mcp-scraper 0.2.13 → 0.2.15

package/dist/bin/api-server.cjs

@@ -7099,6 +7099,20 @@ async function migrate() {
     await db.execute(`ALTER TABLE users ADD COLUMN concurrency_stripe_sub_id TEXT`);
   } catch {
   }
+  await db.execute(`
+    CREATE TABLE IF NOT EXISTS concurrency_locks (
+      id          TEXT PRIMARY KEY,
+      user_id     INTEGER NOT NULL REFERENCES users(id),
+      operation   TEXT NOT NULL,
+      status      TEXT NOT NULL DEFAULT 'active',
+      acquired_at TEXT NOT NULL DEFAULT (datetime('now')),
+      expires_at  TEXT NOT NULL,
+      released_at TEXT,
+      metadata    TEXT
+    )
+  `);
+  await db.execute(`CREATE INDEX IF NOT EXISTS concurrency_locks_user_status ON concurrency_locks(user_id, status, expires_at)`);
+  await db.execute(`CREATE INDEX IF NOT EXISTS concurrency_locks_operation ON concurrency_locks(operation, status, expires_at)`);
   await db.execute(`
     CREATE TABLE IF NOT EXISTS ledger (
       id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -8672,6 +8686,19 @@ var init_site_audit_routes = __esm({
 function browserActiveCostMc(activeMs) {
   return Math.round(activeMs * MC_PER_BROWSER_MS);
 }
+function concurrencySlotBillingInfo() {
+  const billingUrl = process.env.CONCURRENCY_BILLING_URL ?? "https://mcpscraper.dev/billing";
+  return {
+    product: "Extra concurrency slot",
+    price_label: CONCURRENCY_SLOT_PRICE_LABEL,
+    unit_amount_usd: CONCURRENCY_SLOT_PRICE_USD,
+    currency: CONCURRENCY_SLOT_PRICE_CURRENCY,
+    interval: CONCURRENCY_SLOT_PRICE_INTERVAL,
+    billing_url: billingUrl,
+    terminal_command: CONCURRENCY_SLOT_TERMINAL_COMMAND,
+    terminal_command_with_api_key_env: `MCP_SCRAPER_API_KEY=sk_live_your_key ${CONCURRENCY_SLOT_TERMINAL_COMMAND}`
+  };
+}
 function mcToCredits(mc) {
   return mc / MC_PER_CREDIT;
 }
@@ -8688,7 +8715,7 @@ function insufficientBalanceResponse(balanceMc, requiredMc) {
     topup_url: topupUrl
   };
 }
-var MC_COSTS, MC_PER_BROWSER_MS, BROWSER_OPEN_MIN_BALANCE_MC, MC_PER_CREDIT, CREDIT_COST_CATALOG, CONCURRENCY_PRICE_ID, FREE_SIGNUP_MC, FREE_MONTHLY_REFRESH_MC, BALANCE_PRICE_IDS, BALANCE_PACK_LABELS, LedgerOperation;
+var MC_COSTS, MC_PER_BROWSER_MS, BROWSER_OPEN_MIN_BALANCE_MC, MC_PER_CREDIT, CREDIT_COST_CATALOG, CONCURRENCY_PRICE_ID, CONCURRENCY_SLOT_PRICE_USD, CONCURRENCY_SLOT_PRICE_CURRENCY, CONCURRENCY_SLOT_PRICE_INTERVAL, CONCURRENCY_SLOT_PRICE_LABEL, CONCURRENCY_SLOT_TERMINAL_COMMAND, FREE_SIGNUP_MC, FREE_MONTHLY_REFRESH_MC, BALANCE_PRICE_IDS, BALANCE_PACK_LABELS, LedgerOperation;
 var init_rates = __esm({
   "src/api/rates.ts"() {
     "use strict";
@@ -8815,6 +8842,11 @@ var init_rates = __esm({
       }
     ];
     CONCURRENCY_PRICE_ID = "price_1Ta1NRS8aAcsk3TGwsRnYbix";
+    CONCURRENCY_SLOT_PRICE_USD = 5;
+    CONCURRENCY_SLOT_PRICE_CURRENCY = "usd";
+    CONCURRENCY_SLOT_PRICE_INTERVAL = "month";
+    CONCURRENCY_SLOT_PRICE_LABEL = "$5/month";
+    CONCURRENCY_SLOT_TERMINAL_COMMAND = "npx -y -p mcp-scraper@latest mcp-scraper-cli billing concurrency checkout";
     FREE_SIGNUP_MC = 5e5;
     FREE_MONTHLY_REFRESH_MC = 25e4;
     BALANCE_PRICE_IDS = {
@@ -10383,6 +10415,187 @@ var init_server_schemas = __esm({
   }
 });
 
+// src/api/concurrency-gates.ts
+function concurrencyLimitForUser(user) {
+  return 1 + Math.max(0, Number(user.extra_concurrency_slots ?? 0));
+}
+function concurrencyLimitExceededResponse(gate) {
+  const upgrade = concurrencySlotBillingInfo();
+  const message = `You have ${gate.active} active operation${gate.active !== 1 ? "s" : ""}. Your account allows ${gate.limit} concurrent operation${gate.limit !== 1 ? "s" : ""}. Wait for one to finish, or add an extra concurrency slot for ${upgrade.price_label} at ${upgrade.billing_url}. Terminal upgrade: ${upgrade.terminal_command}`;
+  return {
+    error: message,
+    message,
+    error_code: "concurrency_limit_exceeded",
+    error_type: "concurrency_limit",
+    retryable: true,
+    active: gate.active,
+    limit: gate.limit,
+    operation: gate.operation,
+    upgrade,
+    upgrade_url: upgrade.billing_url,
+    upgrade_command: upgrade.terminal_command
+  };
+}
+function isConcurrencyLimitBypassed(user) {
+  const raw = process.env.CONCURRENCY_LIMIT_BYPASS_EMAILS ?? process.env.HARVEST_LIMIT_BYPASS_EMAILS ?? "";
+  return raw.split(",").map((email) => email.trim()).filter(Boolean).includes(user.email);
+}
+function lockTtlModifier(ttlSeconds) {
+  const ttl = Number.isFinite(ttlSeconds) ? Math.max(30, Math.min(Math.trunc(Number(ttlSeconds)), MAX_LOCK_TTL_SECONDS)) : DEFAULT_LOCK_TTL_SECONDS;
+  return `+${ttl} seconds`;
+}
+function safeMetadata(metadata) {
+  if (!metadata) return null;
+  try {
+    return JSON.stringify(metadata).slice(0, 4e3);
+  } catch {
+    return null;
+  }
+}
+async function ensureConcurrencyGateSchema() {
+  if (!schemaReady) {
+    schemaReady = (async () => {
+      const db = getDb();
+      await db.execute(`
+        CREATE TABLE IF NOT EXISTS concurrency_locks (
+          id          TEXT PRIMARY KEY,
+          user_id     INTEGER NOT NULL REFERENCES users(id),
+          operation   TEXT NOT NULL,
+          status      TEXT NOT NULL DEFAULT 'active',
+          acquired_at TEXT NOT NULL DEFAULT (datetime('now')),
+          expires_at  TEXT NOT NULL,
+          released_at TEXT,
+          metadata    TEXT
+        )
+      `);
+      await db.execute(`CREATE INDEX IF NOT EXISTS concurrency_locks_user_status ON concurrency_locks(user_id, status, expires_at)`);
+      await db.execute(`CREATE INDEX IF NOT EXISTS concurrency_locks_operation ON concurrency_locks(operation, status, expires_at)`);
+    })();
+  }
+  return schemaReady;
+}
+async function expireConcurrencyLocksForUser(userId) {
+  await ensureConcurrencyGateSchema();
+  await getDb().execute({
+    sql: `UPDATE concurrency_locks
+          SET status = 'expired', released_at = datetime('now')
+          WHERE user_id = ? AND status = 'active' AND expires_at <= datetime('now')`,
+    args: [userId]
+  });
+}
+async function countActiveUsageForUser(userId) {
+  await ensureConcurrencyGateSchema();
+  await expireConcurrencyLocksForUser(userId);
+  const res = await getDb().execute({
+    sql: `SELECT
+            (
+              SELECT COUNT(*)
+              FROM jobs
+              WHERE user_id = ?
+                AND (status = 'pending' OR (status = 'running' AND started_at > datetime('now', '-10 minutes')))
+            ) +
+            (
+              SELECT COUNT(*)
+              FROM concurrency_locks
+              WHERE user_id = ? AND status = 'active' AND expires_at > datetime('now')
+            ) AS n`,
+    args: [userId, userId]
+  });
+  return Number(res.rows[0]?.n ?? 0);
+}
+async function reuseExistingConcurrencyGate(userId, lockId, ttlSeconds) {
+  if (!/^cl_[a-f0-9]{24,32}$/.test(lockId)) return false;
+  await ensureConcurrencyGateSchema();
+  await expireConcurrencyLocksForUser(userId);
+  const res = await getDb().execute({
+    sql: `UPDATE concurrency_locks
+          SET expires_at = datetime('now', ?)
+          WHERE id = ?
+            AND user_id = ?
+            AND status = 'active'
+            AND expires_at > datetime('now')`,
+    args: [lockTtlModifier(ttlSeconds), lockId, userId]
+  });
+  return Number(res.rowsAffected ?? 0) > 0;
+}
+async function acquireConcurrencyGate(user, operation, options = {}) {
+  await ensureConcurrencyGateSchema();
+  const limit = concurrencyLimitForUser(user);
+  if (isConcurrencyLimitBypassed(user)) {
+    return { ok: true, lockId: null, active: 0, limit, operation, bypassed: true };
+  }
+  if (options.reuseLockId && await reuseExistingConcurrencyGate(user.id, options.reuseLockId, options.ttlSeconds)) {
+    return { ok: true, lockId: null, active: await countActiveUsageForUser(user.id), limit, operation, reused: true };
+  }
+  await expireConcurrencyLocksForUser(user.id);
+  const lockId = `cl_${(0, import_node_crypto2.randomUUID)().replace(/-/g, "").slice(0, 24)}`;
+  const res = await getDb().execute({
+    sql: `INSERT INTO concurrency_locks (id, user_id, operation, status, expires_at, metadata)
+          SELECT ?, ?, ?, 'active', datetime('now', ?), ?
+          WHERE (
+            (
+              SELECT COUNT(*)
+              FROM jobs
+              WHERE user_id = ?
+                AND (status = 'pending' OR (status = 'running' AND started_at > datetime('now', '-10 minutes')))
+            ) +
+            (
+              SELECT COUNT(*)
+              FROM concurrency_locks
+              WHERE user_id = ? AND status = 'active' AND expires_at > datetime('now')
+            )
+          ) < ?`,
+    args: [
+      lockId,
+      user.id,
+      operation,
+      lockTtlModifier(options.ttlSeconds),
+      safeMetadata(options.metadata),
+      user.id,
+      user.id,
+      limit
+    ]
+  });
+  const active = await countActiveUsageForUser(user.id);
+  if (Number(res.rowsAffected ?? 0) > 0) {
+    return { ok: true, lockId, active, limit, operation };
+  }
+  return { ok: false, active, limit, operation, retryAfterSeconds: DEFAULT_RETRY_AFTER_SECONDS };
+}
+async function releaseConcurrencyGate(lockId) {
+  if (!lockId) return;
+  await ensureConcurrencyGateSchema();
+  await getDb().execute({
+    sql: `UPDATE concurrency_locks
+          SET status = 'released', released_at = datetime('now')
+          WHERE id = ? AND status = 'active'`,
+    args: [lockId]
+  });
+}
+async function extendConcurrencyGate(lockId, ttlSeconds = DEFAULT_LOCK_TTL_SECONDS) {
+  if (!lockId) return;
+  await ensureConcurrencyGateSchema();
+  await getDb().execute({
+    sql: `UPDATE concurrency_locks
+          SET expires_at = datetime('now', ?)
+          WHERE id = ? AND status = 'active' AND expires_at > datetime('now')`,
+    args: [lockTtlModifier(ttlSeconds), lockId]
+  });
+}
+var import_node_crypto2, DEFAULT_LOCK_TTL_SECONDS, DEFAULT_RETRY_AFTER_SECONDS, MAX_LOCK_TTL_SECONDS, schemaReady;
+var init_concurrency_gates = __esm({
+  "src/api/concurrency-gates.ts"() {
+    "use strict";
+    import_node_crypto2 = require("crypto");
+    init_db();
+    init_rates();
+    DEFAULT_LOCK_TTL_SECONDS = 15 * 60;
+    DEFAULT_RETRY_AFTER_SECONDS = 30;
+    MAX_LOCK_TTL_SECONDS = 24 * 60 * 60;
+    schemaReady = null;
+  }
+});
+
 // src/api/youtube-routes.ts
 function buildTranscriptMarkdown(result) {
   const lines = [];
@@ -10444,6 +10657,7 @@ var init_youtube_routes = __esm({
     init_errors();
     init_api_auth();
     init_server_schemas();
+    init_concurrency_gates();
     youtubeApp = new import_hono2.Hono();
     youtubeApp.post("/harvest", createApiKeyAuth(), async (c) => {
       const raw = await c.req.json().catch(() => ({}));
@@ -10457,9 +10671,16 @@ var init_youtube_routes = __esm({
         return c.json({ error: "channel mode requires channelHandle (@handle or UC... ID)" }, 400);
       }
       const user = c.get("user");
-      const { ok: ytOk, balance_mc: ytBal } = await debitMc(user.id, MC_COSTS.yt_channel, LedgerOperation.YT_CHANNEL, query ?? channelHandle ?? "");
-      if (!ytOk) return c.json(insufficientBalanceResponse(ytBal, MC_COSTS.yt_channel), 402);
+      const gate = await acquireConcurrencyGate(user, "youtube_harvest", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { mode, query, channelHandle }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let debited = false;
       try {
+        const { ok: ytOk, balance_mc: ytBal } = await debitMc(user.id, MC_COSTS.yt_channel, LedgerOperation.YT_CHANNEL, query ?? channelHandle ?? "");
+        if (!ytOk) return c.json(insufficientBalanceResponse(ytBal, MC_COSTS.yt_channel), 402);
+        debited = true;
         const normalizedChannelUrl = mode === "channel" ? buildYouTubeChannelVideosUrl(channelHandle.trim()) : void 0;
         const result = await ytHarvest({
           mode,
@@ -10484,13 +10705,15 @@ var init_youtube_routes = __esm({
           return c.json({ error: msg }, 400);
         }
         if (err instanceof CaptchaError || msg.includes("CAPTCHA") || msg.includes("blocked")) {
-          await creditMc(user.id, MC_COSTS.yt_channel, LedgerOperation.YT_CHANNEL_REFUND, "failed call");
+          if (debited) await creditMc(user.id, MC_COSTS.yt_channel, LedgerOperation.YT_CHANNEL_REFUND, "failed call");
           await logRequestEvent({ userId: user.id, source: "youtube_harvest", status: "failed", query: mode === "search" ? query?.trim() ?? "" : channelHandle?.trim() ?? "", error: msg });
           return c.json({ error: msg }, 503);
         }
-        await creditMc(user.id, MC_COSTS.yt_channel, LedgerOperation.YT_CHANNEL_REFUND, "failed call");
+        if (debited) await creditMc(user.id, MC_COSTS.yt_channel, LedgerOperation.YT_CHANNEL_REFUND, "failed call");
         await logRequestEvent({ userId: user.id, source: "youtube_harvest", status: "failed", query: mode === "search" ? query?.trim() ?? "" : channelHandle?.trim() ?? "", error: msg });
         return c.json({ error: msg }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     youtubeApp.post("/transcribe", createApiKeyAuth(), async (c) => {
@@ -10502,9 +10725,16 @@ var init_youtube_routes = __esm({
       const user = c.get("user");
       const holdMins = 5;
       const holdMc = MC_COSTS.yt_transcription * holdMins;
-      const { ok: trOk, balance_mc: trBal } = await debitMc(user.id, holdMc, LedgerOperation.TRANSCRIPTION_HOLD, id);
-      if (!trOk) return c.json(insufficientBalanceResponse(trBal, holdMc), 402);
+      const gate = await acquireConcurrencyGate(user, "youtube_transcribe", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { videoId: id }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let debited = false;
       try {
+        const { ok: trOk, balance_mc: trBal } = await debitMc(user.id, holdMc, LedgerOperation.TRANSCRIPTION_HOLD, id);
+        if (!trOk) return c.json(insufficientBalanceResponse(trBal, holdMc), 402);
+        debited = true;
         const result = await fetchCaptions(id);
         const lastChunk = result.chunks?.[result.chunks.length - 1];
         const chunkSecs = lastChunk && Number.isFinite(lastChunk.timestamp[1]) ? lastChunk.timestamp[1] : 0;
@@ -10529,10 +10759,12 @@ var init_youtube_routes = __esm({
           html: buildTranscriptHtml(result)
         });
       } catch (err) {
-        await creditMc(user.id, holdMc, LedgerOperation.TRANSCRIPTION_REFUND, "failed call");
+        if (debited) await creditMc(user.id, holdMc, LedgerOperation.TRANSCRIPTION_REFUND, "failed call");
         const msg = err instanceof Error ? err.message : String(err);
         await logRequestEvent({ userId: user.id, source: "youtube_transcribe", status: "failed", query: id, error: msg });
         return c.json({ error: msg }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
   }
@@ -10549,6 +10781,7 @@ var init_screenshot_routes = __esm({
     init_screenshot();
     init_api_auth();
     init_url_utils();
+    init_concurrency_gates();
     ScreenshotBodySchema = import_zod14.z.object({
       url: import_zod14.z.string().trim().min(1, "url is required"),
       device: import_zod14.z.string().trim().optional(),
@@ -10564,6 +10797,7 @@ var init_screenshot_routes = __esm({
       }
       const body = parsed.data;
       const urlCheck = await validatePublicHttpUrl(body.url, { field: "url", requireHttps: false });
+      let targetUrl = urlCheck.parsed?.href;
       if (urlCheck.error) {
         if (!body.allowLocal) {
           return c.json({ error_code: "invalid_request", message: urlCheck.error }, 400);
@@ -10577,25 +10811,17 @@ var init_screenshot_routes = __esm({
         if (parsedFallback.protocol !== "http:" && parsedFallback.protocol !== "https:") {
           return c.json({ error: "url must use http or https" }, 400);
         }
-        const device2 = body.device === "mobile" ? "mobile" : "desktop";
-        try {
-          const buf = await captureScreenshot(parsedFallback.href, browserServiceApiKey(), device2);
-          return new Response(new Uint8Array(buf), {
-            status: 200,
-            headers: {
-              "Content-Type": "image/png",
-              "Content-Length": String(buf.length),
-              "Cache-Control": "no-store"
-            }
-          });
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return c.json({ error: msg }, 502);
-        }
+        targetUrl = parsedFallback.href;
       }
       const device = body.device === "mobile" ? "mobile" : "desktop";
+      const user = c.get("user");
+      const gate = await acquireConcurrencyGate(user, "screenshot", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { url: targetUrl, device }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       try {
-        const buf = await captureScreenshot(urlCheck.parsed.href, browserServiceApiKey(), device);
+        const buf = await captureScreenshot(targetUrl, browserServiceApiKey(), device);
         return new Response(new Uint8Array(buf), {
           status: 200,
           headers: {
@@ -10607,6 +10833,8 @@ var init_screenshot_routes = __esm({
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         return c.json({ error: msg }, 502);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
   }
@@ -11390,6 +11618,132 @@ var init_FacebookAdGraphql = __esm({
   }
 });
 
+// src/extractor/FacebookOrganicVideoExtractor.ts
+function htmlDecode(value) {
+  return value.replace(/&amp;/g, "&").replace(/&quot;/g, '"').replace(/&#039;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+}
+function decodeEscapedValue(raw) {
+  let out = raw;
+  try {
+    out = JSON.parse(`"${raw.replace(/"/g, '\\"')}"`);
+  } catch {
+    out = raw.replace(/\\u0025/g, "%").replace(/\\u0026/g, "&").replace(/\\u003D/g, "=").replace(/\\u003d/g, "=").replace(/\\"/g, '"').replace(/\\\//g, "/");
+  }
+  return htmlDecode(out);
+}
+function facebookVideoIdFromUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const path6 = parsed.pathname;
+    const direct = path6.match(/\/(?:reel|videos|watch)\/(?:[^/]+\/)?(\d{8,})/i);
+    if (direct) return direct[1];
+    const queryVideoId = parsed.searchParams.get("v") ?? parsed.searchParams.get("video_id");
+    if (queryVideoId && /^\d{8,}$/.test(queryVideoId)) return queryVideoId;
+    const numericTail = path6.match(/\/(\d{8,})\/?$/);
+    if (numericTail) return numericTail[1];
+  } catch {
+  }
+  return null;
+}
+function parseEfg(url) {
+  try {
+    const efg = new URL(url).searchParams.get("efg");
+    if (!efg) return null;
+    return JSON.parse(Buffer.from(efg, "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function manifestDurationSec(htmlWindow) {
+  const decoded = decodeEscapedValue(htmlWindow);
+  const match = decoded.match(/mediaPresentationDuration="PT([\d.]+)S"/);
+  return match ? Number(match[1]) : null;
+}
+function metadataContent(html, key) {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = new RegExp(`<meta\\s+[^>]*(?:property|name)=["']${escaped}["'][^>]*content=["']([^"']+)["'][^>]*>`, "i");
+  const m = html.match(re);
+  return m ? htmlDecode(m[1]).trim() : null;
+}
+function ownerNameFromHtml(html) {
+  const ogTitle = metadataContent(html, "og:title");
+  const pipe = ogTitle?.split("|").map((s) => s.trim()).filter(Boolean);
+  if (pipe && pipe.length > 1) return pipe[pipe.length - 1] ?? null;
+  return null;
+}
+function extractFacebookOrganicVideo(html, pageUrl, sourceUrl = pageUrl, quality = "best") {
+  const videoId = facebookVideoIdFromUrl(pageUrl) ?? facebookVideoIdFromUrl(sourceUrl);
+  const manifestIndex = videoId ? html.indexOf(`dash_mpd_debug.mpd?v=${videoId}`) : -1;
+  const searchWindow = manifestIndex >= 0 ? html.slice(Math.max(0, manifestIndex - 5e4), Math.min(html.length, manifestIndex + 5e4)) : html;
+  const targetDuration = manifestDurationSec(searchWindow);
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  const re = /browser_native_(sd|hd)_url\\?"\s*:\s*\\?"([^"<]+?)\\?"/g;
+  let match;
+  while ((match = re.exec(searchWindow)) !== null) {
+    const url = decodeEscapedValue(match[2]);
+    if (!url || seen.has(url)) continue;
+    seen.add(url);
+    const parsed = parseEfg(url);
+    let bitrate = null;
+    try {
+      const value = new URL(url).searchParams.get("bitrate");
+      bitrate = value ? Number(value) : null;
+    } catch {
+    }
+    candidates.push({
+      url,
+      quality: match[1],
+      bitrate: Number.isFinite(bitrate) ? bitrate : null,
+      durationSec: typeof parsed?.duration_s === "number" ? parsed.duration_s : null,
+      assetId: typeof parsed?.xpv_asset_id === "number" ? parsed.xpv_asset_id : null,
+      vencodeTag: typeof parsed?.vencode_tag === "string" ? parsed.vencode_tag : null
+    });
+  }
+  const targetCandidates = candidates.filter((candidate) => {
+    if (!targetDuration || candidate.durationSec == null) return true;
+    return Math.abs(candidate.durationSec - targetDuration) <= 2;
+  });
+  const selectable = targetCandidates.length ? targetCandidates : candidates;
+  const selected = [...selectable].filter((candidate) => quality === "best" || candidate.quality === quality).sort((a, b) => {
+    const aq = a.quality === "hd" ? 1 : 0;
+    const bq = b.quality === "hd" ? 1 : 0;
+    if (quality === "best" && aq !== bq) return bq - aq;
+    return (b.bitrate ?? 0) - (a.bitrate ?? 0);
+  })[0];
+  if (!selected) {
+    throw new Error("No progressive Facebook video URL was found in the rendered page state");
+  }
+  return {
+    sourceUrl,
+    pageUrl,
+    videoId,
+    title: metadataContent(html, "og:title") ?? metadataContent(html, "twitter:title"),
+    description: metadataContent(html, "og:description") ?? metadataContent(html, "description") ?? metadataContent(html, "twitter:description"),
+    ownerName: ownerNameFromHtml(html),
+    videoUrl: selected.url,
+    selectedQuality: selected.quality,
+    bitrate: selected.bitrate,
+    durationSec: targetDuration ?? selected.durationSec,
+    assetId: selected.assetId,
+    vencodeTag: selected.vencodeTag,
+    candidates: selectable,
+    extractedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function extractFacebookOrganicVideoFromPage(page, sourceUrl, quality = "best") {
+  await page.waitForLoadState("domcontentloaded", { timeout: 15e3 }).catch(() => {
+  });
+  await page.waitForTimeout(1500);
+  const html = await page.content();
+  return extractFacebookOrganicVideo(html, page.url(), sourceUrl, quality);
+}
+var init_FacebookOrganicVideoExtractor = __esm({
+  "src/extractor/FacebookOrganicVideoExtractor.ts"() {
+    "use strict";
+  }
+});
+
 // src/locations.ts
 var LOCATIONS;
 var init_locations = __esm({
@@ -11933,6 +12287,39 @@ var init_kernel_proxy_resolver = __esm({
 function invalidRequest(message) {
   return { error_code: "invalid_request", message };
 }
+function isAllowedFacebookOrganicUrl(url) {
+  const hostname = url.hostname.toLowerCase().replace(/^www\./, "").replace(/^m\./, "");
+  return hostname === "facebook.com" || hostname === "fb.watch";
+}
+function facebookTranscriptMarkdown(title, text, chunks, durationMs) {
+  const fmtTs2 = (s) => `${Math.floor(s / 60)}:${String(Math.floor(s % 60)).padStart(2, "0")}`;
+  const lines = [title, "", `*Transcribed in ${(durationMs / 1e3).toFixed(1)}s*`, "", "## Full Text", "", text, ""];
+  if (chunks.length) {
+    lines.push("## Timestamped Segments", "");
+    for (const ch of chunks) {
+      lines.push(`**[${fmtTs2(ch.timestamp[0])} -> ${fmtTs2(ch.timestamp[1])}]** ${ch.text.trim()}`, "");
+    }
+  }
+  return lines.join("\n");
+}
+async function transcribeFacebookVideoUrl(videoUrl, markdownTitle = "# Facebook Video Transcript") {
+  const startMs = Date.now();
+  const result = await import_client3.fal.subscribe("fal-ai/wizper", {
+    input: { audio_url: videoUrl, task: "transcribe", language: "en" },
+    logs: false,
+    pollInterval: 3e3
+  });
+  const data = result.data;
+  const text = data.text ?? "";
+  const chunks = data.chunks ?? [];
+  const durationMs = Date.now() - startMs;
+  return {
+    text,
+    chunks,
+    durationMs,
+    markdown: facebookTranscriptMarkdown(markdownTitle, text, chunks, durationMs)
+  };
+}
 async function detectSoftBlock(driver) {
   const page = driver.getPage();
   const bodyText = await page.evaluate(() => document.body?.innerText ?? "").catch(() => "");
@@ -11962,7 +12349,7 @@ async function kernelLaunchOptsResidential() {
   }
   return { headless: true, kernelApiKey: browserServiceApiKey(), kernelProxyId: proxyId, viewport: { width: 1280, height: 900 }, locale: "en-US" };
 }
-var import_hono4, import_zod15, import_client3, FacebookAdBodySchema, FacebookPageIntelBodySchema, FacebookTranscribeBodySchema, FacebookSearchBodySchema, FacebookMediaBodySchema, facebookAdApp, ALLOWED_MEDIA_HOSTS;
+var import_hono4, import_zod15, import_client3, FacebookAdBodySchema, FacebookPageIntelBodySchema, FacebookTranscribeBodySchema, FacebookVideoTranscribeBodySchema, FacebookSearchBodySchema, FacebookMediaBodySchema, facebookAdApp, ALLOWED_MEDIA_HOSTS;
 var init_facebook_ad_routes = __esm({
   "src/api/facebook-ad-routes.ts"() {
     "use strict";
@@ -11974,10 +12361,12 @@ var init_facebook_ad_routes = __esm({
     init_BrowserDriver();
     init_FacebookAdExtractor();
     init_FacebookAdGraphql();
+    init_FacebookOrganicVideoExtractor();
     init_kernel_proxy_resolver();
     import_client3 = require("@fal-ai/client");
     init_api_auth();
     init_url_utils();
+    init_concurrency_gates();
     FacebookAdBodySchema = import_zod15.z.object({
       url: import_zod15.z.string().trim().optional(),
       libraryId: import_zod15.z.string().trim().optional(),
@@ -11995,6 +12384,10 @@ var init_facebook_ad_routes = __esm({
     FacebookTranscribeBodySchema = import_zod15.z.object({
       videoUrl: import_zod15.z.string().trim().min(1, "videoUrl is required")
     });
+    FacebookVideoTranscribeBodySchema = import_zod15.z.object({
+      url: import_zod15.z.string().trim().min(1, "url is required"),
+      quality: import_zod15.z.enum(["best", "hd", "sd"]).default("best")
+    });
     FacebookSearchBodySchema = import_zod15.z.object({
       query: import_zod15.z.string().trim().min(1, "query is required"),
       country: import_zod15.z.string().trim().toUpperCase().optional(),
@@ -12016,10 +12409,17 @@ var init_facebook_ad_routes = __esm({
       const libraryId = FacebookAdExtractor.resolveLibraryId(raw2);
       if (!libraryId) return c.json({ error: "Could not resolve a valid Facebook Ad Library ID from the provided input" }, 400);
       const fbUser = c.get("user");
-      const { ok: adOk, balance_mc: adBal } = await debitMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD, raw2);
-      if (!adOk) return c.json(insufficientBalanceResponse(adBal, MC_COSTS.fb_ad), 402);
+      const gate = await acquireConcurrencyGate(fbUser, "facebook_ad", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { libraryId }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       const driver = new BrowserDriver();
+      let debited = false;
       try {
+        const { ok: adOk, balance_mc: adBal } = await debitMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD, raw2);
+        if (!adOk) return c.json(insufficientBalanceResponse(adBal, MC_COSTS.fb_ad), 402);
+        debited = true;
         await driver.launch(kernelLaunchOpts());
         const extractor = new FacebookAdExtractor(driver);
         const result = await extractor.extract(libraryId, { openModal: body.openModal !== false });
@@ -12033,7 +12433,7 @@ var init_facebook_ad_routes = __esm({
         });
         return c.json(result);
       } catch (err) {
-        await creditMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD_REFUND, "failed call");
+        if (debited) await creditMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD_REFUND, "failed call");
         const msg = err instanceof Error ? err.message : String(err);
         await logRequestEvent({ userId: fbUser.id, source: "facebook_ad", status: "failed", query: raw2, error: msg });
         if (msg.toLowerCase().includes("blocked") || msg.toLowerCase().includes("captcha")) {
@@ -12042,24 +12442,26 @@ var init_facebook_ad_routes = __esm({
         return c.json({ error: msg }, 500);
       } finally {
         await driver.close();
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     facebookAdApp.post("/page-intel", createApiKeyAuth(), async (c) => {
       const raw = await c.req.json().catch(() => ({}));
       const parsed = FacebookPageIntelBodySchema.safeParse(raw);
-      if (!parsed.success) {
-        return c.json(invalidRequest(parsed.error.issues[0]?.message ?? "Invalid request"), 400);
-      }
+      if (!parsed.success) return c.json(invalidRequest(parsed.error.issues[0]?.message ?? "Invalid request"), 400);
       const body = parsed.data;
       const maxAds = Math.min(200, Math.max(1, body.maxAds ?? 50));
       const country = body.country?.trim().toUpperCase() ?? "US";
       const listingUrl = buildPageIntelUrl(body, country);
       const fbUser = c.get("user");
-      const { ok: fbOk, balance_mc: fbBal } = await debitMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD, body.pageId ?? body.query ?? body.libraryId ?? "");
-      if (!fbOk) return c.json(insufficientBalanceResponse(fbBal, MC_COSTS.fb_ad), 402);
+      const gate = await acquireConcurrencyGate(fbUser, "facebook_page_intel", { reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"), metadata: { pageId: body.pageId, query: body.query, libraryId: body.libraryId, country } });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       const driver = new BrowserDriver();
-      let refunded = false;
+      let refunded = false, debited = false;
       try {
+        const { ok: fbOk, balance_mc: fbBal } = await debitMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD, body.pageId ?? body.query ?? body.libraryId ?? "");
+        if (!fbOk) return c.json(insufficientBalanceResponse(fbBal, MC_COSTS.fb_ad), 402);
+        debited = true;
         await driver.launch(await kernelLaunchOptsResidential());
         await driver.navigateTo(listingUrl);
         const extractor = new FacebookAdExtractor(driver);
@@ -12074,7 +12476,7 @@ var init_facebook_ad_routes = __esm({
         return c.json(result);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        if (!refunded) await creditMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD_REFUND, "failed call");
+        if (debited && !refunded) await creditMc(fbUser.id, MC_COSTS.fb_ad, LedgerOperation.FB_AD_REFUND, "failed call");
         await logRequestEvent({ userId: fbUser.id, source: "facebook_page_intel", status: "failed", query: body.pageId ?? body.query ?? body.libraryId ?? "", error: msg });
         if (msg.toLowerCase().includes("blocked") || msg.toLowerCase().includes("captcha")) {
           return c.json({ error: msg }, 503);
@@ -12082,6 +12484,7 @@ var init_facebook_ad_routes = __esm({
         return c.json({ error: msg }, 500);
       } finally {
         await driver.close();
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     facebookAdApp.post("/transcribe", createApiKeyAuth(), async (c) => {
@@ -12097,35 +12500,83 @@ var init_facebook_ad_routes = __esm({
       }
       const videoUrl = urlCheck.parsed.href;
       const fbUser = c.get("user");
-      const { ok, balance_mc } = await debitMc(fbUser.id, MC_COSTS.fb_transcribe, LedgerOperation.FB_TRANSCRIBE, videoUrl);
-      if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.fb_transcribe), 402);
+      const gate = await acquireConcurrencyGate(fbUser, "facebook_transcribe", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { videoUrl }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       import_client3.fal.config({ credentials: process.env.FAL_KEY });
+      let debited = false;
       try {
-        const startMs = Date.now();
-        const result = await import_client3.fal.subscribe("fal-ai/wizper", {
-          input: { audio_url: videoUrl, task: "transcribe", language: "en" },
-          logs: false,
-          pollInterval: 3e3
-        });
-        const data = result.data;
-        const text = data.text ?? "";
-        const chunks = data.chunks ?? [];
-        const durationMs = Date.now() - startMs;
-        const fmtTs2 = (s) => `${Math.floor(s / 60)}:${String(Math.floor(s % 60)).padStart(2, "0")}`;
-        const lines = ["# Facebook Ad Transcript", "", `*Transcribed in ${(durationMs / 1e3).toFixed(1)}s*`, "", "## Full Text", "", text, ""];
-        if (chunks.length) {
-          lines.push("## Timestamped Segments", "");
-          for (const ch of chunks) {
-            lines.push(`**[${fmtTs2(ch.timestamp[0])} \u2192 ${fmtTs2(ch.timestamp[1])}]** ${ch.text.trim()}`, "");
-          }
-        }
-        await logRequestEvent({ userId: fbUser.id, source: "facebook_transcribe", status: "done", query: videoUrl, resultCount: chunks.length, result: { text, chunks, durationMs } });
-        return c.json({ text, chunks, durationMs, markdown: lines.join("\n") });
+        const { ok, balance_mc } = await debitMc(fbUser.id, MC_COSTS.fb_transcribe, LedgerOperation.FB_TRANSCRIBE, videoUrl);
+        if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.fb_transcribe), 402);
+        debited = true;
+        const transcript = await transcribeFacebookVideoUrl(videoUrl, "# Facebook Ad Transcript");
+        await logRequestEvent({ userId: fbUser.id, source: "facebook_transcribe", status: "done", query: videoUrl, resultCount: transcript.chunks.length, result: { text: transcript.text, chunks: transcript.chunks, durationMs: transcript.durationMs } });
+        return c.json(transcript);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        await creditMc(fbUser.id, MC_COSTS.fb_transcribe, LedgerOperation.FB_TRANSCRIBE_REFUND, "failed call");
+        if (debited) await creditMc(fbUser.id, MC_COSTS.fb_transcribe, LedgerOperation.FB_TRANSCRIBE_REFUND, "failed call");
         await logRequestEvent({ userId: fbUser.id, source: "facebook_transcribe", status: "failed", query: videoUrl, error: msg });
         return c.json({ error: msg }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
+      }
+    });
+    facebookAdApp.post("/video-transcribe", createApiKeyAuth(), async (c) => {
+      const raw = await c.req.json().catch(() => ({}));
+      const parsed = FacebookVideoTranscribeBodySchema.safeParse(raw);
+      if (!parsed.success) {
+        return c.json(invalidRequest(parsed.error.issues[0]?.message ?? "Invalid request"), 400);
+      }
+      const body = parsed.data;
+      const urlCheck = await validatePublicHttpUrl(body.url, { field: "url", requireHttps: false });
+      if (urlCheck.error) {
+        return c.json(invalidRequest(urlCheck.error), 400);
+      }
+      const sourceUrl = urlCheck.parsed;
+      if (!isAllowedFacebookOrganicUrl(sourceUrl)) {
+        return c.json(invalidRequest("url must be a Facebook organic video, reel, or share URL"), 400);
+      }
+      const fbUser = c.get("user");
+      const gate = await acquireConcurrencyGate(fbUser, "facebook_video_transcribe", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { url: sourceUrl.href }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      import_client3.fal.config({ credentials: process.env.FAL_KEY });
+      const driver = new BrowserDriver();
+      let debited = false;
+      try {
+        const { ok, balance_mc } = await debitMc(fbUser.id, MC_COSTS.fb_transcribe, LedgerOperation.FB_TRANSCRIBE, sourceUrl.href);
+        if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.fb_transcribe), 402);
+        debited = true;
+        await driver.launch(await kernelLaunchOptsResidential());
+        await driver.navigateTo(sourceUrl.href);
+        const page = driver.getPage();
+        const video = await extractFacebookOrganicVideoFromPage(page, sourceUrl.href, body.quality);
+        const transcript = await transcribeFacebookVideoUrl(video.videoUrl, "# Facebook Organic Video Transcript");
+        const result = {
+          ...video,
+          videoDurationSec: video.durationSec,
+          text: transcript.text,
+          chunks: transcript.chunks,
+          durationMs: transcript.durationMs,
+          markdown: transcript.markdown
+        };
+        await logRequestEvent({ userId: fbUser.id, source: "facebook_video_transcribe", status: "done", query: sourceUrl.href, resultCount: transcript.chunks.length, result });
+        return c.json(result);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (debited) await creditMc(fbUser.id, MC_COSTS.fb_transcribe, LedgerOperation.FB_TRANSCRIBE_REFUND, "failed call");
+        await logRequestEvent({ userId: fbUser.id, source: "facebook_video_transcribe", status: "failed", query: sourceUrl.href, error: msg });
+        if (msg.toLowerCase().includes("blocked") || msg.toLowerCase().includes("captcha")) {
+          return c.json({ error: msg }, 503);
+        }
+        return c.json({ error: msg }, 500);
+      } finally {
+        await driver.close();
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     facebookAdApp.post("/search", createApiKeyAuth(), async (c) => {
@@ -12139,11 +12590,18 @@ var init_facebook_ad_routes = __esm({
       const maxResults = Math.min(20, Math.max(1, body.maxResults ?? 10));
       const searchUrl = `https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=${country}&q=${encodeURIComponent(body.query.trim())}&search_type=keyword_unordered`;
       const fbUser = c.get("user");
-      const { ok, balance_mc } = await debitMc(fbUser.id, MC_COSTS.fb_search, LedgerOperation.FB_SEARCH, body.query.trim());
-      if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.fb_search), 402);
+      const gate = await acquireConcurrencyGate(fbUser, "facebook_search", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { query: body.query.trim(), country }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       const driver = new BrowserDriver();
       let searchRefunded = false;
+      let debited = false;
       try {
+        const { ok, balance_mc } = await debitMc(fbUser.id, MC_COSTS.fb_search, LedgerOperation.FB_SEARCH, body.query.trim());
+        if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.fb_search), 402);
+        debited = true;
         await driver.launch(await kernelLaunchOptsResidential());
         const page = driver.getPage();
         const collated = await collectAdLibraryResults(page, searchUrl, Math.max(maxResults * 4, 40));
@@ -12204,7 +12662,7 @@ var init_facebook_ad_routes = __esm({
         return c.json(searchResult);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        if (!searchRefunded) await creditMc(fbUser.id, MC_COSTS.fb_search, LedgerOperation.FB_SEARCH_REFUND, "failed call");
+        if (debited && !searchRefunded) await creditMc(fbUser.id, MC_COSTS.fb_search, LedgerOperation.FB_SEARCH_REFUND, "failed call");
         await logRequestEvent({ userId: fbUser.id, source: "facebook_search", status: "failed", query: body.query.trim(), error: msg });
         if (msg.toLowerCase().includes("blocked") || msg.toLowerCase().includes("captcha")) {
           return c.json({ error: msg }, 503);
@@ -12212,6 +12670,7 @@ var init_facebook_ad_routes = __esm({
         return c.json({ error: msg }, 500);
       } finally {
         await driver.close();
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     ALLOWED_MEDIA_HOSTS = ["fbcdn.net", "cdninstagram.com", "scontent.facebook.com", "scontent.cdninstagram.com"];
@@ -13215,6 +13674,7 @@ var init_maps_routes = __esm({
     init_errors();
     init_browser_service_env();
     init_maps_search_rotation();
+    init_concurrency_gates();
     mapsApp = new import_hono5.Hono();
     mapsApp.post("/search", createApiKeyAuth(), async (c) => {
       const user = c.get("user");
@@ -13226,14 +13686,21 @@ var init_maps_routes = __esm({
       if (!parsed.success) {
         return c.json({ error: parsed.error.issues[0]?.message ?? "Invalid request" }, 400);
       }
-      const { ok, balance_mc } = await debitMc(
-        user.id,
-        MC_COSTS.maps_search,
-        LedgerOperation.MAPS_SEARCH,
-        [parsed.data.query, parsed.data.location].filter(Boolean).join(" ")
-      );
-      if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.maps_search), 402);
+      const gate = await acquireConcurrencyGate(user, "maps_search", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { query: parsed.data.query, location: parsed.data.location }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let debited = false;
       try {
+        const { ok, balance_mc } = await debitMc(
+          user.id,
+          MC_COSTS.maps_search,
+          LedgerOperation.MAPS_SEARCH,
+          [parsed.data.query, parsed.data.location].filter(Boolean).join(" ")
+        );
+        if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.maps_search), 402);
+        debited = true;
         const result = await runMapsSearchWithRotation({
           ...parsed.data,
           configuredKernelProxyId: browserServiceProxyId()
@@ -13249,7 +13716,7 @@ var init_maps_routes = __esm({
         });
         return c.json(result);
       } catch (err) {
-        await creditMc(user.id, MC_COSTS.maps_search, LedgerOperation.REFUND, "failed maps_search call");
+        if (debited) await creditMc(user.id, MC_COSTS.maps_search, LedgerOperation.REFUND, "failed maps_search call");
         const msg = err instanceof Error ? err.message : String(err);
         await logRequestEvent({
           userId: user.id,
@@ -13261,6 +13728,8 @@ var init_maps_routes = __esm({
           result: err instanceof MapsSearchRotationError ? { attempts: err.attempts } : void 0
         });
         return mapsErrorResponse(c, err, "maps_search_failed");
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     mapsApp.post("/place", createApiKeyAuth(), async (c) => {
@@ -13273,17 +13742,24 @@ var init_maps_routes = __esm({
       if (!parsed.success) {
         return c.json({ error: parsed.error.issues[0]?.message ?? "Invalid request" }, 400);
       }
-      const { ok, balance_mc } = await debitMc(
-        user.id,
-        MC_COSTS.maps_place,
-        LedgerOperation.MAPS_PLACE,
-        `${parsed.data.businessName} ${parsed.data.location}`
-      );
-      if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.maps_place), 402);
+      const gate = await acquireConcurrencyGate(user, "maps_place", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { businessName: parsed.data.businessName, location: parsed.data.location }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       const driver = new BrowserDriver();
       const extractor = new MapsExtractor(driver);
       let reviewDebitMc = 0;
+      let debited = false;
       try {
+        const { ok, balance_mc } = await debitMc(
+          user.id,
+          MC_COSTS.maps_place,
+          LedgerOperation.MAPS_PLACE,
+          `${parsed.data.businessName} ${parsed.data.location}`
+        );
+        if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.maps_place), 402);
+        debited = true;
         const result = await extractor.extract(parsed.data);
         const reviewCount = Array.isArray(result.reviews) ? result.reviews.length : 0;
         if (reviewCount > 0) {
@@ -13311,7 +13787,7 @@ var init_maps_routes = __esm({
         });
         return c.json(result);
       } catch (err) {
-        await creditMc(user.id, MC_COSTS.maps_place, LedgerOperation.REFUND, "failed maps_place call");
+        if (debited) await creditMc(user.id, MC_COSTS.maps_place, LedgerOperation.REFUND, "failed maps_place call");
         if (reviewDebitMc > 0) {
           await creditMc(
             user.id,
@@ -13332,6 +13808,7 @@ var init_maps_routes = __esm({
         return mapsErrorResponse(c, msg, "maps_place_failed");
       } finally {
         await driver.close();
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
   }
@@ -13969,6 +14446,8 @@ function formatCreditsInfo(raw, input) {
   const costs = d.costs ?? [];
   const matched = d.matched_cost;
   const ledger = d.ledger ?? [];
+  const concurrencyRaw = d.concurrency;
+  const upgradeRaw = concurrencyRaw?.upgrade;
   const costRows = costs.map((c) => {
     const notes = c.notes ? ` ${c.notes}` : "";
     return `| ${c.label} | ${c.credits} | ${c.unit}${notes} |`;
@@ -13984,10 +14463,20 @@ function formatCreditsInfo(raw, input) {
 ${matched.notes}` : ""}` : input.item ? `
 ## Matched Cost
 No exact cost match found for "${input.item}". See the full cost table below.` : "";
+  const concurrencySection = concurrencyRaw ? [
+    `
+## Concurrency`,
+    `**Current limit:** ${concurrencyRaw.current_limit ?? "unknown"} concurrent operation${concurrencyRaw.current_limit === 1 ? "" : "s"}`,
+    `**Extra slots:** ${concurrencyRaw.current_extra_slots ?? "unknown"}`,
+    `**Extra concurrency slot:** ${upgradeRaw?.price_label ?? "$5/month"}`,
+    `**Upgrade in terminal:** \`${upgradeRaw?.terminal_command ?? "npx -y -p mcp-scraper@latest mcp-scraper-cli billing concurrency checkout"}\``,
+    `**Billing URL:** ${upgradeRaw?.billing_url ?? "https://mcpscraper.dev/billing"}`
+  ].join("\n") : "";
   const full = [
     `# Credits`,
     `**Balance:** ${balance ?? "unknown"} credits`,
     matchedSection,
+    concurrencySection,
     costs.length ? `
 ## Cost Table
 | Item | Credits | Unit |
@@ -14016,7 +14505,22 @@ ${ledgerRows}` : ""
         operation: String(row.operation ?? ""),
         credits: row.amount_mc / 1e3,
         description: row.description ?? null
-      }))
+      })),
+      concurrency: concurrencyRaw && upgradeRaw ? {
+        currentExtraSlots: Number(concurrencyRaw.current_extra_slots ?? 0),
+        currentLimit: Number(concurrencyRaw.current_limit ?? 1),
+        hasSubscription: concurrencyRaw.has_subscription === true,
+        upgrade: {
+          product: String(upgradeRaw.product ?? "Extra concurrency slot"),
+          priceLabel: String(upgradeRaw.price_label ?? "$5/month"),
+          unitAmountUsd: Number(upgradeRaw.unit_amount_usd ?? 5),
+          currency: String(upgradeRaw.currency ?? "usd"),
+          interval: String(upgradeRaw.interval ?? "month"),
+          billingUrl: String(upgradeRaw.billing_url ?? "https://mcpscraper.dev/billing"),
+          terminalCommand: String(upgradeRaw.terminal_command ?? "npx -y -p mcp-scraper@latest mcp-scraper-cli billing concurrency checkout"),
+          terminalCommandWithApiKeyEnv: String(upgradeRaw.terminal_command_with_api_key_env ?? "MCP_SCRAPER_API_KEY=sk_live_your_key npx -y -p mcp-scraper@latest mcp-scraper-cli billing concurrency checkout")
+        }
+      } : null
     }
   };
 }
@@ -14302,6 +14806,62 @@ ${chunkRows}` : "",
   ].filter(Boolean).join("\n");
   return oneBlock(full);
 }
+function formatFacebookVideoTranscribe(raw, input) {
+  const parsed = parseData(raw);
+  if ("error" in parsed) return { content: [{ type: "text", text: parsed.error }], isError: true };
+  const d = parsed.data;
+  const text = d.text ?? "";
+  const chunks = d.chunks ?? [];
+  const wordCount = text.trim() ? text.trim().split(/\s+/).length : 0;
+  const durSec = d.durationMs ? (d.durationMs / 1e3).toFixed(0) : "\u2014";
+  const videoDuration = typeof d.videoDurationSec === "number" ? `${Math.round(d.videoDurationSec)}s` : "\u2014";
+  const label = d.videoId ? `Facebook Organic Video \`${d.videoId}\`` : "Facebook Organic Video";
+  const chunkRows = chunks.slice(0, 50).map((c) => {
+    const sec = Number.isFinite(c.timestamp[0]) ? Math.floor(c.timestamp[0]) : 0;
+    const mm = String(Math.floor(sec / 60)).padStart(2, "0");
+    const ss = String(sec % 60).padStart(2, "0");
+    return `| ${mm}:${ss} | ${cell(truncate(c.text, 120))} |`;
+  }).join("\n");
+  const full = [
+    `# ${label} Transcript`,
+    d.ownerName ? `**Owner:** ${d.ownerName}` : "",
+    `**Video duration:** ${videoDuration} \xB7 **Transcribed in:** ${durSec}s \xB7 **${wordCount} words**`,
+    d.pageUrl ? `**Page URL:** ${d.pageUrl}` : `**Page URL:** ${input.url}`,
+    d.videoUrl ? `**Extracted MP4:** \`${d.videoUrl}\`` : "",
+    `
+## Full Transcript
+${text}`,
+    chunks.length ? `
+## Timestamped Chunks
+| Time | Text |
+|------|------|
+${chunkRows}` : "",
+    `
+---
+\u{1F4A1} To download the extracted MP4, call the Facebook media endpoint with the extracted MP4 URL.`
+  ].filter(Boolean).join("\n");
+  return {
+    ...oneBlock(full),
+    structuredContent: {
+      sourceUrl: d.sourceUrl ?? input.url,
+      pageUrl: d.pageUrl ?? input.url,
+      videoId: d.videoId ?? null,
+      ownerName: d.ownerName ?? null,
+      selectedQuality: d.selectedQuality ?? input.quality ?? "best",
+      bitrate: typeof d.bitrate === "number" ? d.bitrate : null,
+      videoDurationSec: typeof d.videoDurationSec === "number" ? d.videoDurationSec : null,
+      videoUrl: d.videoUrl ?? "",
+      wordCount,
+      chunkCount: chunks.length,
+      transcriptText: text,
+      chunks: chunks.map((c) => ({
+        startSec: Number.isFinite(c.timestamp[0]) ? c.timestamp[0] : 0,
+        endSec: Number.isFinite(c.timestamp[1]) ? c.timestamp[1] : 0,
+        text: c.text
+      }))
+    }
+  };
+}
 var import_node_fs3, import_node_os3, import_node_path5, reportSavingEnabled;
 var init_mcp_response_formatter = __esm({
   "src/mcp/mcp-response-formatter.ts"() {
@@ -14811,6 +15371,7 @@ var init_directory_routes = __esm({
     init_directory_workflow();
     init_location_db();
     init_browser_service_env();
+    init_concurrency_gates();
     directoryApp = new import_hono6.Hono();
     directoryApp.post("/run", createApiKeyAuth(), async (c) => {
       const user = c.get("user");
@@ -14826,18 +15387,27 @@ var init_directory_routes = __esm({
       if (!kernelApiKey && parsed.data.proxyMode !== "none") {
         return c.json({ error: "Browser service API key is required for directory workflow Maps searches unless proxyMode is none" }, 503);
       }
-      const plan = await resolveDirectoryMarkets(parsed.data);
-      const requiredMc = plan.markets.length * MC_COSTS.maps_search;
-      if (requiredMc > 0) {
-        const debit = await debitMc(
-          user.id,
-          requiredMc,
-          LedgerOperation.MAPS_SEARCH,
-          `directory_workflow ${parsed.data.query} ${parsed.data.state} ${plan.markets.length} cities`
-        );
-        if (!debit.ok) return c.json(insufficientBalanceResponse(debit.balance_mc, requiredMc), 402);
-      }
+      const gate = await acquireConcurrencyGate(user, "directory_workflow", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        ttlSeconds: 30 * 60,
+        metadata: { query: parsed.data.query, state: parsed.data.state }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let debited = false;
+      let requiredMc = 0;
       try {
+        const plan = await resolveDirectoryMarkets(parsed.data);
+        requiredMc = plan.markets.length * MC_COSTS.maps_search;
+        if (requiredMc > 0) {
+          const debit = await debitMc(
+            user.id,
+            requiredMc,
+            LedgerOperation.MAPS_SEARCH,
+            `directory_workflow ${parsed.data.query} ${parsed.data.state} ${plan.markets.length} cities`
+          );
+          if (!debit.ok) return c.json(insufficientBalanceResponse(debit.balance_mc, requiredMc), 402);
+          debited = true;
+        }
         const result = await runDirectoryWorkflowFromPlan(parsed.data, plan);
         const failedCities = result.cities.filter((city) => city.status === "failed").length;
         if (failedCities > 0) {
@@ -14854,7 +15424,7 @@ var init_directory_routes = __esm({
         });
         return c.json(result);
       } catch (err) {
-        if (requiredMc > 0) {
+        if (debited && requiredMc > 0) {
           await creditMc(user.id, requiredMc, LedgerOperation.REFUND, "failed directory_workflow call");
         }
         const message = err instanceof Error ? err.message : String(err);
@@ -14867,6 +15437,8 @@ var init_directory_routes = __esm({
           error: message
         });
         return c.json({ error: message, error_code: "directory_workflow_failed", retryable: true }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
   }
@@ -15015,18 +15587,21 @@ var init_http_client2 = __esm({
   "src/workflows/http-client.ts"() {
     "use strict";
     WorkflowHttpClient = class {
-      constructor(apiUrl, apiKey, fetchImpl = fetch) {
+      constructor(apiUrl, apiKey, fetchImpl = fetch, extraHeaders = {}) {
         this.apiUrl = apiUrl;
         this.apiKey = apiKey;
         this.fetchImpl = fetchImpl;
+        this.extraHeaders = extraHeaders;
       }
       apiUrl;
       apiKey;
       fetchImpl;
+      extraHeaders;
       async post(path6, body, timeoutMs = 18e4) {
         const res = await this.fetchImpl(`${this.apiUrl.replace(/\/$/, "")}${path6}`, {
           method: "POST",
           headers: {
+            ...this.extraHeaders,
             "Content-Type": "application/json",
             "x-api-key": this.apiKey
           },
@@ -16374,7 +16949,7 @@ async function runWorkflow(id, rawInput, options = {}) {
   if (!apiKey) throw new Error("MCP_SCRAPER_API_KEY is required for workflow runs. Pass --api-key or set the environment variable.");
   const apiUrl = options.apiUrl?.trim() || process.env.MCP_SCRAPER_API_URL?.trim() || "https://mcpscraper.dev";
   const artifacts = await ArtifactWriter.create(definition.id, definition.title, input, options.outputDir, options.runId);
-  const client2 = new WorkflowHttpClient(apiUrl, apiKey, options.fetchImpl);
+  const client2 = new WorkflowHttpClient(apiUrl, apiKey, options.fetchImpl, options.headers);
   try {
     return await definition.run(input, {
       runId: artifacts.runId,
@@ -16473,7 +17048,7 @@ async function readManifestFromSummary(summary) {
 function webhookSignature(body, timestamp2) {
   const secret2 = process.env.MCP_SCRAPER_WEBHOOK_SECRET?.trim();
   if (!secret2) return null;
-  return (0, import_node_crypto2.createHmac)("sha256", secret2).update(`${timestamp2}.${body}`).digest("hex");
+  return (0, import_node_crypto3.createHmac)("sha256", secret2).update(`${timestamp2}.${body}`).digest("hex");
 }
 async function deliverWorkflowWebhook(input) {
   if (!input.webhookUrl) return;
@@ -16527,7 +17102,8 @@ async function executeWorkflowRun(input) {
       apiKey: input.user.api_key,
       apiUrl: input.apiUrl,
       outputDir: hostedWorkflowOutputDir(),
-      runId: input.runId
+      runId: input.runId,
+      headers: input.concurrencyLockId ? { "x-mcp-scraper-concurrency-lock": input.concurrencyLockId } : void 0
     });
     const manifest = await readManifestFromSummary(summary);
     await completeWorkflowRunRecord(input.runId, summary.status, manifest ?? { summary });
@@ -16556,19 +17132,28 @@ async function dispatchDueWorkflowSchedules(apiUrl, limit = 3) {
       continue;
     }
     const scheduledFor = schedule.next_run_at ?? now;
-    const run = await createWorkflowRun({
-      userId: user.id,
-      scheduleId: schedule.id,
-      workflowId: schedule.workflow_id,
-      workflowInput: schedule.input,
-      idempotencyKey: `${schedule.id}:${scheduledFor}`
+    const gate = await acquireConcurrencyGate(user, "workflow_schedule_dispatch", {
+      ttlSeconds: 60 * 60,
+      metadata: { scheduleId: schedule.id, workflowId: schedule.workflow_id }
     });
-    await markWorkflowScheduleRan(schedule.id, now, addCadence(scheduledFor, schedule.cadence));
-    if (run.status !== "queued") {
-      results.push({ scheduleId: schedule.id, runId: run.id, status: run.status });
+    if (!gate.ok) {
+      results.push({ scheduleId: schedule.id, status: "deferred", error: concurrencyLimitExceededResponse(gate).message });
       continue;
     }
+    let run = null;
     try {
+      run = await createWorkflowRun({
+        userId: user.id,
+        scheduleId: schedule.id,
+        workflowId: schedule.workflow_id,
+        workflowInput: schedule.input,
+        idempotencyKey: `${schedule.id}:${scheduledFor}`
+      });
+      await markWorkflowScheduleRan(schedule.id, now, addCadence(scheduledFor, schedule.cadence));
+      if (run.status !== "queued") {
+        results.push({ scheduleId: schedule.id, runId: run.id, status: run.status });
+        continue;
+      }
       const executed = await executeWorkflowRun({
         runId: run.id,
         user,
@@ -16576,20 +17161,23 @@ async function dispatchDueWorkflowSchedules(apiUrl, limit = 3) {
         workflowInput: schedule.input,
         apiUrl,
         scheduleId: schedule.id,
-        webhookUrl: schedule.webhook_url
+        webhookUrl: schedule.webhook_url,
+        concurrencyLockId: gate.lockId
       });
       results.push({ scheduleId: schedule.id, runId: executed.run.id, status: executed.run.status });
     } catch (err) {
-      results.push({ scheduleId: schedule.id, runId: run.id, status: "failed", error: err instanceof Error ? err.message : String(err) });
+      results.push({ scheduleId: schedule.id, runId: run?.id, status: "failed", error: err instanceof Error ? err.message : String(err) });
+    } finally {
+      await releaseConcurrencyGate(gate.lockId);
     }
   }
   return { dispatched: results.length, results };
 }
-var import_node_crypto2, import_promises7, import_hono7, import_zod24, workflowApp, WorkflowInputSchema, WorkflowIdSchema, CadenceSchema, ScheduleStatusSchema, RunBodySchema, ScheduleCreateSchema, SchedulePatchSchema;
+var import_node_crypto3, import_promises7, import_hono7, import_zod24, workflowApp, WorkflowInputSchema, WorkflowIdSchema, CadenceSchema, ScheduleStatusSchema, RunBodySchema, ScheduleCreateSchema, SchedulePatchSchema;
 var init_workflow_routes = __esm({
   "src/api/workflow-routes.ts"() {
     "use strict";
-    import_node_crypto2 = require("crypto");
+    import_node_crypto3 = require("crypto");
     import_promises7 = require("fs/promises");
     import_hono7 = require("hono");
     import_zod24 = require("zod");
@@ -16598,6 +17186,7 @@ var init_workflow_routes = __esm({
     init_api_auth();
     init_db();
     init_url_utils();
+    init_concurrency_gates();
     workflowApp = new import_hono7.Hono();
     WorkflowInputSchema = import_zod24.z.record(import_zod24.z.unknown()).default({});
     WorkflowIdSchema = import_zod24.z.string().min(1);
@@ -16641,20 +17230,29 @@ var init_workflow_routes = __esm({
       } catch (err) {
         return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
       }
-      const run = await createWorkflowRun({ userId: user.id, workflowId: parsed.data.workflowId, workflowInput: input });
+      const gate = await acquireConcurrencyGate(user, "workflow_run", {
+        ttlSeconds: 60 * 60,
+        metadata: { workflowId: parsed.data.workflowId }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let run = null;
       try {
+        run = await createWorkflowRun({ userId: user.id, workflowId: parsed.data.workflowId, workflowInput: input });
         const executed = await executeWorkflowRun({
           runId: run.id,
           user,
           workflowId: parsed.data.workflowId,
           workflowInput: input,
           apiUrl: originFromUrl(c.req.url),
-          webhookUrl
+          webhookUrl,
+          concurrencyLockId: gate.lockId
         });
         return c.json({ run: exposeRun(c, executed.run, executed.artifacts), summary: executed.summary });
       } catch (err) {
-        const failed = await getWorkflowRun(run.id, user.id);
+        const failed = run ? await getWorkflowRun(run.id, user.id) : null;
         return c.json({ run: failed, error: err instanceof Error ? err.message : String(err) }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     workflowApp.get("/runs", createApiKeyAuth(), async (c) => {
@@ -16752,8 +17350,14 @@ var init_workflow_routes = __esm({
       const user = c.get("user");
       const schedule = await getWorkflowSchedule(c.req.param("id"), user.id);
       if (!schedule) return c.json({ error: "Schedule not found" }, 404);
-      const run = await createWorkflowRun({ userId: user.id, scheduleId: schedule.id, workflowId: schedule.workflow_id, workflowInput: schedule.input });
+      const gate = await acquireConcurrencyGate(user, "workflow_schedule_run", {
+        ttlSeconds: 60 * 60,
+        metadata: { scheduleId: schedule.id, workflowId: schedule.workflow_id }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let run = null;
       try {
+        run = await createWorkflowRun({ userId: user.id, scheduleId: schedule.id, workflowId: schedule.workflow_id, workflowInput: schedule.input });
         const executed = await executeWorkflowRun({
           runId: run.id,
           user,
@@ -16761,12 +17365,15 @@ var init_workflow_routes = __esm({
           workflowInput: schedule.input,
           apiUrl: originFromUrl(c.req.url),
           scheduleId: schedule.id,
-          webhookUrl: schedule.webhook_url
+          webhookUrl: schedule.webhook_url,
+          concurrencyLockId: gate.lockId
         });
         return c.json({ run: exposeRun(c, executed.run, executed.artifacts), summary: executed.summary });
       } catch (err) {
-        const failed = await getWorkflowRun(run.id, user.id);
+        const failed = run ? await getWorkflowRun(run.id, user.id) : null;
         return c.json({ run: failed, error: err instanceof Error ? err.message : String(err) }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     workflowApp.post("/cron/dispatch", async (c) => {
@@ -16782,7 +17389,7 @@ var init_workflow_routes = __esm({
 // src/serp-intelligence/page-snapshot-extractor.ts
 function sha256(value) {
   if (!value) return null;
-  return (0, import_node_crypto3.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto4.createHash)("sha256").update(value).digest("hex");
 }
 function countWords(markdown) {
   const matches = markdown.trim().match(/\b[\p{L}\p{N}][\p{L}\p{N}'-]*\b/gu);
@@ -17082,11 +17689,11 @@ async function capturePageSnapshots(targets, options = {}) {
     }
   };
 }
-var import_node_crypto3, import_p_limit3, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_CONCURRENCY, DEFAULT_MAX_CONTENT_CHARS;
+var import_node_crypto4, import_p_limit3, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_CONCURRENCY, DEFAULT_MAX_CONTENT_CHARS;
 var init_page_snapshot_extractor = __esm({
   "src/serp-intelligence/page-snapshot-extractor.ts"() {
     "use strict";
-    import_node_crypto3 = require("crypto");
+    import_node_crypto4 = require("crypto");
     import_p_limit3 = __toESM(require("p-limit"), 1);
     init_kpo_extractor();
     init_url_utils();
@@ -19382,26 +19989,6 @@ async function enforceSerpIntelligenceRateLimit(c, userId) {
     { "Retry-After": String(result.resetSeconds) }
   );
 }
-async function enforceSerpIntelligenceConcurrency(user) {
-  const active = await countActiveJobsForUser(user.id);
-  const limit = 1 + (user.extra_concurrency_slots ?? 0);
-  if (active < limit) return null;
-  return new Response(
-    JSON.stringify(structuredError({
-      error_code: "concurrency_limit_exceeded",
-      error_type: "concurrency_limit",
-      message: `You have ${active} active job${active !== 1 ? "s" : ""}. Your account allows ${limit} concurrent job${limit !== 1 ? "s" : ""}.`,
-      retryable: true
-    })),
-    {
-      status: 429,
-      headers: {
-        "Content-Type": "application/json",
-        "Retry-After": "30"
-      }
-    }
-  );
-}
 function pageSnapshotTargetsFromBody(body) {
   return body.targets?.length ? body.targets : body.urls.map((url) => ({
     url,
@@ -19421,6 +20008,7 @@ var init_serp_intelligence_routes = __esm({
     init_api_auth();
     init_db();
     init_rates();
+    init_concurrency_gates();
     SERP_INTELLIGENCE_RATE_LIMIT = 60;
     SERP_INTELLIGENCE_RATE_WINDOW_SECONDS = 60;
     POST_CAPTURE_ROUTE_LABEL = "POST /capture";
@@ -19435,17 +20023,22 @@ var init_serp_intelligence_routes = __esm({
       if (!parsed.success) return c.json(formatZodError(parsed.error), 400);
       const limited = await enforceSerpIntelligenceRateLimit(c, user.id);
       if (limited) return limited;
-      const concurrencyLimited = await enforceSerpIntelligenceConcurrency(user);
-      if (concurrencyLimited) return concurrencyLimited;
+      const gate = await acquireConcurrencyGate(user, "serp_intelligence_capture", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { query: parsed.data.query, location: parsed.data.location }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       const cost = MC_COSTS.serp;
-      const { ok, balance_mc } = await debitMc(
-        user.id,
-        cost,
-        LedgerOperation.SERP,
-        parsed.data.query
-      );
-      if (!ok) return c.json(insufficientBalanceResponse(balance_mc, cost), 402);
+      let debited = false;
       try {
+        const { ok, balance_mc } = await debitMc(
+          user.id,
+          cost,
+          LedgerOperation.SERP,
+          parsed.data.query
+        );
+        if (!ok) return c.json(insufficientBalanceResponse(balance_mc, cost), 402);
+        debited = true;
         const result = await captureSerpIntelligenceSnapshot(parsed.data, {
           kernelApiKey: browserServiceApiKey(),
           kernelProxyId: browserServiceProxyId(),
@@ -19463,7 +20056,7 @@ var init_serp_intelligence_routes = __esm({
         });
         return c.json(result);
       } catch (error) {
-        await creditMc(user.id, cost, LedgerOperation.REFUND, "failed serp intelligence capture");
+        if (debited) await creditMc(user.id, cost, LedgerOperation.REFUND, "failed serp intelligence capture");
         const body = error instanceof SerpIntelligenceCaptureError ? error.toJSON() : structuredError({
           error_code: "capture_failed",
           error_type: "capture_error",
@@ -19480,6 +20073,8 @@ var init_serp_intelligence_routes = __esm({
         });
         const status = error instanceof SerpIntelligenceCaptureError ? error.httpStatus : 500;
         return c.json(body, status);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     serpIntelligenceApp.post("/page-snapshots", async (c) => {
@@ -19490,18 +20085,23 @@ var init_serp_intelligence_routes = __esm({
       if (!parsed.success) return c.json(formatZodError(parsed.error), 400);
       const limited = await enforceSerpIntelligenceRateLimit(c, user.id);
       if (limited) return limited;
-      const concurrencyLimited = await enforceSerpIntelligenceConcurrency(user);
-      if (concurrencyLimited) return concurrencyLimited;
       const targets = pageSnapshotTargetsFromBody(parsed.data);
+      const gate = await acquireConcurrencyGate(user, "serp_intelligence_page_snapshots", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { targets: targets.length }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
       const cost = targets.length * MC_COSTS.page_scrape;
-      const { ok, balance_mc } = await debitMc(
-        user.id,
-        cost,
-        LedgerOperation.EXTRACT_URL,
-        `serp intelligence page snapshots: ${targets.length}`
-      );
-      if (!ok) return c.json(insufficientBalanceResponse(balance_mc, cost), 402);
+      let debited = false;
       try {
+        const { ok, balance_mc } = await debitMc(
+          user.id,
+          cost,
+          LedgerOperation.EXTRACT_URL,
+          `serp intelligence page snapshots: ${targets.length}`
+        );
+        if (!ok) return c.json(insufficientBalanceResponse(balance_mc, cost), 402);
+        debited = true;
         const result = await capturePageSnapshots(targets, {
           kernelApiKey: browserServiceApiKey(),
           timeoutMs: parsed.data.timeoutMs,
@@ -19518,7 +20118,7 @@ var init_serp_intelligence_routes = __esm({
         });
         return c.json(result);
       } catch (error) {
-        await creditMc(user.id, cost, LedgerOperation.REFUND, "failed serp intelligence page snapshots");
+        if (debited) await creditMc(user.id, cost, LedgerOperation.REFUND, "failed serp intelligence page snapshots");
         const body = structuredError({
           error_code: "page_snapshot_failed",
           error_type: "capture_error",
@@ -19533,6 +20133,8 @@ var init_serp_intelligence_routes = __esm({
           error: body.message
         });
         return c.json(body, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
   }
@@ -19543,12 +20145,12 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.2.13";
+    PACKAGE_VERSION = "0.2.15";
   }
 });
 
 // src/mcp/mcp-tool-schemas.ts
-var import_zod26, HarvestPaaInputSchema, ExtractUrlInputSchema, MapSiteUrlsInputSchema, ExtractSiteInputSchema, YoutubeHarvestInputSchema, YoutubeTranscribeInputSchema, FacebookPageIntelInputSchema, FacebookAdSearchInputSchema, FacebookAdTranscribeInputSchema, MapsPlaceIntelInputSchema, MapsSearchInputSchema, DirectoryWorkflowInputSchema, RankTrackerModeSchema, RankTrackerBlueprintInputSchema, NullableString, MapsSearchAttemptOutput, MapsSearchOutputSchema, DirectoryMapsBusinessOutput, DirectoryWorkflowOutputSchema, RankTrackerToolPlanOutput, RankTrackerTableOutput, RankTrackerCronJobOutput, RankTrackerBlueprintOutputSchema, OrganicResultOutput, AiOverviewOutput, EntityIdsOutput, HarvestPaaOutputSchema, SearchSerpOutputSchema, ExtractUrlOutputSchema, ExtractSiteOutputSchema, MapsPlaceIntelOutputSchema, CreditsInfoOutputSchema, MapSiteUrlsOutputSchema, YoutubeHarvestOutputSchema, FacebookAdSearchOutputSchema, FacebookPageIntelOutputSchema, CreditsInfoInputSchema, SearchSerpInputSchema, CaptureSerpSnapshotInputSchema, ScreenshotInputSchema, CaptureSerpPageSnapshotsInputSchema;
+var import_zod26, HarvestPaaInputSchema, ExtractUrlInputSchema, MapSiteUrlsInputSchema, ExtractSiteInputSchema, YoutubeHarvestInputSchema, YoutubeTranscribeInputSchema, FacebookPageIntelInputSchema, FacebookAdSearchInputSchema, FacebookAdTranscribeInputSchema, FacebookVideoTranscribeInputSchema, MapsPlaceIntelInputSchema, MapsSearchInputSchema, DirectoryWorkflowInputSchema, RankTrackerModeSchema, RankTrackerBlueprintInputSchema, NullableString, MapsSearchAttemptOutput, MapsSearchOutputSchema, DirectoryMapsBusinessOutput, DirectoryWorkflowOutputSchema, RankTrackerToolPlanOutput, RankTrackerTableOutput, RankTrackerCronJobOutput, RankTrackerBlueprintOutputSchema, OrganicResultOutput, AiOverviewOutput, EntityIdsOutput, HarvestPaaOutputSchema, SearchSerpOutputSchema, ExtractUrlOutputSchema, ExtractSiteOutputSchema, MapsPlaceIntelOutputSchema, CreditsInfoOutputSchema, MapSiteUrlsOutputSchema, YoutubeHarvestOutputSchema, FacebookAdSearchOutputSchema, FacebookPageIntelOutputSchema, FacebookVideoTranscribeOutputSchema, CreditsInfoInputSchema, SearchSerpInputSchema, CaptureSerpSnapshotInputSchema, ScreenshotInputSchema, CaptureSerpPageSnapshotsInputSchema;
 var init_mcp_tool_schemas = __esm({
   "src/mcp/mcp-tool-schemas.ts"() {
     "use strict";
@@ -19605,6 +20207,10 @@ var init_mcp_tool_schemas = __esm({
     FacebookAdTranscribeInputSchema = {
       videoUrl: import_zod26.z.string().url().describe("Facebook CDN video URL from a facebook_page_intel result")
     };
+    FacebookVideoTranscribeInputSchema = {
+      url: import_zod26.z.string().url().describe("Organic Facebook reel, video, watch, or share URL. The tool renders the page, extracts the best public Facebook CDN MP4 URL, then transcribes it."),
+      quality: import_zod26.z.enum(["best", "hd", "sd"]).default("best").describe("Preferred progressive MP4 quality. Use best by default; hd prefers the highest HD progressive URL; sd forces the SD URL.")
+    };
     MapsPlaceIntelInputSchema = {
       businessName: import_zod26.z.string().min(1).describe('Business name only. If user says "Elite Roofing Denver CO", use businessName="Elite Roofing" and location="Denver, CO".'),
       location: import_zod26.z.string().min(1).describe('City/region/country where the business should be searched, e.g. "Denver, CO". Infer from the user request when possible.'),
@@ -19898,7 +20504,22 @@ var init_mcp_tool_schemas = __esm({
         operation: import_zod26.z.string(),
         credits: import_zod26.z.number(),
         description: NullableString
-      }))
+      })),
+      concurrency: import_zod26.z.object({
+        currentExtraSlots: import_zod26.z.number().int().min(0),
+        currentLimit: import_zod26.z.number().int().min(1),
+        hasSubscription: import_zod26.z.boolean(),
+        upgrade: import_zod26.z.object({
+          product: import_zod26.z.string(),
+          priceLabel: import_zod26.z.string(),
+          unitAmountUsd: import_zod26.z.number(),
+          currency: import_zod26.z.string(),
+          interval: import_zod26.z.string(),
+          billingUrl: import_zod26.z.string().url(),
+          terminalCommand: import_zod26.z.string(),
+          terminalCommandWithApiKeyEnv: import_zod26.z.string()
+        })
+      }).nullable()
     };
     MapSiteUrlsOutputSchema = {
       startUrl: import_zod26.z.string(),
@@ -19955,8 +20576,26 @@ var init_mcp_tool_schemas = __esm({
         variations: import_zod26.z.number().int().nullable()
       }))
     };
+    FacebookVideoTranscribeOutputSchema = {
+      sourceUrl: import_zod26.z.string().url(),
+      pageUrl: import_zod26.z.string().url(),
+      videoId: NullableString,
+      ownerName: NullableString,
+      selectedQuality: import_zod26.z.string(),
+      bitrate: import_zod26.z.number().int().nullable(),
+      videoDurationSec: import_zod26.z.number().nullable(),
+      videoUrl: import_zod26.z.string().url(),
+      wordCount: import_zod26.z.number().int().min(0),
+      chunkCount: import_zod26.z.number().int().min(0),
+      transcriptText: import_zod26.z.string(),
+      chunks: import_zod26.z.array(import_zod26.z.object({
+        startSec: import_zod26.z.number(),
+        endSec: import_zod26.z.number(),
+        text: import_zod26.z.string()
+      }))
+    };
     CreditsInfoInputSchema = {
-      item: import_zod26.z.string().optional().describe('Optional tool, action, or feature to look up, e.g. "maps reviews", "extract_url", or "YouTube transcription"'),
+      item: import_zod26.z.string().optional().describe('Optional tool, action, or feature to look up, e.g. "maps reviews", "extract_url", "YouTube transcription", or "concurrency"'),
       includeLedger: import_zod26.z.boolean().default(false).describe("Whether to include recent credit ledger entries")
     };
     SearchSerpInputSchema = {
@@ -20462,6 +21101,13 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
     inputSchema: FacebookAdTranscribeInputSchema,
     annotations: liveWebToolAnnotations("Facebook Ad Transcription")
   }, async (input) => formatFacebookAdTranscribe(await executor.facebookAdTranscribe(input), input));
+  server.registerTool("facebook_video_transcribe", {
+    title: "Facebook Organic Video Transcription",
+    description: withReportNote("Transcribe audio from an organic Facebook reel, video, watch, or share URL. Renders the Facebook page, extracts the best public Facebook CDN MP4 URL from the page state, then returns the full transcript, timestamped chunks, and extracted MP4 URL."),
+    inputSchema: FacebookVideoTranscribeInputSchema,
+    outputSchema: FacebookVideoTranscribeOutputSchema,
+    annotations: liveWebToolAnnotations("Facebook Organic Video Transcription")
+  }, async (input) => formatFacebookVideoTranscribe(await executor.facebookVideoTranscribe(input), input));
   server.registerTool("maps_place_intel", {
     title: "Google Maps Business Profile Details",
     description: withReportNote('Extract Google Maps business intelligence for one known/named business: rating, review count, category, address, phone, website, hours, booking URL, review histogram, review topics, about attributes, entity IDs, and optional review cards. Do not use this for category searches, local market prospect lists, or requests for multiple GMB/GBP profiles; use maps_search first for those. Split business name from location (e.g. "Elite Roofing Denver CO" => businessName "Elite Roofing", location "Denver, CO"). Pass includeReviews true when the user asks for reviews/customer pain.'),
@@ -20492,7 +21138,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => buildRankTrackerBlueprint(input));
   server.registerTool("credits_info", {
     title: "MCP Scraper Credits & Costs",
-    description: "Answer questions about MCP Scraper credits: current credit balance, what a specific tool/action costs, the full cost table, and optionally recent credit ledger entries. Does not expose payment methods or credit card information.",
+    description: "Answer questions about MCP Scraper credits, usage limits, and concurrency upgrades: current credit balance, what a specific tool/action costs, the full cost table, current concurrency limit, the extra-slot price, billing URL, and the terminal checkout command. Does not expose payment methods or credit card information.",
     inputSchema: CreditsInfoInputSchema,
     outputSchema: CreditsInfoOutputSchema,
     annotations: {
@@ -20610,6 +21256,9 @@ var init_http_mcp_tool_executor = __esm({
       facebookAdTranscribe(input) {
         return this.call("/facebook/transcribe", input);
       }
+      facebookVideoTranscribe(input) {
+        return this.call("/facebook/video-transcribe", input, this.httpTimeoutOverrideMs ?? 24e4);
+      }
       mapsPlaceIntel(input) {
         return this.call("/maps/place", input);
       }
@@ -20725,6 +21374,7 @@ async function migrateBrowserAgent() {
       status              TEXT NOT NULL DEFAULT 'open',
       label               TEXT,
       user_id             INTEGER,
+      concurrency_lock_id TEXT,
       created_at          TEXT NOT NULL DEFAULT (datetime('now')),
       closed_at           TEXT,
       last_action_at      TEXT,
@@ -20734,6 +21384,11 @@ async function migrateBrowserAgent() {
   `);
   await db.execute(`CREATE INDEX IF NOT EXISTS browser_agent_sessions_status ON browser_agent_sessions(status)`);
   await db.execute(`CREATE INDEX IF NOT EXISTS browser_agent_sessions_user ON browser_agent_sessions(user_id)`);
+  try {
+    await db.execute(`ALTER TABLE browser_agent_sessions ADD COLUMN concurrency_lock_id TEXT`);
+  } catch {
+  }
+  await db.execute(`CREATE INDEX IF NOT EXISTS browser_agent_sessions_concurrency_lock ON browser_agent_sessions(concurrency_lock_id)`);
   await db.execute(`
     CREATE TABLE IF NOT EXISTS browser_agent_actions (
       id          TEXT PRIMARY KEY,
@@ -20761,11 +21416,11 @@ async function migrateBrowserAgent() {
 }
 async function createSessionRow(input) {
   const db = getDb();
-  const id = `bas_${(0, import_node_crypto4.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
+  const id = `bas_${(0, import_node_crypto5.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
-    sql: `INSERT INTO browser_agent_sessions (id, runtime_session_id, live_view_url, cdp_ws_url, status, label, user_id, last_action_at)
-          VALUES (?, ?, ?, ?, 'open', ?, ?, datetime('now'))`,
-    args: [id, input.runtimeSessionId, input.liveViewUrl, input.cdpWsUrl, input.label, input.userId]
+    sql: `INSERT INTO browser_agent_sessions (id, runtime_session_id, live_view_url, cdp_ws_url, status, label, user_id, concurrency_lock_id, last_action_at)
+          VALUES (?, ?, ?, ?, 'open', ?, ?, ?, datetime('now'))`,
+    args: [id, input.runtimeSessionId, input.liveViewUrl, input.cdpWsUrl, input.label, input.userId, input.concurrencyLockId ?? null]
   });
   const row = await getSessionRow(id);
   if (!row) throw new Error("session insert failed");
@@ -20822,7 +21477,7 @@ async function recordAction(input) {
     sql: `INSERT INTO browser_agent_actions (id, session_id, type, params_json, ok, error)
           VALUES (?, ?, ?, ?, ?, ?)`,
     args: [
-      `baa_${(0, import_node_crypto4.randomUUID)().replace(/-/g, "").slice(0, 20)}`,
+      `baa_${(0, import_node_crypto5.randomUUID)().replace(/-/g, "").slice(0, 20)}`,
       input.sessionId,
       input.type,
       input.params == null ? null : JSON.stringify(input.params),
@@ -20862,11 +21517,11 @@ async function listReplayRows(sessionId) {
   });
   return res.rows;
 }
-var import_node_crypto4, _ready;
+var import_node_crypto5, _ready;
 var init_browser_agent_db = __esm({
   "src/api/browser-agent-db.ts"() {
     "use strict";
-    import_node_crypto4 = require("crypto");
+    import_node_crypto5 = require("crypto");
     init_db();
     _ready = false;
   }
@@ -21186,6 +21841,12 @@ var init_browser_agent_service = __esm({
 });
 
 // src/api/browser-agent-routes.ts
+function browserSessionLockTtlSeconds(timeoutSeconds) {
+  if (typeof timeoutSeconds === "number" && Number.isFinite(timeoutSeconds) && timeoutSeconds > 0) {
+    return Math.max(30 * 60, Math.min(Math.trunc(timeoutSeconds) + 5 * 60, 24 * 60 * 60));
+  }
+  return DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS;
+}
 async function charge(sessionId, userId, startedAtMs) {
   const elapsedMs = Date.now() - startedAtMs;
   const { active_ms, billed_mc } = await addActiveMs(sessionId, elapsedMs);
@@ -21241,6 +21902,8 @@ async function loadOpenSession(id, userId) {
   const row = await getSessionRow(id);
   if (!row) return null;
   if (row.user_id != null && row.user_id !== userId) return null;
+  if (row.status !== "open") return null;
+  await extendConcurrencyGate(row.concurrency_lock_id, DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS);
   return row;
 }
 function buildBrowserAgentRoutes() {
@@ -21256,23 +21919,39 @@ function buildBrowserAgentRoutes() {
       return c.json(insufficientBalanceResponse(Number(user.balance_mc ?? 0), BROWSER_OPEN_MIN_BALANCE_MC), 402);
     }
     const body = await c.req.json().catch(() => ({}));
+    const timeoutSeconds = typeof body.timeout_seconds === "number" ? body.timeout_seconds : void 0;
+    const gate = await acquireConcurrencyGate(user, "browser_agent_session", {
+      ttlSeconds: browserSessionLockTtlSeconds(timeoutSeconds),
+      metadata: { label: typeof body.label === "string" ? body.label : null }
+    });
+    if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+    let runtimeSessionId = null;
     try {
       const created = await createSession({
-        timeoutSeconds: typeof body.timeout_seconds === "number" ? body.timeout_seconds : void 0,
+        timeoutSeconds,
         proxyId: typeof body.proxy_id === "string" ? body.proxy_id : void 0,
         profileName: typeof body.profile === "string" ? body.profile : void 0,
         disableDefaultProxy: body.disable_default_proxy === true,
         viewport: body.viewport && typeof body.viewport === "object" ? body.viewport : void 0
       });
+      runtimeSessionId = created.runtimeSessionId;
       const row = await createSessionRow({
         runtimeSessionId: created.runtimeSessionId,
         liveViewUrl: created.liveViewUrl,
         cdpWsUrl: created.cdpWsUrl,
         label: typeof body.label === "string" ? body.label : null,
-        userId: user.id
+        userId: user.id,
+        concurrencyLockId: gate.lockId
       });
       return c.json({ ...publicSession(row), watch_url: `/console/${row.id}` });
     } catch (err) {
+      if (runtimeSessionId) {
+        try {
+          await closeSession(runtimeSessionId);
+        } catch {
+        }
+      }
+      await releaseConcurrencyGate(gate.lockId);
       return c.json(failure(err), 502);
     }
   });
@@ -21303,6 +21982,7 @@ function buildBrowserAgentRoutes() {
     } catch {
     }
     await markSessionClosed(row.id);
+    await releaseConcurrencyGate(row.concurrency_lock_id);
     return c.json({ ok: true });
   });
   app2.post("/sessions/:id/goto", async (c) => {
@@ -21560,7 +22240,7 @@ function buildBrowserAgentRoutes() {
   });
   return app2;
 }
-var import_hono10, auth;
+var import_hono10, auth, DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS;
 var init_browser_agent_routes = __esm({
   "src/api/browser-agent-routes.ts"() {
     "use strict";
@@ -21571,7 +22251,9 @@ var init_browser_agent_routes = __esm({
     init_rates();
     init_browser_agent_db();
     init_browser_agent_service();
+    init_concurrency_gates();
     auth = createApiKeyAuth();
+    DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS = 2 * 60 * 60;
   }
 });
 
@@ -22073,14 +22755,14 @@ function getSessionSecret() {
 function safeEqualHex(a, b) {
   if (a.length !== b.length) return false;
   try {
-    return (0, import_node_crypto5.timingSafeEqual)(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+    return (0, import_node_crypto6.timingSafeEqual)(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
   } catch {
     return false;
   }
 }
 function signSession(userId) {
   const payload = String(userId);
-  const sig = (0, import_node_crypto5.createHmac)("sha256", secret()).update(payload).digest("hex");
+  const sig = (0, import_node_crypto6.createHmac)("sha256", secret()).update(payload).digest("hex");
   return `${payload}.${sig}`;
 }
 function verifySession(token) {
@@ -22088,16 +22770,16 @@ function verifySession(token) {
   if (dot === -1) return null;
   const payload = token.slice(0, dot);
   const sig = token.slice(dot + 1);
-  const expected = (0, import_node_crypto5.createHmac)("sha256", secret()).update(payload).digest("hex");
+  const expected = (0, import_node_crypto6.createHmac)("sha256", secret()).update(payload).digest("hex");
   if (!safeEqualHex(sig, expected)) return null;
   const id = parseInt(payload);
   return isNaN(id) ? null : id;
 }
-var import_node_crypto5, isProduction, secret;
+var import_node_crypto6, isProduction, secret;
 var init_session = __esm({
   "src/api/session.ts"() {
     "use strict";
-    import_node_crypto5 = require("crypto");
+    import_node_crypto6 = require("crypto");
     isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
     secret = () => getSessionSecret();
   }
@@ -22306,14 +22988,23 @@ function countPaaQuestions2(result) {
 function paaCostForQuestionCount2(questionCount) {
   return Math.max(1, questionCount) * MC_COSTS.paa;
 }
-async function checkHarvestLimits(userId, email, extraSlots = 0) {
-  if (BYPASS_EMAILS.has(email)) return null;
-  const limit = 1 + extraSlots;
-  const active = await countActiveJobsForUser(userId);
-  if (active >= limit) return { error: `You have ${active} job${active !== 1 ? "s" : ""} running. Your account allows ${limit} concurrent job${limit !== 1 ? "s" : ""}. Wait for one to finish or add a concurrency slot at mcpscraper.dev/billing.` };
+async function checkHarvestLimits(user, reuseLockId) {
+  if (reuseLockId && await reuseExistingConcurrencyGate(user.id, reuseLockId, 30 * 60)) return null;
+  if (isConcurrencyLimitBypassed(user)) return null;
+  const limit = concurrencyLimitForUser(user);
+  const active = await countActiveUsageForUser(user.id);
+  if (active >= limit) {
+    return concurrencyLimitExceededResponse({
+      ok: false,
+      active,
+      limit,
+      operation: "harvest",
+      retryAfterSeconds: 30
+    });
+  }
   return null;
 }
-var import_resend, import_hono12, import_hono13, import_factory6, import_cookie, import_stripe2, secureCookies, isProduction2, sessionCookieOptions, requireAllowedOrigin, auth2, adminAuth, sessionAuth, app, STRIPE_API_VERSION, BYPASS_EMAILS, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
+var import_resend, import_hono12, import_hono13, import_factory6, import_cookie, import_stripe2, secureCookies, isProduction2, sessionCookieOptions, requireAllowedOrigin, auth2, adminAuth, sessionAuth, app, STRIPE_API_VERSION, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
 var init_server = __esm({
   "src/api/server.ts"() {
     "use strict";
@@ -22359,6 +23050,7 @@ var init_server = __esm({
     init_harvest_problems();
     init_harvest_attempt_events();
     init_session();
+    init_concurrency_gates();
     secureCookies = process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
     isProduction2 = secureCookies;
     sessionCookieOptions = {
@@ -22555,9 +23247,6 @@ var init_server = __esm({
       await revokeApiKey(user.id);
       return c.json({ ok: true });
     });
-    BYPASS_EMAILS = new Set(
-      (process.env.HARVEST_LIMIT_BYPASS_EMAILS ?? "").split(",").map((e) => e.trim()).filter(Boolean)
-    );
     SYNC_HARVEST_TIMEOUT_OVERRIDE_MS = (() => {
       const raw = process.env.SYNC_HARVEST_TIMEOUT_MS;
       const parsed = raw === void 0 ? NaN : Number(raw);
@@ -22575,8 +23264,8 @@ var init_server = __esm({
         if (checked.error) return c.json({ error: checked.error }, 400);
         body.callback_url = checked.parsed?.href;
       }
-      const limitErr = await checkHarvestLimits(user.id, user.email, user.extra_concurrency_slots);
-      if (limitErr) return c.json(limitErr, 429);
+      const limitErr = await checkHarvestLimits(user, c.req.header("x-mcp-scraper-concurrency-lock"));
+      if (limitErr) return c.json(limitErr, 429, { "Retry-After": "30" });
       const options = {
         query: body.query.trim(),
         location: body.location,
@@ -22611,8 +23300,8 @@ var init_server = __esm({
       const bodyResult = HarvestBodySchema.safeParse(raw);
       if (!bodyResult.success) return c.json({ error: bodyResult.error.issues[0]?.message ?? "Invalid request" }, 400);
       const body = bodyResult.data;
-      const limitErr = await checkHarvestLimits(user.id, user.email, user.extra_concurrency_slots);
-      if (limitErr) return c.json(limitErr, 429);
+      const limitErr = await checkHarvestLimits(user, c.req.header("x-mcp-scraper-concurrency-lock"));
+      if (limitErr) return c.json(limitErr, 429, { "Retry-After": "30" });
       const options = {
         query: body.query.trim(),
         location: body.location,
@@ -22771,9 +23460,16 @@ var init_server = __esm({
         }
       })();
       const user = c.get("user");
-      const { ok: euOk, balance_mc: euBal } = await debitMc(user.id, MC_COSTS.page_scrape, LedgerOperation.EXTRACT_URL, new URL(canonicalUrl).hostname);
-      if (!euOk) return c.json(insufficientBalanceResponse(euBal, MC_COSTS.page_scrape), 402);
+      const gate = await acquireConcurrencyGate(user, "extract_url", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { url: canonicalUrl }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let debited = false;
       try {
+        const { ok: euOk, balance_mc: euBal } = await debitMc(user.id, MC_COSTS.page_scrape, LedgerOperation.EXTRACT_URL, new URL(canonicalUrl).hostname);
+        if (!euOk) return c.json(insufficientBalanceResponse(euBal, MC_COSTS.page_scrape), 402);
+        debited = true;
         const kernelApiKey = browserServiceApiKey();
         const device = screenshotDevice === "mobile" ? "mobile" : "desktop";
         const [result, pageData] = await Promise.all([
@@ -22791,9 +23487,11 @@ var init_server = __esm({
         return c.json({ ...result, screenshot: screenshotMeta, branding: brandingData, media: mediaMeta });
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        await creditMc(user.id, MC_COSTS.page_scrape, LedgerOperation.EXTRACT_URL, "failed call");
+        if (debited) await creditMc(user.id, MC_COSTS.page_scrape, LedgerOperation.EXTRACT_URL, "failed call");
         await logRequestEvent({ userId: user.id, source: "extract_url", status: "failed", query: canonicalUrl, error: msg });
         return c.json({ error: msg }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     app.post("/map-urls", auth2, async (c) => {
@@ -22805,9 +23503,16 @@ var init_server = __esm({
       if (checked.error || !checked.parsed) return c.json({ error: checked.error ?? "Invalid URL" }, 400);
       const parsed = checked.parsed;
       const user = c.get("user");
-      const { ok: mapOk, balance_mc: mapBal } = await debitMc(user.id, MC_COSTS.url_map, LedgerOperation.URL_MAP, parsed.hostname);
-      if (!mapOk) return c.json(insufficientBalanceResponse(mapBal, MC_COSTS.url_map), 402);
+      const gate = await acquireConcurrencyGate(user, "map_urls", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { url: parsed.href }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let debited = false;
       try {
+        const { ok: mapOk, balance_mc: mapBal } = await debitMc(user.id, MC_COSTS.url_map, LedgerOperation.URL_MAP, parsed.hostname);
+        if (!mapOk) return c.json(insufficientBalanceResponse(mapBal, MC_COSTS.url_map), 402);
+        debited = true;
         const result = await spiderSite({
           startUrl: parsed.href,
           maxUrls: Math.min(2e3, Math.max(1, body.maxUrls ?? 500)),
@@ -22825,7 +23530,7 @@ var init_server = __esm({
         return c.json(result);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        await creditMc(user.id, MC_COSTS.url_map, LedgerOperation.URL_MAP_REFUND, "failed call");
+        if (debited) await creditMc(user.id, MC_COSTS.url_map, LedgerOperation.URL_MAP_REFUND, "failed call");
         await logRequestEvent({
           userId: user.id,
           source: "map_urls",
@@ -22834,6 +23539,8 @@ var init_server = __esm({
           error: msg
         });
         return c.json({ error: msg }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     app.post("/extract-site", auth2, async (c) => {
@@ -22846,9 +23553,16 @@ var init_server = __esm({
       const parsed = checked.parsed;
       const user = c.get("user");
       const siteHoldMc = MC_COSTS.page_scrape * 10;
-      const { ok: siteOk, balance_mc: siteBal } = await debitMc(user.id, siteHoldMc, LedgerOperation.EXTRACT_SITE_HOLD, parsed.hostname);
-      if (!siteOk) return c.json(insufficientBalanceResponse(siteBal, siteHoldMc), 402);
+      const gate = await acquireConcurrencyGate(user, "extract_site", {
+        reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+        metadata: { url: parsed.href }
+      });
+      if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+      let debited = false;
       try {
+        const { ok: siteOk, balance_mc: siteBal } = await debitMc(user.id, siteHoldMc, LedgerOperation.EXTRACT_SITE_HOLD, parsed.hostname);
+        if (!siteOk) return c.json(insufficientBalanceResponse(siteBal, siteHoldMc), 402);
+        debited = true;
         const result = await extractSite({
           startUrl: parsed.href,
           maxPages: Math.min(200, Math.max(1, body.maxPages ?? 100)),
@@ -22869,7 +23583,7 @@ var init_server = __esm({
         });
         return c.json(result);
       } catch (err) {
-        await creditMc(user.id, siteHoldMc, LedgerOperation.EXTRACT_SITE_REFUND, "failed call");
+        if (debited) await creditMc(user.id, siteHoldMc, LedgerOperation.EXTRACT_SITE_REFUND, "failed call");
         const msg = err instanceof Error ? err.message : String(err);
         await logRequestEvent({
           userId: user.id,
@@ -22879,6 +23593,8 @@ var init_server = __esm({
           error: msg
         });
         return c.json({ error: msg }, 500);
+      } finally {
+        await releaseConcurrencyGate(gate.lockId);
       }
     });
     app.post("/billing/checkout", requireAllowedOrigin, sessionAuth, async (c) => {
@@ -22947,6 +23663,60 @@ var init_server = __esm({
         return c.json({ error: message }, 500);
       }
     });
+    app.post("/billing/concurrency/terminal-checkout", auth2, async (c) => {
+      try {
+        const user = c.get("user");
+        const upgrade = concurrencySlotBillingInfo();
+        if (user.concurrency_stripe_sub_id) {
+          return c.json({
+            error: "Already subscribed. Your account already has an active extra concurrency slot subscription.",
+            error_code: "concurrency_subscription_exists",
+            concurrency: {
+              extra_slots: user.extra_concurrency_slots,
+              limit: concurrencyLimitForUser(user),
+              has_subscription: true,
+              upgrade
+            }
+          }, 409);
+        }
+        const secret2 = process.env.STRIPE_SECRET_KEY?.trim();
+        if (!secret2) return c.json({ error: "Stripe is not configured." }, 503);
+        const stripeClient = new import_stripe2.default(secret2, { apiVersion: STRIPE_API_VERSION });
+        let customerId = user.stripe_customer_id;
+        if (!customerId) {
+          const customer = await stripeClient.customers.create({ email: user.email });
+          customerId = customer.id;
+          await setStripeCustomerId(user.id, customerId);
+        }
+        const session = await stripeClient.checkout.sessions.create({
+          customer: customerId,
+          mode: "subscription",
+          line_items: [{ price: CONCURRENCY_PRICE_ID, quantity: 1 }],
+          automatic_tax: { enabled: true },
+          billing_address_collection: "required",
+          customer_update: { address: "auto", name: "auto" },
+          tax_id_collection: { enabled: true },
+          success_url: `${appOrigin()}/billing?slot_added=1&source=terminal`,
+          cancel_url: `${appOrigin()}/billing?slot_cancelled=1&source=terminal`
+        });
+        if (!session.url) return c.json({ error: "Stripe did not return a checkout URL." }, 502);
+        return c.json({
+          checkout_url: session.url,
+          price: upgrade,
+          concurrency: {
+            current_extra_slots: user.extra_concurrency_slots,
+            current_limit: concurrencyLimitForUser(user),
+            after_checkout_extra_slots: user.extra_concurrency_slots + 1,
+            after_checkout_limit: concurrencyLimitForUser({ extra_concurrency_slots: user.extra_concurrency_slots + 1 })
+          },
+          next_step: "Open checkout_url in a browser, complete checkout, then restart or retry the MCP request."
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Unable to start terminal checkout.";
+        console.error("[billing/concurrency/terminal-checkout]", message);
+        return c.json({ error: message }, 500);
+      }
+    });
     app.post("/billing/concurrency/cancel", requireAllowedOrigin, sessionAuth, async (c) => {
       const user = c.get("sessionUser");
       if (!user.concurrency_stripe_sub_id) return c.json({ error: "No active concurrency subscription." }, 404);
@@ -22954,9 +23724,10 @@ var init_server = __esm({
       if (!stripeSecret) return c.json({ error: "Stripe is not configured." }, 503);
       const stripeClient = new import_stripe2.default(stripeSecret, { apiVersion: STRIPE_API_VERSION });
       await stripeClient.subscriptions.cancel(user.concurrency_stripe_sub_id);
-      await setExtraConcurrencySlots(user.id, Math.max(0, user.extra_concurrency_slots - 1));
+      const nextSlots = Math.max(0, user.extra_concurrency_slots - 1);
+      await setExtraConcurrencySlots(user.id, nextSlots);
       await setConcurrencySubId(user.id, null);
-      return c.json({ ok: true, concurrency_limit: user.extra_concurrency_slots });
+      return c.json({ ok: true, extra_concurrency_slots: nextSlots, concurrency_limit: 1 + nextSlots });
     });
     app.get("/billing/balance", auth2, async (c) => {
       const user = c.get("user");
@@ -22991,6 +23762,12 @@ var init_server = __esm({
         item: body.item ?? null,
         matched_cost: matchedCost ? (({ aliases, ...cost }) => cost)(matchedCost) : null,
         costs,
+        concurrency: {
+          current_extra_slots: user.extra_concurrency_slots,
+          current_limit: concurrencyLimitForUser(user),
+          has_subscription: !!user.concurrency_stripe_sub_id,
+          upgrade: concurrencySlotBillingInfo()
+        },
         ledger
       });
     });