mcp-scraper 0.21.1 → 0.21.2

package/dist/bin/api-server.cjs

@@ -8525,7 +8525,7 @@ function insufficientBalanceResponse(balanceMc, requiredMc) {
     topup_url: topupUrl
   };
 }
-var MC_COSTS, MC_PER_BROWSER_MS, BROWSER_OPEN_MIN_BALANCE_MC, MC_PER_CREDIT, BILLING_MC_PER_USD_NUMERATOR, BILLING_MC_PER_USD_DENOMINATOR, BILLING_BASIS_POINTS, USD_NANOS, SCHEDULED_RUN_BASE_CREDITS, SCHEDULED_RUN_BASE_MC, SCHEDULED_AGENT_LLM_MARKUP_BPS, SCHEDULED_AGENT_LLM_MARKUP, SCHEDULED_RUN_DEFAULT_MAX_CREDITS, CREDIT_COST_CATALOG, CONCURRENCY_PRICE_ID, SUBSCRIPTION_TIERS, SUBSCRIPTION_TIER_BY_KEY, CONCURRENCY_SLOT_PRICE_USD, CONCURRENCY_SLOT_PRICE_CURRENCY, CONCURRENCY_SLOT_PRICE_INTERVAL, CONCURRENCY_SLOT_PRICE_LABEL, CONCURRENCY_SLOT_TERMINAL_COMMAND, FREE_SIGNUP_MC, MEMORY_FREE_QUOTA_BYTES, MEMORY_PLANS, MEMORY_PLAN_QUOTA, MEMORY_MARGIN_MULTIPLE, MEMORY_PRO_COST_BUDGET_USD, SCHEDULING_PLANS, LedgerOperation, MEMORY_AI_MARGIN_MULTIPLE, SITE_AUDIT_LLM_MARGIN_MULTIPLE, VIDEO_ANALYSIS_LLM_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_HOLD_MC, MC_PER_USD;
+var MC_COSTS, MC_PER_BROWSER_MS, BROWSER_OPEN_MIN_BALANCE_MC, MC_PER_CREDIT, BILLING_MC_PER_USD_NUMERATOR, BILLING_MC_PER_USD_DENOMINATOR, BILLING_BASIS_POINTS, USD_NANOS, SCHEDULED_RUN_BASE_CREDITS, SCHEDULED_RUN_BASE_MC, SCHEDULED_AGENT_LLM_MARKUP_BPS, SCHEDULED_AGENT_LLM_MARKUP, SCHEDULED_RUN_DEFAULT_MAX_CREDITS, CREDIT_COST_CATALOG, CONCURRENCY_PRICE_ID, SUBSCRIPTION_TIERS, SUBSCRIPTION_TIER_BY_KEY, CONCURRENCY_SLOT_PRICE_USD, CONCURRENCY_SLOT_PRICE_CURRENCY, CONCURRENCY_SLOT_PRICE_INTERVAL, CONCURRENCY_SLOT_PRICE_LABEL, CONCURRENCY_SLOT_TERMINAL_COMMAND, FREE_SIGNUP_MC, MEMORY_FREE_QUOTA_BYTES, MEMORY_PLANS, MEMORY_PLAN_QUOTA, MEMORY_MARGIN_MULTIPLE, MEMORY_PRO_COST_BUDGET_USD, LedgerOperation, MEMORY_AI_MARGIN_MULTIPLE, SITE_AUDIT_LLM_MARGIN_MULTIPLE, VIDEO_ANALYSIS_LLM_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_HOLD_MC, MC_PER_USD;
 var init_rates = __esm({
   "src/api/rates.ts"() {
     "use strict";
@@ -8810,9 +8810,6 @@ var init_rates = __esm({
     MEMORY_PLAN_QUOTA = { free: MEMORY_FREE_QUOTA_BYTES, pro: 5e9, team: 5e10 };
     MEMORY_MARGIN_MULTIPLE = 3;
     MEMORY_PRO_COST_BUDGET_USD = 19 / MEMORY_MARGIN_MULTIPLE;
-    SCHEDULING_PLANS = {
-      "price_1ToXcHS8aAcsk3TGf3cW7zHx": { price_id: "price_1ToXcHS8aAcsk3TGf3cW7zHx", label: "Scheduled Actions", interval: "month", monthly_usd: 10, quota_per_period: 1e3 }
-    };
     LedgerOperation = {
       TOPUP: "topup",
       SUBSCRIPTION: "subscription",
@@ -11903,6 +11900,51 @@ var init_internal_memory_routes = __esm({
   }
 });
 
+// src/api/scheduling-access.ts
+function hasPaidSchedulingAccess(user) {
+  return typeof user.subscription_tier === "string" && user.subscription_tier.trim().length > 0;
+}
+function paidPlanRequiredPayload() {
+  return {
+    ok: false,
+    enabled: false,
+    code: PAID_PLAN_REQUIRED_CODE,
+    error: PAID_PLAN_REQUIRED_MESSAGE,
+    billingMode: "credits",
+    runBaseCredits: SCHEDULED_RUN_BASE_CREDITS,
+    llmCostMultiplier: SCHEDULED_AGENT_LLM_MARKUP
+  };
+}
+function memoryScheduleAccessPayload(upstreamName, user) {
+  if (hasPaidSchedulingAccess(user)) return null;
+  if (upstreamName === "getScheduleStatusTool") return paidPlanRequiredPayload();
+  if (PLAN_GATED_MEMORY_SCHEDULE_TOOLS.has(upstreamName)) {
+    return {
+      ok: false,
+      code: PAID_PLAN_REQUIRED_CODE,
+      error: PAID_PLAN_REQUIRED_MESSAGE
+    };
+  }
+  return null;
+}
+function memoryScheduleToolNeedsCredentials(upstreamName) {
+  return upstreamName === "createScheduledActionTool" || upstreamName === "getScheduleLinkTool";
+}
+var PAID_PLAN_REQUIRED_CODE, PAID_PLAN_REQUIRED_MESSAGE, PLAN_GATED_MEMORY_SCHEDULE_TOOLS;
+var init_scheduling_access = __esm({
+  "src/api/scheduling-access.ts"() {
+    "use strict";
+    init_rates();
+    PAID_PLAN_REQUIRED_CODE = "paid_plan_required";
+    PAID_PLAN_REQUIRED_MESSAGE = "Scheduled Actions requires an active MCP Scraper Starter plan or higher.";
+    PLAN_GATED_MEMORY_SCHEDULE_TOOLS = /* @__PURE__ */ new Set([
+      "createScheduledActionTool",
+      "getScheduleLinkTool",
+      "resumeScheduledActionTool"
+    ]);
+  }
+});
+
 // src/api/unified-billing.ts
 function billingSecret() {
   const secret2 = process.env.INTERNAL_BILLING_SECRET ?? process.env.INTERNAL_MEMORY_DEBIT_SECRET;
@@ -11916,6 +11958,19 @@ function normalizeIdentity(identity) {
   }
   return normalized;
 }
+async function resolveSchedulingUser(identity) {
+  const user = await getUserByEmail(normalizeIdentity(identity));
+  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
+  return user;
+}
+async function getSchedulingAccess(identity) {
+  const user = await getUserByEmail(normalizeIdentity(identity));
+  if (!user) return { allowed: false, subscriptionTier: null };
+  return {
+    allowed: hasPaidSchedulingAccess(user),
+    subscriptionTier: user.subscription_tier
+  };
+}
 function normalizeIdempotencyKey(value) {
   const key = value.trim();
   if (!key || key.length > 500) {
@@ -11997,8 +12052,10 @@ function mapEvent(row, balanceMc, duplicate) {
 async function authorizeScheduledRun(args) {
   const identity = normalizeIdentity(args.identity);
   const idempotencyKey = normalizeIdempotencyKey(args.idempotencyKey);
-  const user = await getUserByEmail(identity);
-  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
+  const user = await resolveSchedulingUser(identity);
+  if (!hasPaidSchedulingAccess(user)) {
+    throw new UnifiedBillingError(PAID_PLAN_REQUIRED_CODE, PAID_PLAN_REQUIRED_MESSAGE, 403);
+  }
   const pending = await getDb().execute({
     sql: "SELECT id FROM billing_events WHERE user_id = ? AND billing_class = ? AND status = 'cost_pending' LIMIT 1",
     args: [user.id, SCHEDULED_RUN_BILLING_CLASS]
@@ -12266,6 +12323,7 @@ var init_unified_billing = __esm({
     import_node_crypto4 = require("crypto");
     init_db();
     init_rates();
+    init_scheduling_access();
     SCHEDULED_RUN_BILLING_CLASS = "scheduled_agent_run";
     SCHEDULED_RUN_SOURCE_SURFACE = "mastra_scheduler";
     AUTHORIZATION_TTL_MS = 30 * 60 * 1e3;
@@ -12284,6 +12342,192 @@ var init_unified_billing = __esm({
   }
 });
 
+// src/api/session.ts
+function getSessionSecret() {
+  const configured = process.env.SESSION_SECRET?.trim();
+  if (configured) return configured;
+  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
+  return "dev-secret-change-me";
+}
+function safeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return (0, import_node_crypto5.timingSafeEqual)(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+function signSession(userId) {
+  const payload = String(userId);
+  const sig = (0, import_node_crypto5.createHmac)("sha256", secret()).update(payload).digest("hex");
+  return `${payload}.${sig}`;
+}
+function verifySession(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot === -1) return null;
+  const payload = token.slice(0, dot);
+  const sig = token.slice(dot + 1);
+  const expected = (0, import_node_crypto5.createHmac)("sha256", secret()).update(payload).digest("hex");
+  if (!safeEqualHex(sig, expected)) return null;
+  const id = parseInt(payload);
+  return isNaN(id) ? null : id;
+}
+var import_node_crypto5, isProduction, secret;
+var init_session = __esm({
+  "src/api/session.ts"() {
+    "use strict";
+    import_node_crypto5 = require("crypto");
+    isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
+    secret = () => getSessionSecret();
+  }
+});
+
+// src/api/memory.ts
+function parseMemoryRpcBody(text) {
+  const dataLine = text.split("\n").find((line) => line.startsWith("data:"));
+  const payload = dataLine ? dataLine.slice(5).trim() : text;
+  return JSON.parse(payload);
+}
+function isMemoryOperator(email) {
+  if (!email) return false;
+  const ops = (process.env.MEMORY_OPERATOR_IDENTITIES ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  return ops.includes(email.trim().toLowerCase());
+}
+function encKey() {
+  return (0, import_node_crypto6.scryptSync)(getSessionSecret(), "mcp-memory-key-v1", 32);
+}
+function encryptMemoryKey(secret2) {
+  const iv = (0, import_node_crypto6.randomBytes)(12);
+  const cipher = (0, import_node_crypto6.createCipheriv)("aes-256-gcm", encKey(), iv);
+  const enc = Buffer.concat([cipher.update(secret2, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
+}
+function decryptMemoryKey(stored) {
+  try {
+    const [ivB, tagB, dataB] = stored.split(":");
+    const decipher = (0, import_node_crypto6.createDecipheriv)("aes-256-gcm", encKey(), Buffer.from(ivB, "base64"));
+    decipher.setAuthTag(Buffer.from(tagB, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+async function memoryCall(toolName, args, userMemoryKey) {
+  try {
+    const res = await fetch(`${MEMORY_BASE_URL()}/mcp`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        authorization: `Bearer ${userMemoryKey}`
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "tools/call",
+        params: { name: toolName, arguments: args }
+      })
+    });
+    const text = await res.text();
+    if (!res.ok) return { ok: false, error: `memory ${toolName} failed (${res.status})` };
+    const body = parseMemoryRpcBody(text);
+    if (body.error) return { ok: false, error: body.error.message ?? `memory ${toolName} failed` };
+    if (body.result?.structuredContent) return body.result.structuredContent;
+    const textContent = body.result?.content?.find((c) => c.type === "text")?.text;
+    if (textContent) {
+      try {
+        return JSON.parse(textContent);
+      } catch {
+        return { ok: false, error: textContent };
+      }
+    }
+    return { ok: false, error: `memory ${toolName} returned no result` };
+  } catch (err) {
+    return { ok: false, error: err?.message ?? "memory call failed" };
+  }
+}
+function memoryIdentity(user) {
+  return user.email;
+}
+function resolveMemoryIdentity(user) {
+  return memoryIdentity(user);
+}
+function memoryPlanForReads(user) {
+  if (isMemoryOperator(user.email)) return "unlimited";
+  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
+  return "free";
+}
+async function provisionMemoryForUser(user) {
+  try {
+    const { key } = await getOrCreateUserMemoryKey(user);
+    if (key) await setMemoryProvisioned(user.id, true);
+  } catch {
+  }
+}
+function resolveEffectiveMemoryPlan(user) {
+  return user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
+}
+async function getOrCreateUserMemoryKey(user) {
+  const creds = await getUserMemoryCreds(user.id);
+  if (creds.memory_key) {
+    const decrypted = decryptMemoryKey(creds.memory_key);
+    if (decrypted) return { key: decrypted };
+  }
+  const admin = ADMIN_KEY();
+  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
+  const identity = memoryIdentity(user);
+  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
+  const provisioned = await import_provision_defaults.provisionDefaultsTool.execute(
+    { apiKey: admin, granteeIdentity: identity, issueKey: true, plan },
+    {}
+  );
+  if (!provisioned.ok || !provisioned.secret) {
+    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
+  }
+  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
+  return { key: provisioned.secret };
+}
+async function syncMemoryKeyPlan(user, plan) {
+  const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
+  const { key, error } = await getOrCreateUserMemoryKey(user);
+  if (!key) return { ok: false, error: error ?? "memory unavailable" };
+  const listed = await memoryCall(
+    "listKeysTool",
+    {},
+    key
+  );
+  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
+  const target = listed.keys[0];
+  if (target.plan === effectivePlan) return { ok: true };
+  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key);
+  return { ok: res.ok, error: res.error };
+}
+async function syncScheduledActionCredentials(user) {
+  const admin = ADMIN_KEY();
+  if (!admin) return { ok: false, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
+  const identity = resolveMemoryIdentity(user);
+  const res = await import_set_schedule_entitlement.setScheduleEntitlementTool.execute({
+    apiKey: admin,
+    granteeIdentity: identity,
+    mcpScraperApiKey: user.api_key
+  }, {});
+  return { ok: res.ok, error: res.error };
+}
+var import_node_crypto6, import_provision_defaults, import_set_schedule_entitlement, MEMORY_BASE_URL, ADMIN_KEY;
+var init_memory = __esm({
+  "src/api/memory.ts"() {
+    "use strict";
+    import_node_crypto6 = require("crypto");
+    init_session();
+    init_db();
+    import_provision_defaults = require("mcpscraper-memory-tools/tools/vaults/provision-defaults");
+    import_set_schedule_entitlement = require("mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement");
+    MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
+    ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
+  }
+});
+
 // src/api/internal-billing-routes.ts
 function internalRequestAuthorized(header) {
   const expected = process.env.INTERNAL_BILLING_SECRET ?? process.env.INTERNAL_MEMORY_DEBIT_SECRET;
@@ -12307,15 +12551,22 @@ function billingError(error) {
     status: 500
   };
 }
-var import_hono3, import_zod12, internalBillingApp, metadataSchema, authorizeSchema, settleSchema, voidSchema;
+var import_hono3, import_zod12, internalBillingApp, metadataSchema, schedulingAccessSchema, authorizeSchema, settleSchema, voidSchema;
 var init_internal_billing_routes = __esm({
   "src/api/internal-billing-routes.ts"() {
     "use strict";
     import_hono3 = require("hono");
     import_zod12 = require("zod");
     init_unified_billing();
+    init_scheduling_access();
+    init_db();
+    init_memory();
     internalBillingApp = new import_hono3.Hono();
     metadataSchema = import_zod12.z.record(import_zod12.z.unknown()).optional();
+    schedulingAccessSchema = import_zod12.z.object({
+      identity: import_zod12.z.string().min(1).max(320),
+      provisionCredentials: import_zod12.z.boolean().optional()
+    });
     authorizeSchema = import_zod12.z.object({
       identity: import_zod12.z.string().min(1).max(320),
       idempotencyKey: import_zod12.z.string().min(1).max(500),
@@ -12359,6 +12610,41 @@ var init_internal_billing_routes = __esm({
         return c.json(response.body, response.status);
       }
     });
+    internalBillingApp.post("/scheduling-access", async (c) => {
+      const parsed = schedulingAccessSchema.safeParse(await c.req.json().catch(() => null));
+      if (!parsed.success) {
+        return c.json({ ok: false, error_code: "invalid_request", error: "invalid scheduling access request" }, 400);
+      }
+      try {
+        const access2 = await getSchedulingAccess(parsed.data.identity);
+        if (access2.allowed && parsed.data.provisionCredentials) {
+          const user = await getUserByEmail(parsed.data.identity.trim().toLowerCase());
+          if (!user) {
+            return c.json({ ok: false, error_code: "user_not_found", error: "billing identity was not found" }, 404);
+          }
+          const credentials = await syncScheduledActionCredentials(user);
+          if (!credentials.ok) {
+            return c.json({
+              ok: false,
+              error_code: "schedule_credentials_unavailable",
+              error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+            }, 503);
+          }
+        }
+        return c.json({
+          ok: true,
+          allowed: access2.allowed,
+          subscriptionTier: access2.subscriptionTier,
+          ...access2.allowed ? {} : {
+            error_code: PAID_PLAN_REQUIRED_CODE,
+            error: PAID_PLAN_REQUIRED_MESSAGE
+          }
+        });
+      } catch (error) {
+        const response = billingError(error);
+        return c.json(response.body, response.status);
+      }
+    });
     internalBillingApp.post("/scheduled-run/settle", async (c) => {
       const parsed = settleSchema.safeParse(await c.req.json().catch(() => null));
       if (!parsed.success) {
@@ -14785,7 +15071,7 @@ async function acquireConcurrencyGate(user, operation, options = {}) {
     return { ok: true, lockId: null, active: await countActiveUsageForUser(user.id), limit, operation, reused: true };
   }
   await expireConcurrencyLocksForUser(user.id);
-  const lockId = `cl_${(0, import_node_crypto5.randomUUID)().replace(/-/g, "").slice(0, 24)}`;
+  const lockId = `cl_${(0, import_node_crypto7.randomUUID)().replace(/-/g, "").slice(0, 24)}`;
   const res = await getDb().execute({
     sql: `INSERT INTO concurrency_locks (id, user_id, operation, status, expires_at, metadata)
           SELECT ?, ?, ?, 'active', datetime('now', ?), ?
@@ -14839,11 +15125,11 @@ async function extendConcurrencyGate(lockId, ttlSeconds = DEFAULT_LOCK_TTL_SECON
     args: [lockTtlModifier(ttlSeconds), lockId]
   });
 }
-var import_node_crypto5, DEFAULT_LOCK_TTL_SECONDS, DEFAULT_RETRY_AFTER_SECONDS, MAX_LOCK_TTL_SECONDS, schemaReady;
+var import_node_crypto7, DEFAULT_LOCK_TTL_SECONDS, DEFAULT_RETRY_AFTER_SECONDS, MAX_LOCK_TTL_SECONDS, schemaReady;
 var init_concurrency_gates = __esm({
   "src/api/concurrency-gates.ts"() {
     "use strict";
-    import_node_crypto5 = require("crypto");
+    import_node_crypto7 = require("crypto");
     init_db();
     init_rates();
     DEFAULT_LOCK_TTL_SECONDS = 15 * 60;
@@ -17786,194 +18072,6 @@ var init_reddit_routes = __esm({
   }
 });
 
-// src/api/session.ts
-function getSessionSecret() {
-  const configured = process.env.SESSION_SECRET?.trim();
-  if (configured) return configured;
-  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
-  return "dev-secret-change-me";
-}
-function safeEqualHex(a, b) {
-  if (a.length !== b.length) return false;
-  try {
-    return (0, import_node_crypto6.timingSafeEqual)(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-  } catch {
-    return false;
-  }
-}
-function signSession(userId) {
-  const payload = String(userId);
-  const sig = (0, import_node_crypto6.createHmac)("sha256", secret()).update(payload).digest("hex");
-  return `${payload}.${sig}`;
-}
-function verifySession(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot === -1) return null;
-  const payload = token.slice(0, dot);
-  const sig = token.slice(dot + 1);
-  const expected = (0, import_node_crypto6.createHmac)("sha256", secret()).update(payload).digest("hex");
-  if (!safeEqualHex(sig, expected)) return null;
-  const id = parseInt(payload);
-  return isNaN(id) ? null : id;
-}
-var import_node_crypto6, isProduction, secret;
-var init_session = __esm({
-  "src/api/session.ts"() {
-    "use strict";
-    import_node_crypto6 = require("crypto");
-    isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
-    secret = () => getSessionSecret();
-  }
-});
-
-// src/api/memory.ts
-function parseMemoryRpcBody(text) {
-  const dataLine = text.split("\n").find((line) => line.startsWith("data:"));
-  const payload = dataLine ? dataLine.slice(5).trim() : text;
-  return JSON.parse(payload);
-}
-function isMemoryOperator(email) {
-  if (!email) return false;
-  const ops = (process.env.MEMORY_OPERATOR_IDENTITIES ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
-  return ops.includes(email.trim().toLowerCase());
-}
-function encKey() {
-  return (0, import_node_crypto7.scryptSync)(getSessionSecret(), "mcp-memory-key-v1", 32);
-}
-function encryptMemoryKey(secret2) {
-  const iv = (0, import_node_crypto7.randomBytes)(12);
-  const cipher = (0, import_node_crypto7.createCipheriv)("aes-256-gcm", encKey(), iv);
-  const enc = Buffer.concat([cipher.update(secret2, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
-}
-function decryptMemoryKey(stored) {
-  try {
-    const [ivB, tagB, dataB] = stored.split(":");
-    const decipher = (0, import_node_crypto7.createDecipheriv)("aes-256-gcm", encKey(), Buffer.from(ivB, "base64"));
-    decipher.setAuthTag(Buffer.from(tagB, "base64"));
-    return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
-  } catch {
-    return null;
-  }
-}
-async function memoryCall(toolName, args, userMemoryKey) {
-  try {
-    const res = await fetch(`${MEMORY_BASE_URL()}/mcp`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        accept: "application/json, text/event-stream",
-        authorization: `Bearer ${userMemoryKey}`
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "tools/call",
-        params: { name: toolName, arguments: args }
-      })
-    });
-    const text = await res.text();
-    if (!res.ok) return { ok: false, error: `memory ${toolName} failed (${res.status})` };
-    const body = parseMemoryRpcBody(text);
-    if (body.error) return { ok: false, error: body.error.message ?? `memory ${toolName} failed` };
-    if (body.result?.structuredContent) return body.result.structuredContent;
-    const textContent = body.result?.content?.find((c) => c.type === "text")?.text;
-    if (textContent) {
-      try {
-        return JSON.parse(textContent);
-      } catch {
-        return { ok: false, error: textContent };
-      }
-    }
-    return { ok: false, error: `memory ${toolName} returned no result` };
-  } catch (err) {
-    return { ok: false, error: err?.message ?? "memory call failed" };
-  }
-}
-function memoryIdentity(user) {
-  return user.email;
-}
-function resolveMemoryIdentity(user) {
-  return memoryIdentity(user);
-}
-function memoryPlanForReads(user) {
-  if (isMemoryOperator(user.email)) return "unlimited";
-  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
-  return "free";
-}
-async function provisionMemoryForUser(user) {
-  try {
-    const { key } = await getOrCreateUserMemoryKey(user);
-    if (key) await setMemoryProvisioned(user.id, true);
-  } catch {
-  }
-}
-function resolveEffectiveMemoryPlan(user) {
-  return user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
-}
-async function getOrCreateUserMemoryKey(user) {
-  const creds = await getUserMemoryCreds(user.id);
-  if (creds.memory_key) {
-    const decrypted = decryptMemoryKey(creds.memory_key);
-    if (decrypted) return { key: decrypted };
-  }
-  const admin = ADMIN_KEY();
-  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
-  const identity = memoryIdentity(user);
-  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
-  const provisioned = await import_provision_defaults.provisionDefaultsTool.execute(
-    { apiKey: admin, granteeIdentity: identity, issueKey: true, plan },
-    {}
-  );
-  if (!provisioned.ok || !provisioned.secret) {
-    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
-  }
-  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
-  return { key: provisioned.secret };
-}
-async function syncMemoryKeyPlan(user, plan) {
-  const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
-  const { key, error } = await getOrCreateUserMemoryKey(user);
-  if (!key) return { ok: false, error: error ?? "memory unavailable" };
-  const listed = await memoryCall(
-    "listKeysTool",
-    {},
-    key
-  );
-  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
-  const target = listed.keys[0];
-  if (target.plan === effectivePlan) return { ok: true };
-  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key);
-  return { ok: res.ok, error: res.error };
-}
-async function syncScheduleEntitlement(user, enabled, quotaPerPeriod) {
-  const admin = ADMIN_KEY();
-  if (!admin) return { ok: false, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
-  const identity = resolveMemoryIdentity(user);
-  const res = await import_set_schedule_entitlement.setScheduleEntitlementTool.execute({
-    apiKey: admin,
-    granteeIdentity: identity,
-    enabled,
-    quotaPerPeriod,
-    mcpScraperApiKey: user.api_key
-  }, {});
-  return { ok: res.ok, error: res.error };
-}
-var import_node_crypto7, import_provision_defaults, import_set_schedule_entitlement, MEMORY_BASE_URL, ADMIN_KEY;
-var init_memory = __esm({
-  "src/api/memory.ts"() {
-    "use strict";
-    import_node_crypto7 = require("crypto");
-    init_session();
-    init_db();
-    import_provision_defaults = require("mcpscraper-memory-tools/tools/vaults/provision-defaults");
-    import_set_schedule_entitlement = require("mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement");
-    MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
-    ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
-  }
-});
-
 // src/api/video-routes.ts
 function invalidRequest5(message) {
   return { error_code: "invalid_request", message };
@@ -28401,7 +28499,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.21.1";
+    PACKAGE_VERSION = "0.21.2";
   }
 });
 
@@ -34324,7 +34422,7 @@ var init_memory_tool_schemas = __esm({
     CreateScheduledActionSchema = {
       id: "create-scheduled-action",
       upstreamName: "createScheduledActionTool",
-      description: "Create a Credit-metered scheduled action in agent mode (default) or connection_sync mode. Each execution has a 75-Credit base charge; agent model usage is added at 1.5 times OpenRouter's actual reported cost. Agent mode follows the description and writes a result into the target vault. connection_sync deterministically runs approved read-only tools on bound service connections and ingests their data. Cadence 'once' runs a single time then completes permanently. Requires write access to the target vault.",
+      description: "Create a Credit-metered scheduled action for an active MCP Scraper Starter plan or higher, in agent mode (default) or connection_sync mode. Each execution has a 75-Credit base charge; agent model usage is added at 1.5 times OpenRouter's actual reported cost. Agent mode follows the description and writes a result into the target vault. connection_sync deterministically runs approved read-only tools on bound service connections and ingests their data. Cadence 'once' runs a single time then completes permanently. Requires write access to the target vault.",
       input: {
         description: import_zod36.z.string().min(1).describe("Free-text description of what this action should do each time it runs."),
         vault: import_zod36.z.string().min(1).describe("The vault this action writes its results into. You must already have write access to it."),
@@ -34373,12 +34471,13 @@ var init_memory_tool_schemas = __esm({
     GetScheduleLinkSchema = {
       id: "get-schedule-link",
       upstreamName: "getScheduleLinkTool",
-      description: "Get your durable, bookmarkable link to the hosted Scheduled Actions page \u2014 a login-free UI to create, view, edit, pause, resume, and delete scheduled actions. The embedded secret is shown only once, on first call; it cannot be re-shown, only revoked and reissued via revoke-schedule-link.",
+      description: "Get your durable, bookmarkable link to the hosted Scheduled Actions page. Requires an active MCP Scraper Starter plan or higher. The embedded secret is shown only once, on first call; it cannot be re-shown, only revoked and reissued via revoke-schedule-link.",
       input: {},
       output: {
         ok: import_zod36.z.boolean().describe("True on success; false on auth error."),
         url: import_zod36.z.string().optional().describe("The schedule link. Present only the first time a link is minted for this identity."),
         alreadyExists: import_zod36.z.boolean().optional().describe("True when a link already exists and was NOT re-shown. Use revoke-schedule-link then call this again to get a fresh one."),
+        code: import_zod36.z.string().optional().describe("Machine-readable denial code when the link cannot be issued."),
         error: import_zod36.z.string().optional().describe("Human-readable failure reason when ok is false.")
       },
       annotations: {
@@ -34392,7 +34491,7 @@ var init_memory_tool_schemas = __esm({
     GetScheduleStatusSchema = {
       id: "get-schedule-status",
       upstreamName: "getScheduleStatusTool",
-      description: "Get the Credit-metered Scheduled Actions policy. Scheduling is included rather than sold as a separate subscription: each execution has a 75-Credit base charge, and agent model usage is billed at 1.5 times OpenRouter's actual reported cost.",
+      description: "Get the Credit-metered Scheduled Actions access and billing policy. Scheduling requires an active MCP Scraper Starter plan or higher but has no separate subscription: each execution has a 75-Credit base charge, and agent model usage is billed at 1.5 times OpenRouter's actual reported cost.",
       input: {},
       output: {
         ok: import_zod36.z.boolean(),
@@ -34403,6 +34502,8 @@ var init_memory_tool_schemas = __esm({
         quotaPerPeriod: import_zod36.z.number().optional(),
         usedThisPeriod: import_zod36.z.number().optional(),
         periodStart: import_zod36.z.string().optional(),
+        defaultTimezone: import_zod36.z.string().nullable().optional().describe("IANA timezone applied to new schedules that name a time without a zone; null means UTC."),
+        code: import_zod36.z.string().optional().describe("Machine-readable reason scheduling is unavailable."),
         error: import_zod36.z.string().optional()
       },
       annotations: {
@@ -34496,6 +34597,7 @@ var init_memory_tool_schemas = __esm({
       output: {
         ok: import_zod36.z.boolean(),
         nextRunAt: import_zod36.z.string().optional(),
+        code: import_zod36.z.string().optional().describe("Machine-readable denial code when the action cannot be resumed."),
         error: import_zod36.z.string().optional()
       },
       annotations: {
@@ -34527,11 +34629,11 @@ var init_memory_tool_schemas = __esm({
     SetScheduleEntitlementSchema = {
       id: "set-schedule-entitlement",
       upstreamName: "setScheduleEntitlementTool",
-      description: "Legacy migration and account-recovery control for old Scheduled Actions entitlements. New scheduling is Credit-metered and does not require a separate subscription. This admin-only tool may preserve a legacy API-key delegation or recover historical entitlement rows during migration.",
+      description: "Admin-only scheduled-action credential provisioning and historical-row recovery. Rotate the encrypted delegated MCP Scraper API key without changing legacy enabled/quota fields by omitting those fields. Legacy entitlement values are not runtime access controls; paid-plan access is checked against MCP Scraper directly.",
       input: {
         granteeIdentity: import_zod36.z.string().min(1).describe("Identity whose scheduling entitlement is being set (e.g. an email)."),
-        enabled: import_zod36.z.boolean().describe("True to enable scheduled actions for this identity, false on cancel/expire."),
-        quotaPerPeriod: import_zod36.z.number().optional().describe("Legacy monthly execution quota retained only for historical-row compatibility; it does not price new Credit-metered runs."),
+        enabled: import_zod36.z.boolean().optional().describe("Historical entitlement value for migration/recovery only. Omit to preserve the stored value."),
+        quotaPerPeriod: import_zod36.z.number().optional().describe("Historical monthly execution quota retained only for migration compatibility. Omit to preserve the stored value."),
         mcpScraperApiKey: import_zod36.z.string().optional().describe("The identity's mcp-scraper API key, stored encrypted, used to reach mcp-scraper tools during scheduled-action execution.")
       },
       output: {
@@ -35269,6 +35371,7 @@ var init_memory_inprocess_executor = __esm({
   "src/mcp/memory-inprocess-executor.ts"() {
     "use strict";
     init_memory();
+    init_scheduling_access();
     CUTOVER = /* @__PURE__ */ new Map();
     HybridMemoryToolExecutor = class {
       constructor(httpExecutor, user) {
@@ -35285,6 +35388,29 @@ var init_memory_inprocess_executor = __esm({
         return this.mkKeyPromise;
       }
       async callMemoryTool(upstreamName, args) {
+        const accessDenied = memoryScheduleAccessPayload(upstreamName, this.user);
+        if (accessDenied) {
+          return {
+            content: [{ type: "text", text: JSON.stringify(accessDenied) }],
+            structuredContent: accessDenied,
+            isError: false
+          };
+        }
+        if (memoryScheduleToolNeedsCredentials(upstreamName)) {
+          const credentials = await syncScheduledActionCredentials(this.user);
+          if (!credentials.ok) {
+            const result = {
+              ok: false,
+              code: "schedule_credentials_unavailable",
+              error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+            };
+            return {
+              content: [{ type: "text", text: JSON.stringify(result) }],
+              structuredContent: result,
+              isError: false
+            };
+          }
+        }
         const handler = CUTOVER.get(upstreamName);
         if (!handler) return this.httpExecutor.callMemoryTool(upstreamName, args);
         const mkKey = await this.resolveMkKey();
@@ -38331,6 +38457,8 @@ var init_stripe_routes = __esm({
           if (user && invoice.id && !await ledgerExistsForStripePI(invoice.id)) {
             await creditMc(user.id, tier.credits_mc, LedgerOperation.SUBSCRIPTION, `${tier.label} subscription credits`, invoice.id);
             await setSubscriptionTier(user.id, tier.tier, tier.concurrency, invoice.subscription ?? user.subscription_id);
+            const credentials = await syncScheduledActionCredentials(user);
+            if (!credentials.ok) console.warn("[stripe] scheduled-action credential sync failed:", credentials.error ?? "unknown error");
           }
         }
       }
@@ -38348,15 +38476,6 @@ var init_stripe_routes = __esm({
           }
           return c.json({ received: true });
         }
-        if (priceId && priceId in SCHEDULING_PLANS) {
-          const sched = SCHEDULING_PLANS[priceId];
-          const user2 = await resolveUser(sub.customer, sub.customer_email);
-          if (user2) {
-            const live = sub.status === "active" || sub.status === "trialing";
-            await syncScheduleEntitlement(user2, live, sched.quota_per_period);
-          }
-          return c.json({ received: true });
-        }
         const user = await getUserByStripeCustomerId(sub.customer);
         if (!user) return c.json({ received: true });
         if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -38364,6 +38483,10 @@ var init_stripe_routes = __esm({
           const live = sub.status === "active" || sub.status === "trialing";
           const newTier = live ? tier.tier : null;
           await setSubscriptionTier(user.id, newTier, live ? tier.concurrency : 0, live ? sub.id : null);
+          if (live) {
+            const credentials = await syncScheduledActionCredentials(user);
+            if (!credentials.ok) console.warn("[stripe] scheduled-action credential sync failed:", credentials.error ?? "unknown error");
+          }
         } else if (priceId === CONCURRENCY_PRICE_ID && event.type === "customer.subscription.created") {
           await setExtraConcurrencySlots(user.id, user.extra_concurrency_slots + 1);
           await setConcurrencySubId(user.id, sub.id);
@@ -38380,11 +38503,6 @@ var init_stripe_routes = __esm({
           }
           return c.json({ received: true });
         }
-        if (priceId && priceId in SCHEDULING_PLANS) {
-          const user2 = await getUserByStripeCustomerId(sub.customer);
-          if (user2) await syncScheduleEntitlement(user2, false);
-          return c.json({ received: true });
-        }
         const user = await getUserByStripeCustomerId(sub.customer);
         if (!user) return c.json({ received: true });
         if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -42514,7 +42632,7 @@ async function checkHarvestLimits(user, reuseLockId) {
   }
   return null;
 }
-var import_resend2, import_hono24, import_hono25, import_factory6, import_cookie2, import_stripe2, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, requireIntegrationsTier, app, STRIPE_API_VERSION, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
+var import_resend2, import_hono24, import_hono25, import_factory6, import_cookie2, import_stripe2, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, requireIntegrationsTier, requirePaidSchedulingTier, app, STRIPE_API_VERSION, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
 var init_server = __esm({
   "src/api/server.ts"() {
     "use strict";
@@ -42586,6 +42704,7 @@ var init_server = __esm({
     init_harvest_attempt_events();
     init_session();
     init_memory();
+    init_scheduling_access();
     init_memory_db();
     init_nango_control();
     init_resend_control();
@@ -42645,6 +42764,11 @@ var init_server = __esm({
       }
       return next();
     });
+    requirePaidSchedulingTier = (0, import_factory6.createMiddleware)(async (c, next) => {
+      const user = c.get("user");
+      if (!hasPaidSchedulingAccess(user)) return c.json(paidPlanRequiredPayload(), 403);
+      return next();
+    });
     app = new import_hono24.Hono();
     STRIPE_API_VERSION = "2026-02-25.clover";
     app.use("*", async (c, next) => {
@@ -42894,6 +43018,18 @@ var init_server = __esm({
       const user = c.get("user");
       const body = await c.req.json().catch(() => ({}));
       if (!body.toolName) return c.json({ ok: false, error: "toolName is required" }, 400);
+      const accessDenied = memoryScheduleAccessPayload(body.toolName, user);
+      if (accessDenied) return c.json(accessDenied);
+      if (memoryScheduleToolNeedsCredentials(body.toolName)) {
+        const credentials = await syncScheduledActionCredentials(user);
+        if (!credentials.ok) {
+          return c.json({
+            ok: false,
+            code: "schedule_credentials_unavailable",
+            error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+          }, 503);
+        }
+      }
       const { key, error } = await getOrCreateUserMemoryKey(user);
       if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 502);
       const result = await memoryCall(body.toolName, body.args ?? {}, key);
@@ -43093,7 +43229,7 @@ var init_server = __esm({
         llmCostMultiplier: SCHEDULED_AGENT_LLM_MARKUP
       }, 410);
     });
-    app.get("/schedule-status", auth2, async (c) => {
+    app.get("/schedule-status", auth2, requirePaidSchedulingTier, async (c) => {
       try {
         const user = c.get("user");
         const { key, error } = await getOrCreateUserMemoryKey(user);
@@ -43460,9 +43596,13 @@ var init_server = __esm({
         return scheduleConnectionError(c, err, "Unable to run this connection action.");
       }
     });
-    app.post("/schedule-link", auth2, async (c) => {
+    app.post("/schedule-link", auth2, requirePaidSchedulingTier, async (c) => {
       try {
         const user = c.get("user");
+        const credentials = await syncScheduledActionCredentials(user);
+        if (!credentials.ok) {
+          return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
+        }
         const { key, error } = await getOrCreateUserMemoryKey(user);
         if (!key) return c.json({ error: error ?? "memory unavailable" }, 503);
         const r = await memoryCall("getScheduleLinkTool", {}, key);
@@ -43500,8 +43640,12 @@ var init_server = __esm({
         });
       }
     });
-    app.post("/schedule-actions", auth2, async (c) => {
+    app.post("/schedule-actions", auth2, requirePaidSchedulingTier, async (c) => {
       const user = c.get("user");
+      const credentials = await syncScheduledActionCredentials(user);
+      if (!credentials.ok) {
+        return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
+      }
       const { key, error } = await getOrCreateUserMemoryKey(user);
       if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
       const body = await c.req.json().catch(() => ({}));
@@ -43593,7 +43737,7 @@ var init_server = __esm({
       const r = await memoryCall("pauseScheduledActionTool", { id: c.req.param("id") }, key);
       return c.json(r);
     });
-    app.post("/schedule-actions/:id/resume", auth2, async (c) => {
+    app.post("/schedule-actions/:id/resume", auth2, requirePaidSchedulingTier, async (c) => {
       const user = c.get("user");
       const { key, error } = await getOrCreateUserMemoryKey(user);
       if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);