Credit system
Atomic balance changes and annual installments.
Balance and ledger
lib/credits.ts uses a conditional atomic UPDATE, balance+credit_ledger in one transaction. Amounts must be positive PostgreSQL-safe integers; free tools skip 0-credit debit. Never use a separate balance pre-read as concurrency protection.
Signup grants 300 credits. Subscription/pack credits require confirmed payment. Paid actions pre-debit and compensate failures; failed refunds return compensation_pending and require requestId reconciliation, not a false refund-success claim.
Annual plans freeze monthly schedules. /api/cron/subscription-grants checks CRON_SECRET Bearer (legacy Basic supported), runs daily by default, catches up due grants and cleans expired tool-rate counters. Cron/refund operations share user-first locking to prevent duplicate grants.
Cancellation retains paid installments; refunds/disputes pause grants for review. Admin USD totals exclude historical other currencies; individual payments retain their own currency.