@@ -22,6 +22,7 @@
     "@tipoff/radio": "workspace:*",
     "@tipoff/sports": "workspace:*",
     "hono": "^4.10.3",
-    "mpegts.js": "1.8.2"
+    "mpegts.js": "1.8.2",
+    "@profullstack/leaderboard": "^0.3.0"
   }
 }
@@ -1,5 +1,4 @@
 import { createGateway, isTrainingAgent } from '@profullstack/x402-gateway';
-import { x402Gateway } from '@profullstack/x402-gateway/hono';
 import * as auth from '@tipoff/auth';
 import * as invites from '@tipoff/auth/invites';
 import { brand, config, href } from '@tipoff/config';
@@ -33,6 +32,7 @@ import { getCookie, setCookie } from 'hono/cookie';
 import { assetUrl, isCurrentVersion, loadAssetVersions } from './lib/asset-version.js';
 import { attempt, callerAddress, forgive, MISS, VIEW } from './lib/auth-throttle.js';
 import { buildCalendar } from './lib/ics.js';
+import { agentName, leaderboard } from './lib/leaderboard.js';
 import { MAX_TILES, parseChannelIds } from './lib/multiview.js';
 import { buildFeed } from './lib/rss.js';
 import { SECURITY_HEADERS } from './lib/security-headers.js';
@@ -185,7 +185,11 @@ const crawlGateway = createGateway({
   passMinutes: config.crawl.passMinutes,
   // The maps stay readable: a crawler that reads them may decide the API is
   // the cheaper way in, which is the point of publishing them.
-  openPaths: ['/llms.txt', '/skill.md'],
+  // Both spellings: the gateway prefix-matches only entries ending in a slash,
+  // so '/leaderboard' alone would open the index and still charge for every
+  // board on it. An agent that hits a 402 on the page ranking its own spend
+  // cannot read the case for buying a pass.
+  openPaths: ['/llms.txt', '/skill.md', '/leaderboard', '/leaderboard/'],
   /*
    * Lightpanda is a headless browser sold to scrapers, and on 2026-09-02 a
    * fleet of it fetched 8,500 pages here in a day from 104 countries. It is not
@@ -208,8 +212,54 @@ const crawlGateway = createGateway({
   chargeSpoofedBrowsers: true,
   exempt: (request) => (request.headers.get('cookie') ?? '').includes(`${config.session.cookie}=`),
   contact: config.contactEmail ? `mailto:${config.contactEmail}` : `${config.siteUrl}/contact`,
+  /*
+   * Write the sale down. Until now a pass existed only for as long as the
+   * response took to send, so neither "what did this earn" nor "who is the
+   * customer" could be answered afterwards.
+   *
+   * The promise is returned rather than dropped: the gateway awaits this hook
+   * before the receipt goes out, so returning it is what makes the sale land
+   * before the buyer is told it succeeded. The gateway swallows a rejection,
+   * so a database failure still sells the pass it was paid for.
+   */
+  onSale: (sale) =>
+    q
+      .recordCrawlSale({
+        payer: sale.payer,
+        ref: sale.ref,
+        days: sale.days,
+        priceCents: sale.priceCents,
+        totalCents: sale.totalCents,
+        currency: sale.currency,
+        userAgent: sale.userAgent,
+        expiresAt: sale.expiresAt,
+      })
+      .catch((err) => console.error('[x402] could not record the sale', err)),
+});
+/*
+ * Count what the wall turns away, before it answers.
+ *
+ * A 402 is the pipeline: it is an agent that wants this data and has not paid
+ * yet, and that is the only measure of demand this site has. Counted per agent
+ * per day, so the cost is one upsert on a request that was going to be refused
+ * anyway, and never awaited.
+ */
+app.use('*', async (c, next) => {
+  const answer = await crawlGateway.handle(c.req.raw);
+  if (!answer) return next();
+  if (answer.status === 402)
+    q.recordCrawlDemand(agentName(c.req.header('user-agent'))).catch(() => {});
+  return answer;
+});
+
+/**
+ * The public board: who pays for this data, and who keeps asking without
+ * paying. Open to everyone, including the agents on it.
+ */
+app.use('*', async (c, next) => {
+  const answer = await leaderboard.handle(c.req.raw);
+  return answer ?? next();
 });
-app.use('*', x402Gateway(crawlGateway));
 
 /*
  * Security headers, on everything.
 
@@ -0,0 +1,148 @@
+import { createLeaderboard, projectionStore } from '@profullstack/leaderboard';
+import { brand, config } from '@tipoff/config';
+import { sql } from '@tipoff/db';
+
+/**
+ * The public board over the crawler paywall.
+ *
+ * Two sides, never in one list. An agent that paid is a customer and is ranked
+ * by money; an agent that keeps hitting the wall without paying is demand, and
+ * is ranked by volume. Putting them in one table would say those are the same
+ * kind of fact, and the difference between them is the entire business.
+ *
+ * Both tables are written by the gateway hooks in app.js, so the board keeps no
+ * copy of its own and cannot drift from them. Badges are the exception: they
+ * are awarded rather than derived.
+ */
+
+const ms = (v) => (v instanceof Date ? v.getTime() : new Date(v).getTime());
+
+const badges = {
+  async awardBadge(player, badge) {
+    const rows = await sql`
+      insert into leaderboard_badges (player, badge) values (${player}, ${badge})
+      on conflict (player, badge) do nothing
+      returning player`;
+    return rows.length > 0;
+  },
+  async badges() {
+    const rows = await sql`select player, badge, awarded_at from leaderboard_badges`;
+    const out = {};
+    for (const r of rows) {
+      out[r.player] ??= {};
+      out[r.player][r.badge] = ms(r.awarded_at);
+    }
+    return out;
+  },
+};
+
+const KNOWN_AGENTS = [
+  'meta-externalagent',
+  'GPTBot',
+  'ClaudeBot',
+  'anthropic-ai',
+  'CCBot',
+  'Bytespider',
+  'Applebot',
+  'FacebookBot',
+  'Lightpanda',
+  'PerplexityBot',
+  'Google-Extended',
+];
+
+/**
+ * The name a reader recognises. An agent that says nothing useful is grouped
+ * under one honest label rather than given a row per random string, which
+ * would fill the board with noise and bury the agents that matter.
+ */
+export function agentName(userAgent) {
+  const ua = String(userAgent ?? '');
+  const known = KNOWN_AGENTS.find((k) => ua.toLowerCase().includes(k.toLowerCase()));
+  if (known) return known;
+  const token = ua.match(/([A-Za-z][\w.-]{2,30})\/[\d.]+/)?.[1];
+  return token ?? 'unidentified';
+}
+
+const shortWallet = (p) => (p.length > 14 ? `${p.slice(0, 6)}…${p.slice(-4)}` : p);
+
+async function events({ since }) {
+  const from = new Date(since || 0);
+  const [sales, demand] = await Promise.all([
+    sql`select payer, user_agent, total_cents, days, created_at
+        from crawl_sales where created_at >= ${from}`,
+    // crawl_demand.day is a DATE. Binding a JS Date here sends Postgres the
+    // full "Thu Jan 01 1970 00:00:00 GMT+0000 (…)" string, which it refuses to
+    // parse as a date, and the whole board 500s. Send the day itself.
+    sql`select agent, day, hits from crawl_demand where day >= ${from.toISOString().slice(0, 10)}`,
+  ]);
+
+  const out = [];
+  for (const s of sales) {
+    const player = s.payer || agentName(s.user_agent);
+    if (!player) continue;
+    const at = ms(s.created_at);
+    const name = agentName(s.user_agent) ?? shortWallet(String(player));
+    const each = (metric, delta) => out.push({ player: String(player), name, metric, delta, at });
+    each('spent', Number(s.total_cents) || 0);
+    each('passes', 1);
+    each('days', Number(s.days) || 1);
+  }
+  for (const d of demand) {
+    // A day bucket lands at noon UTC, so it falls inside the day it describes
+    // no matter which way a period boundary rounds.
+    const at = ms(d.day) + 12 * 3600 * 1000;
+    out.push({
+      player: `ua:${d.agent}`,
+      name: d.agent,
+      metric: 'blocked',
+      delta: Number(d.hits) || 0,
+      at,
+    });
+  }
+  return out;
+}
+
+export const leaderboard = createLeaderboard({
+  siteName: brand.name,
+  siteUrl: config.siteUrl,
+  basePath: '/leaderboard',
+  store: projectionStore({ events, badges }),
+  sides: { buy: 'Agents paying', use: 'Agents not paying' },
+  boards: {
+    spenders: {
+      label: 'Biggest spenders',
+      metric: 'spent',
+      format: 'usd',
+      unit: 'Spent',
+      side: 'buy',
+      actor: 'Agent',
+    },
+    passes: {
+      label: 'Most passes bought',
+      metric: 'passes',
+      format: 'integer',
+      unit: 'Passes',
+      side: 'buy',
+      actor: 'Agent',
+    },
+    days: {
+      label: 'Most days of access',
+      metric: 'days',
+      format: 'integer',
+      unit: 'Days',
+      side: 'buy',
+      actor: 'Agent',
+    },
+    blocked: {
+      label: 'Most requests refused',
+      metric: 'blocked',
+      format: 'integer',
+      unit: 'Refused',
+      side: 'use',
+      actor: 'Agent',
+    },
+  },
+  // Nobody earns here: this site sells its own data rather than anyone else's.
+  ladder: null,
+  cacheMs: 60_000,
+});
@@ -0,0 +1,42 @@
+-- What the crawler paywall is actually doing, and who is on the other side.
+--
+-- The gateway has been answering 402 and selling day passes for a while, and
+-- none of it was written down: a sale existed only for as long as the response
+-- took to send. So there is no way to answer "what did the paywall earn this
+-- month" or "which agent is the customer", which are the only two questions
+-- that matter about it.
+--
+-- Two tables, because there are two facts. A sale is money. A demand is an
+-- agent hitting the wall and not paying, which is the pipeline, and there are
+-- thousands of those a day: it is counted per agent per day rather than stored
+-- per request, so the table stays small enough to leave on forever.
+create table if not exists crawl_sales (
+  id          bigserial primary key,
+  payer       text,
+  ref         text unique,
+  days        int not null default 1,
+  price_cents int not null,
+  total_cents int not null,
+  currency    text not null default 'USD',
+  user_agent  text,
+  expires_at  timestamptz,
+  created_at  timestamptz not null default now()
+);
+create index if not exists crawl_sales_payer_idx on crawl_sales (lower(payer), created_at desc);
+
+create table if not exists crawl_demand (
+  agent   text not null,
+  day     date not null,
+  hits    bigint not null default 0,
+  primary key (agent, day)
+);
+
+-- Badges for the public board. Everything else it shows is projected out of
+-- the two tables above; a badge is awarded at a moment and then kept, and that
+-- fact lives nowhere else.
+create table if not exists leaderboard_badges (
+  player     text not null,
+  badge      text not null,
+  awarded_at timestamptz not null default now(),
+  primary key (player, badge)
+);
@@ -3429,3 +3429,49 @@ export async function sharedSiriusXmOwner(ownerId, { viewerId = null } = {}) {
   `;
   return row ?? null;
 }
+
+/*
+ * The crawler paywall's own books.
+ *
+ * The gateway has been answering 402 and selling day passes without writing any
+ * of it down, so neither the revenue nor the customer was knowable after the
+ * response was sent. These two record it.
+ */
+
+/**
+ * One sale. `ref` is the payment reference and is unique, so a settlement
+ * delivered twice books once rather than doubling the day's takings.
+ */
+export async function recordCrawlSale({
+  payer = null,
+  ref = null,
+  days = 1,
+  priceCents = 0,
+  totalCents = 0,
+  currency = 'USD',
+  userAgent = null,
+  expiresAt = null,
+}) {
+  const [row] = await sql`
+    insert into crawl_sales (payer, ref, days, price_cents, total_cents, currency, user_agent, expires_at)
+    values (${payer}, ${ref}, ${days}, ${priceCents}, ${totalCents}, ${currency}, ${userAgent},
+            ${expiresAt ? new Date(expiresAt) : null})
+    on conflict (ref) do nothing
+    returning id`;
+  return row ?? null;
+}
+
+/**
+ * One refused request, counted per agent per day.
+ *
+ * There are thousands of these a day and none of them is interesting on its
+ * own, so the row is a counter rather than an event. Cheap enough to call on
+ * every 402 and small enough to keep forever.
+ */
+export async function recordCrawlDemand(agent, at = new Date()) {
+  if (!agent) return;
+  await sql`
+    insert into crawl_demand (agent, day, hits)
+    values (${agent}, ${new Date(at).toISOString().slice(0, 10)}, 1)
+    on conflict (agent, day) do update set hits = crawl_demand.hits + 1`;
+}
Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,7 @@`
`22`	`22`	`"@tipoff/radio": "workspace:*",`
`23`	`23`	`"@tipoff/sports": "workspace:*",`
`24`	`24`	`"hono": "^4.10.3",`
`25`		`- "mpegts.js": "1.8.2"`
	`25`	`+ "mpegts.js": "1.8.2",`
	`26`	`+ "@profullstack/leaderboard": "^0.3.0"`
`26`	`27`	`}`
`27`	`28`	`}`