Apps pro.js: offline Pro keys (Ed25519) + direct checkout map (Workers cap fix, 17 Oct 2026)

billsprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -154,7 +177,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -164,3 +187,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

fitcheck/pro.js

@@ -11,7 +11,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var listeners = [];
 
   function get() { try { return JSON.parse(localStorage.getItem(KEY) || "null"); } catch (e) { return null; } }
@@ -19,7 +19,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); }).then(function (j) { return !!(j && j.pro); }).catch(function () { return null; });
   }
@@ -99,10 +122,30 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, download: download, csv: csv, markdown: markdown, rows: rows, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   if (m && SID.test(decodeURIComponent(m[1]))) {
     var code = decodeURIComponent(m[1]);
     history.replaceState(null, "", location.pathname + location.search);
     if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", function () { apply(); unlock(code); }); else { apply(); unlock(code); }
   } else if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", apply); else apply();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

hazelsprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

honeyfold/pro.js

@@ -11,7 +11,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var listeners = [];
 
   function get() { try { return JSON.parse(localStorage.getItem(KEY) || "null"); } catch (e) { return null; } }
@@ -19,7 +19,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); }).then(function (j) { return !!(j && j.pro); }).catch(function () { return null; });
   }
@@ -99,10 +122,30 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, download: download, csv: csv, markdown: markdown, rows: rows, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   if (m && SID.test(decodeURIComponent(m[1]))) {
     var code = decodeURIComponent(m[1]);
     history.replaceState(null, "", location.pathname + location.search);
     if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", function () { apply(); unlock(code); }); else { apply(); unlock(code); }
   } else if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", apply); else apply();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

hoursprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -154,7 +177,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -164,3 +187,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

menumoor/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -154,7 +177,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -164,3 +187,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

pactsprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

pitchsprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

platesprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

profit-margin-calculator/pro.js

@@ -11,7 +11,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var listeners = [];
 
   function get() { try { return JSON.parse(localStorage.getItem(KEY) || "null"); } catch (e) { return null; } }
@@ -19,7 +19,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); }).then(function (j) { return !!(j && j.pro); }).catch(function () { return null; });
   }
@@ -99,10 +122,30 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, download: download, csv: csv, markdown: markdown, rows: rows, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   if (m && SID.test(decodeURIComponent(m[1]))) {
     var code = decodeURIComponent(m[1]);
     history.replaceState(null, "", location.pathname + location.search);
     if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", function () { apply(); unlock(code); }); else { apply(); unlock(code); }
   } else if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", apply); else apply();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

quotesprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

rentsprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

rotasprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -154,7 +177,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -164,3 +187,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

salary-to-hourly-calculator/pro.js

@@ -11,7 +11,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var listeners = [];
 
   function get() { try { return JSON.parse(localStorage.getItem(KEY) || "null"); } catch (e) { return null; } }
@@ -19,7 +19,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); }).then(function (j) { return !!(j && j.pro); }).catch(function () { return null; });
   }
@@ -99,10 +122,30 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, download: download, csv: csv, markdown: markdown, rows: rows, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   if (m && SID.test(decodeURIComponent(m[1]))) {
     var code = decodeURIComponent(m[1]);
     history.replaceState(null, "", location.pathname + location.search);
     if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", function () { apply(); unlock(code); }); else { apply(); unlock(code); }
   } else if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", apply); else apply();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

sigsprig/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

stampsprig/pro.js

@@ -2,8 +2,8 @@
  * self-contained). Extends pro.js with several plans (monthly, yearly, one-time) and a re-check for subscriptions.
  * Config before this script:
  *   window.CMX_PRO = { id, name, perks: [..], plans: [{ offer, label, price, per, note, best }], free: "one line" }
- * Buy: counted link https://data.cybermax-tools.workers.dev/buy/<offer>?s=app-<id> -> Stripe Payment Link.
- * After checkout Stripe sends the buyer to data.cybermax-tools.workers.dev/unlock/<id>?session_id=..., which checks the
+ * Buy: counted link https://data.cybermaxtools.com/buy/<offer>?s=app-<id> -> Stripe Payment Link.
+ * After checkout Stripe sends the buyer to data.cybermaxtools.com/unlock/<id>?session_id=..., which checks the
  * Checkout Session (and, for a subscription, that it is still active) and returns here with #cmx-pro=<session id>.
  * The app checks that code once (/unlock/<id>?json=1&session_id=..) and remembers Pro in this browser; it re-checks every
  * 3 days, so a cancelled subscription turns off by itself (one tiny request per buyer every 3 days, none for free users).
@@ -13,9 +13,9 @@
   "use strict";
   var C = window.CMX_PRO || {};
   if (!C.id) return;
-  var DATA = "https://data.cybermax-tools.workers.dev";
+  var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^cs_(live|test)_[A-Za-z0-9]{10,200}$/;
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -58,6 +81,18 @@
   function esc(s) { return String(s).replace(/[&<>"]/g, function (c) { return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c]; }); }
   function buyUrl(offer, from) { return DATA + "/buy/" + offer + "?s=app-" + C.id + (from ? "-" + from : ""); }
 
+  // Convert kit (funnel beacons, real proof, email capture, phone buy bar), loaded from the CyberMax Store; optional:
+  // if it can't load (offline), the app and the Pro box work exactly the same.
+  var KIT = "https://cybermaxtools.com/store/convert.js", kitQ = [];
+  function conv(fn) {
+    if (window.CMXConvert) return fn(window.CMXConvert);
+    kitQ.push(fn);
+    if (kitQ.length > 1 || !navigator.onLine) return;
+    var sc = document.createElement("script"); sc.src = KIT; sc.async = true;
+    sc.onload = function () { var q = kitQ.splice(0); q.forEach(function (f) { try { f(window.CMXConvert); } catch (e) { /* */ } }); };
+    document.head.appendChild(sc);
+  }
+
   function box() {
     var el = document.getElementById("cmx-pro");
     if (!el) {
@@ -86,10 +121,16 @@
     }).join("");
     el.innerHTML = '<h2>' + esc(C.name) + ' Pro</h2>' + (C.free ? '<p class="cmx-pro-small">Free: ' + esc(C.free) + "</p>" : "") +
       "<ul>" + C.perks.map(function (p) { return "<li>" + esc(p) + "</li>"; }).join("") + '</ul><div class="cmx-plans">' + plans +
-      '</div><p class="cmx-pro-small">Secure Stripe checkout. Pro turns on the moment you pay; no account needed.' + (subs ? " Subscriptions cancel any time." : " One payment, no subscription.") + '</p>' +
-      '<details><summary>Already bought Pro?</summary><form id="cmx-pro-form"><label>Unlock code <input id="cmx-pro-code" autocomplete="off" placeholder="cs_live_…"></label> <button class="btn ghost" type="submit">Unlock</button></form></details><p id="cmx-pro-msg" class="cmx-pro-small" aria-live="polite"></p>';
+      '</div><p class="cmx-pro-small">Secure Stripe checkout. Pro turns on the moment you pay; no account needed.' + (subs ? " Subscriptions cancel any time from your receipt email." : " One payment, no subscription.") +
+      ' 14-day promise: if it doesn\'t work as described, we fix it or refund you in full (<a href="https://cybermaxtools.com/terms#payments" target="_blank" rel="noopener">terms</a>). Questions: <a href="mailto:cybermax.tools@gmail.com">cybermax.tools@gmail.com</a></p><div class="cmx-pro-proof"></div><div class="cmx-pro-cap"></div>' +
+      '<details><summary>Already bought Pro?</summary><form id="cmx-pro-form"><label>Unlock code <input id="cmx-pro-code" autocomplete="off" placeholder="cs_live_… or Gumroad licence key"></label> <button class="btn ghost" type="submit">Unlock</button></form></details><p id="cmx-pro-msg" class="cmx-pro-small" aria-live="polite"></p>';
+    Array.prototype.forEach.call(el.querySelectorAll("a.cmx-plan"), function (a) { a.addEventListener("click", function () { conv(function (K) { K.event("upgrade-click", C.id); }); }); });
+    conv(function (K) {
+      K.proof(el.querySelector(".cmx-pro-proof"), C.id);
+      K.capture(el.querySelector(".cmx-pro-cap"), { list: "weekly-" + C.id, src: "app-" + C.id, label: "Not ready for Pro? Email me " + C.name + " tips and new features (about once a week)" });
+    });
     var f = document.getElementById("cmx-pro-form");
-    if (f) f.onsubmit = function (e) { e.preventDefault(); var c = (document.getElementById("cmx-pro-code").value || "").trim(); if (SID.test(c)) unlock(c); else toast("Paste the code from your receipt page (it starts with cs_live_)."); };
+    if (f) f.onsubmit = function (e) { e.preventDefault(); var c = (document.getElementById("cmx-pro-code").value || "").trim(); if (SID.test(c)) unlock(c); else toast("Paste the code from your receipt page (it starts with cs_live_) or your Gumroad licence key."); };
   }
 
   function apply() {
@@ -103,6 +144,12 @@
     var el = box();
     if (from) Array.prototype.forEach.call(el.querySelectorAll("a.cmx-plan"), function (a) { a.href = buyUrl(a.getAttribute("data-offer"), from); });
     if (reason) toast(reason);
+    // A real limit: count it, and on phones keep one buy button in reach (no timer; closes with one tap).
+    conv(function (K) {
+      K.event("limit", C.id); K.event("upgrade-view", C.id);
+      var best = (C.plans || []).filter(function (p) { return p.best; })[0] || (C.plans || [])[0];
+      if (best && !isPro()) K.sticky({ text: C.name + " Pro: " + best.price + (best.per || ""), cta: "Go Pro", href: buyUrl(best.offer, (from || "limit") + "-bar"), product: C.id });
+    });
     el.scrollIntoView({ behavior: "smooth", block: "start" });
     el.classList.add("cmx-pro-flash"); setTimeout(function () { el.classList.remove("cmx-pro-flash"); }, 1600);
   }
@@ -128,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -138,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

tagwren/pro.js

@@ -15,7 +15,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var RECHECK = 3 * 864e5;
   var listeners = [];
 
@@ -24,7 +24,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); })
       .then(function (j) { return j && typeof j.pro === "boolean" ? j.pro : null; })
@@ -152,7 +175,7 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, upsell: upsell, quota: quota, download: download, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   function start() {
     if (m && SID.test(decodeURIComponent(m[1]))) {
       var code = decodeURIComponent(m[1]);
@@ -162,3 +185,23 @@
   }
   if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", start); else start();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();

utm-builder/pro.js

@@ -11,7 +11,7 @@
   if (!C.id) return;
   var DATA = "https://data.cybermaxtools.com";
   var KEY = "cmx-pro:" + C.id;
-  var SID = /^(cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
+  var SID = /^(cmxk1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|cs_(live|test)_[A-Za-z0-9]{10,200}|[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})$/i; // Stripe order code or Gumroad licence key
   var listeners = [];
 
   function get() { try { return JSON.parse(localStorage.getItem(KEY) || "null"); } catch (e) { return null; } }
@@ -19,7 +19,30 @@
   var mem = get();
   function isPro() { return !!(mem && mem.code); }
 
+  // Offline Pro keys (17 Oct 2026): "cmxk1.<payload>.<Ed25519 signature>" from data.cybermaxtools.com/unlock is verified
+  // here with WebCrypto and the public key below, so unlocking needs no Worker call. Expired, foreign-signed or unverifiable
+  // (no Ed25519 in this browser) keys fall back to the online check of the order code inside them, as before.
+  var CMX_PUB = "u0FDxbu0d9B9Sz5-yLT6AuL5IagyTlFcbBgEDqZxWtk";
+  function b64d(s) { s = s.replace(/-/g, "+").replace(/_/g, "/"); while (s.length % 4) s += "="; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u; }
+  function cmxVerify(k) {
+    var parts = k.split("."), p = null;
+    try { p = JSON.parse(new TextDecoder().decode(b64d(parts[1]))); } catch (e) { return Promise.resolve({ p: null, ok: false }); }
+    if (!(window.crypto && crypto.subtle)) return Promise.resolve({ p: p, ok: null });
+    return crypto.subtle.importKey("raw", b64d(CMX_PUB), { name: "Ed25519" }, false, ["verify"])
+      .then(function (key) { return crypto.subtle.verify({ name: "Ed25519" }, key, b64d(parts[2]), new TextEncoder().encode(parts[0] + "." + parts[1])); })
+      .then(function (ok) { return { p: p, ok: !!ok }; }, function () { return { p: p, ok: null }; });
+  }
   function check(code) {
+    if (!/^cmxk1\./.test(code)) return checkOnline(code);
+    return cmxVerify(code).then(function (r) {
+      var p = r.p;
+      if (!p || p.a !== C.id) return false;
+      if (r.ok && (!p.x || p.x * 1000 > Date.now())) return true;
+      return p.c ? checkOnline(p.c) : false;
+    });
+  }
+
+  function checkOnline(code) {
     return fetch(DATA + "/unlock/" + encodeURIComponent(C.id) + "?json=1&session_id=" + encodeURIComponent(code))
       .then(function (r) { return r.json(); }).then(function (j) { return !!(j && j.pro); }).catch(function () { return null; });
   }
@@ -99,10 +122,30 @@
 
   window.CMXPro = { isPro: isPro, onChange: function (fn) { listeners.push(fn); fn(isPro()); }, download: download, csv: csv, markdown: markdown, rows: rows, toast: toast };
 
-  var m = /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
+  var m = /[#&]cmx-key=([^&]+)/.exec(location.hash || "") || /[#&]cmx-pro=([^&]+)/.exec(location.hash || "");
   if (m && SID.test(decodeURIComponent(m[1]))) {
     var code = decodeURIComponent(m[1]);
     history.replaceState(null, "", location.pathname + location.search);
     if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", function () { apply(); unlock(code); }); else { apply(); unlock(code); }
   } else if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", apply); else apply();
 })();
+
+/* Direct checkout (17 Oct 2026, Workers cap fix): a click on a data.cybermaxtools.com/buy/<offer> link goes straight to
+   the Stripe/Polar checkout (map: https://cybermaxtools.com/store/buy-direct.json, a static file) and the click is counted
+   by a background beacon. Without the map the link works as before. */
+(function () {
+  var MAP = null, U = "https://cybermaxtools.com/store/buy-direct.json";
+  try { MAP = JSON.parse(sessionStorage.getItem("cmx-bd") || "null"); } catch (e) { /* none */ }
+  if (!MAP && window.fetch) fetch(U).then(function (r) { return r.json(); }).then(function (j) { MAP = j; try { sessionStorage.setItem("cmx-bd", JSON.stringify(j)); } catch (e) { /* full */ } }).catch(function () {});
+  document.addEventListener("click", function (e) {
+    var a = e.target && e.target.closest && e.target.closest('a[href*="data.cybermaxtools.com/buy/"]');
+    if (!a || !MAP || !MAP.offers) return;
+    try {
+      var u = new URL(a.href), k = /^\/buy\/([a-z0-9-]+)\/?$/.exec(u.pathname), t = k && MAP.offers[k[1]];
+      if (!t) return;
+      var s = String(u.searchParams.get("s") || "unknown").toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 80) || "unknown";
+      a.href = t.split(MAP.ph).join(s);
+      if (!navigator.webdriver) navigator.sendBeacon(u.href + (u.search ? "&" : "?") + "b=1");
+    } catch (x) { /* keep the counted link */ }
+  }, true);
+})();