mcp-scraper 0.21.1 → 0.21.3

package/dist/bin/api-server.cjs

@@ -3602,6 +3602,7 @@ __export(db_exports, {
   creditMc: () => creditMc,
   deactivateUser: () => deactivateUser,
   debitMc: () => debitMc,
+  debitMcIdempotent: () => debitMcIdempotent,
   deleteWorkflowSchedule: () => deleteWorkflowSchedule,
   expireOldLots: () => expireOldLots,
   failJob: () => failJob,
@@ -3918,6 +3919,19 @@ async function migrate() {
   `);
   await db.execute(`CREATE INDEX IF NOT EXISTS billing_events_user_created_at ON billing_events(user_id, created_at DESC)`);
   await db.execute(`CREATE INDEX IF NOT EXISTS billing_events_authorization ON billing_events(authorization_id)`);
+  await db.execute(`
+    CREATE TABLE IF NOT EXISTS billing_debits (
+      idempotency_key TEXT PRIMARY KEY,
+      user_id         INTEGER NOT NULL REFERENCES users(id),
+      amount_mc       INTEGER NOT NULL,
+      operation       TEXT NOT NULL,
+      description     TEXT,
+      status          TEXT NOT NULL DEFAULT 'claimed',
+      created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+      applied_at      TEXT
+    )
+  `);
+  await db.execute(`CREATE INDEX IF NOT EXISTS billing_debits_user_status ON billing_debits(user_id, status)`);
   await db.execute(`
     CREATE TABLE IF NOT EXISTS site_audit_jobs (
       id            TEXT    PRIMARY KEY,
@@ -5289,6 +5303,72 @@ async function debitMc(userId, mc, operation, description) {
   const res = await db.execute({ sql: "SELECT balance_mc FROM users WHERE id = ?", args: [userId] });
   return { ok: true, balance_mc: Number(res.rows[0]?.balance_mc ?? 0) };
 }
+async function debitMcIdempotent(userId, mc, operation, description, idempotencyKey) {
+  if (!Number.isSafeInteger(mc) || mc <= 0) throw new Error("idempotent debit amount must be a positive integer");
+  if (!idempotencyKey || idempotencyKey.length > 500) throw new Error("idempotent debit key is required and must be bounded");
+  const db = getDb();
+  await ensureMigrated(userId);
+  const results = await db.batch([
+    {
+      sql: "UPDATE billing_debits SET amount_mc = ?, description = ? WHERE idempotency_key = ? AND user_id = ? AND operation = ? AND status = 'claimed'",
+      args: [mc, description, idempotencyKey, userId, operation]
+    },
+    {
+      sql: "INSERT OR IGNORE INTO billing_debits (idempotency_key, user_id, amount_mc, operation, description, status) VALUES (?, ?, ?, ?, ?, 'claimed')",
+      args: [idempotencyKey, userId, mc, operation, description]
+    },
+    {
+      sql: "UPDATE users SET balance_mc = balance_mc - ? WHERE id = ? AND balance_mc >= ? AND EXISTS (SELECT 1 FROM billing_debits WHERE idempotency_key = ? AND user_id = ? AND amount_mc = ? AND operation = ? AND status = 'claimed')",
+      args: [mc, userId, mc, idempotencyKey, userId, mc, operation]
+    },
+    {
+      sql: "UPDATE billing_debits SET status = 'applying' WHERE idempotency_key = ? AND user_id = ? AND amount_mc = ? AND operation = ? AND status = 'claimed' AND changes() = 1",
+      args: [idempotencyKey, userId, mc, operation]
+    },
+    {
+      sql: `WITH ordered AS MATERIALIZED (
+              SELECT id,
+                     remaining_mc,
+                     COALESCE(SUM(remaining_mc) OVER (
+                       ORDER BY expires_at ASC, granted_at ASC, id ASC
+                       ROWS BETWEEN UNBOUNDED PRECEDING AND 1 PRECEDING
+                     ), 0) AS prior_mc
+              FROM credit_lots
+              WHERE user_id = ? AND remaining_mc > 0 AND expires_at > datetime('now')
+            ), allocation AS (
+              SELECT id, MIN(remaining_mc, MAX(0, ? - prior_mc)) AS take_mc
+              FROM ordered
+            )
+            UPDATE credit_lots
+            SET remaining_mc = remaining_mc - COALESCE((SELECT take_mc FROM allocation WHERE allocation.id = credit_lots.id), 0)
+            WHERE id IN (SELECT id FROM allocation WHERE take_mc > 0)
+              AND EXISTS (SELECT 1 FROM billing_debits WHERE idempotency_key = ? AND status = 'applying')`,
+      args: [userId, mc, idempotencyKey]
+    },
+    {
+      sql: "INSERT INTO ledger (user_id, amount_mc, operation, description) SELECT user_id, -amount_mc, operation, description FROM billing_debits WHERE idempotency_key = ? AND status = 'applying'",
+      args: [idempotencyKey]
+    },
+    {
+      sql: "UPDATE billing_debits SET status = 'applied', applied_at = datetime('now') WHERE idempotency_key = ? AND status = 'applying'",
+      args: [idempotencyKey]
+    }
+  ], "write");
+  const claim = await db.execute({
+    sql: "SELECT user_id, amount_mc, operation, status FROM billing_debits WHERE idempotency_key = ? LIMIT 1",
+    args: [idempotencyKey]
+  });
+  const row = claim.rows[0];
+  if (!row || Number(row.user_id) !== userId || Number(row.amount_mc) !== mc || String(row.operation) !== operation) {
+    throw new Error("idempotent debit key conflicts with another debit");
+  }
+  const balance = await db.execute({ sql: "SELECT balance_mc FROM users WHERE id = ?", args: [userId] });
+  return {
+    ok: String(row.status) === "applied",
+    balance_mc: Number(balance.rows[0]?.balance_mc ?? 0),
+    duplicate: results[2]?.rowsAffected === 0 && String(row.status) === "applied"
+  };
+}
 async function getLedger(userId, limit = 50) {
   const res = await getDb().execute({
     sql: "SELECT * FROM ledger WHERE user_id = ? ORDER BY created_at DESC LIMIT ?",
@@ -8496,6 +8576,18 @@ function vendorCostUsdToMc(costUsd, markupBps) {
   if (mc > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error("calculated mc exceeds the safe integer range");
   return Number(mc);
 }
+function getPublicRatesPayload() {
+  const starter = SUBSCRIPTION_TIER_BY_KEY.starter;
+  const costs = CREDIT_COST_CATALOG.map(({ aliases, ...cost }) => ({
+    ...cost,
+    ...cost.notes ? { notes: cost.notes.replace(/ via fal\.ai/g, "") } : {}
+  }));
+  return {
+    creditsPerDollarStarter: Math.round(mcToCredits(starter.credits_mc) / starter.monthly_usd),
+    costs,
+    scheduling: SCHEDULED_ACTIONS_RATE_POLICY
+  };
+}
 function concurrencySlotBillingInfo() {
   const billingUrl = process.env.CONCURRENCY_BILLING_URL ?? "https://mcpscraper.dev/billing";
   return {
@@ -8525,12 +8617,14 @@ function insufficientBalanceResponse(balanceMc, requiredMc) {
     topup_url: topupUrl
   };
 }
-var MC_COSTS, MC_PER_BROWSER_MS, BROWSER_OPEN_MIN_BALANCE_MC, MC_PER_CREDIT, BILLING_MC_PER_USD_NUMERATOR, BILLING_MC_PER_USD_DENOMINATOR, BILLING_BASIS_POINTS, USD_NANOS, SCHEDULED_RUN_BASE_CREDITS, SCHEDULED_RUN_BASE_MC, SCHEDULED_AGENT_LLM_MARKUP_BPS, SCHEDULED_AGENT_LLM_MARKUP, SCHEDULED_RUN_DEFAULT_MAX_CREDITS, CREDIT_COST_CATALOG, CONCURRENCY_PRICE_ID, SUBSCRIPTION_TIERS, SUBSCRIPTION_TIER_BY_KEY, CONCURRENCY_SLOT_PRICE_USD, CONCURRENCY_SLOT_PRICE_CURRENCY, CONCURRENCY_SLOT_PRICE_INTERVAL, CONCURRENCY_SLOT_PRICE_LABEL, CONCURRENCY_SLOT_TERMINAL_COMMAND, FREE_SIGNUP_MC, MEMORY_FREE_QUOTA_BYTES, MEMORY_PLANS, MEMORY_PLAN_QUOTA, MEMORY_MARGIN_MULTIPLE, MEMORY_PRO_COST_BUDGET_USD, SCHEDULING_PLANS, LedgerOperation, MEMORY_AI_MARGIN_MULTIPLE, SITE_AUDIT_LLM_MARGIN_MULTIPLE, VIDEO_ANALYSIS_LLM_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_HOLD_MC, MC_PER_USD;
+var MC_COSTS, MC_PER_BROWSER_MS, BROWSER_OPEN_MIN_BALANCE_MC, MC_PER_CREDIT, BILLING_MC_PER_USD_NUMERATOR, BILLING_MC_PER_USD_DENOMINATOR, BILLING_BASIS_POINTS, USD_NANOS, SCHEDULED_RUN_BASE_CREDITS, SCHEDULED_RUN_BASE_MC, SCHEDULED_AGENT_LLM_MARKUP_BPS, SCHEDULED_AGENT_LLM_MARKUP, SCHEDULED_RUN_DEFAULT_MAX_CREDITS, SCHEDULED_ACTIONS_RATE_POLICY, CREDIT_COST_CATALOG, CONCURRENCY_PRICE_ID, SUBSCRIPTION_TIERS, SUBSCRIPTION_TIER_BY_KEY, CONCURRENCY_SLOT_PRICE_USD, CONCURRENCY_SLOT_PRICE_CURRENCY, CONCURRENCY_SLOT_PRICE_INTERVAL, CONCURRENCY_SLOT_PRICE_LABEL, CONCURRENCY_SLOT_TERMINAL_COMMAND, FREE_SIGNUP_MC, MEMORY_FREE_QUOTA_BYTES, MEMORY_PLANS, MEMORY_PLAN_QUOTA, MEMORY_MARGIN_MULTIPLE, MEMORY_PRO_COST_BUDGET_USD, LedgerOperation, MEMORY_AI_MARGIN_MULTIPLE, SITE_AUDIT_LLM_MARGIN_MULTIPLE, VIDEO_ANALYSIS_LLM_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_MARGIN_MULTIPLE, MEDIA_TRANSCRIBE_HOLD_MC, MC_PER_USD;
 var init_rates = __esm({
   "src/api/rates.ts"() {
     "use strict";
     MC_COSTS = {
       serp: 100,
+      serp_headless: 400,
+      serp_headful: 1400,
       paa: 300,
       paa_base: 5500,
       page_scrape: 100,
@@ -8571,14 +8665,38 @@ var init_rates = __esm({
     SCHEDULED_AGENT_LLM_MARKUP_BPS = 15e3;
     SCHEDULED_AGENT_LLM_MARKUP = SCHEDULED_AGENT_LLM_MARKUP_BPS / BILLING_BASIS_POINTS;
     SCHEDULED_RUN_DEFAULT_MAX_CREDITS = 5e3;
+    SCHEDULED_ACTIONS_RATE_POLICY = {
+      billingMode: "credits",
+      entitlement: "paid_plan_included",
+      separateSubscriptionRequired: false,
+      chargeEvent: "started_occurrence",
+      runBaseCredits: SCHEDULED_RUN_BASE_CREDITS,
+      runBaseMc: SCHEDULED_RUN_BASE_MC,
+      llmCostMultiplier: SCHEDULED_AGENT_LLM_MARKUP,
+      llmCostMultiplierBps: SCHEDULED_AGENT_LLM_MARKUP_BPS,
+      modes: {
+        connection_sync: {
+          runBaseCredits: SCHEDULED_RUN_BASE_CREDITS,
+          modelCostBilling: "none",
+          modelCostMultiplier: 0
+        },
+        agent: {
+          runBaseCredits: SCHEDULED_RUN_BASE_CREDITS,
+          modelCostBilling: "actual_reported_cost",
+          modelCostProvider: "openrouter",
+          modelCostMultiplier: SCHEDULED_AGENT_LLM_MARKUP,
+          modelCostMultiplierBps: SCHEDULED_AGENT_LLM_MARKUP_BPS
+        }
+      }
+    };
     CREDIT_COST_CATALOG = [
       {
         key: "serp",
         label: "SERP search",
         aliases: ["search_serp", "serp", "google search", "organic results"],
-        credits: mcToCredits(MC_COSTS.serp),
-        unit: "per search",
-        notes: "Returns AI Overview, PAA snippet, videos, forums, and local pack."
+        credits: mcToCredits(MC_COSTS.serp_headless),
+        unit: "per search (headless); escalates to headful only when needed",
+        notes: `Returns AI Overview, PAA snippet, videos, forums, and local pack. Billed ${mcToCredits(MC_COSTS.serp_headless)} credits when served headless (the common case), ${mcToCredits(MC_COSTS.serp_headful)} credits if an anti-bot escalation forces headful mode (overestimate refunded).`
       },
       {
         key: "paa",
@@ -8810,9 +8928,6 @@ var init_rates = __esm({
     MEMORY_PLAN_QUOTA = { free: MEMORY_FREE_QUOTA_BYTES, pro: 5e9, team: 5e10 };
     MEMORY_MARGIN_MULTIPLE = 3;
     MEMORY_PRO_COST_BUDGET_USD = 19 / MEMORY_MARGIN_MULTIPLE;
-    SCHEDULING_PLANS = {
-      "price_1ToXcHS8aAcsk3TGf3cW7zHx": { price_id: "price_1ToXcHS8aAcsk3TGf3cW7zHx", label: "Scheduled Actions", interval: "month", monthly_usd: 10, quota_per_period: 1e3 }
-    };
     LedgerOperation = {
       TOPUP: "topup",
       SUBSCRIPTION: "subscription",
@@ -8821,6 +8936,7 @@ var init_rates = __esm({
       PAA: "paa",
       PAA_REFUND: "paa_refund",
       SERP: "serp",
+      SERP_REFUND: "serp_refund",
       REFUND: "refund",
       TRANSCRIPTION: "transcription",
       TRANSCRIPTION_HOLD: "transcription_hold",
@@ -11903,6 +12019,60 @@ var init_internal_memory_routes = __esm({
   }
 });
 
+// src/api/scheduling-access.ts
+function schedulingAccessOverrides() {
+  return new Set(
+    (process.env.SCHEDULING_ACCESS_OVERRIDE_IDENTITIES ?? "").split(",").map((identity) => identity.trim().toLowerCase()).filter(Boolean)
+  );
+}
+function hasPaidSchedulingAccess(user) {
+  const tier = typeof user.subscription_tier === "string" ? user.subscription_tier.trim() : "";
+  const subscriptionId = typeof user.subscription_id === "string" ? user.subscription_id.trim() : "";
+  if (tier && subscriptionId) return true;
+  const identity = typeof user.email === "string" ? user.email.trim().toLowerCase() : "";
+  return identity.length > 0 && schedulingAccessOverrides().has(identity);
+}
+function paidPlanRequiredPayload() {
+  return {
+    ok: false,
+    enabled: false,
+    code: PAID_PLAN_REQUIRED_CODE,
+    error: PAID_PLAN_REQUIRED_MESSAGE,
+    billingMode: "credits",
+    runBaseCredits: SCHEDULED_RUN_BASE_CREDITS,
+    llmCostMultiplier: SCHEDULED_AGENT_LLM_MARKUP
+  };
+}
+function memoryScheduleAccessPayload(upstreamName, user) {
+  if (hasPaidSchedulingAccess(user)) return null;
+  if (upstreamName === "getScheduleStatusTool") return paidPlanRequiredPayload();
+  if (PLAN_GATED_MEMORY_SCHEDULE_TOOLS.has(upstreamName)) {
+    return {
+      ok: false,
+      code: PAID_PLAN_REQUIRED_CODE,
+      error: PAID_PLAN_REQUIRED_MESSAGE
+    };
+  }
+  return null;
+}
+function memoryScheduleToolNeedsCredentials(upstreamName) {
+  return upstreamName === "createScheduledActionTool" || upstreamName === "getScheduleLinkTool";
+}
+var PAID_PLAN_REQUIRED_CODE, PAID_PLAN_REQUIRED_MESSAGE, PLAN_GATED_MEMORY_SCHEDULE_TOOLS;
+var init_scheduling_access = __esm({
+  "src/api/scheduling-access.ts"() {
+    "use strict";
+    init_rates();
+    PAID_PLAN_REQUIRED_CODE = "paid_plan_required";
+    PAID_PLAN_REQUIRED_MESSAGE = "Scheduled Actions requires an active MCP Scraper Starter plan or higher.";
+    PLAN_GATED_MEMORY_SCHEDULE_TOOLS = /* @__PURE__ */ new Set([
+      "createScheduledActionTool",
+      "getScheduleLinkTool",
+      "resumeScheduledActionTool"
+    ]);
+  }
+});
+
 // src/api/unified-billing.ts
 function billingSecret() {
   const secret2 = process.env.INTERNAL_BILLING_SECRET ?? process.env.INTERNAL_MEMORY_DEBIT_SECRET;
@@ -11916,6 +12086,19 @@ function normalizeIdentity(identity) {
   }
   return normalized;
 }
+async function resolveSchedulingUser(identity) {
+  const user = await getUserByEmail(normalizeIdentity(identity));
+  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
+  return user;
+}
+async function getSchedulingAccess(identity) {
+  const user = await getUserByEmail(normalizeIdentity(identity));
+  if (!user) return { allowed: false, subscriptionTier: null };
+  return {
+    allowed: hasPaidSchedulingAccess(user),
+    subscriptionTier: user.subscription_tier
+  };
+}
 function normalizeIdempotencyKey(value) {
   const key = value.trim();
   if (!key || key.length > 500) {
@@ -11940,6 +12123,15 @@ function safeMetadata(value) {
   if (!value) return "{}";
   return JSON.stringify(value).slice(0, 4e3);
 }
+function metadataReason(row) {
+  if (!row.metadata) return void 0;
+  try {
+    const metadata = JSON.parse(row.metadata);
+    return typeof metadata.reason === "string" ? metadata.reason : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function mapAuthorization(row, balanceMc) {
   return {
     id: row.id,
@@ -11968,23 +12160,28 @@ async function eventByKey(idempotencyKey) {
   });
   return result.rows[0] ? result.rows[0] : null;
 }
-function mapEvent(row, balanceMc, duplicate) {
-  let reason;
-  if (row.metadata) {
-    try {
-      const metadata = JSON.parse(row.metadata);
-      if (typeof metadata.reason === "string") reason = metadata.reason;
-    } catch {
-    }
-  }
+function mapStartEvent(row, balanceMc, duplicate) {
+  return {
+    id: row.id,
+    authorizationId: row.authorization_id,
+    status: "started",
+    amountMc: SCHEDULED_RUN_BASE_MC,
+    credits: SCHEDULED_RUN_BASE_MC / MC_PER_CREDIT,
+    balanceMc,
+    duplicate
+  };
+}
+function mapSettlementEvent(row, balanceMc, duplicate) {
   const rawNanos = row.raw_cost_usd_nanos == null ? null : Number(row.raw_cost_usd_nanos);
-  const modelMc = Math.max(0, Number(row.amount_mc) - SCHEDULED_RUN_BASE_MC);
+  const modelMc = Math.max(0, Number(row.amount_mc));
+  const amountMc = SCHEDULED_RUN_BASE_MC + modelMc;
+  const reason = metadataReason(row);
   return {
     id: row.id,
     authorizationId: row.authorization_id,
     status: row.status === "settled" ? "settled" : "cost_pending",
-    amountMc: Number(row.amount_mc),
-    credits: Number(row.amount_mc) / MC_PER_CREDIT,
+    amountMc,
+    credits: amountMc / MC_PER_CREDIT,
     baseMc: SCHEDULED_RUN_BASE_MC,
     modelMc,
     rawCostUsd: rawNanos == null ? null : rawNanos / USD_NANOS,
@@ -11997,14 +12194,16 @@ function mapEvent(row, balanceMc, duplicate) {
 async function authorizeScheduledRun(args) {
   const identity = normalizeIdentity(args.identity);
   const idempotencyKey = normalizeIdempotencyKey(args.idempotencyKey);
-  const user = await getUserByEmail(identity);
-  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
+  const user = await resolveSchedulingUser(identity);
+  if (!hasPaidSchedulingAccess(user)) {
+    throw new UnifiedBillingError(PAID_PLAN_REQUIRED_CODE, PAID_PLAN_REQUIRED_MESSAGE, 403);
+  }
   const pending = await getDb().execute({
     sql: "SELECT id FROM billing_events WHERE user_id = ? AND billing_class = ? AND status = 'cost_pending' LIMIT 1",
     args: [user.id, SCHEDULED_RUN_BILLING_CLASS]
   });
   if (pending.rows.length > 0) {
-    throw new UnifiedBillingError("pending_cost", "a previous scheduled run has an unresolved cost", 409);
+    throw new UnifiedBillingError("pending_cost", "a previous scheduled run has an unresolved model cost", 409);
   }
   const existing = await getDb().execute({
     sql: "SELECT id, user_id, idempotency_key, status, minimum_amount_mc, maximum_amount_mc, token_hash, expires_at FROM billing_authorizations WHERE idempotency_key = ? LIMIT 1",
@@ -12013,14 +12212,9 @@ async function authorizeScheduledRun(args) {
   if (existing.rows[0]) {
     const row = existing.rows[0];
     if (Number(row.user_id) !== user.id) {
-      throw new UnifiedBillingError(
-        "invalid_request",
-        "the idempotency key is already in use by another billing identity",
-        409
-      );
+      throw new UnifiedBillingError("invalid_request", "the idempotency key is already in use by another billing identity", 409);
     }
-    const balanceMc2 = await reconcileBalanceMc(user.id, user.balance_mc);
-    return mapAuthorization(row, balanceMc2);
+    return mapAuthorization(row, await reconcileBalanceMc(user.id, user.balance_mc));
   }
   const maximumCredits = args.maximumCredits ?? SCHEDULED_RUN_DEFAULT_MAX_CREDITS;
   if (!Number.isFinite(maximumCredits) || maximumCredits < SCHEDULED_RUN_BASE_MC / MC_PER_CREDIT) {
@@ -12041,17 +12235,7 @@ async function authorizeScheduledRun(args) {
   const expiresAt = new Date(Date.now() + AUTHORIZATION_TTL_MS).toISOString();
   const inserted = await getDb().execute({
     sql: "INSERT OR IGNORE INTO billing_authorizations (id, user_id, idempotency_key, billing_class, status, minimum_amount_mc, maximum_amount_mc, token_hash, metadata, expires_at) VALUES (?, ?, ?, ?, 'authorized', ?, ?, ?, ?, ?)",
-    args: [
-      id,
-      user.id,
-      idempotencyKey,
-      SCHEDULED_RUN_BILLING_CLASS,
-      SCHEDULED_RUN_BASE_MC,
-      maximumMc,
-      tokenHash(token),
-      safeMetadata(args.metadata),
-      expiresAt
-    ]
+    args: [id, user.id, idempotencyKey, SCHEDULED_RUN_BILLING_CLASS, SCHEDULED_RUN_BASE_MC, maximumMc, tokenHash(token), safeMetadata(args.metadata), expiresAt]
   });
   if (inserted.rowsAffected === 0) {
     const raced = await getDb().execute({
@@ -12061,11 +12245,7 @@ async function authorizeScheduledRun(args) {
     if (!raced.rows[0]) throw new Error("billing authorization insert raced without a readable winner");
     const row = raced.rows[0];
     if (Number(row.user_id) !== user.id) {
-      throw new UnifiedBillingError(
-        "invalid_request",
-        "the idempotency key is already in use by another billing identity",
-        409
-      );
+      throw new UnifiedBillingError("invalid_request", "the idempotency key is already in use by another billing identity", 409);
     }
     return mapAuthorization(row, balanceMc);
   }
@@ -12082,180 +12262,235 @@ async function authorizeScheduledRun(args) {
     reservationMode: "balance_check"
   };
 }
-async function settleScheduledRun(args) {
-  const identity = normalizeIdentity(args.identity);
-  const user = await getUserByEmail(identity);
-  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
-  const authorization = await authorizationById(args.authorizationId);
+async function startScheduledRun(args) {
+  const user = await resolveSchedulingUser(args.identity);
+  let authorization = await authorizationById(args.authorizationId);
   if (!authorization || Number(authorization.user_id) !== user.id) {
     throw new UnifiedBillingError("authorization_not_found", "billing authorization was not found", 404);
   }
   verifyToken(authorization, args.authorizationToken);
-  const settlementKey = authorization.id + ":settlement";
-  const existing = await eventByKey(settlementKey);
-  if (existing) {
-    const balanceMc = await reconcileBalanceMc(user.id, user.balance_mc);
-    if (existing.status === "settling") {
-      throw new UnifiedBillingError("settlement_in_progress", "scheduled-run settlement is already in progress", 409);
-    }
-    return mapEvent(existing, balanceMc, true);
+  const startKey = authorization.id + ":start";
+  const existing = await eventByKey(startKey);
+  if (existing?.status === "settled") {
+    await getDb().execute({
+      sql: "UPDATE billing_authorizations SET status = 'started' WHERE id = ? AND status IN ('authorized', 'starting')",
+      args: [authorization.id]
+    });
+    return mapStartEvent(existing, await reconcileBalanceMc(user.id, user.balance_mc), true);
   }
-  if (authorization.status !== "authorized") {
-    throw new UnifiedBillingError("authorization_closed", "billing authorization is no longer open", 409);
+  if (!hasPaidSchedulingAccess(user)) {
+    throw new UnifiedBillingError(PAID_PLAN_REQUIRED_CODE, PAID_PLAN_REQUIRED_MESSAGE, 403);
   }
-  if (Date.parse(authorization.expires_at) <= Date.now()) {
+  if (authorization.status === "authorized") {
+    if (Date.parse(authorization.expires_at) <= Date.now()) {
+      await getDb().execute({
+        sql: "UPDATE billing_authorizations SET status = 'expired' WHERE id = ? AND status = 'authorized'",
+        args: [authorization.id]
+      });
+      throw new UnifiedBillingError("authorization_expired", "billing authorization expired before execution started", 409);
+    }
     await getDb().execute({
-      sql: "UPDATE billing_authorizations SET status = 'expired' WHERE id = ? AND status = 'authorized'",
+      sql: "UPDATE billing_authorizations SET status = 'starting' WHERE id = ? AND status = 'authorized'",
       args: [authorization.id]
     });
-    throw new UnifiedBillingError("authorization_expired", "billing authorization expired before settlement", 409);
+    authorization = await authorizationById(authorization.id);
   }
-  const rawCostUsd = args.rawCostUsd ?? null;
-  if (args.modelCostStatus === "reported" && (rawCostUsd == null || !Number.isFinite(rawCostUsd) || rawCostUsd < 0)) {
-    throw new UnifiedBillingError("invalid_request", "reported model cost must be a finite non-negative number", 400);
-  }
-  if (args.modelCostStatus === "not_applicable" && rawCostUsd != null && rawCostUsd !== 0) {
-    throw new UnifiedBillingError("invalid_request", "not_applicable model cost cannot include a non-zero cost", 400);
+  if (!authorization || !["starting", "started"].includes(authorization.status)) {
+    throw new UnifiedBillingError("authorization_closed", "billing authorization is no longer startable", 409);
   }
-  const eventId = (0, import_node_crypto4.randomUUID)();
-  const rawCostNanos = rawCostUsd == null ? null : Math.round(rawCostUsd * USD_NANOS);
-  const modelMc = rawCostUsd == null ? 0 : vendorCostUsdToMc(rawCostUsd, SCHEDULED_AGENT_LLM_MARKUP_BPS);
-  const totalMc = SCHEDULED_RUN_BASE_MC + modelMc;
-  const pendingReason = args.modelCostStatus === "missing" ? "openrouter_cost_missing" : totalMc > Number(authorization.maximum_amount_mc) ? "max_credits_per_run_exceeded" : null;
-  if (pendingReason) {
+  const eventId = existing?.id ?? (0, import_node_crypto4.randomUUID)();
+  if (!existing) {
     await getDb().execute({
-      sql: "INSERT INTO billing_events (id, user_id, authorization_id, idempotency_key, billing_class, source_surface, status, amount_mc, raw_cost_usd_nanos, multiplier_bps, input_tokens, output_tokens, cached_tokens, model_steps, metadata) VALUES (?, ?, ?, ?, ?, ?, 'cost_pending', ?, ?, ?, ?, ?, ?, ?, ?)",
+      sql: "INSERT OR IGNORE INTO billing_events (id, user_id, authorization_id, idempotency_key, billing_class, source_surface, status, amount_mc, multiplier_bps, metadata) VALUES (?, ?, ?, ?, ?, ?, 'capturing', ?, ?, ?)",
       args: [
         eventId,
         user.id,
         authorization.id,
-        settlementKey,
+        startKey,
         SCHEDULED_RUN_BILLING_CLASS,
         SCHEDULED_RUN_SOURCE_SURFACE,
-        totalMc,
-        rawCostNanos,
+        SCHEDULED_RUN_BASE_MC,
         SCHEDULED_AGENT_LLM_MARKUP_BPS,
-        Math.max(0, Math.round(args.inputTokens ?? 0)),
-        Math.max(0, Math.round(args.outputTokens ?? 0)),
-        Math.max(0, Math.round(args.cachedTokens ?? 0)),
-        Math.max(0, Math.round(args.modelSteps ?? 0)),
-        safeMetadata({ ...args.metadata, reason: pendingReason })
+        safeMetadata({ ...args.metadata, billingPhase: "start", chargeMode: "base_capture" })
       ]
     });
-    await getDb().execute({
-      sql: "UPDATE billing_authorizations SET status = 'cost_pending', settled_at = datetime('now') WHERE id = ?",
-      args: [authorization.id]
-    });
-    return {
-      id: eventId,
-      authorizationId: authorization.id,
-      status: "cost_pending",
-      amountMc: totalMc,
-      credits: totalMc / MC_PER_CREDIT,
-      baseMc: SCHEDULED_RUN_BASE_MC,
-      modelMc,
-      rawCostUsd,
-      multiplierBps: SCHEDULED_AGENT_LLM_MARKUP_BPS,
-      balanceMc: await reconcileBalanceMc(user.id, user.balance_mc),
-      reason: pendingReason,
-      duplicate: false
-    };
-  }
-  const claimed = await getDb().execute({
-    sql: "INSERT OR IGNORE INTO billing_events (id, user_id, authorization_id, idempotency_key, billing_class, source_surface, status, amount_mc, raw_cost_usd_nanos, multiplier_bps, input_tokens, output_tokens, cached_tokens, model_steps, metadata) VALUES (?, ?, ?, ?, ?, ?, 'settling', ?, ?, ?, ?, ?, ?, ?, ?)",
-    args: [
-      eventId,
-      user.id,
-      authorization.id,
-      settlementKey,
-      SCHEDULED_RUN_BILLING_CLASS,
-      SCHEDULED_RUN_SOURCE_SURFACE,
-      totalMc,
-      rawCostNanos,
-      SCHEDULED_AGENT_LLM_MARKUP_BPS,
-      Math.max(0, Math.round(args.inputTokens ?? 0)),
-      Math.max(0, Math.round(args.outputTokens ?? 0)),
-      Math.max(0, Math.round(args.cachedTokens ?? 0)),
-      Math.max(0, Math.round(args.modelSteps ?? 0)),
-      safeMetadata(args.metadata)
-    ]
-  });
-  if (claimed.rowsAffected === 0) {
-    const raced = await eventByKey(settlementKey);
-    if (!raced) throw new Error("billing settlement raced without a readable winner");
-    if (raced.status === "settling") {
-      throw new UnifiedBillingError("settlement_in_progress", "scheduled-run settlement is already in progress", 409);
-    }
-    return mapEvent(raced, await reconcileBalanceMc(user.id, user.balance_mc), true);
   }
-  const debit = await debitMc(
+  const debit = await debitMcIdempotent(
     user.id,
-    totalMc,
+    SCHEDULED_RUN_BASE_MC,
     LedgerOperation.SCHEDULED_RUN,
-    "scheduled-run:" + authorization.id
+    "scheduled-run:" + authorization.id + ":base",
+    startKey
   );
   if (!debit.ok) {
-    const metadata = safeMetadata({ ...args.metadata, reason: "insufficient_credits_at_settlement" });
     await getDb().execute({
-      sql: "UPDATE billing_events SET status = 'cost_pending', metadata = ? WHERE id = ?",
-      args: [metadata, eventId]
-    });
-    await getDb().execute({
-      sql: "UPDATE billing_authorizations SET status = 'cost_pending', settled_at = datetime('now') WHERE id = ?",
+      sql: "UPDATE billing_authorizations SET status = 'authorized' WHERE id = ? AND status = 'starting'",
       args: [authorization.id]
     });
-    return {
-      id: eventId,
-      authorizationId: authorization.id,
-      status: "cost_pending",
-      amountMc: totalMc,
-      credits: totalMc / MC_PER_CREDIT,
-      baseMc: SCHEDULED_RUN_BASE_MC,
+    throw new UnifiedBillingError(
+      "insufficient_credits",
+      "the wallet could not capture the scheduled-run base charge",
+      402,
+      { balanceMc: debit.balance_mc, requiredMc: SCHEDULED_RUN_BASE_MC }
+    );
+  }
+  await getDb().execute({
+    sql: "UPDATE billing_events SET status = 'settled', settled_at = datetime('now') WHERE idempotency_key = ? AND status = 'capturing'",
+    args: [startKey]
+  });
+  await getDb().execute({
+    sql: "UPDATE billing_authorizations SET status = 'started' WHERE id = ? AND status IN ('authorized', 'starting', 'started')",
+    args: [authorization.id]
+  });
+  const started = await eventByKey(startKey);
+  if (!started) throw new Error("scheduled-run base capture completed without an event receipt");
+  return mapStartEvent(started, debit.balance_mc, debit.duplicate);
+}
+function validateModelCost(args) {
+  const rawCostUsd = args.rawCostUsd ?? null;
+  if (args.modelCostStatus === "reported" && (rawCostUsd == null || !Number.isFinite(rawCostUsd) || rawCostUsd < 0)) {
+    throw new UnifiedBillingError("invalid_request", "reported model cost must be a finite non-negative number", 400);
+  }
+  if (args.modelCostStatus === "not_applicable" && rawCostUsd != null && rawCostUsd !== 0) {
+    throw new UnifiedBillingError("invalid_request", "not_applicable model cost cannot include a non-zero cost", 400);
+  }
+  return rawCostUsd;
+}
+async function recoverSettlement(row, user, authorization, duplicate) {
+  const modelMc = Math.max(0, Number(row.amount_mc));
+  let balanceMc = await reconcileBalanceMc(user.id, user.balance_mc);
+  if (modelMc > 0) {
+    const debit = await debitMcIdempotent(
+      user.id,
       modelMc,
-      rawCostUsd,
-      multiplierBps: SCHEDULED_AGENT_LLM_MARKUP_BPS,
-      balanceMc: debit.balance_mc,
-      reason: "insufficient_credits_at_settlement",
-      duplicate: false
-    };
+      LedgerOperation.SCHEDULED_RUN,
+      "scheduled-run:" + authorization.id + ":model",
+      authorization.id + ":model"
+    );
+    balanceMc = debit.balance_mc;
+    if (!debit.ok) {
+      await getDb().execute({
+        sql: "UPDATE billing_events SET status = 'cost_pending', metadata = ? WHERE id = ? AND status = 'settling'",
+        args: [safeMetadata({ reason: "insufficient_credits_for_model_delta", billingPhase: "settlement", chargeMode: "model_delta" }), row.id]
+      });
+      await getDb().execute({
+        sql: "UPDATE billing_authorizations SET status = 'cost_pending' WHERE id = ? AND status IN ('started', 'cost_pending')",
+        args: [authorization.id]
+      });
+      const pending = await eventByKey(authorization.id + ":settlement");
+      if (!pending) throw new Error("scheduled-run pending settlement lost its event");
+      return mapSettlementEvent(pending, balanceMc, duplicate);
+    }
   }
   await getDb().execute({
-    sql: "UPDATE billing_events SET status = 'settled', settled_at = datetime('now') WHERE id = ?",
-    args: [eventId]
+    sql: "UPDATE billing_events SET status = 'settled', settled_at = datetime('now') WHERE id = ? AND status = 'settling'",
+    args: [row.id]
   });
   await getDb().execute({
-    sql: "UPDATE billing_authorizations SET status = 'settled', settled_at = datetime('now') WHERE id = ?",
+    sql: "UPDATE billing_authorizations SET status = 'settled', settled_at = datetime('now') WHERE id = ? AND status IN ('started', 'cost_pending', 'settled')",
     args: [authorization.id]
   });
-  return {
-    id: eventId,
-    authorizationId: authorization.id,
-    status: "settled",
-    amountMc: totalMc,
-    credits: totalMc / MC_PER_CREDIT,
-    baseMc: SCHEDULED_RUN_BASE_MC,
+  const settled = await eventByKey(authorization.id + ":settlement");
+  if (!settled) throw new Error("scheduled-run settlement completed without an event receipt");
+  return mapSettlementEvent(settled, balanceMc, duplicate);
+}
+async function settleScheduledRun(args) {
+  const user = await resolveSchedulingUser(args.identity);
+  let authorization = await authorizationById(args.authorizationId);
+  if (!authorization || Number(authorization.user_id) !== user.id) {
+    throw new UnifiedBillingError("authorization_not_found", "billing authorization was not found", 404);
+  }
+  verifyToken(authorization, args.authorizationToken);
+  const rawCostUsd = validateModelCost(args);
+  const startEvent = await eventByKey(authorization.id + ":start");
+  if (!startEvent || startEvent.status !== "settled") {
+    throw new UnifiedBillingError("authorization_closed", "scheduled-run settlement requires a captured start", 409);
+  }
+  if (authorization.status === "starting") {
+    await getDb().execute({
+      sql: "UPDATE billing_authorizations SET status = 'started' WHERE id = ? AND status = 'starting'",
+      args: [authorization.id]
+    });
+    authorization = await authorizationById(authorization.id);
+  }
+  if (!authorization || !["started", "cost_pending", "settled"].includes(authorization.status)) {
+    throw new UnifiedBillingError("authorization_closed", "billing authorization is not open for settlement", 409);
+  }
+  const settlementKey = authorization.id + ":settlement";
+  let existing = await eventByKey(settlementKey);
+  if (existing?.status === "settled") {
+    return mapSettlementEvent(existing, await reconcileBalanceMc(user.id, user.balance_mc), true);
+  }
+  if (existing?.status === "settling") {
+    return recoverSettlement(existing, user, authorization, true);
+  }
+  const hadExistingClaim = Boolean(existing);
+  const rawCostNanos = rawCostUsd == null ? null : Math.round(rawCostUsd * USD_NANOS);
+  const modelMc = rawCostUsd == null ? 0 : vendorCostUsdToMc(rawCostUsd, SCHEDULED_AGENT_LLM_MARKUP_BPS);
+  const maximumModelMc = Math.max(0, Number(authorization.maximum_amount_mc) - SCHEDULED_RUN_BASE_MC);
+  const pendingReason = args.modelCostStatus === "missing" ? "openrouter_cost_missing" : modelMc > maximumModelMc ? "max_credits_per_run_exceeded" : null;
+  const metadata = safeMetadata({
+    ...args.metadata,
+    billingPhase: "settlement",
+    chargeMode: "model_delta",
+    ...pendingReason ? { reason: pendingReason } : {}
+  });
+  const eventId = existing?.id ?? (0, import_node_crypto4.randomUUID)();
+  const status = pendingReason ? "cost_pending" : "settling";
+  const eventValues = [
     modelMc,
-    rawCostUsd,
-    multiplierBps: SCHEDULED_AGENT_LLM_MARKUP_BPS,
-    balanceMc: debit.balance_mc,
-    duplicate: false
-  };
+    rawCostNanos,
+    SCHEDULED_AGENT_LLM_MARKUP_BPS,
+    Math.max(0, Math.round(args.inputTokens ?? 0)),
+    Math.max(0, Math.round(args.outputTokens ?? 0)),
+    Math.max(0, Math.round(args.cachedTokens ?? 0)),
+    Math.max(0, Math.round(args.modelSteps ?? 0)),
+    metadata
+  ];
+  if (existing) {
+    await getDb().execute({
+      sql: "UPDATE billing_events SET status = ?, amount_mc = ?, raw_cost_usd_nanos = ?, multiplier_bps = ?, input_tokens = ?, output_tokens = ?, cached_tokens = ?, model_steps = ?, metadata = ?, settled_at = NULL WHERE id = ? AND status = 'cost_pending'",
+      args: [status, ...eventValues, existing.id]
+    });
+  } else {
+    await getDb().execute({
+      sql: "INSERT OR IGNORE INTO billing_events (id, user_id, authorization_id, idempotency_key, billing_class, source_surface, status, amount_mc, raw_cost_usd_nanos, multiplier_bps, input_tokens, output_tokens, cached_tokens, model_steps, metadata) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      args: [eventId, user.id, authorization.id, settlementKey, SCHEDULED_RUN_BILLING_CLASS, SCHEDULED_RUN_SOURCE_SURFACE, status, ...eventValues]
+    });
+  }
+  existing = await eventByKey(settlementKey);
+  if (!existing) throw new Error("scheduled-run settlement claim was not readable");
+  const duplicateClaim = hadExistingClaim || eventId !== existing.id;
+  if (existing.status === "settled") {
+    return mapSettlementEvent(existing, await reconcileBalanceMc(user.id, user.balance_mc), true);
+  }
+  if (existing.status === "cost_pending") {
+    await getDb().execute({
+      sql: "UPDATE billing_authorizations SET status = 'cost_pending' WHERE id = ? AND status IN ('started', 'cost_pending')",
+      args: [authorization.id]
+    });
+    return mapSettlementEvent(existing, await reconcileBalanceMc(user.id, user.balance_mc), duplicateClaim);
+  }
+  if (existing.status !== "settling") {
+    throw new UnifiedBillingError("settlement_in_progress", "scheduled-run settlement could not be claimed", 409);
+  }
+  return recoverSettlement(existing, user, authorization, duplicateClaim);
 }
 async function voidScheduledRunAuthorization(args) {
-  const identity = normalizeIdentity(args.identity);
-  const user = await getUserByEmail(identity);
-  if (!user) throw new UnifiedBillingError("user_not_found", "billing identity was not found", 404);
+  const user = await resolveSchedulingUser(args.identity);
   const authorization = await authorizationById(args.authorizationId);
   if (!authorization || Number(authorization.user_id) !== user.id) {
     throw new UnifiedBillingError("authorization_not_found", "billing authorization was not found", 404);
   }
   verifyToken(authorization, args.authorizationToken);
   if (authorization.status === "authorized") {
-    await getDb().execute({
+    const result = await getDb().execute({
       sql: "UPDATE billing_authorizations SET status = 'void', metadata = ?, settled_at = datetime('now') WHERE id = ? AND status = 'authorized'",
       args: [safeMetadata({ reason: args.reason ?? "voided_before_execution" }), authorization.id]
     });
-    return { ok: true, status: "void" };
+    if (result.rowsAffected > 0) return { ok: true, status: "void" };
+    const raced = await authorizationById(authorization.id);
+    return { ok: true, status: raced?.status ?? "closed" };
   }
   return { ok: true, status: authorization.status };
 }
@@ -12266,9 +12501,10 @@ var init_unified_billing = __esm({
     import_node_crypto4 = require("crypto");
     init_db();
     init_rates();
+    init_scheduling_access();
     SCHEDULED_RUN_BILLING_CLASS = "scheduled_agent_run";
     SCHEDULED_RUN_SOURCE_SURFACE = "mastra_scheduler";
-    AUTHORIZATION_TTL_MS = 30 * 60 * 1e3;
+    AUTHORIZATION_TTL_MS = 24 * 60 * 60 * 1e3;
     UnifiedBillingError = class extends Error {
       constructor(code, message, httpStatus, details = {}) {
         super(message);
@@ -12284,6 +12520,192 @@ var init_unified_billing = __esm({
   }
 });
 
+// src/api/session.ts
+function getSessionSecret() {
+  const configured = process.env.SESSION_SECRET?.trim();
+  if (configured) return configured;
+  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
+  return "dev-secret-change-me";
+}
+function safeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return (0, import_node_crypto5.timingSafeEqual)(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+function signSession(userId) {
+  const payload = String(userId);
+  const sig = (0, import_node_crypto5.createHmac)("sha256", secret()).update(payload).digest("hex");
+  return `${payload}.${sig}`;
+}
+function verifySession(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot === -1) return null;
+  const payload = token.slice(0, dot);
+  const sig = token.slice(dot + 1);
+  const expected = (0, import_node_crypto5.createHmac)("sha256", secret()).update(payload).digest("hex");
+  if (!safeEqualHex(sig, expected)) return null;
+  const id = parseInt(payload);
+  return isNaN(id) ? null : id;
+}
+var import_node_crypto5, isProduction, secret;
+var init_session = __esm({
+  "src/api/session.ts"() {
+    "use strict";
+    import_node_crypto5 = require("crypto");
+    isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
+    secret = () => getSessionSecret();
+  }
+});
+
+// src/api/memory.ts
+function parseMemoryRpcBody(text) {
+  const dataLine = text.split("\n").find((line) => line.startsWith("data:"));
+  const payload = dataLine ? dataLine.slice(5).trim() : text;
+  return JSON.parse(payload);
+}
+function isMemoryOperator(email) {
+  if (!email) return false;
+  const ops = (process.env.MEMORY_OPERATOR_IDENTITIES ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  return ops.includes(email.trim().toLowerCase());
+}
+function encKey() {
+  return (0, import_node_crypto6.scryptSync)(getSessionSecret(), "mcp-memory-key-v1", 32);
+}
+function encryptMemoryKey(secret2) {
+  const iv = (0, import_node_crypto6.randomBytes)(12);
+  const cipher = (0, import_node_crypto6.createCipheriv)("aes-256-gcm", encKey(), iv);
+  const enc = Buffer.concat([cipher.update(secret2, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
+}
+function decryptMemoryKey(stored) {
+  try {
+    const [ivB, tagB, dataB] = stored.split(":");
+    const decipher = (0, import_node_crypto6.createDecipheriv)("aes-256-gcm", encKey(), Buffer.from(ivB, "base64"));
+    decipher.setAuthTag(Buffer.from(tagB, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+async function memoryCall(toolName, args, userMemoryKey) {
+  try {
+    const res = await fetch(`${MEMORY_BASE_URL()}/mcp`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        authorization: `Bearer ${userMemoryKey}`
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "tools/call",
+        params: { name: toolName, arguments: args }
+      })
+    });
+    const text = await res.text();
+    if (!res.ok) return { ok: false, error: `memory ${toolName} failed (${res.status})` };
+    const body = parseMemoryRpcBody(text);
+    if (body.error) return { ok: false, error: body.error.message ?? `memory ${toolName} failed` };
+    if (body.result?.structuredContent) return body.result.structuredContent;
+    const textContent = body.result?.content?.find((c) => c.type === "text")?.text;
+    if (textContent) {
+      try {
+        return JSON.parse(textContent);
+      } catch {
+        return { ok: false, error: textContent };
+      }
+    }
+    return { ok: false, error: `memory ${toolName} returned no result` };
+  } catch (err) {
+    return { ok: false, error: err?.message ?? "memory call failed" };
+  }
+}
+function memoryIdentity(user) {
+  return user.email;
+}
+function resolveMemoryIdentity(user) {
+  return memoryIdentity(user);
+}
+function memoryPlanForReads(user) {
+  if (isMemoryOperator(user.email)) return "unlimited";
+  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
+  return "free";
+}
+async function provisionMemoryForUser(user) {
+  try {
+    const { key } = await getOrCreateUserMemoryKey(user);
+    if (key) await setMemoryProvisioned(user.id, true);
+  } catch {
+  }
+}
+function resolveEffectiveMemoryPlan(user) {
+  return user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
+}
+async function getOrCreateUserMemoryKey(user) {
+  const creds = await getUserMemoryCreds(user.id);
+  if (creds.memory_key) {
+    const decrypted = decryptMemoryKey(creds.memory_key);
+    if (decrypted) return { key: decrypted };
+  }
+  const admin = ADMIN_KEY();
+  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
+  const identity = memoryIdentity(user);
+  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
+  const provisioned = await import_provision_defaults.provisionDefaultsTool.execute(
+    { apiKey: admin, granteeIdentity: identity, issueKey: true, plan },
+    {}
+  );
+  if (!provisioned.ok || !provisioned.secret) {
+    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
+  }
+  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
+  return { key: provisioned.secret };
+}
+async function syncMemoryKeyPlan(user, plan) {
+  const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
+  const { key, error } = await getOrCreateUserMemoryKey(user);
+  if (!key) return { ok: false, error: error ?? "memory unavailable" };
+  const listed = await memoryCall(
+    "listKeysTool",
+    {},
+    key
+  );
+  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
+  const target = listed.keys[0];
+  if (target.plan === effectivePlan) return { ok: true };
+  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key);
+  return { ok: res.ok, error: res.error };
+}
+async function syncScheduledActionCredentials(user) {
+  const admin = ADMIN_KEY();
+  if (!admin) return { ok: false, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
+  const identity = resolveMemoryIdentity(user);
+  const res = await import_set_schedule_entitlement.setScheduleEntitlementTool.execute({
+    apiKey: admin,
+    granteeIdentity: identity,
+    mcpScraperApiKey: user.api_key
+  }, {});
+  return { ok: res.ok, error: res.error };
+}
+var import_node_crypto6, import_provision_defaults, import_set_schedule_entitlement, MEMORY_BASE_URL, ADMIN_KEY;
+var init_memory = __esm({
+  "src/api/memory.ts"() {
+    "use strict";
+    import_node_crypto6 = require("crypto");
+    init_session();
+    init_db();
+    import_provision_defaults = require("mcpscraper-memory-tools/tools/vaults/provision-defaults");
+    import_set_schedule_entitlement = require("mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement");
+    MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
+    ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
+  }
+});
+
 // src/api/internal-billing-routes.ts
 function internalRequestAuthorized(header) {
   const expected = process.env.INTERNAL_BILLING_SECRET ?? process.env.INTERNAL_MEMORY_DEBIT_SECRET;
@@ -12307,15 +12729,22 @@ function billingError(error) {
     status: 500
   };
 }
-var import_hono3, import_zod12, internalBillingApp, metadataSchema, authorizeSchema, settleSchema, voidSchema;
+var import_hono3, import_zod12, internalBillingApp, metadataSchema, schedulingAccessSchema, authorizeSchema, settleSchema, startSchema, voidSchema;
 var init_internal_billing_routes = __esm({
   "src/api/internal-billing-routes.ts"() {
     "use strict";
     import_hono3 = require("hono");
     import_zod12 = require("zod");
     init_unified_billing();
+    init_scheduling_access();
+    init_db();
+    init_memory();
     internalBillingApp = new import_hono3.Hono();
     metadataSchema = import_zod12.z.record(import_zod12.z.unknown()).optional();
+    schedulingAccessSchema = import_zod12.z.object({
+      identity: import_zod12.z.string().min(1).max(320),
+      provisionCredentials: import_zod12.z.boolean().optional()
+    });
     authorizeSchema = import_zod12.z.object({
       identity: import_zod12.z.string().min(1).max(320),
       idempotencyKey: import_zod12.z.string().min(1).max(500),
@@ -12334,6 +12763,12 @@ var init_internal_billing_routes = __esm({
       modelSteps: import_zod12.z.number().finite().nonnegative().optional(),
       metadata: metadataSchema
     });
+    startSchema = import_zod12.z.object({
+      identity: import_zod12.z.string().min(1).max(320),
+      authorizationId: import_zod12.z.string().uuid(),
+      authorizationToken: import_zod12.z.string().min(20).max(500),
+      metadata: metadataSchema
+    });
     voidSchema = import_zod12.z.object({
       identity: import_zod12.z.string().min(1).max(320),
       authorizationId: import_zod12.z.string().uuid(),
@@ -12359,6 +12794,41 @@ var init_internal_billing_routes = __esm({
         return c.json(response.body, response.status);
       }
     });
+    internalBillingApp.post("/scheduling-access", async (c) => {
+      const parsed = schedulingAccessSchema.safeParse(await c.req.json().catch(() => null));
+      if (!parsed.success) {
+        return c.json({ ok: false, error_code: "invalid_request", error: "invalid scheduling access request" }, 400);
+      }
+      try {
+        const access2 = await getSchedulingAccess(parsed.data.identity);
+        if (access2.allowed && parsed.data.provisionCredentials) {
+          const user = await getUserByEmail(parsed.data.identity.trim().toLowerCase());
+          if (!user) {
+            return c.json({ ok: false, error_code: "user_not_found", error: "billing identity was not found" }, 404);
+          }
+          const credentials = await syncScheduledActionCredentials(user);
+          if (!credentials.ok) {
+            return c.json({
+              ok: false,
+              error_code: "schedule_credentials_unavailable",
+              error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+            }, 503);
+          }
+        }
+        return c.json({
+          ok: true,
+          allowed: access2.allowed,
+          subscriptionTier: access2.subscriptionTier,
+          ...access2.allowed ? {} : {
+            error_code: PAID_PLAN_REQUIRED_CODE,
+            error: PAID_PLAN_REQUIRED_MESSAGE
+          }
+        });
+      } catch (error) {
+        const response = billingError(error);
+        return c.json(response.body, response.status);
+      }
+    });
     internalBillingApp.post("/scheduled-run/settle", async (c) => {
       const parsed = settleSchema.safeParse(await c.req.json().catch(() => null));
       if (!parsed.success) {
@@ -12372,6 +12842,19 @@ var init_internal_billing_routes = __esm({
         return c.json(response.body, response.status);
       }
     });
+    internalBillingApp.post("/scheduled-run/start", async (c) => {
+      const parsed = startSchema.safeParse(await c.req.json().catch(() => null));
+      if (!parsed.success) {
+        return c.json({ ok: false, error_code: "invalid_request", error: "invalid scheduled-run start request" }, 400);
+      }
+      try {
+        const start = await startScheduledRun(parsed.data);
+        return c.json({ ok: true, start });
+      } catch (error) {
+        const response = billingError(error);
+        return c.json(response.body, response.status);
+      }
+    });
     internalBillingApp.post("/scheduled-run/void", async (c) => {
       const parsed = voidSchema.safeParse(await c.req.json().catch(() => null));
       if (!parsed.success) {
@@ -12658,6 +13141,7 @@ var init_BrowserDriver = __esm({
           else if (config.headlessMode === "headless") useHeadless = true;
           else useHeadless = costCtx?.forceHeadless === true || process.env.KERNEL_HEADLESS_DISABLED !== "true" && !!costCtx?.op && HEADLESS_OPS.has(costCtx.op);
           this.kernelHeadlessSent = useHeadless ? true : null;
+          if (costCtx?.headlessSentOut) costCtx.headlessSentOut.value = this.kernelHeadlessSent;
           const kernelBrowser = await this.kernelClient.browsers.create({
             stealth: true,
             timeout_seconds: timeoutSeconds,
@@ -14785,7 +15269,7 @@ async function acquireConcurrencyGate(user, operation, options = {}) {
     return { ok: true, lockId: null, active: await countActiveUsageForUser(user.id), limit, operation, reused: true };
   }
   await expireConcurrencyLocksForUser(user.id);
-  const lockId = `cl_${(0, import_node_crypto5.randomUUID)().replace(/-/g, "").slice(0, 24)}`;
+  const lockId = `cl_${(0, import_node_crypto7.randomUUID)().replace(/-/g, "").slice(0, 24)}`;
   const res = await getDb().execute({
     sql: `INSERT INTO concurrency_locks (id, user_id, operation, status, expires_at, metadata)
           SELECT ?, ?, ?, 'active', datetime('now', ?), ?
@@ -14839,11 +15323,11 @@ async function extendConcurrencyGate(lockId, ttlSeconds = DEFAULT_LOCK_TTL_SECON
     args: [lockTtlModifier(ttlSeconds), lockId]
   });
 }
-var import_node_crypto5, DEFAULT_LOCK_TTL_SECONDS, DEFAULT_RETRY_AFTER_SECONDS, MAX_LOCK_TTL_SECONDS, schemaReady;
+var import_node_crypto7, DEFAULT_LOCK_TTL_SECONDS, DEFAULT_RETRY_AFTER_SECONDS, MAX_LOCK_TTL_SECONDS, schemaReady;
 var init_concurrency_gates = __esm({
   "src/api/concurrency-gates.ts"() {
     "use strict";
-    import_node_crypto5 = require("crypto");
+    import_node_crypto7 = require("crypto");
     init_db();
     init_rates();
     DEFAULT_LOCK_TTL_SECONDS = 15 * 60;
@@ -17786,194 +18270,6 @@ var init_reddit_routes = __esm({
   }
 });
 
-// src/api/session.ts
-function getSessionSecret() {
-  const configured = process.env.SESSION_SECRET?.trim();
-  if (configured) return configured;
-  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
-  return "dev-secret-change-me";
-}
-function safeEqualHex(a, b) {
-  if (a.length !== b.length) return false;
-  try {
-    return (0, import_node_crypto6.timingSafeEqual)(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-  } catch {
-    return false;
-  }
-}
-function signSession(userId) {
-  const payload = String(userId);
-  const sig = (0, import_node_crypto6.createHmac)("sha256", secret()).update(payload).digest("hex");
-  return `${payload}.${sig}`;
-}
-function verifySession(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot === -1) return null;
-  const payload = token.slice(0, dot);
-  const sig = token.slice(dot + 1);
-  const expected = (0, import_node_crypto6.createHmac)("sha256", secret()).update(payload).digest("hex");
-  if (!safeEqualHex(sig, expected)) return null;
-  const id = parseInt(payload);
-  return isNaN(id) ? null : id;
-}
-var import_node_crypto6, isProduction, secret;
-var init_session = __esm({
-  "src/api/session.ts"() {
-    "use strict";
-    import_node_crypto6 = require("crypto");
-    isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
-    secret = () => getSessionSecret();
-  }
-});
-
-// src/api/memory.ts
-function parseMemoryRpcBody(text) {
-  const dataLine = text.split("\n").find((line) => line.startsWith("data:"));
-  const payload = dataLine ? dataLine.slice(5).trim() : text;
-  return JSON.parse(payload);
-}
-function isMemoryOperator(email) {
-  if (!email) return false;
-  const ops = (process.env.MEMORY_OPERATOR_IDENTITIES ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
-  return ops.includes(email.trim().toLowerCase());
-}
-function encKey() {
-  return (0, import_node_crypto7.scryptSync)(getSessionSecret(), "mcp-memory-key-v1", 32);
-}
-function encryptMemoryKey(secret2) {
-  const iv = (0, import_node_crypto7.randomBytes)(12);
-  const cipher = (0, import_node_crypto7.createCipheriv)("aes-256-gcm", encKey(), iv);
-  const enc = Buffer.concat([cipher.update(secret2, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
-}
-function decryptMemoryKey(stored) {
-  try {
-    const [ivB, tagB, dataB] = stored.split(":");
-    const decipher = (0, import_node_crypto7.createDecipheriv)("aes-256-gcm", encKey(), Buffer.from(ivB, "base64"));
-    decipher.setAuthTag(Buffer.from(tagB, "base64"));
-    return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
-  } catch {
-    return null;
-  }
-}
-async function memoryCall(toolName, args, userMemoryKey) {
-  try {
-    const res = await fetch(`${MEMORY_BASE_URL()}/mcp`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        accept: "application/json, text/event-stream",
-        authorization: `Bearer ${userMemoryKey}`
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "tools/call",
-        params: { name: toolName, arguments: args }
-      })
-    });
-    const text = await res.text();
-    if (!res.ok) return { ok: false, error: `memory ${toolName} failed (${res.status})` };
-    const body = parseMemoryRpcBody(text);
-    if (body.error) return { ok: false, error: body.error.message ?? `memory ${toolName} failed` };
-    if (body.result?.structuredContent) return body.result.structuredContent;
-    const textContent = body.result?.content?.find((c) => c.type === "text")?.text;
-    if (textContent) {
-      try {
-        return JSON.parse(textContent);
-      } catch {
-        return { ok: false, error: textContent };
-      }
-    }
-    return { ok: false, error: `memory ${toolName} returned no result` };
-  } catch (err) {
-    return { ok: false, error: err?.message ?? "memory call failed" };
-  }
-}
-function memoryIdentity(user) {
-  return user.email;
-}
-function resolveMemoryIdentity(user) {
-  return memoryIdentity(user);
-}
-function memoryPlanForReads(user) {
-  if (isMemoryOperator(user.email)) return "unlimited";
-  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
-  return "free";
-}
-async function provisionMemoryForUser(user) {
-  try {
-    const { key } = await getOrCreateUserMemoryKey(user);
-    if (key) await setMemoryProvisioned(user.id, true);
-  } catch {
-  }
-}
-function resolveEffectiveMemoryPlan(user) {
-  return user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
-}
-async function getOrCreateUserMemoryKey(user) {
-  const creds = await getUserMemoryCreds(user.id);
-  if (creds.memory_key) {
-    const decrypted = decryptMemoryKey(creds.memory_key);
-    if (decrypted) return { key: decrypted };
-  }
-  const admin = ADMIN_KEY();
-  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
-  const identity = memoryIdentity(user);
-  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
-  const provisioned = await import_provision_defaults.provisionDefaultsTool.execute(
-    { apiKey: admin, granteeIdentity: identity, issueKey: true, plan },
-    {}
-  );
-  if (!provisioned.ok || !provisioned.secret) {
-    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
-  }
-  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
-  return { key: provisioned.secret };
-}
-async function syncMemoryKeyPlan(user, plan) {
-  const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
-  const { key, error } = await getOrCreateUserMemoryKey(user);
-  if (!key) return { ok: false, error: error ?? "memory unavailable" };
-  const listed = await memoryCall(
-    "listKeysTool",
-    {},
-    key
-  );
-  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
-  const target = listed.keys[0];
-  if (target.plan === effectivePlan) return { ok: true };
-  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key);
-  return { ok: res.ok, error: res.error };
-}
-async function syncScheduleEntitlement(user, enabled, quotaPerPeriod) {
-  const admin = ADMIN_KEY();
-  if (!admin) return { ok: false, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
-  const identity = resolveMemoryIdentity(user);
-  const res = await import_set_schedule_entitlement.setScheduleEntitlementTool.execute({
-    apiKey: admin,
-    granteeIdentity: identity,
-    enabled,
-    quotaPerPeriod,
-    mcpScraperApiKey: user.api_key
-  }, {});
-  return { ok: res.ok, error: res.error };
-}
-var import_node_crypto7, import_provision_defaults, import_set_schedule_entitlement, MEMORY_BASE_URL, ADMIN_KEY;
-var init_memory = __esm({
-  "src/api/memory.ts"() {
-    "use strict";
-    import_node_crypto7 = require("crypto");
-    init_session();
-    init_db();
-    import_provision_defaults = require("mcpscraper-memory-tools/tools/vaults/provision-defaults");
-    import_set_schedule_entitlement = require("mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement");
-    MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
-    ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
-  }
-});
-
 // src/api/video-routes.ts
 function invalidRequest5(message) {
   return { error_code: "invalid_request", message };
@@ -28401,7 +28697,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.21.1";
+    PACKAGE_VERSION = "0.21.3";
   }
 });
 
@@ -34324,7 +34620,7 @@ var init_memory_tool_schemas = __esm({
     CreateScheduledActionSchema = {
       id: "create-scheduled-action",
       upstreamName: "createScheduledActionTool",
-      description: "Create a Credit-metered scheduled action in agent mode (default) or connection_sync mode. Each execution has a 75-Credit base charge; agent model usage is added at 1.5 times OpenRouter's actual reported cost. Agent mode follows the description and writes a result into the target vault. connection_sync deterministically runs approved read-only tools on bound service connections and ingests their data. Cadence 'once' runs a single time then completes permanently. Requires write access to the target vault.",
+      description: "Create a Credit-metered scheduled action for an active MCP Scraper Starter plan or higher, in agent mode (default) or connection_sync mode. Each execution has a 75-Credit base charge; agent model usage is added at 1.5 times OpenRouter's actual reported cost. Agent mode follows the description and writes a result into the target vault. connection_sync deterministically runs approved read-only tools on bound service connections and ingests their data. Cadence 'once' runs a single time then completes permanently. Requires write access to the target vault.",
       input: {
         description: import_zod36.z.string().min(1).describe("Free-text description of what this action should do each time it runs."),
         vault: import_zod36.z.string().min(1).describe("The vault this action writes its results into. You must already have write access to it."),
@@ -34373,12 +34669,13 @@ var init_memory_tool_schemas = __esm({
     GetScheduleLinkSchema = {
       id: "get-schedule-link",
       upstreamName: "getScheduleLinkTool",
-      description: "Get your durable, bookmarkable link to the hosted Scheduled Actions page \u2014 a login-free UI to create, view, edit, pause, resume, and delete scheduled actions. The embedded secret is shown only once, on first call; it cannot be re-shown, only revoked and reissued via revoke-schedule-link.",
+      description: "Get your durable, bookmarkable link to the hosted Scheduled Actions page. Requires an active MCP Scraper Starter plan or higher. The embedded secret is shown only once, on first call; it cannot be re-shown, only revoked and reissued via revoke-schedule-link.",
       input: {},
       output: {
         ok: import_zod36.z.boolean().describe("True on success; false on auth error."),
         url: import_zod36.z.string().optional().describe("The schedule link. Present only the first time a link is minted for this identity."),
         alreadyExists: import_zod36.z.boolean().optional().describe("True when a link already exists and was NOT re-shown. Use revoke-schedule-link then call this again to get a fresh one."),
+        code: import_zod36.z.string().optional().describe("Machine-readable denial code when the link cannot be issued."),
         error: import_zod36.z.string().optional().describe("Human-readable failure reason when ok is false.")
       },
       annotations: {
@@ -34392,7 +34689,7 @@ var init_memory_tool_schemas = __esm({
     GetScheduleStatusSchema = {
       id: "get-schedule-status",
       upstreamName: "getScheduleStatusTool",
-      description: "Get the Credit-metered Scheduled Actions policy. Scheduling is included rather than sold as a separate subscription: each execution has a 75-Credit base charge, and agent model usage is billed at 1.5 times OpenRouter's actual reported cost.",
+      description: "Get the Credit-metered Scheduled Actions access and billing policy. Scheduling requires an active MCP Scraper Starter plan or higher but has no separate subscription: each execution has a 75-Credit base charge, and agent model usage is billed at 1.5 times OpenRouter's actual reported cost.",
       input: {},
       output: {
         ok: import_zod36.z.boolean(),
@@ -34403,6 +34700,8 @@ var init_memory_tool_schemas = __esm({
         quotaPerPeriod: import_zod36.z.number().optional(),
         usedThisPeriod: import_zod36.z.number().optional(),
         periodStart: import_zod36.z.string().optional(),
+        defaultTimezone: import_zod36.z.string().nullable().optional().describe("IANA timezone applied to new schedules that name a time without a zone; null means UTC."),
+        code: import_zod36.z.string().optional().describe("Machine-readable reason scheduling is unavailable."),
         error: import_zod36.z.string().optional()
       },
       annotations: {
@@ -34496,6 +34795,7 @@ var init_memory_tool_schemas = __esm({
       output: {
         ok: import_zod36.z.boolean(),
         nextRunAt: import_zod36.z.string().optional(),
+        code: import_zod36.z.string().optional().describe("Machine-readable denial code when the action cannot be resumed."),
         error: import_zod36.z.string().optional()
       },
       annotations: {
@@ -34527,11 +34827,11 @@ var init_memory_tool_schemas = __esm({
     SetScheduleEntitlementSchema = {
       id: "set-schedule-entitlement",
       upstreamName: "setScheduleEntitlementTool",
-      description: "Legacy migration and account-recovery control for old Scheduled Actions entitlements. New scheduling is Credit-metered and does not require a separate subscription. This admin-only tool may preserve a legacy API-key delegation or recover historical entitlement rows during migration.",
+      description: "Admin-only scheduled-action credential provisioning and historical-row recovery. Rotate the encrypted delegated MCP Scraper API key without changing legacy enabled/quota fields by omitting those fields. Legacy entitlement values are not runtime access controls; paid-plan access is checked against MCP Scraper directly.",
       input: {
         granteeIdentity: import_zod36.z.string().min(1).describe("Identity whose scheduling entitlement is being set (e.g. an email)."),
-        enabled: import_zod36.z.boolean().describe("True to enable scheduled actions for this identity, false on cancel/expire."),
-        quotaPerPeriod: import_zod36.z.number().optional().describe("Legacy monthly execution quota retained only for historical-row compatibility; it does not price new Credit-metered runs."),
+        enabled: import_zod36.z.boolean().optional().describe("Historical entitlement value for migration/recovery only. Omit to preserve the stored value."),
+        quotaPerPeriod: import_zod36.z.number().optional().describe("Historical monthly execution quota retained only for migration compatibility. Omit to preserve the stored value."),
         mcpScraperApiKey: import_zod36.z.string().optional().describe("The identity's mcp-scraper API key, stored encrypted, used to reach mcp-scraper tools during scheduled-action execution.")
       },
       output: {
@@ -35269,6 +35569,7 @@ var init_memory_inprocess_executor = __esm({
   "src/mcp/memory-inprocess-executor.ts"() {
     "use strict";
     init_memory();
+    init_scheduling_access();
     CUTOVER = /* @__PURE__ */ new Map();
     HybridMemoryToolExecutor = class {
       constructor(httpExecutor, user) {
@@ -35285,6 +35586,29 @@ var init_memory_inprocess_executor = __esm({
         return this.mkKeyPromise;
       }
       async callMemoryTool(upstreamName, args) {
+        const accessDenied = memoryScheduleAccessPayload(upstreamName, this.user);
+        if (accessDenied) {
+          return {
+            content: [{ type: "text", text: JSON.stringify(accessDenied) }],
+            structuredContent: accessDenied,
+            isError: false
+          };
+        }
+        if (memoryScheduleToolNeedsCredentials(upstreamName)) {
+          const credentials = await syncScheduledActionCredentials(this.user);
+          if (!credentials.ok) {
+            const result = {
+              ok: false,
+              code: "schedule_credentials_unavailable",
+              error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+            };
+            return {
+              content: [{ type: "text", text: JSON.stringify(result) }],
+              structuredContent: result,
+              isError: false
+            };
+          }
+        }
         const handler = CUTOVER.get(upstreamName);
         if (!handler) return this.httpExecutor.callMemoryTool(upstreamName, args);
         const mkKey = await this.resolveMkKey();
@@ -38331,6 +38655,8 @@ var init_stripe_routes = __esm({
           if (user && invoice.id && !await ledgerExistsForStripePI(invoice.id)) {
             await creditMc(user.id, tier.credits_mc, LedgerOperation.SUBSCRIPTION, `${tier.label} subscription credits`, invoice.id);
             await setSubscriptionTier(user.id, tier.tier, tier.concurrency, invoice.subscription ?? user.subscription_id);
+            const credentials = await syncScheduledActionCredentials(user);
+            if (!credentials.ok) console.warn("[stripe] scheduled-action credential sync failed:", credentials.error ?? "unknown error");
           }
         }
       }
@@ -38348,15 +38674,6 @@ var init_stripe_routes = __esm({
           }
           return c.json({ received: true });
         }
-        if (priceId && priceId in SCHEDULING_PLANS) {
-          const sched = SCHEDULING_PLANS[priceId];
-          const user2 = await resolveUser(sub.customer, sub.customer_email);
-          if (user2) {
-            const live = sub.status === "active" || sub.status === "trialing";
-            await syncScheduleEntitlement(user2, live, sched.quota_per_period);
-          }
-          return c.json({ received: true });
-        }
         const user = await getUserByStripeCustomerId(sub.customer);
         if (!user) return c.json({ received: true });
         if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -38364,6 +38681,10 @@ var init_stripe_routes = __esm({
           const live = sub.status === "active" || sub.status === "trialing";
           const newTier = live ? tier.tier : null;
           await setSubscriptionTier(user.id, newTier, live ? tier.concurrency : 0, live ? sub.id : null);
+          if (live) {
+            const credentials = await syncScheduledActionCredentials(user);
+            if (!credentials.ok) console.warn("[stripe] scheduled-action credential sync failed:", credentials.error ?? "unknown error");
+          }
         } else if (priceId === CONCURRENCY_PRICE_ID && event.type === "customer.subscription.created") {
           await setExtraConcurrencySlots(user.id, user.extra_concurrency_slots + 1);
           await setConcurrencySubId(user.id, sub.id);
@@ -38380,11 +38701,6 @@ var init_stripe_routes = __esm({
           }
           return c.json({ received: true });
         }
-        if (priceId && priceId in SCHEDULING_PLANS) {
-          const user2 = await getUserByStripeCustomerId(sub.customer);
-          if (user2) await syncScheduleEntitlement(user2, false);
-          return c.json({ received: true });
-        }
         const user = await getUserByStripeCustomerId(sub.customer);
         if (!user) return c.json({ received: true });
         if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -42189,8 +42505,9 @@ async function processJob(job) {
   running++;
   try {
     const opts = typeof job.options === "string" ? JSON.parse(job.options) : job.options;
+    const headlessSentOut = { value: null };
     const result = await runWithCostContext(
-      { op: opts.serpOnly ? "serp" : "paa", userId: Number(job.user_id) },
+      { op: opts.serpOnly ? "serp" : "paa", userId: Number(job.user_id), headlessSentOut },
       () => harvest({
         ...opts,
         kernelApiKey: browserServiceApiKey(),
@@ -42207,6 +42524,11 @@ async function processJob(job) {
       const diff = opts.billingHoldMc - actualCost;
       if (diff > 0) await creditMc(job.user_id, diff, "paa_refund", "overestimate refund");
       else if (diff < 0) await debitMc(job.user_id, -diff, "paa", opts.query ?? job.query);
+    } else if (opts.serpOnly && typeof opts.billingHoldMc === "number") {
+      const actualCost = headlessSentOut.value === true ? MC_COSTS.serp_headless : MC_COSTS.serp_headful;
+      const diff = opts.billingHoldMc - actualCost;
+      if (diff > 0) await creditMc(job.user_id, diff, "serp_refund", "headless-mode pricing settle");
+      else if (diff < 0) await debitMc(job.user_id, -diff, "serp", opts.query ?? job.query);
     }
     if (job.callback_url) {
       await deliverWebhook(job.callback_url, { job_id: job.id, status: "done", result, attempts });
@@ -42514,7 +42836,7 @@ async function checkHarvestLimits(user, reuseLockId) {
   }
   return null;
 }
-var import_resend2, import_hono24, import_hono25, import_factory6, import_cookie2, import_stripe2, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, requireIntegrationsTier, app, STRIPE_API_VERSION, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
+var import_resend2, import_hono24, import_hono25, import_factory6, import_cookie2, import_stripe2, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, requireIntegrationsTier, requirePaidSchedulingTier, app, STRIPE_API_VERSION, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
 var init_server = __esm({
   "src/api/server.ts"() {
     "use strict";
@@ -42586,6 +42908,7 @@ var init_server = __esm({
     init_harvest_attempt_events();
     init_session();
     init_memory();
+    init_scheduling_access();
     init_memory_db();
     init_nango_control();
     init_resend_control();
@@ -42645,6 +42968,11 @@ var init_server = __esm({
       }
       return next();
     });
+    requirePaidSchedulingTier = (0, import_factory6.createMiddleware)(async (c, next) => {
+      const user = c.get("user");
+      if (!hasPaidSchedulingAccess(user)) return c.json(paidPlanRequiredPayload(), 403);
+      return next();
+    });
     app = new import_hono24.Hono();
     STRIPE_API_VERSION = "2026-02-25.clover";
     app.use("*", async (c, next) => {
@@ -42799,11 +43127,7 @@ var init_server = __esm({
       return c.json(CATALOG);
     });
     app.get("/rates", (c) => {
-      const costs = CREDIT_COST_CATALOG.map(({ aliases, ...cost }) => ({
-        ...cost,
-        ...cost.notes ? { notes: cost.notes.replace(/ via fal\.ai/g, "") } : {}
-      }));
-      return c.json({ creditsPerDollarStarter: Math.round(1 / 15e-5), costs });
+      return c.json(getPublicRatesPayload());
     });
     app.get("/me", async (c) => {
       const token = (0, import_cookie2.getCookie)(c, "session");
@@ -42894,6 +43218,18 @@ var init_server = __esm({
       const user = c.get("user");
       const body = await c.req.json().catch(() => ({}));
       if (!body.toolName) return c.json({ ok: false, error: "toolName is required" }, 400);
+      const accessDenied = memoryScheduleAccessPayload(body.toolName, user);
+      if (accessDenied) return c.json(accessDenied);
+      if (memoryScheduleToolNeedsCredentials(body.toolName)) {
+        const credentials = await syncScheduledActionCredentials(user);
+        if (!credentials.ok) {
+          return c.json({
+            ok: false,
+            code: "schedule_credentials_unavailable",
+            error: credentials.error ?? "Scheduled Actions credentials are unavailable."
+          }, 503);
+        }
+      }
       const { key, error } = await getOrCreateUserMemoryKey(user);
       if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 502);
       const result = await memoryCall(body.toolName, body.args ?? {}, key);
@@ -43093,7 +43429,7 @@ var init_server = __esm({
         llmCostMultiplier: SCHEDULED_AGENT_LLM_MARKUP
       }, 410);
     });
-    app.get("/schedule-status", auth2, async (c) => {
+    app.get("/schedule-status", auth2, requirePaidSchedulingTier, async (c) => {
       try {
         const user = c.get("user");
         const { key, error } = await getOrCreateUserMemoryKey(user);
@@ -43460,9 +43796,13 @@ var init_server = __esm({
         return scheduleConnectionError(c, err, "Unable to run this connection action.");
       }
     });
-    app.post("/schedule-link", auth2, async (c) => {
+    app.post("/schedule-link", auth2, requirePaidSchedulingTier, async (c) => {
       try {
         const user = c.get("user");
+        const credentials = await syncScheduledActionCredentials(user);
+        if (!credentials.ok) {
+          return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
+        }
         const { key, error } = await getOrCreateUserMemoryKey(user);
         if (!key) return c.json({ error: error ?? "memory unavailable" }, 503);
         const r = await memoryCall("getScheduleLinkTool", {}, key);
@@ -43500,8 +43840,12 @@ var init_server = __esm({
         });
       }
     });
-    app.post("/schedule-actions", auth2, async (c) => {
+    app.post("/schedule-actions", auth2, requirePaidSchedulingTier, async (c) => {
       const user = c.get("user");
+      const credentials = await syncScheduledActionCredentials(user);
+      if (!credentials.ok) {
+        return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
+      }
       const { key, error } = await getOrCreateUserMemoryKey(user);
       if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
       const body = await c.req.json().catch(() => ({}));
@@ -43593,7 +43937,7 @@ var init_server = __esm({
       const r = await memoryCall("pauseScheduledActionTool", { id: c.req.param("id") }, key);
       return c.json(r);
     });
-    app.post("/schedule-actions/:id/resume", auth2, async (c) => {
+    app.post("/schedule-actions/:id/resume", auth2, requirePaidSchedulingTier, async (c) => {
       const user = c.get("user");
       const { key, error } = await getOrCreateUserMemoryKey(user);
       if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
@@ -43698,7 +44042,7 @@ var init_server = __esm({
         serpOnly: body.serpOnly ?? false,
         pages: Math.min(2, Math.max(1, body.pages ?? 1))
       };
-      const harvestCost = options.serpOnly ? MC_COSTS.serp : paaCostForQuestionCount2(options.maxQuestions);
+      const harvestCost = options.serpOnly ? MC_COSTS.serp_headful : paaCostForQuestionCount2(options.maxQuestions);
       const { ok: harvestOk, balance_mc: harvestBal } = await debitMc(user.id, harvestCost, options.serpOnly ? LedgerOperation.SERP : LedgerOperation.PAA, options.query);
       if (!harvestOk) return c.json(insufficientBalanceResponse(harvestBal, harvestCost), 402);
       const jobId = await createJob(user.id, options.query, { ...options, billingHoldMc: harvestCost }, body.callback_url);
@@ -43734,7 +44078,7 @@ var init_server = __esm({
         serpOnly: body.serpOnly ?? false,
         pages: Math.min(2, Math.max(1, body.pages ?? 1))
       };
-      const syncCost = options.serpOnly ? MC_COSTS.serp : paaCostForQuestionCount2(options.maxQuestions);
+      const syncCost = options.serpOnly ? MC_COSTS.serp_headful : paaCostForQuestionCount2(options.maxQuestions);
       const { ok: syncOk, balance_mc: syncBal } = await debitMc(user.id, syncCost, options.serpOnly ? LedgerOperation.SERP : LedgerOperation.PAA, options.query);
       if (!syncOk) return c.json(insufficientBalanceResponse(syncBal, syncCost), 402);
       const jobId = await createRunningJob(user.id, options.query, options);
@@ -43744,10 +44088,11 @@ var init_server = __esm({
         c.req.raw.signal,
         AbortSignal.timeout(syncTimeoutMs)
       ]);
+      const headlessSentOut = { value: null };
       try {
         const harvestCtx = currentCostContext();
         const result = await runWithCostContext(
-          { ...harvestCtx, op: options.serpOnly ? "serp" : "paa", userId: user.id },
+          { ...harvestCtx, op: options.serpOnly ? "serp" : "paa", userId: user.id, headlessSentOut },
           () => harvest({
             ...options,
             kernelApiKey: browserServiceApiKey(),
@@ -43766,6 +44111,11 @@ var init_server = __esm({
           const diff = syncCost - actualCost;
           if (diff > 0) await creditMc(user.id, diff, LedgerOperation.PAA_REFUND, "overestimate refund");
           else if (diff < 0) await debitMc(user.id, -diff, LedgerOperation.PAA, options.query);
+        } else {
+          const actualCost = headlessSentOut.value === true ? MC_COSTS.serp_headless : MC_COSTS.serp_headful;
+          const diff = syncCost - actualCost;
+          if (diff > 0) await creditMc(user.id, diff, LedgerOperation.SERP_REFUND, "headless-mode pricing settle");
+          else if (diff < 0) await debitMc(user.id, -diff, LedgerOperation.SERP, options.query);
         }
         return c.json({ job_id: jobId, status: "done", result: sanitizeHarvestResult(result), attempts: sanitizeAttempts(attempts) });
       } catch (err) {