neoagent 3.0.1-beta.2 → 3.0.1-beta.21

package/landing/index.html

@@ -910,7 +910,7 @@ p { margin: 0; text-wrap: pretty; }
   <div class="wrap">
     <div class="hero-grid">
       <div class="hero-copy">
-        <div class="pill"><span class="tag">New</span> <b>NeoAgent is now in private beta</b></div>
+        <div class="pill"><span class="tag">New</span> <b>NeoAgent is now in beta</b></div>
         <h1>
           <span class="h1-line"><span class="w" style="--i:0">One</span> <span class="w" style="--i:1">agent</span> <span class="w" style="--i:2">for</span> <span class="w" style="--i:3">your</span></span>
           <span class="h1-line"><span class="w" style="--i:4"><em>whole</em></span> <span class="w" style="--i:5"><em>digital</em></span> <span class="w" style="--i:6"><em>life</em></span></span>
@@ -1194,7 +1194,7 @@ p { margin: 0; text-wrap: pretty; }
 <section class="section-tight" id="cta" data-screen-label="cta">
   <div class="wrap">
     <div class="final reveal">
-      <span class="eyebrow" style="display:block;margin-bottom:20px;">Private beta · Limited spots</span>
+      <span class="eyebrow" style="display:block;margin-bottom:20px;">Beta · Limited spots</span>
       <h2>The agent that just <em>handles it.</em></h2>
       <p>Be first to put NeoAgent to work across your devices, channels, and life. We'll send your invite as spots open up.</p>
       <div class="hero-actions" style="justify-content:center;">

package/lib/manager.js

@@ -1432,81 +1432,43 @@ function startFallback() {
   logOk(`Started detached process (pid ${child.pid})`);
 }
 
-async function ensureQemuInstalled({ required = false } = {}) {
-  heading('Ensure QEMU Installed');
+// The isolated browser/CLI runtime runs each user's guest agent in a Docker
+// container built from a baked image (browser + dependencies installed at build
+// time). Docker cannot be auto-installed safely across platforms, so when it is
+// missing we surface clear guidance; when it is present we pre-build the guest
+// image so the first browser/CLI action is instant rather than paying a one-time
+// multi-minute build on demand.
+async function ensureContainerRuntime({ required = false } = {}) {
+  heading('Ensure Container Runtime');
   const platform = detectPlatform();
-  
-  const hasSystem = commandExists('qemu-system-x86_64') || commandExists('qemu-system-aarch64');
-  const hasImg = commandExists('qemu-img');
 
-  if (hasSystem && hasImg) {
-    logOk('QEMU components are already installed');
-    return;
-  }
-
-  logInfo('QEMU components not found. Attempting to install...');
+  const dockerReady = commandExists('docker')
+    && spawnSync('docker', ['info'], { stdio: 'ignore', timeout: 10000 }).status === 0;
 
-  try {
-    if (platform === 'macos') {
-      if (!commandExists('brew')) {
-        const message = 'Homebrew is required for automatic QEMU install on macOS. Install Homebrew from https://brew.sh/ and run `neoagent install` again.';
-        if (required) throw new Error(message);
-        logWarn('Homebrew not found; VM features will stay unavailable until QEMU is installed.');
-        rememberInstallAction(message);
-        return false;
-      }
-      logInfo('Running "brew install qemu"...');
-      runOrThrow('brew', ['install', 'qemu']);
-    } else if (platform === 'linux') {
-      const isArm = process.arch === 'arm64' || process.arch === 'aarch64';
-      if (commandExists('apt-get')) {
-        const pkgs = ['qemu-utils'];
-        if (isArm) {
-          pkgs.push('qemu-system-arm');
-        } else {
-          pkgs.push('qemu-system-x86');
-        }
-        logInfo(`Running "sudo apt-get update && sudo apt-get install -y ${pkgs.join(' ')}"...`);
-        runOrThrow('sudo', ['apt-get', 'update']);
-        runOrThrow('sudo', ['apt-get', 'install', '-y', ...pkgs]);
-      } else if (commandExists('dnf')) {
-        logInfo('Running "sudo dnf install -y qemu-kvm qemu-img"...');
-        runOrThrow('sudo', ['dnf', 'install', '-y', 'qemu-kvm', 'qemu-img']);
-      } else if (commandExists('yum')) {
-        logInfo('Running "sudo yum install -y qemu-kvm qemu-img"...');
-        runOrThrow('sudo', ['yum', 'install', '-y', 'qemu-kvm', 'qemu-img']);
-      } else {
-        const message = 'Unsupported Linux package manager for automatic QEMU install. Install qemu-system and qemu-utils, then run `neoagent install` again.';
-        if (required) throw new Error(message);
-        logWarn('Could not find apt-get, dnf, or yum for QEMU installation.');
-        rememberInstallAction(message);
-        return false;
-      }
-    } else {
-      const message = 'Unsupported platform for automatic QEMU installation. Install QEMU manually if you need VM-isolated runtime features.';
-      if (required) throw new Error(message);
-      logWarn('Skipping QEMU auto-install on this platform.');
-      rememberInstallAction(message);
-      return false;
-    }
-  } catch (err) {
-    if (required) throw err;
-    logWarn(`QEMU install did not complete: ${err.message}`);
-    rememberInstallAction('Install QEMU manually or rerun `neoagent install` after your package manager is ready.');
+  if (!dockerReady) {
+    const installHint = platform === 'macos'
+      ? 'Install Docker Desktop from https://www.docker.com/products/docker-desktop/ and start it.'
+      : 'Install Docker Engine (https://docs.docker.com/engine/install/) and ensure the daemon is running.';
+    const message = `Docker is required for the isolated browser/CLI runtime. ${installHint} Then run \`neoagent install\` again.`;
+    if (required) throw new Error(message);
+    logWarn('Docker not detected; the cloud browser and CLI will be unavailable until Docker is installed and running.');
+    rememberInstallAction(message);
     return false;
   }
 
-  const verifiedSystem = commandExists('qemu-system-x86_64') || commandExists('qemu-system-aarch64');
-  const verifiedImg = commandExists('qemu-img');
+  logOk('Docker is installed and the daemon is running');
 
-  if (verifiedSystem && verifiedImg) {
-    logOk('QEMU installed successfully');
+  try {
+    logInfo('Building the guest runtime image (one-time; downloads the browser and dependencies)…');
+    const { GuestImageBuilder } = require('../server/services/runtime/guest_image');
+    await new GuestImageBuilder({ runtimeProfile: 'browser_cli' }).ensure();
+    logOk('Guest runtime image is ready');
     return true;
-  } else {
-    const message = 'QEMU installation finished but required binaries were not found in PATH.';
+  } catch (err) {
+    const message = `Guest runtime image build did not complete: ${err.message}`;
     if (required) throw new Error(message);
     logWarn(message);
-    rememberInstallAction('Ensure qemu-system and qemu-img are available in PATH, then run `neoagent install` again.');
+    rememberInstallAction('Rerun `neoagent install` to retry building the guest runtime image, or it will build automatically on first use.');
     return false;
   }
 }
@@ -1585,7 +1547,7 @@ async function cmdInstall() {
   }
 
   installDependencies();
-  await ensureQemuInstalled({ required: false });
+  await ensureContainerRuntime({ required: false });
   ensureYtDlpInstalled();
   buildBundledWebClientIfPossible({ required: true });
 
@@ -2000,6 +1962,152 @@ function cmdVersion() {
   console.log(currentInstalledVersionLabel());
 }
 
+async function cmdBilling(args = []) {
+  const sub = (args[0] || 'status').toLowerCase();
+
+  if (sub === '--help' || sub === '-h' || sub === 'help') {
+    console.log('\nNeoAgent Billing');
+    console.log('Usage: neoagent billing [subcommand]');
+    console.log('');
+    console.log('Subcommands:');
+    console.log('  neoagent billing           Show billing configuration status');
+    console.log('  neoagent billing setup     Interactive Stripe setup wizard');
+    console.log('  neoagent billing enable    Enable billing and restart');
+    console.log('  neoagent billing disable   Disable billing and restart');
+    console.log('');
+    return;
+  }
+
+  if (sub === 'status') {
+    cliBanner('Billing', 'configuration status');
+    heading('Billing Status');
+    const env = Object.fromEntries(parseEnv(readEnvFileRaw()).entries());
+    const enabled = ['1', 'true', 'yes'].includes(String(env.NEOAGENT_BILLING_ENABLED || '').toLowerCase());
+    const hasSecret = Boolean(env.STRIPE_SECRET_KEY);
+    const hasPub = Boolean(env.STRIPE_PUBLISHABLE_KEY);
+    const hasWebhook = Boolean(env.STRIPE_WEBHOOK_SECRET);
+    const trialDays = env.BILLING_TRIAL_DAYS || '14';
+
+    cliSection('Billing config');
+    statusLine(enabled, 'enabled', enabled ? 'yes' : 'no', enabled ? '' : 'run: neoagent billing enable');
+    statusLine(hasSecret, 'secret', hasSecret ? maskEnvValue('SECRET', env.STRIPE_SECRET_KEY) : 'not set', hasSecret ? '' : 'run: neoagent billing setup');
+    statusLine(hasPub, 'public', hasPub ? maskEnvValue('KEY', env.STRIPE_PUBLISHABLE_KEY) : 'not set');
+    statusLine(hasWebhook, 'webhook', hasWebhook ? 'configured' : 'not set');
+    console.log('');
+    cliSection('Trial');
+    console.log(`  trial days  ${trialDays}`);
+
+    const port = loadEnvPort();
+    const publicUrl = env.PUBLIC_URL || `http://localhost:${port}`;
+    console.log('');
+    cliSection('Webhook endpoint');
+    console.log(`  ${publicUrl}/api/billing/webhook`);
+    console.log('');
+
+    if (!hasSecret || !hasPub) {
+      logWarn('Stripe keys not configured. Run `neoagent billing setup` to get started.');
+    } else if (!enabled) {
+      logInfo('Billing is configured but not enabled. Run `neoagent billing enable` to activate.');
+    } else {
+      logOk('Billing is active. Manage plans in Admin › Billing.');
+    }
+    return;
+  }
+
+  if (sub === 'enable') {
+    heading('Enable Billing');
+    upsertEnvValue('NEOAGENT_BILLING_ENABLED', 'true');
+    logOk('Set NEOAGENT_BILLING_ENABLED=true');
+    logInfo('Restarting NeoAgent to apply changes...');
+    cmdRestart();
+    return;
+  }
+
+  if (sub === 'disable') {
+    heading('Disable Billing');
+    upsertEnvValue('NEOAGENT_BILLING_ENABLED', 'false');
+    logOk('Set NEOAGENT_BILLING_ENABLED=false');
+    logInfo('Restarting NeoAgent to apply changes...');
+    cmdRestart();
+    return;
+  }
+
+  if (sub === 'setup') {
+    cliBanner('Billing Setup', 'Stripe configuration');
+    heading('Billing Setup');
+    ensureRuntimeDirs();
+
+    const current = Object.fromEntries(parseEnv(readEnvFileRaw()).entries());
+    const port = loadEnvPort();
+    const publicUrl = current.PUBLIC_URL || `http://localhost:${port}`;
+
+    logInfo('Press Enter to keep the current value shown in brackets.');
+    logInfo(`Webhook endpoint: ${publicUrl}/api/billing/webhook`);
+    console.log('');
+
+    heading('Stripe API keys');
+    logInfo('Find these in your Stripe dashboard: https://dashboard.stripe.com/apikeys');
+    const secretKey = await askSecret('Stripe secret key (sk_live_... or sk_test_...)', current.STRIPE_SECRET_KEY || '');
+    const publishableKey = await askSecret('Stripe publishable key (pk_live_... or pk_test_...)', current.STRIPE_PUBLISHABLE_KEY || '');
+
+    if (secretKey && !secretKey.startsWith('sk_')) {
+      logWarn('Secret key does not start with "sk_" — double-check the value.');
+    }
+    if (publishableKey && !publishableKey.startsWith('pk_')) {
+      logWarn('Publishable key does not start with "pk_" — double-check the value.');
+    }
+
+    heading('Webhook');
+    logInfo(`Register this endpoint in Stripe: ${publicUrl}/api/billing/webhook`);
+    logInfo('Required events: customer.subscription.*, invoice.payment_succeeded, invoice.payment_failed');
+    const webhookSecret = await askSecret('Stripe webhook signing secret (whsec_...)', current.STRIPE_WEBHOOK_SECRET || '');
+
+    if (webhookSecret && !webhookSecret.startsWith('whsec_')) {
+      logWarn('Webhook secret does not start with "whsec_" — double-check the value.');
+    }
+
+    heading('Trial');
+    const trialDaysRaw = await ask('Free trial length in days (0 to disable)', current.BILLING_TRIAL_DAYS || '14');
+    const trialDays = Number(trialDaysRaw);
+    if (!Number.isInteger(trialDays) || trialDays < 0) {
+      throw new Error(`Invalid trial length "${trialDaysRaw}". Must be a non-negative integer.`);
+    }
+
+    if (secretKey) upsertEnvValue('STRIPE_SECRET_KEY', secretKey);
+    if (publishableKey) upsertEnvValue('STRIPE_PUBLISHABLE_KEY', publishableKey);
+    if (webhookSecret) upsertEnvValue('STRIPE_WEBHOOK_SECRET', webhookSecret);
+    upsertEnvValue('BILLING_TRIAL_DAYS', String(trialDays));
+
+    logOk('Stripe credentials saved to .env');
+
+    const isAlreadyEnabled = ['1', 'true', 'yes'].includes(String(current.NEOAGENT_BILLING_ENABLED || '').toLowerCase());
+    let enableNow = isAlreadyEnabled;
+    if (!isAlreadyEnabled) {
+      const enableAnswer = await ask('Enable billing now? (y/N)', 'N');
+      enableNow = enableAnswer.toLowerCase() === 'y' || enableAnswer.toLowerCase() === 'yes';
+    }
+
+    if (enableNow) {
+      upsertEnvValue('NEOAGENT_BILLING_ENABLED', 'true');
+      logOk('Billing enabled');
+      logInfo('Restarting NeoAgent to apply credentials...');
+      cmdRestart();
+    } else {
+      logInfo('Billing is not yet enabled. Run `neoagent billing enable` when ready.');
+    }
+
+    console.log('');
+    heading('Next steps');
+    logInfo('1. Verify the webhook endpoint is reachable from Stripe');
+    logInfo('2. Create subscription plans in Admin › Billing › Plans');
+    logInfo('3. Add a free plan (price = 0) for users without a paid subscription');
+    logInfo('   See: neoagent billing status');
+    return;
+  }
+
+  throw new Error(`Unknown billing subcommand: ${sub}. Run "neoagent billing --help" for usage.`);
+}
+
 function printHelp() {
   const c = COLORS;
   const W = 38;
@@ -2047,6 +2155,13 @@ function printHelp() {
   row('admin',               'Show admin dashboard URL and credentials');
   console.log('');
 
+  cliSection('Billing');
+  row('billing',             'Show billing configuration status');
+  row('billing setup',       'Interactive Stripe setup wizard');
+  row('billing enable',      'Enable billing and restart');
+  row('billing disable',     'Disable billing and restart');
+  console.log('');
+
   cliSection('Maintenance');
   row('migrate',             'Migrate from another agent installation');
   row('migrate dry-run',     'Preview what would be migrated');
@@ -2106,6 +2221,9 @@ async function runCLI(argv) {
     case 'login':
       await cmdLogin(argv.slice(1));
       break;
+    case 'billing':
+      await cmdBilling(argv.slice(1));
+      break;
     case 'admin': {
       cliBanner('Admin Dashboard', 'credentials');
       const adminCreds = readAdminCredentials();

package/lib/schema_migrations.js

@@ -458,6 +458,88 @@ function migrateToolPoliciesAllowAlways(db) {
   `);
 }
 
+function migrateBilling(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS billing_plans (
+      id                  TEXT PRIMARY KEY,
+      name                TEXT NOT NULL,
+      description         TEXT DEFAULT '',
+      price_cents         INTEGER NOT NULL DEFAULT 0,
+      currency            TEXT NOT NULL DEFAULT 'usd',
+      interval            TEXT DEFAULT 'month',
+      stripe_price_id     TEXT,
+      token_limit_4h      INTEGER,
+      token_limit_weekly  INTEGER,
+      allowed_models_json TEXT DEFAULT '[]',
+      features_json       TEXT DEFAULT '[]',
+      is_active           INTEGER DEFAULT 1,
+      sort_order          INTEGER DEFAULT 0,
+      created_at          TEXT DEFAULT (datetime('now')),
+      updated_at          TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS billing_customers (
+      user_id            INTEGER PRIMARY KEY,
+      stripe_customer_id TEXT UNIQUE,
+      created_at         TEXT DEFAULT (datetime('now')),
+      updated_at         TEXT DEFAULT (datetime('now')),
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS user_subscriptions (
+      id                     TEXT PRIMARY KEY,
+      user_id                INTEGER NOT NULL,
+      plan_id                TEXT NOT NULL,
+      stripe_subscription_id TEXT UNIQUE,
+      status                 TEXT NOT NULL,
+      trial_ends_at          TEXT,
+      current_period_start   TEXT,
+      current_period_end     TEXT,
+      cancel_at_period_end   INTEGER DEFAULT 0,
+      canceled_at            TEXT,
+      created_at             TEXT DEFAULT (datetime('now')),
+      updated_at             TEXT DEFAULT (datetime('now')),
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      FOREIGN KEY (plan_id) REFERENCES billing_plans(id)
+    );
+
+    CREATE TABLE IF NOT EXISTS subscription_events (
+      id              INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id         INTEGER NOT NULL,
+      subscription_id TEXT,
+      event_type      TEXT NOT NULL,
+      stripe_event_id TEXT UNIQUE,
+      payload_json    TEXT DEFAULT '{}',
+      created_at      TEXT DEFAULT (datetime('now')),
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS trial_fingerprints (
+      id               INTEGER PRIMARY KEY AUTOINCREMENT,
+      fingerprint_hash TEXT NOT NULL,
+      fingerprint_type TEXT NOT NULL,
+      user_id          INTEGER,
+      used_at          TEXT DEFAULT (datetime('now')),
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_billing_customers_stripe
+      ON billing_customers(stripe_customer_id);
+
+    CREATE INDEX IF NOT EXISTS idx_user_subscriptions_user
+      ON user_subscriptions(user_id, status, updated_at DESC);
+
+    CREATE INDEX IF NOT EXISTS idx_user_subscriptions_stripe
+      ON user_subscriptions(stripe_subscription_id);
+
+    CREATE INDEX IF NOT EXISTS idx_subscription_events_stripe
+      ON subscription_events(stripe_event_id);
+
+    CREATE INDEX IF NOT EXISTS idx_trial_fingerprints_hash
+      ON trial_fingerprints(fingerprint_hash, fingerprint_type);
+  `);
+}
+
 function runSchemaMigrations(db) {
   migrateMemoryEmbeddingIndex(db);
   migrateMemoryProvenance(db);
@@ -469,6 +551,7 @@ function runSchemaMigrations(db) {
   migrateToolPermissions(db);
   migrateApprovalPersistence(db);
   migrateToolPoliciesAllowAlways(db);
+  migrateBilling(db);
 }
 
 module.exports = {
@@ -482,5 +565,6 @@ module.exports = {
   migrateToolPermissions,
   migrateApprovalPersistence,
   migrateToolPoliciesAllowAlways,
+  migrateBilling,
   runSchemaMigrations,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "3.0.1-beta.2",
+  "version": "3.0.1-beta.21",
   "description": "Self-hosted AI agent for long-running tasks, automation, messaging, device control, and local memory",
   "license": "AGPL-3.0-only",
   "main": "server/index.js",
@@ -51,10 +51,14 @@
     "flutter:test": "cd flutter_app && flutter test ../test/flutter/unit ../test/flutter/widget",
     "flutter:test:unit": "cd flutter_app && flutter test ../test/flutter/unit",
     "flutter:test:widget": "cd flutter_app && flutter test ../test/flutter/widget",
+    "benchmark:setup": "node benchmark/cli.js setup",
+    "benchmark:run": "node benchmark/cli.js run",
+    "benchmark:report": "node benchmark/cli.js report",
     "benchmark:tokens": "node scripts/benchmark-token-cost.js",
     "benchmark:memory": "node scripts/benchmark-memory.js",
     "benchmark:memorybench:install": "node scripts/install-memorybench-provider.js",
-    "release": "npx semantic-release"
+    "release": "npx semantic-release",
+    "audit:ci": "npm audit --omit=dev --audit-level=high"
   },
   "repository": {
     "type": "git",
@@ -99,11 +103,12 @@
     "remotion": "^4.0.459",
     "sharp": "^0.34.5",
     "socket.io": "^4.8.1",
+    "stripe": "^22.2.1",
     "telegraf": "^4.16.3",
     "telnyx": "^5.51.0",
     "tesseract.js": "^7.0.0",
     "uuid": "^11.1.0",
-    "ws": "^8.19.0"
+    "ws": "^8.21.0"
   },
   "overrides": {
     "axios": "^1.15.2",
@@ -113,7 +118,8 @@
     "protobufjs": "^7.5.5",
     "serialize-javascript": "^7.0.5",
     "undici": "^6.24.0",
-    "webpackbar": "^7.0.0"
+    "webpackbar": "^7.0.0",
+    "ws": "^8.21.0"
   },
   "devDependencies": {
     "@docusaurus/core": "3.10.0",

package/server/admin/access.js

@@ -113,12 +113,12 @@ async function setSignup(enabled) {
 }
 
 async function rotateApiKey(btn) {
-  if (!confirm(
-    'Rotate admin API key?\n\n' +
-    'The current key will stop working immediately.\n' +
-    'Any scripts using it must be updated.\n\n' +
-    'The new key will be shown once — copy it before leaving.'
-  )) return;
+  if (!await showConfirmModal({
+    title: 'Rotate admin API key?',
+    body: 'The current key will stop working immediately. Any scripts using it must be updated.<br><br>The new key will be shown once — copy it before leaving.',
+    confirmLabel: 'Rotate Key',
+    confirmClass: 'btn-danger',
+  })) return;
   btn.disabled = true;
   btn.textContent = 'Rotating…';
   try {
@@ -140,7 +140,12 @@ async function rotateApiKey(btn) {
 }
 
 async function revokeApiKey(btn) {
-  if (!confirm('Revoke admin API key?\n\nAll programmatic access using this key will stop immediately.')) return;
+  if (!await showConfirmModal({
+    title: 'Revoke admin API key?',
+    body: 'All programmatic access using this key will stop immediately.',
+    confirmLabel: 'Revoke Key',
+    confirmClass: 'btn-danger',
+  })) return;
   btn.disabled = true;
   btn.textContent = 'Revoking…';
   _revealedKey = null;

package/server/admin/admin.css

@@ -318,3 +318,81 @@ button:disabled,
   border: 1px solid rgba(116, 192, 124, 0.25);
   color: var(--success);
 }
+
+/* ── Form helpers (used in dynamic modals) ───────────────────────────────── */
+.form-label {
+  display: block;
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  color: var(--text-muted);
+  text-transform: uppercase;
+  margin-bottom: 6px;
+}
+
+.form-label small {
+  font-size: 10px;
+  font-weight: 400;
+  text-transform: none;
+  letter-spacing: 0;
+  opacity: 0.75;
+}
+
+.form-input {
+  width: 100%;
+  background: var(--bg-input);
+  border: 1px solid var(--border-light);
+  border-radius: var(--radius-sm);
+  padding: 9px 12px;
+  color: var(--text);
+  font-family: var(--font-sans);
+  font-size: 13px;
+  outline: none;
+  transition: border-color 0.15s;
+  -webkit-appearance: none;
+}
+
+.form-input:focus {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 3px var(--accent-muted);
+}
+
+.form-input:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
+
+/* ── Small button variant ────────────────────────────────────────────────── */
+.btn-sm {
+  padding: 5px 10px;
+  font-size: 12px;
+}
+
+/* ── Generic data table (billing, etc.) ──────────────────────────────────── */
+.data-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 13px;
+}
+
+.data-table th {
+  text-align: left;
+  font-size: 10px;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.07em;
+  color: var(--text-muted);
+  padding: 6px 10px;
+  border-bottom: 1px solid var(--border);
+  white-space: nowrap;
+}
+
+.data-table td {
+  padding: 10px 10px;
+  border-bottom: 1px solid var(--border);
+  color: var(--text-secondary);
+  vertical-align: middle;
+}
+
+.data-table tr:last-child td { border-bottom: none; }
+.data-table tr:hover td { background: var(--row-hover); }