mcp-scraper 0.21.0 → 0.21.2

package/dist/{server-PH3VJ74X.js → server-CHTX6YQA.js}

@@ -35,7 +35,7 @@ import {
   sanitizeAttempts,
   sanitizeHarvestResult,
   transcribeMediaUrl
-} from "./chunk-XHJJQRNQ.js";
+} from "./chunk-ZNNYPE2U.js";
 import {
   auditImages,
   buildLinkReport,
@@ -77,7 +77,7 @@ import {
   RawMapsOverviewSchema,
   RawMapsReviewStatsSchema
 } from "./chunk-XGIPATLV.js";
-import "./chunk-L4LMSXLO.js";
+import "./chunk-NBF4F4UT.js";
 import {
   completeExtractJob,
   countSuccessfulPages,
@@ -88,7 +88,7 @@ import {
   saveExtractPages,
   setExtractJobTotal,
   settleExtractJob
-} from "./chunk-TUSLATZY.js";
+} from "./chunk-X3NIXHHG.js";
 import {
   BROWSER_OPEN_MIN_BALANCE_MC,
   CONCURRENCY_PRICE_ID,
@@ -108,7 +108,6 @@ import {
   SCHEDULED_RUN_BASE_CREDITS,
   SCHEDULED_RUN_BASE_MC,
   SCHEDULED_RUN_DEFAULT_MAX_CREDITS,
-  SCHEDULING_PLANS,
   SITE_AUDIT_LLM_MARGIN_MULTIPLE,
   SUBSCRIPTION_TIERS,
   SUBSCRIPTION_TIER_BY_KEY,
@@ -118,7 +117,7 @@ import {
   concurrencySlotBillingInfo,
   insufficientBalanceResponse,
   vendorCostUsdToMc
-} from "./chunk-HXGZMMW5.js";
+} from "./chunk-2FF4GBQ4.js";
 import {
   CaptchaError,
   RECAPTCHA_INSTRUCTIONS,
@@ -7985,6 +7984,46 @@ import { z as z10 } from "zod";
 
 // src/api/unified-billing.ts
 import { createHash as createHash2, createHmac, randomUUID, timingSafeEqual } from "crypto";
+
+// src/api/scheduling-access.ts
+var PAID_PLAN_REQUIRED_CODE = "paid_plan_required";
+var PAID_PLAN_REQUIRED_MESSAGE = "Scheduled Actions requires an active MCP Scraper Starter plan or higher.";
+function hasPaidSchedulingAccess(user) {
+  return typeof user.subscription_tier === "string" && user.subscription_tier.trim().length > 0;
+}
+function paidPlanRequiredPayload() {
+  return {
+    ok: false,
+    enabled: false,
+    code: PAID_PLAN_REQUIRED_CODE,
+    error: PAID_PLAN_REQUIRED_MESSAGE,
+    billingMode: "credits",
+    runBaseCredits: SCHEDULED_RUN_BASE_CREDITS,
+    llmCostMultiplier: SCHEDULED_AGENT_LLM_MARKUP
+  };
+}
+var PLAN_GATED_MEMORY_SCHEDULE_TOOLS = /* @__PURE__ */ new Set([
+  "createScheduledActionTool",
+  "getScheduleLinkTool",
+  "resumeScheduledActionTool"
+]);
+function memoryScheduleAccessPayload(upstreamName, user) {
+  if (hasPaidSchedulingAccess(user)) return null;
+  if (upstreamName === "getScheduleStatusTool") return paidPlanRequiredPayload();
+  if (PLAN_GATED_MEMORY_SCHEDULE_TOOLS.has(upstreamName)) {
+    return {
+      ok: false,
+      code: PAID_PLAN_REQUIRED_CODE,
+      error: PAID_PLAN_REQUIRED_MESSAGE
+    };
+  }
+  return null;
+}
+function memoryScheduleToolNeedsCredentials(upstreamName) {
+  return upstreamName === "createScheduledActionTool" || upstreamName === "getScheduleLinkTool";
+}
+
+// src/api/unified-billing.ts
 var SCHEDULED_RUN_BILLING_CLASS = "scheduled_agent_run";
 var SCHEDULED_RUN_SOURCE_SURFACE = "mastra_scheduler";
 var AUTHORIZATION_TTL_MS = 30 * 60 * 1e3;
@@ -8012,6 +8051,19 @@ function normalizeIdentity(identity) {
   }
   return normalized;
 }
+async function resolveSchedulingUser(identity) {
+  const user = await getUserByEmail(normalizeIdentity(identity));
+  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
+  return user;
+}
+async function getSchedulingAccess(identity) {
+  const user = await getUserByEmail(normalizeIdentity(identity));
+  if (!user) return { allowed: false, subscriptionTier: null };
+  return {
+    allowed: hasPaidSchedulingAccess(user),
+    subscriptionTier: user.subscription_tier
+  };
+}
 function normalizeIdempotencyKey(value) {
   const key = value.trim();
   if (!key || key.length > 500) {
@@ -8093,8 +8145,10 @@ function mapEvent(row, balanceMc, duplicate) {
 async function authorizeScheduledRun(args) {
   const identity = normalizeIdentity(args.identity);
   const idempotencyKey = normalizeIdempotencyKey(args.idempotencyKey);
-  const user = await getUserByEmail(identity);
-  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
+  const user = await resolveSchedulingUser(identity);
+  if (!hasPaidSchedulingAccess(user)) {
+    throw new UnifiedBillingError(PAID_PLAN_REQUIRED_CODE, PAID_PLAN_REQUIRED_MESSAGE, 403);
+  }
   const pending = await getDb().execute({
     sql: "SELECT id FROM billing_events WHERE user_id = ? AND billing_class = ? AND status = 'cost_pending' LIMIT 1",
     args: [user.id, SCHEDULED_RUN_BILLING_CLASS]
@@ -8356,9 +8410,187 @@ async function voidScheduledRunAuthorization(args) {
   return { ok: true, status: authorization.status };
 }
 
+// src/api/memory.ts
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
+
+// src/api/session.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
+function getSessionSecret() {
+  const configured = process.env.SESSION_SECRET?.trim();
+  if (configured) return configured;
+  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
+  return "dev-secret-change-me";
+}
+var secret = () => getSessionSecret();
+function safeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual2(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+function signSession(userId) {
+  const payload = String(userId);
+  const sig = createHmac2("sha256", secret()).update(payload).digest("hex");
+  return `${payload}.${sig}`;
+}
+function verifySession(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot === -1) return null;
+  const payload = token.slice(0, dot);
+  const sig = token.slice(dot + 1);
+  const expected = createHmac2("sha256", secret()).update(payload).digest("hex");
+  if (!safeEqualHex(sig, expected)) return null;
+  const id = parseInt(payload);
+  return isNaN(id) ? null : id;
+}
+
+// src/api/memory.ts
+import { provisionDefaultsTool } from "mcpscraper-memory-tools/tools/vaults/provision-defaults";
+import { setScheduleEntitlementTool } from "mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement";
+var MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
+var ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
+function parseMemoryRpcBody(text) {
+  const dataLine = text.split("\n").find((line) => line.startsWith("data:"));
+  const payload = dataLine ? dataLine.slice(5).trim() : text;
+  return JSON.parse(payload);
+}
+function isMemoryOperator(email) {
+  if (!email) return false;
+  const ops = (process.env.MEMORY_OPERATOR_IDENTITIES ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  return ops.includes(email.trim().toLowerCase());
+}
+function encKey() {
+  return scryptSync(getSessionSecret(), "mcp-memory-key-v1", 32);
+}
+function encryptMemoryKey(secret2) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", encKey(), iv);
+  const enc = Buffer.concat([cipher.update(secret2, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
+}
+function decryptMemoryKey(stored) {
+  try {
+    const [ivB, tagB, dataB] = stored.split(":");
+    const decipher = createDecipheriv("aes-256-gcm", encKey(), Buffer.from(ivB, "base64"));
+    decipher.setAuthTag(Buffer.from(tagB, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+async function memoryCall(toolName, args, userMemoryKey) {
+  try {
+    const res = await fetch(`${MEMORY_BASE_URL()}/mcp`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        authorization: `Bearer ${userMemoryKey}`
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "tools/call",
+        params: { name: toolName, arguments: args }
+      })
+    });
+    const text = await res.text();
+    if (!res.ok) return { ok: false, error: `memory ${toolName} failed (${res.status})` };
+    const body = parseMemoryRpcBody(text);
+    if (body.error) return { ok: false, error: body.error.message ?? `memory ${toolName} failed` };
+    if (body.result?.structuredContent) return body.result.structuredContent;
+    const textContent = body.result?.content?.find((c) => c.type === "text")?.text;
+    if (textContent) {
+      try {
+        return JSON.parse(textContent);
+      } catch {
+        return { ok: false, error: textContent };
+      }
+    }
+    return { ok: false, error: `memory ${toolName} returned no result` };
+  } catch (err) {
+    return { ok: false, error: err?.message ?? "memory call failed" };
+  }
+}
+function memoryIdentity(user) {
+  return user.email;
+}
+function resolveMemoryIdentity(user) {
+  return memoryIdentity(user);
+}
+function memoryPlanForReads(user) {
+  if (isMemoryOperator(user.email)) return "unlimited";
+  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
+  return "free";
+}
+async function provisionMemoryForUser(user) {
+  try {
+    const { key } = await getOrCreateUserMemoryKey(user);
+    if (key) await setMemoryProvisioned(user.id, true);
+  } catch {
+  }
+}
+function resolveEffectiveMemoryPlan(user) {
+  return user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
+}
+async function getOrCreateUserMemoryKey(user) {
+  const creds = await getUserMemoryCreds(user.id);
+  if (creds.memory_key) {
+    const decrypted = decryptMemoryKey(creds.memory_key);
+    if (decrypted) return { key: decrypted };
+  }
+  const admin = ADMIN_KEY();
+  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
+  const identity = memoryIdentity(user);
+  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
+  const provisioned = await provisionDefaultsTool.execute(
+    { apiKey: admin, granteeIdentity: identity, issueKey: true, plan },
+    {}
+  );
+  if (!provisioned.ok || !provisioned.secret) {
+    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
+  }
+  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
+  return { key: provisioned.secret };
+}
+async function syncMemoryKeyPlan(user, plan) {
+  const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
+  const { key, error } = await getOrCreateUserMemoryKey(user);
+  if (!key) return { ok: false, error: error ?? "memory unavailable" };
+  const listed = await memoryCall(
+    "listKeysTool",
+    {},
+    key
+  );
+  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
+  const target = listed.keys[0];
+  if (target.plan === effectivePlan) return { ok: true };
+  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key);
+  return { ok: res.ok, error: res.error };
+}
+async function syncScheduledActionCredentials(user) {
+  const admin = ADMIN_KEY();
+  if (!admin) return { ok: false, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
+  const identity = resolveMemoryIdentity(user);
+  const res = await setScheduleEntitlementTool.execute({
+    apiKey: admin,
+    granteeIdentity: identity,
+    mcpScraperApiKey: user.api_key
+  }, {});
+  return { ok: res.ok, error: res.error };
+}
+
 // src/api/internal-billing-routes.ts
 var internalBillingApp = new Hono3();
 var metadataSchema = z10.record(z10.unknown()).optional();
+var schedulingAccessSchema = z10.object({
+  identity: z10.string().min(1).max(320),
+  provisionCredentials: z10.boolean().optional()
+});
 var authorizeSchema = z10.object({
   identity: z10.string().min(1).max(320),
   idempotencyKey: z10.string().min(1).max(500),
@@ -8424,6 +8656,41 @@ internalBillingApp.post("/scheduled-run/authorize", async (c) => {
     return c.json(response.body, response.status);
   }
 });
+internalBillingApp.post("/scheduling-access", async (c) => {
+  const parsed = schedulingAccessSchema.safeParse(await c.req.json().catch(() => null));
+  if (!parsed.success) {
+    return c.json({ ok: false, error_code: "invalid_request", error: "invalid scheduling access request" }, 400);
+  }
+  try {
+    const access2 = await getSchedulingAccess(parsed.data.identity);
+    if (access2.allowed && parsed.data.provisionCredentials) {
+      const user = await getUserByEmail(parsed.data.identity.trim().toLowerCase());
+      if (!user) {
+        return c.json({ ok: false, error_code: "user_not_found", error: "billing identity was not found" }, 404);
+      }
+      const credentials = await syncScheduledActionCredentials(user);
+      if (!credentials.ok) {
+        return c.json({
+          ok: false,
+          error_code: "schedule_credentials_unavailable",
+          error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+        }, 503);
+      }
+    }
+    return c.json({
+      ok: true,
+      allowed: access2.allowed,
+      subscriptionTier: access2.subscriptionTier,
+      ...access2.allowed ? {} : {
+        error_code: PAID_PLAN_REQUIRED_CODE,
+        error: PAID_PLAN_REQUIRED_MESSAGE
+      }
+    });
+  } catch (error) {
+    const response = billingError(error);
+    return c.json(response.body, response.status);
+  }
+});
 internalBillingApp.post("/scheduled-run/settle", async (c) => {
   const parsed = settleSchema.safeParse(await c.req.json().catch(() => null));
   if (!parsed.success) {
@@ -12198,184 +12465,6 @@ redditApp.post("/thread", createApiKeyAuth(), async (c) => {
 // src/api/video-routes.ts
 import { Hono as Hono10 } from "hono";
 import { z as z18 } from "zod";
-
-// src/api/memory.ts
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
-
-// src/api/session.ts
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
-function getSessionSecret() {
-  const configured = process.env.SESSION_SECRET?.trim();
-  if (configured) return configured;
-  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
-  return "dev-secret-change-me";
-}
-var secret = () => getSessionSecret();
-function safeEqualHex(a, b) {
-  if (a.length !== b.length) return false;
-  try {
-    return timingSafeEqual2(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-  } catch {
-    return false;
-  }
-}
-function signSession(userId) {
-  const payload = String(userId);
-  const sig = createHmac2("sha256", secret()).update(payload).digest("hex");
-  return `${payload}.${sig}`;
-}
-function verifySession(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot === -1) return null;
-  const payload = token.slice(0, dot);
-  const sig = token.slice(dot + 1);
-  const expected = createHmac2("sha256", secret()).update(payload).digest("hex");
-  if (!safeEqualHex(sig, expected)) return null;
-  const id = parseInt(payload);
-  return isNaN(id) ? null : id;
-}
-
-// src/api/memory.ts
-import { provisionDefaultsTool } from "mcpscraper-memory-tools/tools/vaults/provision-defaults";
-import { setScheduleEntitlementTool } from "mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement";
-var MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
-var ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
-function parseMemoryRpcBody(text) {
-  const dataLine = text.split("\n").find((line) => line.startsWith("data:"));
-  const payload = dataLine ? dataLine.slice(5).trim() : text;
-  return JSON.parse(payload);
-}
-function isMemoryOperator(email) {
-  if (!email) return false;
-  const ops = (process.env.MEMORY_OPERATOR_IDENTITIES ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
-  return ops.includes(email.trim().toLowerCase());
-}
-function encKey() {
-  return scryptSync(getSessionSecret(), "mcp-memory-key-v1", 32);
-}
-function encryptMemoryKey(secret2) {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", encKey(), iv);
-  const enc = Buffer.concat([cipher.update(secret2, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
-}
-function decryptMemoryKey(stored) {
-  try {
-    const [ivB, tagB, dataB] = stored.split(":");
-    const decipher = createDecipheriv("aes-256-gcm", encKey(), Buffer.from(ivB, "base64"));
-    decipher.setAuthTag(Buffer.from(tagB, "base64"));
-    return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
-  } catch {
-    return null;
-  }
-}
-async function memoryCall(toolName, args, userMemoryKey) {
-  try {
-    const res = await fetch(`${MEMORY_BASE_URL()}/mcp`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        accept: "application/json, text/event-stream",
-        authorization: `Bearer ${userMemoryKey}`
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "tools/call",
-        params: { name: toolName, arguments: args }
-      })
-    });
-    const text = await res.text();
-    if (!res.ok) return { ok: false, error: `memory ${toolName} failed (${res.status})` };
-    const body = parseMemoryRpcBody(text);
-    if (body.error) return { ok: false, error: body.error.message ?? `memory ${toolName} failed` };
-    if (body.result?.structuredContent) return body.result.structuredContent;
-    const textContent = body.result?.content?.find((c) => c.type === "text")?.text;
-    if (textContent) {
-      try {
-        return JSON.parse(textContent);
-      } catch {
-        return { ok: false, error: textContent };
-      }
-    }
-    return { ok: false, error: `memory ${toolName} returned no result` };
-  } catch (err) {
-    return { ok: false, error: err?.message ?? "memory call failed" };
-  }
-}
-function memoryIdentity(user) {
-  return user.email;
-}
-function resolveMemoryIdentity(user) {
-  return memoryIdentity(user);
-}
-function memoryPlanForReads(user) {
-  if (isMemoryOperator(user.email)) return "unlimited";
-  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
-  return "free";
-}
-async function provisionMemoryForUser(user) {
-  try {
-    const { key } = await getOrCreateUserMemoryKey(user);
-    if (key) await setMemoryProvisioned(user.id, true);
-  } catch {
-  }
-}
-function resolveEffectiveMemoryPlan(user) {
-  return user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
-}
-async function getOrCreateUserMemoryKey(user) {
-  const creds = await getUserMemoryCreds(user.id);
-  if (creds.memory_key) {
-    const decrypted = decryptMemoryKey(creds.memory_key);
-    if (decrypted) return { key: decrypted };
-  }
-  const admin = ADMIN_KEY();
-  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
-  const identity = memoryIdentity(user);
-  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
-  const provisioned = await provisionDefaultsTool.execute(
-    { apiKey: admin, granteeIdentity: identity, issueKey: true, plan },
-    {}
-  );
-  if (!provisioned.ok || !provisioned.secret) {
-    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
-  }
-  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
-  return { key: provisioned.secret };
-}
-async function syncMemoryKeyPlan(user, plan) {
-  const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
-  const { key, error } = await getOrCreateUserMemoryKey(user);
-  if (!key) return { ok: false, error: error ?? "memory unavailable" };
-  const listed = await memoryCall(
-    "listKeysTool",
-    {},
-    key
-  );
-  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
-  const target = listed.keys[0];
-  if (target.plan === effectivePlan) return { ok: true };
-  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key);
-  return { ok: res.ok, error: res.error };
-}
-async function syncScheduleEntitlement(user, enabled, quotaPerPeriod) {
-  const admin = ADMIN_KEY();
-  if (!admin) return { ok: false, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
-  const identity = resolveMemoryIdentity(user);
-  const res = await setScheduleEntitlementTool.execute({
-    apiKey: admin,
-    granteeIdentity: identity,
-    enabled,
-    quotaPerPeriod,
-    mcpScraperApiKey: user.api_key
-  }, {});
-  return { ok: res.ok, error: res.error };
-}
-
-// src/api/video-routes.ts
 var videoApp = new Hono10();
 var AnalyzeBodySchema = z18.object({
   sourceUrl: z18.string().trim().url("sourceUrl must be a direct video file URL"),
@@ -15816,6 +15905,29 @@ var HybridMemoryToolExecutor = class {
     return this.mkKeyPromise;
   }
   async callMemoryTool(upstreamName, args) {
+    const accessDenied = memoryScheduleAccessPayload(upstreamName, this.user);
+    if (accessDenied) {
+      return {
+        content: [{ type: "text", text: JSON.stringify(accessDenied) }],
+        structuredContent: accessDenied,
+        isError: false
+      };
+    }
+    if (memoryScheduleToolNeedsCredentials(upstreamName)) {
+      const credentials = await syncScheduledActionCredentials(this.user);
+      if (!credentials.ok) {
+        const result = {
+          ok: false,
+          code: "schedule_credentials_unavailable",
+          error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }],
+          structuredContent: result,
+          isError: false
+        };
+      }
+    }
     const handler = CUTOVER.get(upstreamName);
     if (!handler) return this.httpExecutor.callMemoryTool(upstreamName, args);
     const mkKey = await this.resolveMkKey();
@@ -18692,6 +18804,8 @@ stripeApp.post("/webhooks", async (c) => {
       if (user && invoice.id && !await ledgerExistsForStripePI(invoice.id)) {
         await creditMc(user.id, tier.credits_mc, LedgerOperation.SUBSCRIPTION, `${tier.label} subscription credits`, invoice.id);
         await setSubscriptionTier(user.id, tier.tier, tier.concurrency, invoice.subscription ?? user.subscription_id);
+        const credentials = await syncScheduledActionCredentials(user);
+        if (!credentials.ok) console.warn("[stripe] scheduled-action credential sync failed:", credentials.error ?? "unknown error");
       }
     }
   }
@@ -18709,15 +18823,6 @@ stripeApp.post("/webhooks", async (c) => {
       }
       return c.json({ received: true });
     }
-    if (priceId && priceId in SCHEDULING_PLANS) {
-      const sched = SCHEDULING_PLANS[priceId];
-      const user2 = await resolveUser(sub.customer, sub.customer_email);
-      if (user2) {
-        const live = sub.status === "active" || sub.status === "trialing";
-        await syncScheduleEntitlement(user2, live, sched.quota_per_period);
-      }
-      return c.json({ received: true });
-    }
     const user = await getUserByStripeCustomerId(sub.customer);
     if (!user) return c.json({ received: true });
     if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -18725,6 +18830,10 @@ stripeApp.post("/webhooks", async (c) => {
       const live = sub.status === "active" || sub.status === "trialing";
       const newTier = live ? tier.tier : null;
       await setSubscriptionTier(user.id, newTier, live ? tier.concurrency : 0, live ? sub.id : null);
+      if (live) {
+        const credentials = await syncScheduledActionCredentials(user);
+        if (!credentials.ok) console.warn("[stripe] scheduled-action credential sync failed:", credentials.error ?? "unknown error");
+      }
     } else if (priceId === CONCURRENCY_PRICE_ID && event.type === "customer.subscription.created") {
       await setExtraConcurrencySlots(user.id, user.extra_concurrency_slots + 1);
       await setConcurrencySubId(user.id, sub.id);
@@ -18741,11 +18850,6 @@ stripeApp.post("/webhooks", async (c) => {
       }
       return c.json({ received: true });
     }
-    if (priceId && priceId in SCHEDULING_PLANS) {
-      const user2 = await getUserByStripeCustomerId(sub.customer);
-      if (user2) await syncScheduleEntitlement(user2, false);
-      return c.json({ received: true });
-    }
     const user = await getUserByStripeCustomerId(sub.customer);
     if (!user) return c.json({ received: true });
     if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -22463,6 +22567,11 @@ var requireIntegrationsTier = createMiddleware3(async (c, next) => {
   }
   return next();
 });
+var requirePaidSchedulingTier = createMiddleware3(async (c, next) => {
+  const user = c.get("user");
+  if (!hasPaidSchedulingAccess(user)) return c.json(paidPlanRequiredPayload(), 403);
+  return next();
+});
 var app = new Hono24();
 var STRIPE_API_VERSION = "2026-02-25.clover";
 function requireStripeSecret() {
@@ -22773,6 +22882,18 @@ app.post("/memory/mcp-call", auth2, async (c) => {
   const user = c.get("user");
   const body = await c.req.json().catch(() => ({}));
   if (!body.toolName) return c.json({ ok: false, error: "toolName is required" }, 400);
+  const accessDenied = memoryScheduleAccessPayload(body.toolName, user);
+  if (accessDenied) return c.json(accessDenied);
+  if (memoryScheduleToolNeedsCredentials(body.toolName)) {
+    const credentials = await syncScheduledActionCredentials(user);
+    if (!credentials.ok) {
+      return c.json({
+        ok: false,
+        code: "schedule_credentials_unavailable",
+        error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+      }, 503);
+    }
+  }
   const { key, error } = await getOrCreateUserMemoryKey(user);
   if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 502);
   const result = await memoryCall(body.toolName, body.args ?? {}, key);
@@ -23078,7 +23199,7 @@ function renderResendOAuthResult(ok) {
   const message = ok ? "Your Resend account is connected privately to MCP Scraper. You can close this tab." : "The connection could not be completed. Close this tab and try again from Integrations.";
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>${title}</title><style>:root{color-scheme:light dark}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;background:#f5f2ee;color:#26211d;font-family:ui-sans-serif,system-ui,-apple-system,sans-serif}.card{width:min(100%,440px);padding:32px;border:1px solid #d8d0c8;border-radius:16px;background:#fff;box-shadow:0 18px 55px rgba(31,24,18,.1)}.mark{width:38px;height:38px;display:grid;place-items:center;border-radius:10px;background:#26211d;color:#fff;font-size:20px;font-weight:700}h1{margin:18px 0 8px;font-size:24px;line-height:1.15}p{margin:0;color:#71675f;line-height:1.55}a{display:inline-flex;margin-top:20px;color:#b44d36;font-weight:650;text-underline-offset:3px}@media(prefers-color-scheme:dark){body{background:#171411;color:#f4eee8}.card{background:#211d19;border-color:#3b342d}.mark{background:#f4eee8;color:#211d19}p{color:#b9aea5}}</style></head><body><main class="card"><div class="mark" aria-hidden="true">R</div><h1>${title}</h1><p>${message}</p><a href="/dashboard/integrations">Return to Integrations</a></main><script>if(window.opener){try{window.opener.postMessage({type:'mcp-scraper:resend-oauth',ok:${ok}},window.location.origin)}catch(e){}}setTimeout(function(){window.close()},1200)</script></body></html>`;
 }
-app.get("/schedule-status", auth2, async (c) => {
+app.get("/schedule-status", auth2, requirePaidSchedulingTier, async (c) => {
   try {
     const user = c.get("user");
     const { key, error } = await getOrCreateUserMemoryKey(user);
@@ -23445,9 +23566,13 @@ app.post("/schedule-connections/actions/call", auth2, requireIntegrationsTier, a
     return scheduleConnectionError(c, err, "Unable to run this connection action.");
   }
 });
-app.post("/schedule-link", auth2, async (c) => {
+app.post("/schedule-link", auth2, requirePaidSchedulingTier, async (c) => {
   try {
     const user = c.get("user");
+    const credentials = await syncScheduledActionCredentials(user);
+    if (!credentials.ok) {
+      return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
+    }
     const { key, error } = await getOrCreateUserMemoryKey(user);
     if (!key) return c.json({ error: error ?? "memory unavailable" }, 503);
     const r = await memoryCall("getScheduleLinkTool", {}, key);
@@ -23485,8 +23610,12 @@ app.get("/schedule-actions", auth2, async (c) => {
     });
   }
 });
-app.post("/schedule-actions", auth2, async (c) => {
+app.post("/schedule-actions", auth2, requirePaidSchedulingTier, async (c) => {
   const user = c.get("user");
+  const credentials = await syncScheduledActionCredentials(user);
+  if (!credentials.ok) {
+    return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
+  }
   const { key, error } = await getOrCreateUserMemoryKey(user);
   if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const body = await c.req.json().catch(() => ({}));
@@ -23578,7 +23707,7 @@ app.post("/schedule-actions/:id/pause", auth2, async (c) => {
   const r = await memoryCall("pauseScheduledActionTool", { id: c.req.param("id") }, key);
   return c.json(r);
 });
-app.post("/schedule-actions/:id/resume", auth2, async (c) => {
+app.post("/schedule-actions/:id/resume", auth2, requirePaidSchedulingTier, async (c) => {
   const user = c.get("user");
   const { key, error } = await getOrCreateUserMemoryKey(user);
   if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
@@ -24461,7 +24590,7 @@ app.get("/cron/tick", async (c) => {
   if (!process.env.CRON_SECRET || secret2 !== `Bearer ${process.env.CRON_SECRET}`) {
     return c.json({ error: "Unauthorized" }, 401);
   }
-  const { drainQueue } = await import("./worker-45WEWCMQ.js");
+  const { drainQueue } = await import("./worker-GE5JMHE6.js");
   const budget = { maxJobs: 10, deadlineMs: Date.now() + 28e4 };
   const workflowDispatchResult = await dispatchDueWorkflowSchedules(`${new URL(c.req.url).protocol}//${new URL(c.req.url).host}`);
   const [results, sweepResult, reapResult, expiredResult, blobCleanup, connectedDataArtifactCleanup] = await Promise.all([
@@ -24489,7 +24618,7 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
     return c.json({ error: "Unauthorized" }, 401);
   }
   const jobId = c.req.param("id");
-  const { getExtractJob: getExtractJob2, completeExtractJob: completeExtractJob2 } = await import("./site-extract-repository-YNPXEZCB.js");
+  const { getExtractJob: getExtractJob2, completeExtractJob: completeExtractJob2 } = await import("./site-extract-repository-5V5EEQ72.js");
   const { assembleExtractArtifacts } = await import("./extract-bundle-HMCYUVBJ.js");
   const job = await getExtractJob2(jobId);
   if (!job) return c.json({ error: "job not found" }, 404);
@@ -24497,7 +24626,7 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
   await completeExtractJob2(jobId, stored);
   let settlement = "already_settled_or_refunded";
   if (job.billedMc == null && job.userId != null) {
-    const { settleExtractJob: settleExtractJob2, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-YNPXEZCB.js");
+    const { settleExtractJob: settleExtractJob2, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-5V5EEQ72.js");
     const heldMc = Number(job.options.heldMc ?? 0);
     const successful = await countSuccessfulPages2(jobId);
     const usedMc = Math.min(successful * MC_COSTS.page_scrape, heldMc);
@@ -24663,4 +24792,4 @@ app.get("/blog/:slug/", (c) => {
 export {
   app
 };
-//# sourceMappingURL=server-PH3VJ74X.js.map
+//# sourceMappingURL=server-CHTX6YQA.js.map