          }) : void 0;
           if (subjectContext) {
             const materialized = await materializeSubjectContext(subjectContext);
             if (!materialized.ok) {
+              await refund?.({
+                toolName: executedToolName,
+                runtimeStatus: "failing"
+              }).catch(() => void 0);
               return {
                 type: materialized.status === 403 ? "authentication_error" : "internal_error",
                 code: materialized.code,
@@ -7768,7 +7831,8 @@ function createStatelessMcpHandler(scope) {
           return {
             type: "billing",
             credits_used: creditCost,
-            ...creditCost > 0 && { credits_remaining: keyedBalance }
+            ...creditCost > 0 && { credits_remaining: keyedBalance },
+            ...refund && { refund }
           };
         } : anonymousLane ? async (executedToolName) => {
           const creditCost = getMcpCreditCost(executedToolName);
@@ -7790,10 +7854,36 @@ function createStatelessMcpHandler(scope) {
               runtimeStatus: "failing"
             };
           }
+          if (!anonCallHeld) {
+            const quota = await consumeAnonMaterialQuota(
+              anonymousLane.ipHash
+            );
+            if (!quota.allowed) {
+              return {
+                type: "rate_limit_error",
+                code: "ANON_QUOTA_EXCEEDED",
+                message: ANON_QUOTA_EXHAUSTED_MESSAGE,
+                runtimeStatus: "rate_limited"
+              };
+            }
+            anonCallHeld = true;
+            anonymousLane.quotaRemaining = quota.remaining;
+          }
+          anonCallBilled = true;
           return {
             type: "billing",
             credits_used: creditCost,
-            credits_remaining: anonymousLane.quotaRemaining ?? null
+            credits_remaining: anonymousLane.quotaRemaining ?? null,
+            refund: async () => {
+              const remaining = await refundAnonCall(
+                res,
+                anonymousLane.ipHash
+              );
+              if (remaining === void 0) return { refunded: false };
+              anonCallHeld = false;
+              anonymousLane.quotaRemaining = remaining;
+              return { refunded: true, creditsRemaining: remaining };
+            }
           };
         } : void 0
       }).getServer();
@@ -7820,6 +7910,10 @@ function createStatelessMcpHandler(scope) {
           () => transport.handleRequest(req, res, body)
         )
       );
+      if (anonymousLane && anonCallHeld && !anonCallBilled) {
+        anonCallHeld = false;
+        await refundAnonCall(res, anonymousLane.ipHash);
+      }
       secureLogger.debug("MCP request completed", {
         sessionId: sessionCorrelationId,
         scope: scope.kind === "root" ? "root" : `category:${scope.category}`
@@ -8341,6 +8435,7 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
       return;
     }
     res.setHeader("X-Quota-Remaining", String(quota.remaining));
+    let refundAttempted = false;
     const result = await executeEndpoint(heroEndpoint, body?.args ?? {}, {
       transport: "rest",
       requestId: req.requestId,
@@ -8349,7 +8444,12 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
       beforeExecution: async () => ({
         type: "billing",
         credits_used: getMcpCreditCost(toolName),
-        credits_remaining: quota.remaining
+        credits_remaining: quota.remaining,
+        refund: async () => {
+          refundAttempted = true;
+          const remaining = await refundAnonCall(res, ipHash);
+          return remaining === void 0 ? { refunded: false } : { refunded: true, creditsRemaining: remaining };
+        }
       }),
       analytics: {
         principalRaw: `anon:${ipHash}`,
@@ -8358,6 +8458,9 @@ var anonymousHeroExecuteMiddleware = asyncHandler(
         isInternal: isMonitorSecretRequest(req)
       }
     });
+    if (!result.ok && !refundAttempted) {
+      await refundAnonCall(res, ipHash);
+    }
     const meta = buildRestExecutionMeta(
       toolName,
       result.durationMs,
@@ -8413,6 +8516,14 @@ app.post(
     const endpointArgs = authReq.resolvedRestToolArgs ?? { ...args ?? {} };
     const keyedBeforeExecution = async (endpoint) => {
       const blocked = await debitApiKeyCreditForExecution(req, res);
+      const debitKey = authReq.creditDebitedKey;
+      const refund = debitKey && authReq.userId ? (reason) => refundKeyedCredit(res, {
+        userId: authReq.userId,
+        debitIdempotencyKey: debitKey,
+        toolName: reason.toolName,
+        runtimeStatus: reason.runtimeStatus,
+        transport: "rest"
+      }) : void 0;
       if (blocked) {
         if (blocked.code === "QUOTA_EXCEEDED") {
           recordPaywall(req, {
@@ -8431,6 +8542,10 @@ app.post(
           authReq.hiveSubjectContext
         );
         if (!materialized.ok) {
+          await refund?.({
+            toolName: endpoint.tool.name,
+            runtimeStatus: "failing"
+          }).catch(() => void 0);
           return {
             type: materialized.status === 403 ? "authentication_error" : "internal_error",
             code: materialized.code,
@@ -8458,7 +8573,8 @@ app.post(
         credits_used: creditCost,
         ...creditCost > 0 && remainingHeader !== void 0 && {
           credits_remaining: String(remainingHeader) === "unlimited" ? null : Number(remainingHeader)
-        }
+        },
+        ...refund && { refund }
       };
     };
     const heroEndpoint = HERO_TOOL_NAMES.has(executionToolName) ? getRestHeroEndpoint(executionToolName) : void 0;

package/build/stdio.js

@@ -6,7 +6,7 @@ import {
 import {
   createHiveMcpServer,
   secureLogger
-} from "./chunk-WDF56OFL.js";
+} from "./chunk-MVO6LL3H.js";
 import "./chunk-4QDGA6GP.js";
 import "./chunk-EPF36Q3Z.js";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hive-intelligence",
-  "version": "1.7.3",
+  "version": "1.9.0",
   "description": "Evidence-backed crypto due diligence for AI agents, with sources, freshness, and a runtime receipt on every call.",
   "mcpName": "xyz.hiveintelligence/mcp",
   "type": "module",