From dac8ca30f212dd94734f44293b24d38f3024dac1 Mon Sep 17 00:00:00 2001
From: yash-pouranik <yashpouranik124@gmail.com>
Date: Sun, 20 Sep 2026 23:25:33 +0530
Subject: [PATCH 1/4] feat: redesign pricing model to usage and scale-based
 tiering

- Unlock BYOS, BYOK, custom mail templates, and marketing broadcasts on Free tier
- Increase Free tier mail limit to 50/month and active webhooks to 3
- Implement smart count-based webhook creation gate (unrestricted edit/delete/test)
- Enforce shared monthly mail quota pool for broadcast sends with auto-refund
- Make StatsRow Current Plan display dynamic using useAuth
- Sync landing page pricing and dashboard UpgradeModal features and FAQs
- Fix outdated bitbros.in pricing URLs to urbackend.in
- Sync Mintlify documentation quotas (10MB storage, 50MB database)
- Fix CLI status command to properly render unlimited (-1) metrics
---
 .../src/middlewares/planEnforcement.js        | 16 ++++++++--
 apps/landing/src/pages/pricing.astro          | 32 +++++++++----------
 .../src/controllers/mail.controller.js        | 23 +++++++++++--
 .../src/components/Dashboard/StatsRow.jsx     | 10 ++++--
 .../src/components/Dashboard/UsageQuota.jsx   |  8 ++---
 .../src/components/UpgradeModal.jsx           | 28 ++++++++--------
 apps/web-dashboard/src/pages/Dashboard.jsx    |  2 +-
 apps/web-dashboard/src/pages/Docs.jsx         |  2 +-
 apps/web-dashboard/src/utils/api.js           |  4 +--
 .../docs/api-reference/storage/upload.mdx     |  2 +-
 mintlify/docs/guides/ai-byok.mdx              |  1 -
 mintlify/docs/guides/mail-platform.mdx        |  4 +--
 mintlify/docs/guides/storage.mdx              |  4 +--
 mintlify/docs/limits-and-quotas.mdx           |  4 +--
 mintlify/docs/sdk/storage.mdx                 |  2 +-
 packages/common/src/utils/planLimits.js       | 14 ++++----
 .../src/commands/status/index.ts              | 24 ++++++++++----
 sdks/urbackend-cli/src/utils/format.ts        |  1 +
 18 files changed, 109 insertions(+), 72 deletions(-)

diff --git a/apps/dashboard-api/src/middlewares/planEnforcement.js b/apps/dashboard-api/src/middlewares/planEnforcement.js
index 70cd25cb6..fb96a1317 100644
--- a/apps/dashboard-api/src/middlewares/planEnforcement.js
+++ b/apps/dashboard-api/src/middlewares/planEnforcement.js
@@ -177,7 +177,7 @@ exports.checkByokGate = async function(req, res, next) {
 }
 
 exports.checkWebhookGate = async function(req, res, next) {
-    const { Project, resolveEffectivePlan, getPlanLimits, AppError, sanitizeObjectId } = require('@urbackend/common');
+    const { Project, Webhook, resolveEffectivePlan, getPlanLimits, AppError, sanitizeObjectId } = require('@urbackend/common');
     try {
         if (isAdminRequest(req)) return next();
 
@@ -186,8 +186,15 @@ exports.checkWebhookGate = async function(req, res, next) {
             return next(new AppError(403, 'Verify your email to create or test webhooks.'));
         }
 
+        // Only enforce count limit on new webhook creation (POST without webhookId)
+        const isCreate = req.method === 'POST' && !req.params.webhookId;
+        if (!isCreate) {
+            return next();
+        }
+
         const rawProjectId = req.params.projectId || req.body.projectId || req.query.projectId;
         const cleanProjectId = sanitizeObjectId(rawProjectId);
+        if (!cleanProjectId) return next(new AppError(400, 'Invalid or missing projectId'));
 
         let customLimits = null;
         if (cleanProjectId) {
@@ -198,8 +205,11 @@ exports.checkWebhookGate = async function(req, res, next) {
         const effectivePlan = resolveEffectivePlan(req.developer);
         const limits = getPlanLimits({ plan: effectivePlan, customLimits });
 
-        if (limits.webhooksLimit === 0) {
-            return next(new AppError(403, 'Webhooks are a Pro feature. Please upgrade to create integrations.'));
+        if (limits.webhooksLimit !== -1) {
+            const currentCount = await Webhook.countDocuments({ projectId: cleanProjectId });
+            if (currentCount >= limits.webhooksLimit) {
+                return next(new AppError(403, `Webhook limit reached (${limits.webhooksLimit}). Please upgrade your plan for unlimited webhooks.`));
+            }
         }
 
         next();
diff --git a/apps/landing/src/pages/pricing.astro b/apps/landing/src/pages/pricing.astro
index 05ab5babd..7a121234e 100644
--- a/apps/landing/src/pages/pricing.astro
+++ b/apps/landing/src/pages/pricing.astro
@@ -5,29 +5,27 @@ import Footer from '../components/Footer.astro';
 import { Check, ChevronDown, HelpCircle, ArrowRight } from 'lucide-react';
 
 const FREE_FEATURES = [
-  '1 Project',
-  '5 Collections per project',
+  '1 Project, 5 Collections',
   '2,000 API requests / day',
-  '10MB File Storage',
   '200 Auth Users',
-  '25 Emails / month',
-  'Global email templates',
+  '3 Active Webhooks',
+  '50 Emails / month (Sends & Broadcasts)',
+  'Custom HTML Email Templates',
+  'Bring Your Own MongoDB (BYOM)',
+  'Bring Your Own Storage (S3 / R2)',
+  'Bring Your Own Keys (Resend, OAuth, AI)',
+  'Team Collaboration (up to 2 members)',
   'Community support',
 ];
 
 const PRO_FEATURES = [
-  '10 Projects',
-  'Unlimited collections',
-  'Unlimited API requests',
+  '10 Projects, Unlimited Collections',
+  'Unlimited API requests (600 req/min burst)',
   'Unlimited Auth Users',
-  'Unlimited Webhooks',
-  'External Database (BYOM)',
-  'Bring your own Storage (S3/R2)',
+  'Unlimited Webhooks + Priority Delivery',
   '1,000 Emails / month',
-  'Custom HTML email templates',
-  'BYOK — own API keys',
-  'Analytics Pro',
-  'AI integrations (OpenAI, Groq)',
+  'Up to 6 Team Members',
+  'Analytics Pro & Deep Insights',
   'Priority support',
 ];
 
@@ -38,7 +36,7 @@ const PRICING_FAQS = [
   },
   {
     q: 'Can I bring my own MongoDB Atlas cluster on the Free tier?',
-    a: 'The Free tier includes urBackend managed database storage. Bring Your Own MongoDB (BYOM) is available on the Pro tier during beta.'
+    a: 'Yes! Both Free and Pro tiers support Bring Your Own MongoDB (BYOM) and Bring Your Own Storage (BYOS). Connect your Atlas cluster or S3 bucket directly on any plan.'
   },
   {
     q: 'How does the free 1-month Pro trial work?',
@@ -46,7 +44,7 @@ const PRICING_FAQS = [
   },
   {
     q: 'Do you offer team collaboration?',
-    a: 'Yes. Pro plans support inviting team members with granular project access controls and role-based permissions.'
+    a: 'Yes. Free plans allow up to 2 team members (owner + 1 collaborator). Pro plans support up to 6 members with role-based access control.'
   }
 ];
 ---
diff --git a/apps/public-api/src/controllers/mail.controller.js b/apps/public-api/src/controllers/mail.controller.js
index 6fae46f00..be6c1dc1f 100644
--- a/apps/public-api/src/controllers/mail.controller.js
+++ b/apps/public-api/src/controllers/mail.controller.js
@@ -727,12 +727,12 @@ module.exports.deleteContact = async (req, res, next) => {
   }
 };
 
-// --- BROADCASTS (BYOK + Pro Gate) ---
+// --- BROADCASTS (BYOK Gate + Quota Tracking) ---
 
 const requireBroadcastGate = async (req) => {
   const { resend, usingByok } = await resolveResendClient(req);
   if (!usingByok || !req.planLimits?.byokEnabled) {
-    const err = new Error("Broadcasts require both a BYOK Resend key and a Pro plan.");
+    const err = new Error("Broadcasts require a configured BYOK Resend key.");
     err.statusCode = 403;
     throw err;
   }
@@ -766,17 +766,34 @@ module.exports.createBroadcast = async (req, res, next) => {
 };
 
 module.exports.sendBroadcast = async (req, res, next) => {
+  let consumedQuotaKey = null;
   try {
     const { id } = req.params;
     if (!/^[A-Za-z0-9_-]+$/.test(id)) {
       return next(new AppError(400, "Invalid broadcast ID format."));
     }
     const resend = await requireBroadcastGate(req);
+
+    const projectId = req.project?._id?.toString() || req.project?._id;
+    if (projectId) {
+      const limit = getMonthlyMailLimit(req.project, req.planLimits);
+      const { count, key } = await reserveMonthlyMailSlot(projectId, limit);
+      consumedQuotaKey = key;
+    }
+
     const { data, error } = await resend.broadcasts.send(id);
-    if (error) return next(new AppError(error.statusCode || 500, error.message));
+    if (error) {
+      if (consumedQuotaKey) {
+        await redis.decr(consumedQuotaKey).catch(() => {});
+      }
+      return next(new AppError(error.statusCode || 500, error.message));
+    }
 
     return new ApiResponse(data).send(res, 200);
   } catch (err) {
+    if (consumedQuotaKey) {
+      await redis.decr(consumedQuotaKey).catch(() => {});
+    }
     return next(new AppError(err.statusCode || 500, err.message));
   }
 };
diff --git a/apps/web-dashboard/src/components/Dashboard/StatsRow.jsx b/apps/web-dashboard/src/components/Dashboard/StatsRow.jsx
index add9b3fa6..2b138f19b 100644
--- a/apps/web-dashboard/src/components/Dashboard/StatsRow.jsx
+++ b/apps/web-dashboard/src/components/Dashboard/StatsRow.jsx
@@ -1,8 +1,12 @@
 import React from 'react';
 import { Folder, Activity, Zap } from 'lucide-react';
 import StatCard from './StatCard';
+import { useAuth } from '../../context/AuthContext';
 
 const StatsRow = ({ projectsCount }) => {
+  const { user } = useAuth();
+  const isPro = user?.plan === 'pro';
+
   return (
     <div style={{ display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(280px, 1fr))', gap: '1.5rem', marginBottom: '4rem' }}>
       <StatCard
@@ -22,10 +26,10 @@ const StatsRow = ({ projectsCount }) => {
       />
       <StatCard
         title="Current Plan"
-        value="Free Tier"
+        value={isPro ? "Pro Tier" : "Free Tier"}
         icon={Zap}
-        color="#FFBD2E"
-        background="rgba(255, 189, 46, 0.1)"
+        color={isPro ? "var(--color-primary, #3ECF8E)" : "#FFBD2E"}
+        background={isPro ? "rgba(62, 207, 142, 0.1)" : "rgba(255, 189, 46, 0.1)"}
       />
     </div>
   );
diff --git a/apps/web-dashboard/src/components/Dashboard/UsageQuota.jsx b/apps/web-dashboard/src/components/Dashboard/UsageQuota.jsx
index 161f45563..a19bd269c 100644
--- a/apps/web-dashboard/src/components/Dashboard/UsageQuota.jsx
+++ b/apps/web-dashboard/src/components/Dashboard/UsageQuota.jsx
@@ -67,7 +67,7 @@ const UsageQuota = () => {
         <UsageProgressBar
           label="Webhooks"
           used={usage?.totalWebhooks ?? 0}
-          limit={limits?.webhooksLimit ?? 0}
+          limit={limits?.webhooksLimit ?? 3}
           unit="Hooks"
           unlimited={limits?.webhooksLimit === -1}
           tooltip={limits?.webhooksLimit === -1 ? "Unlimited webhooks included in your plan" : ""}
@@ -87,8 +87,8 @@ const UsageQuota = () => {
           limit={limits?.storageBytes ?? 10485760}
           formatValue={formatBytes}
           unit=""
-          unlimited={limits?.storageBytes === -1}
-          tooltip={limits?.storageBytes === -1 ? "Bring Your Own Storage (BYOS) enabled: Connect an external storage provider for unlimited storage." : ""}
+          unlimited={limits?.storageBytes === -1 || limits?.byosEnabled}
+          tooltip={limits?.byosEnabled ? "Bring Your Own Storage (BYOS) enabled: Connect an external storage provider for unlimited storage." : (limits?.storageBytes === -1 ? "Unlimited managed file storage" : "")}
         />
         <UsageProgressBar
           label="Requests"
@@ -103,7 +103,7 @@ const UsageQuota = () => {
       {!isPro && (
         <button
           id="usage-quota-upgrade-btn"
-          onClick={() => window.location.href = 'https://urbackend.bitbros.in/pricing'}
+          onClick={() => window.location.href = 'https://urbackend.in/pricing'}
           className="btn btn-secondary"
           style={{ marginTop: '0.5rem', width: '100%', fontSize: '0.75rem', padding: '5px' }}
         >
diff --git a/apps/web-dashboard/src/components/UpgradeModal.jsx b/apps/web-dashboard/src/components/UpgradeModal.jsx
index f50496985..1f3110830 100644
--- a/apps/web-dashboard/src/components/UpgradeModal.jsx
+++ b/apps/web-dashboard/src/components/UpgradeModal.jsx
@@ -6,29 +6,27 @@ import { X, Zap, Check, Loader2 } from 'lucide-react';
 // import { useAuth } from '../context/AuthContext';
 
 const FREE_FEATURES = [
-    '1 Project',
-    '5 Collections per project',
+    '1 Project, 5 Collections',
     '2,000 API requests / day',
-    '10MB File Storage',
     '200 Auth Users',
-    '25 Emails / month',
-    'Global email templates',
+    '3 Active Webhooks',
+    '50 Emails / month (Sends & Broadcasts)',
+    'Custom HTML Email Templates',
+    'Bring Your Own MongoDB (BYOM)',
+    'Bring Your Own Storage (S3 / R2)',
+    'Bring Your Own Keys (Resend, OAuth, AI)',
+    'Team Collaboration (up to 2 members)',
     'Community support',
 ];
 
 const PRO_FEATURES = [
-    '10 Projects',
-    'Unlimited collections',
-    'Unlimited API requests',
+    '10 Projects, Unlimited Collections',
+    'Unlimited API requests (600 req/min burst)',
     'Unlimited Auth Users',
-    'Unlimited Webhooks',
-    'External Database (BYOM)',
-    'Bring your own Storage (S3/R2)',
+    'Unlimited Webhooks + Priority Delivery',
     '1,000 Emails / month',
-    'Custom HTML email templates',
-    'BYOK — own API keys',
-    'Analytics Pro',
-    'AI integrations (OpenAI, Groq)',
+    'Up to 6 Team Members',
+    'Analytics Pro & Deep Insights',
     'Priority support',
 ];
 
diff --git a/apps/web-dashboard/src/pages/Dashboard.jsx b/apps/web-dashboard/src/pages/Dashboard.jsx
index a797cd100..f578ec05b 100644
--- a/apps/web-dashboard/src/pages/Dashboard.jsx
+++ b/apps/web-dashboard/src/pages/Dashboard.jsx
@@ -176,7 +176,7 @@ export default function Dashboard() {
                   </span>
                 </div>
                 <button
-                  onClick={() => window.location.href = 'https://urbackend.bitbros.in/pricing'}
+                  onClick={() => window.location.href = 'https://urbackend.in/pricing'}
                   className="btn btn-secondary"
                   style={{ fontSize: '0.75rem', padding: '3px 10px', whiteSpace: 'nowrap', flexShrink: 0 }}
                 >
diff --git a/apps/web-dashboard/src/pages/Docs.jsx b/apps/web-dashboard/src/pages/Docs.jsx
index 9a756e841..13a115763 100644
--- a/apps/web-dashboard/src/pages/Docs.jsx
+++ b/apps/web-dashboard/src/pages/Docs.jsx
@@ -599,7 +599,7 @@ console.log("File URL:", result.url);
 
                         <h3 style={{ fontSize: '1.1rem', marginBottom: '1rem' }}>Storage & Database Quotas</h3>
                         <p style={{ color: '#aaa', lineHeight: '1.6', marginBottom: '1rem' }}>
-                            Total allowed usage is determined by your current plan. By default on the Free tier, projects have caps on total Database Documents and File Storage. Exceeding these returns a <code>403 Forbidden</code> response on POST/PUT requests.
+                            Total allowed usage is determined by your current plan. On the Free tier, projects have managed caps on Database Storage (50 MB) and File Storage (10 MB). Connect your own MongoDB Atlas (BYOM) or external S3/R2 storage (BYOS) to unlock unlimited storage. Exceeding managed quotas returns a <code>403 Forbidden</code> response on POST/PUT requests.
                         </p>
                     </div>
                 );
diff --git a/apps/web-dashboard/src/utils/api.js b/apps/web-dashboard/src/utils/api.js
index f0c60b663..8875edc91 100644
--- a/apps/web-dashboard/src/utils/api.js
+++ b/apps/web-dashboard/src/utils/api.js
@@ -104,8 +104,8 @@ api.interceptors.response.use(
 
             if (isPlanError && !isVerificationGate && !requiresByok) {
                 toast.error("Plan limit reached. Please upgrade to continue.");
-                if (window.location.href !== 'https://urbackend.bitbros.in/pricing') {
-                    window.location.assign('https://urbackend.bitbros.in/pricing');
+                if (window.location.href !== 'https://urbackend.in/pricing') {
+                    window.location.assign('https://urbackend.in/pricing');
                 }
                 return Promise.reject(error);
             } else {
diff --git a/mintlify/docs/api-reference/storage/upload.mdx b/mintlify/docs/api-reference/storage/upload.mdx
index 36037c221..007f75992 100644
--- a/mintlify/docs/api-reference/storage/upload.mdx
+++ b/mintlify/docs/api-reference/storage/upload.mdx
@@ -51,7 +51,7 @@ Send the request as `multipart/form-data` with a single field:
 | Limit | Value |
 | :--- | :--- |
 | Max file size | 10 MB per file (urBackend-hosted storage only) |
-| Total storage quota | 100 MB (default plan) |
+| Total storage quota | 10 MB (Free plan; unlimited with BYOS) |
 
 Projects connected to external (bring-your-own) storage are not subject to the 10 MB per-file limit.
 
diff --git a/mintlify/docs/guides/ai-byok.mdx b/mintlify/docs/guides/ai-byok.mdx
index c17922231..e1f5878d4 100644
--- a/mintlify/docs/guides/ai-byok.mdx
+++ b/mintlify/docs/guides/ai-byok.mdx
@@ -131,7 +131,6 @@ Pass `"groqKey": null` to clear the project's key.
 | Condition | Status | Detail |
 | :--- | :--- | :--- |
 | Key does not start with `gsk_`, or is longer than 200 characters | `400` | `Invalid Groq API key format. Key must start with 'gsk_'.` |
-| Saving a key on a plan without BYOK for AI enabled | `403` | `Bring Your Own AI Key (Groq) is a Pro feature. Please upgrade to continue.` |
 | Project ID is not a valid ObjectId | `400` | `Invalid project ID` |
 | Project not found or caller is not an admin | `404` | `Project not found or access denied` |
 | Groq rejects the key at request time | `401` | `Invalid BYOK Groq key provided` |
diff --git a/mintlify/docs/guides/mail-platform.mdx b/mintlify/docs/guides/mail-platform.mdx
index bd114f3da..e09f50b37 100644
--- a/mintlify/docs/guides/mail-platform.mdx
+++ b/mintlify/docs/guides/mail-platform.mdx
@@ -50,7 +50,7 @@ flowchart LR
 | Batch send (`/api/mail/send-batch`, max 100 items) | ✅ | ✅ | ✅ |
 | Delivery logs + live status | ✅ | ✅ | ✅ |
 | Audiences & Contacts | ❌ | ✅ | ✅ |
-| Marketing Broadcasts | ❌ | ❌ | ✅ |
+| Marketing Broadcasts | ❌ | ✅ (within 50/mo limit) | ✅ (within 1,000/mo limit) |
 
 ## Getting started
 
@@ -604,7 +604,7 @@ Add product screenshots/annotated walkthrough images in this section if your doc
 | `GET/PATCH/DELETE /api/mail/audiences/:id/contacts/*` | `400` | Invalid audience/contact id format |
 | `GET/PATCH/DELETE /api/mail/audiences/:id/contacts/*` | `403` | Contacts require a custom Resend API Key (BYOK) |
 | `POST /api/mail/broadcasts*` | `400` | audienceId, subject, and html are required |
-| `POST /api/mail/broadcasts*` | `403` | Broadcasts require both BYOK and Pro plan |
+| `POST /api/mail/broadcasts*` | `403` | Broadcasts require a configured BYOK Resend key |
 | `POST /api/mail/webhook` | `400` | Webhook signature verification failed |
 | Provider-proxied endpoints | passthrough | Upstream Resend status/message are surfaced |
 
diff --git a/mintlify/docs/guides/storage.mdx b/mintlify/docs/guides/storage.mdx
index a562e67b9..9d1b5c6a3 100644
--- a/mintlify/docs/guides/storage.mdx
+++ b/mintlify/docs/guides/storage.mdx
@@ -50,7 +50,7 @@ Uploads use a presigned URL three-step flow so the binary is sent directly to st
 | `filePath` | Opaque storage path (format: `projectId/uuid_sanitizedFilename`) — save this to confirm or delete the file later |
 
 <Note>
-  This endpoint enforces the 10 MB max file size and checks available headroom against your plan's project storage quota before the upload is confirmed. On the free tier, the default project storage limit is 20 MB. If your project uses external (bring-your-own) storage, the 10 MB per-file cap and project quota checks do not apply.
+  This endpoint enforces the 10 MB max file size and checks available headroom against your plan's project storage quota before the upload is confirmed. On the free tier, the default project storage limit is 10 MB. If your project uses external (bring-your-own) storage, the 10 MB per-file cap and project quota checks do not apply.
 </Note>
 
 ### Step 2 — Upload the binary to storage
@@ -229,7 +229,7 @@ If the path is invalid or the file has already been removed, the API returns `40
 | Limit | Value |
 | --- | --- |
 | Maximum file size | 10 MB per file (urBackend-hosted storage only) |
-| Total storage per project | 20 MB (free tier; higher limits on paid plans) |
+| Total storage per project | 10 MB (Free tier; unlimited with external BYOS) |
 
 Projects connected to external (bring-your-own) storage are not subject to the 10 MB per-file limit.
 
diff --git a/mintlify/docs/limits-and-quotas.mdx b/mintlify/docs/limits-and-quotas.mdx
index af6d4aa17..47246505f 100644
--- a/mintlify/docs/limits-and-quotas.mdx
+++ b/mintlify/docs/limits-and-quotas.mdx
@@ -19,7 +19,7 @@ Requests that exceed the limit receive a `429 Too Many Requests` response. Desig
 | Resource | Limit |
 | :--- | :--- |
 | File upload size | 10 MB per file (urBackend-hosted storage only) |
-| Storage quota per project | 20 MB |
+| Storage quota per project | 10 MB (Free tier; unlimited with BYOS) |
 
 Files that exceed the limit return `413 Payload Too Large`. Projects connected to external (bring-your-own) storage are not subject to the 10 MB per-file limit.
 
@@ -27,7 +27,7 @@ Files that exceed the limit return `413 Payload Too Large`. Projects connected t
 
 | Resource | Limit |
 | :--- | :--- |
-| Database size per project | 20 MB |
+| Database size per project | 50 MB (Free tier; unlimited with BYOM) |
 | Documents per read request (`limit`) | 100 by default, up to 1000 |
 
 When your project approaches the database quota, writes may be rejected with `403 Forbidden`. Monitor your usage in the Dashboard.
diff --git a/mintlify/docs/sdk/storage.mdx b/mintlify/docs/sdk/storage.mdx
index 48f9b627c..609dc122f 100644
--- a/mintlify/docs/sdk/storage.mdx
+++ b/mintlify/docs/sdk/storage.mdx
@@ -125,7 +125,7 @@ deleteFile(path: string): Promise<{ deleted: boolean }>
 | Limit | Value |
 |---|---|
 | Max file size | 10 MB per file (urBackend-hosted storage only) |
-| Total storage per project | 20 MB (Free Tier) |
+| Total storage per project | 10 MB (Free Tier; unlimited with BYOS) |
 
 <Note>
 Uploads that exceed 10 MB are rejected with a `StorageError`. Projects connected to external (bring-your-own) storage are not subject to the 10 MB per-file limit. 
diff --git a/packages/common/src/utils/planLimits.js b/packages/common/src/utils/planLimits.js
index 009d944b4..c8ef089ae 100644
--- a/packages/common/src/utils/planLimits.js
+++ b/packages/common/src/utils/planLimits.js
@@ -16,21 +16,21 @@ const PLAN_LIMITS = {
     authUsersLimit: 200,     // was: 1000 — biggest change
 
     // Mail
-    mailPerMonth: 25,        // was: 50 — half it
-    mailTemplatesEnabled: false,
+    mailPerMonth: 50,
+    mailTemplatesEnabled: true,
 
     // Webhooks
-    webhooksLimit: 0,        // was: 100 — REMOVE from free entirely
-    webhookRetryEnabled: false,
+    webhooksLimit: 3,
+    webhookRetryEnabled: true,
 
     // BYOM/BYOS/BYOK
     byomEnabled: true,       
-    byosEnabled: false,      
-    byokEnabled: false,      
+    byosEnabled: true,      
+    byokEnabled: true,      
     aiByokEnabled: true,
 
     // Features
-    analyticsProEnabled: false,
+    analyticsProEnabled: true,
     teamsEnabled: true,
     maxMembers: 2,           // owner + 1 member
   },
diff --git a/sdks/urbackend-cli/src/commands/status/index.ts b/sdks/urbackend-cli/src/commands/status/index.ts
index 719dd0c5c..67f8ee760 100644
--- a/sdks/urbackend-cli/src/commands/status/index.ts
+++ b/sdks/urbackend-cli/src/commands/status/index.ts
@@ -31,24 +31,34 @@ export async function statusCommand(): Promise<void> {
       console.log(`${label("Plan expires")} ${stats.planExpiresAt}`);
     }
 
+    const fmtLimit = (val: number | undefined, isBytes = false): string => {
+      if (val === undefined || val === null) return "N/A";
+      if (val === -1) return "Unlimited";
+      return isBytes ? formatBytes(val) : val.toLocaleString();
+    };
+
     console.log("\n── Usage ────────────────────────────────────────");
     console.log(
-      `${label("Projects")} ${stats.usage.totalProjects} / ${stats.limits.maxProjects}`,
+      `${label("Projects")} ${stats.usage.totalProjects} / ${fmtLimit(stats.limits.maxProjects)}`,
+    );
+    console.log(
+      `${label("Collections")} ${stats.usage.totalCollections} / ${fmtLimit(stats.limits.maxCollections)}`,
+    );
+    console.log(
+      `${label("Database")} ${formatBytes(stats.usage.totalDatabaseUsed)} / ${fmtLimit(stats.limits.mongoBytes, true)}`,
     );
     console.log(
-      `${label("Collections")} ${stats.usage.totalCollections} / ${stats.limits.maxCollections}`,
+      `${label("Storage")} ${formatBytes(stats.usage.totalStorageUsed)} / ${fmtLimit(stats.limits.storageBytes, true)}`,
     );
     console.log(
-      `${label("Database")} ${formatBytes(stats.usage.totalDatabaseUsed)} / ${formatBytes(stats.limits.mongoBytes)}`,
+      `${label("API requests")} ${stats.usage.totalRequests.toLocaleString()} / ${fmtLimit(stats.limits.reqPerDay)} today`,
     );
     console.log(
-      `${label("Storage")} ${formatBytes(stats.usage.totalStorageUsed)} / ${formatBytes(stats.limits.storageBytes)}`,
+      `${label("Auth users")} ${stats.usage.totalUsers} / ${fmtLimit(stats.limits.authUsersLimit)}`,
     );
     console.log(
-      `${label("API requests")} ${stats.usage.totalRequests.toLocaleString()} / ${stats.limits.reqPerDay.toLocaleString()} today`,
+      `${label("Webhooks")} ${stats.usage.totalWebhooks} / ${fmtLimit(stats.limits.webhooksLimit)}`,
     );
-    console.log(`${label("Auth users")} ${stats.usage.totalUsers} / ${stats.limits.authUsersLimit}`);
-    console.log(`${label("Webhooks")} ${stats.usage.totalWebhooks}`);
 
     if (currentProjectId) {
       try {
diff --git a/sdks/urbackend-cli/src/utils/format.ts b/sdks/urbackend-cli/src/utils/format.ts
index e96fa6e3f..0c8f2a356 100644
--- a/sdks/urbackend-cli/src/utils/format.ts
+++ b/sdks/urbackend-cli/src/utils/format.ts
@@ -2,6 +2,7 @@
  * Formats bytes into a human-readable string (KB, MB, GB).
  */
 export function formatBytes(bytes: number): string {
+  if (bytes < 0) return "Unlimited";
   if (bytes === 0) return "0 B";
   const units = ["B", "KB", "MB", "GB", "TB"];
   const i = Math.floor(Math.log(bytes) / Math.log(1024));

From e469e2c54e8a671d98be0b3fc66bb9e4d2c680d0 Mon Sep 17 00:00:00 2001
From: yash-pouranik <yashpouranik124@gmail.com>
Date: Sun, 20 Sep 2026 23:56:22 +0530
Subject: [PATCH 2/4] docs: remove inaccurate comparison table from README

---
 README.md | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 9a69cc75a..b547b50a0 100644
--- a/README.md
+++ b/README.md
@@ -58,14 +58,7 @@ That's it! 🎉
 
 ## 🟢 Why urBackend?
 
-While tools like PocketBase are great for small single-server apps (SQLite), **urBackend** is built for scale.
-
-| Feature | urBackend | Firebase | PocketBase |
-| :--- | :--- | :--- | :--- |
-| **Database** | **MongoDB (Scalable)** | Proprietary NoSQL | SQLite (Single Server) |
-| **Caching** | **Redis Built-in** | None | None |
-| **Hosting** | **Self-Hosted / Cloud** | Cloud Only | Self-Hosted |
-| **Source** | **Open-Source** | Closed-Source | Open-Source |
+**urBackend** is built for developer velocity and horizontal scale, combining the simplicity of a modern BaaS with the power of MongoDB and Redis.
 
 ### Core Features:
 - **Instant NoSQL:** Create collections and push JSON data instantly.

From 95bc164fe3e18f6280997ee169c7a60f26df4a29 Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 08:55:17 +0000
Subject: [PATCH 3/4] fix: enforce webhook quotas atomically and list analytics
 on the free plan

Serialize quota checks and webhook creation in a transaction, preserve admin bypass, and add regression tests.
---
 .../planEnforcement.capabilities.test.js      | 40 ++++++++-
 .../src/__tests__/webhook.controller.test.js  | 90 +++++++++++++++++++
 .../src/controllers/webhook.controller.js     | 39 +++++++-
 .../src/middlewares/planEnforcement.js        | 11 +--
 apps/landing/src/pages/pricing.astro          |  2 +-
 packages/common/src/models/Project.js         |  3 +
 6 files changed, 172 insertions(+), 13 deletions(-)

diff --git a/apps/dashboard-api/src/__tests__/planEnforcement.capabilities.test.js b/apps/dashboard-api/src/__tests__/planEnforcement.capabilities.test.js
index 17f0bac8a..e96dadd14 100644
--- a/apps/dashboard-api/src/__tests__/planEnforcement.capabilities.test.js
+++ b/apps/dashboard-api/src/__tests__/planEnforcement.capabilities.test.js
@@ -8,6 +8,7 @@ jest.mock('@urbackend/common', () => {
 
   const Project = {
     countDocuments: jest.fn(),
+    findById: jest.fn(),
     findOne: jest.fn(),
   };
 
@@ -16,12 +17,12 @@ jest.mock('@urbackend/common', () => {
     Project,
     sanitizeObjectId: jest.fn((value) => value || null),
     resolveEffectivePlan: jest.fn(() => 'free'),
-    getPlanLimits: jest.fn(() => ({ maxProjects: 1, maxCollections: 5 })),
+    getPlanLimits: jest.fn(() => ({ maxProjects: 1, maxCollections: 5, webhooksLimit: 3 })),
   };
 });
 
 const { Project, AppError } = require('@urbackend/common');
-const { checkDeveloperCapability, checkProjectLimit, checkCollectionLimit } = require('../middlewares/planEnforcement');
+const { checkDeveloperCapability, checkProjectLimit, checkCollectionLimit, checkWebhookGate } = require('../middlewares/planEnforcement');
 
 const makeReq = (overrides = {}) => ({
   user: { _id: 'dev_1', email: 'dev@example.com', isVerified: false },
@@ -131,4 +132,39 @@ describe('planEnforcement capability checks', () => {
 
     expect(next).toHaveBeenCalledWith();
   });
+
+  test('passes the finite webhook quota to the create controller without pre-counting', async () => {
+    Project.findById.mockReturnValue({
+      select: jest.fn().mockReturnThis(),
+      lean: jest.fn().mockResolvedValue({ customLimits: null }),
+    });
+    const req = makeReq({
+      method: 'POST',
+      params: { projectId: 'project_1' },
+      user: { _id: 'dev_1', email: 'dev@example.com', isVerified: true },
+      developer: { _id: 'dev_1', isVerified: true },
+    });
+    const next = jest.fn();
+
+    await checkWebhookGate(req, {}, next);
+
+    expect(req.webhookQuotaLimit).toBe(3);
+    expect(next).toHaveBeenCalledWith();
+  });
+
+  test('preserves the admin webhook quota bypass', async () => {
+    const req = makeReq({
+      method: 'POST',
+      params: { projectId: 'project_1' },
+      user: { _id: 'admin_1', email: 'admin@example.com', isAdmin: true, isVerified: true },
+      developer: { _id: 'admin_1', isVerified: true },
+    });
+    const next = jest.fn();
+
+    await checkWebhookGate(req, {}, next);
+
+    expect(req.webhookQuotaLimit).toBeUndefined();
+    expect(Project.findById).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalledWith();
+  });
 });
diff --git a/apps/dashboard-api/src/__tests__/webhook.controller.test.js b/apps/dashboard-api/src/__tests__/webhook.controller.test.js
index 723f2c4a1..a5666853b 100644
--- a/apps/dashboard-api/src/__tests__/webhook.controller.test.js
+++ b/apps/dashboard-api/src/__tests__/webhook.controller.test.js
@@ -15,6 +15,7 @@ jest.mock('@urbackend/common', () => {
   return {
     Webhook: {
       create: jest.fn(),
+      countDocuments: jest.fn(),
       find: jest.fn(),
       findOne: jest.fn(),
       findOneAndUpdate: jest.fn(),
@@ -26,6 +27,7 @@ jest.mock('@urbackend/common', () => {
     },
     Project: {
       findOne: jest.fn(),
+      updateOne: jest.fn(),
     },
     AppError,
     encrypt: jest.fn((val) => ({ encrypted: 'enc', iv: 'iv', tag: 'tag' })),
@@ -95,6 +97,10 @@ describe('webhook.controller', () => {
     next = jest.fn();
   });
 
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
   describe('createWebhook', () => {
     test('creates webhook with valid input', async () => {
       Project.findOne.mockResolvedValue({ _id: validProjectId });
@@ -145,6 +151,90 @@ describe('webhook.controller', () => {
       );
     });
 
+    test('checks finite quota and creates the webhook in one transaction', async () => {
+      const session = {
+        withTransaction: jest.fn(async (operation) => operation()),
+        endSession: jest.fn(),
+      };
+      jest.spyOn(mongoose, 'startSession').mockResolvedValue(session);
+      Project.findOne.mockResolvedValue({ _id: validProjectId });
+      Project.updateOne.mockResolvedValue({ matchedCount: 1 });
+      Webhook.countDocuments.mockResolvedValue(2);
+      createWebhookSchema.safeParse.mockReturnValue({
+        success: true,
+        data: {
+          name: 'Test Webhook',
+          url: 'https://example.com/hook',
+          secret: 'whsec_testsecret12345678',
+          events: {},
+        },
+      });
+      Webhook.create.mockResolvedValue([{
+        _id: validWebhookId,
+        projectId: validProjectId,
+        name: 'Test Webhook',
+        url: 'https://example.com/hook',
+        events: new Map(),
+        enabled: true,
+      }]);
+      req.body = {
+        name: 'Test Webhook',
+        url: 'https://example.com/hook',
+        secret: 'whsec_testsecret12345678',
+      };
+      req.webhookQuotaLimit = 3;
+
+      await createWebhook(req, res, next);
+
+      expect(Project.updateOne).toHaveBeenCalledWith(
+        { _id: validProjectId, owner: 'user123' },
+        { $inc: { webhookQuotaVersion: 1 } },
+        { session }
+      );
+      expect(Webhook.countDocuments).toHaveBeenCalledWith(
+        { projectId: validProjectId },
+        { session }
+      );
+      expect(Webhook.create).toHaveBeenCalledWith(
+        [expect.objectContaining({ projectId: validProjectId, name: 'Test Webhook' })],
+        { session }
+      );
+      expect(session.endSession).toHaveBeenCalled();
+      expect(res.status).toHaveBeenCalledWith(201);
+    });
+
+    test('does not create a webhook when the transactional quota reservation fails', async () => {
+      const session = {
+        withTransaction: jest.fn(async (operation) => operation()),
+        endSession: jest.fn(),
+      };
+      jest.spyOn(mongoose, 'startSession').mockResolvedValue(session);
+      Project.findOne.mockResolvedValue({ _id: validProjectId });
+      Project.updateOne.mockResolvedValue({ matchedCount: 1 });
+      Webhook.countDocuments.mockResolvedValue(3);
+      createWebhookSchema.safeParse.mockReturnValue({
+        success: true,
+        data: {
+          name: 'Test Webhook',
+          url: 'https://example.com/hook',
+          secret: 'whsec_testsecret12345678',
+        },
+      });
+      req.body = {
+        name: 'Test Webhook',
+        url: 'https://example.com/hook',
+        secret: 'whsec_testsecret12345678',
+      };
+      req.webhookQuotaLimit = 3;
+
+      await createWebhook(req, res, next);
+
+      expect(Webhook.create).not.toHaveBeenCalled();
+      expect(session.endSession).toHaveBeenCalled();
+      expect(next).toHaveBeenCalledWith(expect.any(AppError));
+      expect(next.mock.calls[0][0].statusCode).toBe(403);
+    });
+
     test('returns 404 if project not found', async () => {
       Project.findOne.mockResolvedValue(null);
 
diff --git a/apps/dashboard-api/src/controllers/webhook.controller.js b/apps/dashboard-api/src/controllers/webhook.controller.js
index e09777627..019757c71 100644
--- a/apps/dashboard-api/src/controllers/webhook.controller.js
+++ b/apps/dashboard-api/src/controllers/webhook.controller.js
@@ -47,15 +47,48 @@ module.exports.createWebhook = async (req, res, next) => {
 
     // Encrypt the secret
     const encryptedSecret = encrypt(secret);
-
-    const webhook = await Webhook.create({
+    const webhookData = {
       projectId,
       name,
       url,
       secret: encryptedSecret,
       events: events || {},
       enabled: enabled !== false,
-    });
+    };
+
+    let webhook;
+    const quotaLimit = req.webhookQuotaLimit;
+    if (Number.isInteger(quotaLimit) && quotaLimit >= 0) {
+      const session = await mongoose.startSession();
+      try {
+        await session.withTransaction(async () => {
+          // Updating one shared project document serializes concurrent quota
+          // checks for this project. The update rolls back with the insert.
+          const reservation = await Project.updateOne(
+            { _id: projectId, ...getProjectAccessQuery(req.user._id) },
+            { $inc: { webhookQuotaVersion: 1 } },
+            { session }
+          );
+          if (reservation.matchedCount !== 1) {
+            throw new AppError(404, "Project not found");
+          }
+
+          const currentCount = await Webhook.countDocuments(
+            { projectId },
+            { session }
+          );
+          if (currentCount >= quotaLimit) {
+            throw new AppError(403, `Webhook limit reached (${quotaLimit}). Please upgrade your plan for unlimited webhooks.`);
+          }
+
+          [webhook] = await Webhook.create([webhookData], { session });
+        });
+      } finally {
+        await session.endSession();
+      }
+    } else {
+      webhook = await Webhook.create(webhookData);
+    }
 
     // Return without secret
     return new ApiResponse({
diff --git a/apps/dashboard-api/src/middlewares/planEnforcement.js b/apps/dashboard-api/src/middlewares/planEnforcement.js
index fb96a1317..d33220a97 100644
--- a/apps/dashboard-api/src/middlewares/planEnforcement.js
+++ b/apps/dashboard-api/src/middlewares/planEnforcement.js
@@ -177,7 +177,7 @@ exports.checkByokGate = async function(req, res, next) {
 }
 
 exports.checkWebhookGate = async function(req, res, next) {
-    const { Project, Webhook, resolveEffectivePlan, getPlanLimits, AppError, sanitizeObjectId } = require('@urbackend/common');
+    const { Project, resolveEffectivePlan, getPlanLimits, AppError, sanitizeObjectId } = require('@urbackend/common');
     try {
         if (isAdminRequest(req)) return next();
 
@@ -205,12 +205,9 @@ exports.checkWebhookGate = async function(req, res, next) {
         const effectivePlan = resolveEffectivePlan(req.developer);
         const limits = getPlanLimits({ plan: effectivePlan, customLimits });
 
-        if (limits.webhooksLimit !== -1) {
-            const currentCount = await Webhook.countDocuments({ projectId: cleanProjectId });
-            if (currentCount >= limits.webhooksLimit) {
-                return next(new AppError(403, `Webhook limit reached (${limits.webhooksLimit}). Please upgrade your plan for unlimited webhooks.`));
-            }
-        }
+        // The controller performs the authoritative quota check and insert in
+        // one transaction. Passing the limit avoids a count-then-create race.
+        req.webhookQuotaLimit = limits.webhooksLimit;
 
         next();
     } catch (err) {
diff --git a/apps/landing/src/pages/pricing.astro b/apps/landing/src/pages/pricing.astro
index 7a121234e..d890cfc85 100644
--- a/apps/landing/src/pages/pricing.astro
+++ b/apps/landing/src/pages/pricing.astro
@@ -15,6 +15,7 @@ const FREE_FEATURES = [
   'Bring Your Own Storage (S3 / R2)',
   'Bring Your Own Keys (Resend, OAuth, AI)',
   'Team Collaboration (up to 2 members)',
+  'Analytics Pro & Deep Insights',
   'Community support',
 ];
 
@@ -25,7 +26,6 @@ const PRO_FEATURES = [
   'Unlimited Webhooks + Priority Delivery',
   '1,000 Emails / month',
   'Up to 6 Team Members',
-  'Analytics Pro & Deep Insights',
   'Priority support',
 ];
 
diff --git a/packages/common/src/models/Project.js b/packages/common/src/models/Project.js
index 4e05fc78e..95e77c228 100755
--- a/packages/common/src/models/Project.js
+++ b/packages/common/src/models/Project.js
@@ -140,6 +140,9 @@ const projectSchema = new mongoose.Schema(
     databaseUsed: { type: Number, default: 0 },
     databaseLimit: { type: Number, default: 20 * 1024 * 1024 },
 
+    // Internal write-lock version for atomic webhook quota reservations.
+    webhookQuotaVersion: { type: Number, default: 0, select: false },
+
     // Granular Resources Structure
     resources: {
       db: {

From 9335e3a77ff53b8769c7b207ae0ddfb7020b2ee2 Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:09:11 +0000
Subject: [PATCH 4/4] fix(docker): initialize MongoDB replica set and wait for
 primary readiness before starting APIs

---
 docker-compose.yml | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 6ebd7c86b..5ebee89e1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,8 +5,20 @@ services:
     image: mongo:7
     container_name: urbackend_mongo
     restart: unless-stopped
+    command: ["mongod", "--replSet", "rs0", "--bind_ip_all"]
     volumes:
       - mongo_data:/data/db
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          mongosh --quiet --eval 'try { rs.status() } catch (err) {
+          rs.initiate({_id: "rs0", members: [{_id: 0, host: "mongo:27017"}]})
+          }; db.hello().isWritablePrimary' | grep true
+      interval: 5s
+      timeout: 10s
+      retries: 10
+      start_period: 10s
 
   # ── Redis ─────────────────────────────────────────────────────────────────────
   redis:
@@ -26,14 +38,16 @@ services:
     ports:
       - '1234:1234'
     depends_on:
-      - mongo
-      - redis
+      mongo:
+        condition: service_healthy
+      redis:
+        condition: service_started
     env_file:
       - path: .env
         required: false
     environment:
       # Override DB URLs to use Docker service names
-      MONGO_URL: mongodb://mongo:27017/urbackend
+      MONGO_URL: mongodb://mongo:27017/urbackend?replicaSet=rs0
       REDIS_URL: redis://redis:6379
       NODE_ENV: production
       PORT: 1234
@@ -48,13 +62,15 @@ services:
     ports:
       - '1235:1235'
     depends_on:
-      - mongo
-      - redis
+      mongo:
+        condition: service_healthy
+      redis:
+        condition: service_started
     env_file:
       - path: .env
         required: false
     environment:
-      MONGO_URL: mongodb://mongo:27017/urbackend
+      MONGO_URL: mongodb://mongo:27017/urbackend?replicaSet=rs0
       REDIS_URL: redis://redis:6379
       NODE_ENV: production
       USER_PORT: 1235