@contextplusplus/core 1.1.0

package/dist/infrastructure/auth/supabase-auth-live.js

@@ -0,0 +1,241 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cd7f9711-a0b1-596b-85b6-2f5bda077fa8")}catch(e){}}();
+import { createHash, createHmac } from "node:crypto";
+import { createClient } from "@supabase/supabase-js";
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
+import { Effect, Layer, Option, Redacted, Schema } from "effect";
+import { AuthService } from "../../application/ports/auth-service.js";
+import { ProductConfigService } from "../../application/ports/config-service.js";
+import { ConfigurationError, InvalidCredentialError, sanitizeErrorCause } from "../../domain/errors.js";
+import { UserId } from "../../domain/ids.js";
+import { isApiKeyScope } from "../../domain/scopes.js";
+/**
+ * Hex digest of an API key — the only representation we persist.
+ *
+ * With no secret: `sha256(rawKey)` (the legacy, byte-for-byte behaviour). With a
+ * secret (`API_KEY_HASH_SECRET`): keyed `HMAC-sha256(rawKey)`, so a stolen DB
+ * dump cannot be brute-forced offline without the secret. Verification accepts
+ * BOTH, so enabling the secret never invalidates an existing key.
+ */
+export function hashApiKey(rawKey, secret) {
+    if (secret !== undefined) {
+        return createHmac("sha256", Redacted.value(secret))
+            .update(rawKey, "utf8")
+            .digest("hex");
+    }
+    return createHash("sha256").update(rawKey, "utf8").digest("hex");
+}
+/** Maps a verified JWT payload to the claims the service consumes. */
+function payloadToClaims(payload) {
+    if (typeof payload.sub !== "string") {
+        throw new InvalidCredentialError({ credential: "bearer", reason: "JWT is missing a subject claim" });
+    }
+    return {
+        sub: payload.sub,
+        ...(typeof payload.email === "string" ? { email: payload.email } : {}),
+        ...(typeof payload.role === "string" ? { role: payload.role } : {})
+    };
+}
+/** Local/dev HS256 verifier. Hosted projects substitute a JWKS verifier. */
+export function hs256Verifier(secret, audience, issuer) {
+    const key = new TextEncoder().encode(Redacted.value(secret));
+    return async (token) => {
+        const { payload } = await jwtVerify(token, key, {
+            algorithms: ["HS256"],
+            audience,
+            // Enforce the issuer only when it is known (the caller derives it from
+            // SUPABASE_URL). A pure local-HS256 setup with no SUPABASE_URL leaves it
+            // undefined, preserving the prior no-issuer behaviour (non-breaking).
+            ...(issuer !== undefined ? { issuer } : {})
+        });
+        return payloadToClaims(payload);
+    };
+}
+/**
+ * Asymmetric verifier for hosted Supabase projects, which sign user session
+ * JWTs with ES256 (and may rotate to RS256). Keys are fetched from the
+ * project's JWKS endpoint; jose caches and refreshes the key set internally,
+ * so the remote set is created once per verifier and reused across requests.
+ */
+export function jwksVerifier(supabaseUrl, audience) {
+    const base = supabaseUrl.replace(/\/+$/, "");
+    const jwksUrl = new URL(`${base}/auth/v1/.well-known/jwks.json`);
+    // Supabase signs hosted session JWTs with `iss = ${SUPABASE_URL}/auth/v1`. The
+    // JWKS is project-specific so a foreign-project token already fails signature
+    // verification, but enforcing `iss` is cheap defence-in-depth.
+    const issuer = `${base}/auth/v1`;
+    const jwks = createRemoteJWKSet(jwksUrl);
+    return async (token) => {
+        const { payload } = await jwtVerify(token, jwks, {
+            algorithms: ["ES256", "RS256"],
+            audience,
+            issuer
+        });
+        return payloadToClaims(payload);
+    };
+}
+const decodeBearerUserId = (value) => Schema.decodeUnknown(UserId)(value).pipe(Effect.mapError((cause) => new InvalidCredentialError({
+    credential: "bearer",
+    reason: "Token subject is not a valid user id",
+    cause: sanitizeErrorCause(cause)
+})));
+const decodeApiKeyUserId = (value) => Schema.decodeUnknown(UserId)(value).pipe(Effect.mapError((cause) => new InvalidCredentialError({
+    credential: "api-key",
+    reason: "Stored api key owner is not a valid user id",
+    cause: sanitizeErrorCause(cause)
+})));
+function toUser(userId, claims, credential) {
+    return {
+        userId,
+        role: claims.role ?? "authenticated",
+        credential,
+        ...(claims.email !== undefined ? { email: claims.email } : {})
+    };
+}
+function isExpired(expiresAt) {
+    if (expiresAt === null) {
+        return false;
+    }
+    const parsed = Date.parse(expiresAt);
+    return Number.isFinite(parsed) && parsed <= Date.now();
+}
+export function makeSupabaseAuthService(deps, apiKeyHashSecret = Option.none()) {
+    return AuthService.make({
+        verifyBearerToken: (token) => Effect.gen(function* () {
+            const claims = yield* Effect.tryPromise({
+                try: () => deps.verifyJwt(Redacted.value(token)),
+                catch: (cause) => new InvalidCredentialError({
+                    credential: "bearer",
+                    reason: "JWT verification failed",
+                    cause: sanitizeErrorCause(cause)
+                })
+            });
+            const userId = yield* decodeBearerUserId(claims.sub);
+            return toUser(userId, claims, "bearer");
+        }).pipe(Effect.withSpan("SupabaseAuthService.verifyBearerToken")),
+        verifyApiKey: (apiKey) => Effect.gen(function* () {
+            const raw = Redacted.value(apiKey);
+            // Backward-compatible lookup: when a hash secret is configured, try the
+            // keyed HMAC first (how new keys are stored), then fall back to the
+            // legacy sha256 (keys created before the secret existed). With no secret
+            // this is exactly one sha256 lookup — byte-for-byte the prior behaviour.
+            // Two narrow lookups (not one `.in`) keep the dep contract a single hash,
+            // so a DB error still fails closed instead of being masked by a fallback.
+            const secret = Option.getOrUndefined(apiKeyHashSecret);
+            const candidates = secret !== undefined
+                ? [hashApiKey(raw, secret), hashApiKey(raw)]
+                : [hashApiKey(raw)];
+            let row = null;
+            for (const candidate of candidates) {
+                row = yield* Effect.tryPromise({
+                    try: () => deps.lookupApiKeyOwner(candidate),
+                    catch: (cause) => new InvalidCredentialError({
+                        credential: "api-key",
+                        reason: "API key lookup failed",
+                        cause: sanitizeErrorCause(cause)
+                    })
+                });
+                if (row !== null) {
+                    break;
+                }
+            }
+            if (row === null || row.revoked_at !== null || isExpired(row.expires_at)) {
+                return yield* new InvalidCredentialError({
+                    credential: "api-key",
+                    reason: "API key is invalid, revoked, or expired"
+                });
+            }
+            const userId = yield* decodeApiKeyUserId(row.user_id);
+            // A `null`/absent scope set means a legacy/default key → full-scope, so
+            // `scopes` is omitted (the boundary treats omitted as full). A present
+            // set is filtered to known scopes and enforced.
+            const scopes = row.scopes === null || row.scopes === undefined
+                ? undefined
+                : row.scopes.filter(isApiKeyScope);
+            return {
+                userId,
+                role: "authenticated",
+                credential: "api-key",
+                ...(scopes !== undefined ? { scopes } : {})
+            };
+        }).pipe(Effect.withSpan("SupabaseAuthService.verifyApiKey"))
+    });
+}
+const rejectUnconfiguredJwt = () => Promise.reject(new ConfigurationError({ key: "SUPABASE_JWT_SECRET", message: "SUPABASE_JWT_SECRET is not configured" }));
+const rejectUnconfiguredApiKey = () => Promise.reject(new ConfigurationError({ key: "SUPABASE_SERVICE_ROLE_KEY", message: "Supabase service role is not configured" }));
+function serviceRoleClient(config) {
+    return Option.flatMap(config.supabaseServiceRoleKey, (serviceRoleKey) => Option.map(config.supabaseUrl, (url) => createClient(url, Redacted.value(serviceRoleKey), {
+        auth: { persistSession: false, autoRefreshToken: false }
+    })));
+}
+function lookupApiKeyOwner(client) {
+    return async (keyHashHex) => {
+        const { data, error } = await client
+            .from("api_keys")
+            .select("user_id, expires_at, revoked_at, scopes")
+            .eq("key_hash", keyHashHex)
+            .maybeSingle();
+        if (error !== null) {
+            throw error;
+        }
+        return data ?? null;
+    };
+}
+/**
+ * Routes a presented token to the verifier matching its header `alg`: symmetric
+ * HS256 for the local/dev stack (needs `SUPABASE_JWT_SECRET`), asymmetric
+ * ES256/RS256 for hosted Supabase projects (needs `SUPABASE_URL` for JWKS).
+ * Unknown/none algorithms and unconfigured verifiers are rejected.
+ */
+export function makeRoutingVerifier(config) {
+    const audience = config.supabaseJwtAudience;
+    // Expected issuer is `${SUPABASE_URL}/auth/v1` (Supabase's signing `iss`).
+    // Known only when SUPABASE_URL is configured; the HS256 verifier enforces it
+    // only then, so a pure local-HS256 setup (no URL) keeps its prior behaviour.
+    const issuer = Option.getOrUndefined(Option.map(config.supabaseUrl, (url) => `${url.replace(/\/+$/, "")}/auth/v1`));
+    const hs256 = Option.map(config.supabaseJwtSecret, (secret) => hs256Verifier(secret, audience, issuer));
+    const jwks = Option.map(config.supabaseUrl, (url) => jwksVerifier(url, audience));
+    return async (token) => {
+        const { alg } = decodeProtectedHeader(token);
+        if (alg === "HS256") {
+            return Option.match(hs256, {
+                onNone: () => Promise.reject(new ConfigurationError({ key: "SUPABASE_JWT_SECRET", message: "SUPABASE_JWT_SECRET is not configured" })),
+                onSome: (verify) => verify(token)
+            });
+        }
+        if (alg === "ES256" || alg === "RS256") {
+            return Option.match(jwks, {
+                onNone: () => Promise.reject(new ConfigurationError({ key: "SUPABASE_URL", message: "SUPABASE_URL is not configured" })),
+                onSome: (verify) => verify(token)
+            });
+        }
+        return Promise.reject(new InvalidCredentialError({ credential: "bearer", reason: "Unsupported JWT algorithm" }));
+    };
+}
+export function supabaseAuthDeps(config) {
+    const verifyJwt = Option.isNone(config.supabaseJwtSecret) &&
+        Option.isNone(config.supabaseUrl)
+        ? rejectUnconfiguredJwt
+        : makeRoutingVerifier(config);
+    const owner = Option.match(serviceRoleClient(config), {
+        onNone: () => rejectUnconfiguredApiKey,
+        onSome: (client) => lookupApiKeyOwner(client)
+    });
+    return { verifyJwt, lookupApiKeyOwner: owner };
+}
+export const SupabaseAuthLive = Layer.effect(AuthService, Effect.gen(function* () {
+    const { config } = yield* ProductConfigService;
+    // P2-4 observability: when BOTH SUPABASE_JWT_SECRET and SUPABASE_URL are set,
+    // the router trusts HS256 (the static secret) ALONGSIDE ES256 (JWKS). That is
+    // valid for an intentional dual mode, but a JWKS-mode production usually does
+    // NOT want HS256 accepted. Warn once at layer build. This is PURE
+    // observability — never a refuse: a hard failure here would 500 all auth and
+    // take the live API down (prod commonly has both set today).
+    if (Option.isSome(config.supabaseJwtSecret) &&
+        Option.isSome(config.supabaseUrl)) {
+        yield* Effect.logWarning("auth: both SUPABASE_JWT_SECRET and SUPABASE_URL are set — HS256 tokens are accepted alongside JWKS/ES256. Remove SUPABASE_JWT_SECRET from JWKS-mode production unless dual-mode is intentional.");
+    }
+    return makeSupabaseAuthService(supabaseAuthDeps(config), config.apiKeyHashSecret);
+}));
+//# sourceMappingURL=supabase-auth-live.js.map
+//# debugId=cd7f9711-a0b1-596b-85b6-2f5bda077fa8

package/dist/infrastructure/auth/supabase-auth-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-auth-live.js","sources":["../../../src/infrastructure/auth/supabase-auth-live.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EACL,WAAW,EAGZ,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,oBAAoB,EAErB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACxG,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AA+BvD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,MAAkC;IAElC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAChD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACtB,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,OAAmB;IAC1C,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAC3B,MAAiC,EACjC,QAAgB,EAChB,MAAe;IAEf,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;YAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ;YACR,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,WAAmB,EACnB,QAAgB;IAEhB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IACjE,+EAA+E;IAC/E,8EAA8E;IAC9E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC;IACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAE,CAC3C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,sBAAsB,CAAC;IACzB,UAAU,EAAE,QAAQ;IACpB,MAAM,EAAE,sCAAsC;IAC9C,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;CACjC,CAAC,CACL,CACF,CAAC;AAEJ,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAE,CAC3C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,sBAAsB,CAAC;IACzB,UAAU,EAAE,SAAS;IACrB,MAAM,EAAE,6CAA6C;IACrD,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;CACjC,CAAC,CACL,CACF,CAAC;AAEJ,SAAS,MAAM,CACb,MAAc,EACd,MAAyB,EACzB,UAA8B;IAE9B,OAAO;QACL,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,eAAe;QACpC,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,SAAwB;IACzC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAsB,EACtB,mBAA6D,MAAM,CAAC,IAAI,EAAE;IAE1E,OAAO,WAAW,CAAC,IAAI,CAAC;QACtB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACtC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,sBAAsB,CAAC;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,yBAAyB;oBACjC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;iBACjC,CAAC;aACL,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QACnE,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnC,wEAAwE;YACxE,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;YACvD,MAAM,UAAU,GACd,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,GAAG,GAA0B,IAAI,CAAC;YACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;oBAC5C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,sBAAsB,CAAC;wBACzB,UAAU,EAAE,SAAS;wBACrB,MAAM,EAAE,uBAAuB;wBAC/B,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;qBACjC,CAAC;iBACL,CAAC,CAAC;gBACH,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;oBACjB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,CAAC,IAAI,sBAAsB,CAAC;oBACvC,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,yCAAyC;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtD,wEAAwE;YACxE,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAC7C,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;gBACL,MAAM;gBACN,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,SAAS;gBACrB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChB,CAAC;QAChC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB,GAAG,GAA+B,EAAE,CAC7D,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE3H,MAAM,wBAAwB,GAAG,GAAmC,EAAE,CACpE,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,2BAA2B,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAEnI,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CACrC,YAAY,CAAW,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;QAC1D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACzD,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAgC;IACzD,OAAO,KAAK,EAAE,UAAkB,EAAkC,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;aACjC,IAAI,CAAC,UAAU,CAAC;aAChB,MAAM,CAAC,yCAAyC,CAAC;aACjD,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;aAC1B,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAQ,IAA8B,IAAI,IAAI,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC5C,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,WAAW,EAClB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAC9C,CACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5D,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CACxC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAC5B,CAAC;IACF,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;gBACzB,MAAM,EAAE,GAAG,EAAE,CACX,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;gBAC1H,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG,EAAE,CACX,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBAC5G,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,SAAS,GACb,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QAC/B,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;QACpD,MAAM,EAAE,GAAG,EAAE,CAAC,wBAAwB;QACtC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAC1C,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC;IAC/C,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,kEAAkE;IAClE,6EAA6E;IAC7E,6DAA6D;IAC7D,IACE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EACjC,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,iMAAiM,CAClM,CAAC;IACJ,CAAC;IACD,OAAO,uBAAuB,CAC5B,gBAAgB,CAAC,MAAM,CAAC,EACxB,MAAM,CAAC,gBAAgB,CACxB,CAAC;AACJ,CAAC,CAAC,CACH,CAAC","debugId":"cd7f9711-a0b1-596b-85b6-2f5bda077fa8"}

package/dist/infrastructure/billing/stripe-billing-live.d.ts

@@ -0,0 +1,73 @@
+import Stripe from "stripe";
+import { Layer } from "effect";
+import { BillingService, type BillingServiceApi } from "../../application/ports/billing-service.js";
+import { ProductConfigService } from "../../application/ports/config-service.js";
+/**
+ * Verified, denormalized subscription state extracted from a Stripe webhook
+ * event, ready to hand to the `upsert_subscription_from_stripe` RPC. `null`
+ * timestamps map to SQL NULL. `plan` is resolved app-side from the price id.
+ */
+export interface SubscriptionUpsert {
+    readonly stripeEventId: string;
+    readonly eventType: string;
+    /**
+     * The Stripe event's `created` timestamp (ISO 8601). Threaded through to the
+     * upsert RPC so it can apply state MONOTONICALLY — a later-delivered but OLDER
+     * event (Stripe gives no global ordering guarantee) must never overwrite newer
+     * state (e.g. resurrect a canceled subscription). See the
+     * `…_release_quota_unit` / webhook-ordering migration.
+     */
+    readonly eventCreated: string;
+    readonly userId: string;
+    readonly stripeCustomerId: string | null;
+    readonly stripeSubscriptionId: string;
+    readonly stripePriceId: string | null;
+    readonly plan: string;
+    readonly status: string;
+    readonly currentPeriodStart: string | null;
+    readonly currentPeriodEnd: string | null;
+    readonly cancelAtPeriodEnd: boolean;
+}
+/**
+ * Injectable Stripe boundary. The live deps drive the Stripe SDK + the Supabase
+ * service-role RPC; tests stub these so checkout/portal/webhook logic runs with
+ * no network and no live spend. Webhook signature verification stays in the
+ * service (so the fake cannot accidentally bypass it) and only the verified,
+ * extracted upsert reaches `upsertSubscription`.
+ */
+export interface StripeBillingDeps {
+    readonly createCheckoutUrl: (input: {
+        readonly userId: string;
+        readonly priceId: string;
+        readonly customerEmail?: string;
+    }) => Promise<string | null>;
+    /**
+     * Opens a Stripe billing portal bound to the authenticated user. The dep
+     * resolves the Stripe customer server-side from the user's mapped customer; it
+     * never accepts a client-supplied customer id, so cross-tenant portal access
+     * (IDOR) is structurally impossible.
+     */
+    readonly createPortalUrl: (input: {
+        readonly userId: string;
+    }) => Promise<string>;
+    /** Verify the signed payload; throws on a bad/missing signature. */
+    readonly constructEvent: (payload: string, signature: string) => Stripe.Event;
+    readonly upsertSubscription: (upsert: SubscriptionUpsert) => Promise<boolean>;
+}
+/**
+ * Pulls the denormalized subscription state out of a verified subscription
+ * event. In Stripe API 2026-05-27, the billing period lives on the first
+ * subscription item, not on the subscription root. Returns `undefined` when the
+ * event lacks the `user_id` metadata or a resolvable plan, so the caller skips
+ * the upsert and still answers 200 (Stripe stops retrying).
+ */
+export declare function extractSubscriptionUpsert(event: Stripe.Event, prices: {
+    readonly standard?: string;
+    readonly pro?: string;
+}): SubscriptionUpsert | undefined;
+export declare function makeStripeBillingService(deps: StripeBillingDeps, prices: {
+    readonly standard?: string;
+    readonly pro?: string;
+}): BillingServiceApi;
+export declare const StripeBillingLive: Layer.Layer<BillingService, never, ProductConfigService>;
+//# sourceMappingURL=stripe-billing-live.d.ts.map

package/dist/infrastructure/billing/stripe-billing-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe-billing-live.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/billing/stripe-billing-live.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAU,KAAK,EAAoB,MAAM,QAAQ,CAAC;AAEzD,OAAO,EACL,cAAc,EAId,KAAK,iBAAiB,EAIvB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,oBAAoB,EAGrB,MAAM,2CAA2C,CAAC;AAQnD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE;QAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;KACjC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,CACvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,KACd,MAAM,CAAC,KAAK,CAAC;IAClB,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/E;AA2BD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,kBAAkB,GAAG,SAAS,CAgChC;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,iBAAiB,CAsEnB;AA8KD,eAAO,MAAM,iBAAiB,0DAwB7B,CAAC"}

package/dist/infrastructure/billing/stripe-billing-live.js

@@ -0,0 +1,296 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0c8d06fe-7859-5e40-934e-4c900fb0d1e1")}catch(e){}}();
+import Stripe from "stripe";
+import { Effect, Layer, Option, Redacted } from "effect";
+import { BillingService, planForPriceId, priceIdForPlan } from "../../application/ports/billing-service.js";
+import { ProductConfigService } from "../../application/ports/config-service.js";
+import { BillingStateError, ConfigurationError, InputValidationError, sanitizeErrorCause } from "../../domain/errors.js";
+const SUBSCRIPTION_EVENT_TYPES = new Set([
+    "customer.subscription.created",
+    "customer.subscription.updated",
+    "customer.subscription.deleted"
+]);
+function billingError(operation) {
+    return (cause) => new BillingStateError({ operation, cause: sanitizeErrorCause(cause) });
+}
+function isoFromUnix(seconds) {
+    if (typeof seconds !== "number" || !Number.isFinite(seconds)) {
+        return null;
+    }
+    return new Date(seconds * 1000).toISOString();
+}
+function customerId(value) {
+    if (typeof value === "string") {
+        return value.length > 0 ? value : null;
+    }
+    return value?.id ?? null;
+}
+/**
+ * Pulls the denormalized subscription state out of a verified subscription
+ * event. In Stripe API 2026-05-27, the billing period lives on the first
+ * subscription item, not on the subscription root. Returns `undefined` when the
+ * event lacks the `user_id` metadata or a resolvable plan, so the caller skips
+ * the upsert and still answers 200 (Stripe stops retrying).
+ */
+export function extractSubscriptionUpsert(event, prices) {
+    if (!SUBSCRIPTION_EVENT_TYPES.has(event.type)) {
+        return undefined;
+    }
+    const subscription = event.data.object;
+    const userId = subscription.metadata?.["user_id"];
+    if (typeof userId !== "string" || userId.length === 0) {
+        return undefined;
+    }
+    const firstItem = subscription.items?.data?.[0];
+    const priceId = firstItem?.price?.id ?? null;
+    const plan = planForPriceId(priceId, prices);
+    if (plan === undefined) {
+        return undefined;
+    }
+    return {
+        stripeEventId: event.id,
+        eventType: event.type,
+        // `event.created` is always present on a Stripe event; fall back to "now"
+        // only if a malformed fixture omits it, so the NOT NULL ordering column is
+        // always populated.
+        eventCreated: isoFromUnix(event.created) ?? new Date().toISOString(),
+        userId,
+        stripeCustomerId: customerId(subscription.customer),
+        stripeSubscriptionId: subscription.id,
+        stripePriceId: priceId,
+        plan,
+        status: subscription.status,
+        currentPeriodStart: isoFromUnix(firstItem?.current_period_start),
+        currentPeriodEnd: isoFromUnix(firstItem?.current_period_end),
+        cancelAtPeriodEnd: subscription.cancel_at_period_end === true
+    };
+}
+export function makeStripeBillingService(deps, prices) {
+    const resolvePriceId = (plan) => Effect.gen(function* () {
+        const priceId = priceIdForPlan(plan, prices);
+        if (priceId === undefined || priceId.length === 0) {
+            return yield* new InputValidationError({
+                message: `No Stripe price configured for plan "${plan}"`
+            });
+        }
+        return priceId;
+    });
+    return BillingService.make({
+        createCheckoutSession: (request) => Effect.gen(function* () {
+            const priceId = yield* resolvePriceId(request.plan);
+            const url = yield* Effect.tryPromise({
+                try: () => deps.createCheckoutUrl({
+                    userId: String(request.userId),
+                    priceId,
+                    ...(request.customerEmail !== undefined
+                        ? { customerEmail: request.customerEmail }
+                        : {})
+                }),
+                catch: billingError("create-checkout-session")
+            });
+            if (url === null || url.length === 0) {
+                return yield* new BillingStateError({
+                    operation: "create-checkout-session"
+                });
+            }
+            return { url };
+        }).pipe(Effect.withSpan("StripeBillingService.createCheckoutSession")),
+        createPortalSession: (request) => Effect.gen(function* () {
+            const url = yield* Effect.tryPromise({
+                try: () => deps.createPortalUrl({ userId: String(request.userId) }),
+                catch: billingError("create-portal-session")
+            });
+            return { url };
+        }).pipe(Effect.withSpan("StripeBillingService.createPortalSession")),
+        handleWebhookEvent: ({ payload, signature }) => Effect.gen(function* () {
+            if (signature === undefined || signature.length === 0) {
+                return yield* new InputValidationError({
+                    message: "Missing Stripe-Signature header"
+                });
+            }
+            const event = yield* Effect.try({
+                try: () => deps.constructEvent(payload, signature),
+                // Sanitized: never echoes the raw payload or the signature.
+                catch: () => new InputValidationError({
+                    message: "Stripe signature verification failed"
+                })
+            });
+            const upsert = extractSubscriptionUpsert(event, prices);
+            if (upsert === undefined) {
+                return { applied: false, eventType: event.type };
+            }
+            const applied = yield* Effect.tryPromise({
+                try: () => deps.upsertSubscription(upsert),
+                catch: billingError("upsert-subscription")
+            });
+            return { applied, eventType: event.type };
+        }).pipe(Effect.withSpan("StripeBillingService.handleWebhookEvent"))
+    });
+}
+// ---------------------------------------------------------------------------
+// Live wiring: real Stripe SDK + Supabase service-role RPC. Builds offline; the
+// deps reject (BillingStateError) only when invoked without configuration.
+// ---------------------------------------------------------------------------
+function stripeClient(billing) {
+    return Option.map(billing.stripeSecretKey, (secret) => {
+        const host = Option.getOrUndefined(billing.stripeApiHost);
+        const port = Option.getOrUndefined(billing.stripeApiPort);
+        const protocol = Option.getOrUndefined(billing.stripeApiProtocol);
+        return new Stripe(Redacted.value(secret), {
+            // Pin the API version so subscription period fields are read from the
+            // layout this code expects, independent of the live account's default
+            // API version. extractSubscriptionUpsert reads current_period_start/end
+            // off the subscription ITEM (firstItem.current_period_*) — the layout
+            // introduced in 2026-05-27.dahlia. On an account whose default version
+            // predates that layout those fields are undefined, so currentPeriodEnd
+            // becomes null and every paying user fails the entitlement gate (402).
+            // Stripe.API_VERSION is the SDK's pinned LatestApiVersion literal
+            // ("2026-05-27.dahlia" in stripe@22.x), so this can never drift from the
+            // types this build was compiled against.
+            apiVersion: Stripe.API_VERSION,
+            maxNetworkRetries: 0,
+            ...(host !== undefined ? { host } : {}),
+            ...(port !== undefined ? { port } : {}),
+            ...(protocol !== undefined ? { protocol } : {})
+        });
+    });
+}
+const rejectUnconfigured = (operation) => () => Promise.reject(new ConfigurationError({ key: "STRIPE_SECRET_KEY", message: `Stripe is not configured (${operation})` }));
+function pricesFrom(billing) {
+    const standard = Option.getOrUndefined(billing.stripePriceStandard);
+    const pro = Option.getOrUndefined(billing.stripePricePro);
+    return {
+        ...(standard !== undefined ? { standard } : {}),
+        ...(pro !== undefined ? { pro } : {})
+    };
+}
+function liveDeps(client, billing, upsert, resolveCustomerId) {
+    const webhookSecret = Option.getOrUndefined(billing.stripeWebhookSecret);
+    return {
+        createCheckoutUrl: async ({ userId, priceId, customerEmail }) => {
+            const session = await client.checkout.sessions.create({
+                mode: "subscription",
+                line_items: [{ price: priceId, quantity: 1 }],
+                success_url: billing.checkoutSuccessUrl,
+                cancel_url: billing.checkoutCancelUrl,
+                client_reference_id: userId,
+                subscription_data: { metadata: { user_id: userId } },
+                ...(customerEmail !== undefined ? { customer_email: customerEmail } : {})
+            });
+            return session.url;
+        },
+        // IDOR fix: the portal customer is resolved server-side from the user's
+        // mapped Stripe customer (`profiles.stripe_customer_id`). A request never
+        // carries a customer id, so one user can never open another user's portal.
+        // A user with no mapped customer (never checked out) cannot open a portal.
+        createPortalUrl: async ({ userId }) => {
+            const customer = await resolveCustomerId(userId);
+            if (customer === null || customer.length === 0) {
+                throw new BillingStateError({ operation: "create-portal-session", cause: { message: "No Stripe customer is mapped to this user" } });
+            }
+            const session = await client.billingPortal.sessions.create({
+                customer,
+                return_url: billing.portalReturnUrl
+            });
+            return session.url;
+        },
+        constructEvent: (payload, signature) => {
+            if (webhookSecret === undefined) {
+                throw new ConfigurationError({ key: "STRIPE_WEBHOOK_SECRET", message: "STRIPE_WEBHOOK_SECRET is not configured" });
+            }
+            return client.webhooks.constructEvent(payload, signature, Redacted.value(webhookSecret));
+        },
+        upsertSubscription: upsert
+    };
+}
+/**
+ * Service-role RPC for the idempotent webhook upsert. Imported lazily so the
+ * billing live layer does not pull `@supabase/supabase-js` into checkout/portal
+ * code paths that may run without Supabase configured.
+ */
+async function makeSupabaseUpsert(config) {
+    const url = Option.getOrUndefined(config.supabaseUrl);
+    const serviceRoleKey = Option.getOrUndefined(config.supabaseServiceRoleKey);
+    if (url === undefined || serviceRoleKey === undefined) {
+        return rejectUnconfigured("upsert-subscription");
+    }
+    const { createClient } = await import("@supabase/supabase-js");
+    const client = createClient(url, Redacted.value(serviceRoleKey), {
+        auth: { persistSession: false, autoRefreshToken: false }
+    });
+    return async (input) => {
+        // The SQL function's text params accept NULL (e.g. a subscription with no
+        // period end), but `supabase gen types` models function args as non-null.
+        // Cast the args to the generated shape; the typed handle still checks the
+        // RPC name, and the function tolerates the nullable inputs at runtime.
+        const { data, error } = await client.rpc("upsert_subscription_from_stripe", {
+            p_stripe_event_id: input.stripeEventId,
+            p_event_type: input.eventType,
+            p_event_created: input.eventCreated,
+            p_user_id: input.userId,
+            p_stripe_customer_id: input.stripeCustomerId,
+            p_stripe_subscription_id: input.stripeSubscriptionId,
+            p_stripe_price_id: input.stripePriceId,
+            p_plan: input.plan,
+            p_status: input.status,
+            p_current_period_start: input.currentPeriodStart,
+            p_current_period_end: input.currentPeriodEnd,
+            p_cancel_at_period_end: input.cancelAtPeriodEnd
+        });
+        if (error !== null) {
+            throw error;
+        }
+        const row = (Array.isArray(data) ? data[0] : data);
+        return row?.applied === true;
+    };
+}
+/**
+ * Service-role lookup of the Stripe customer mapped to a user. Used to bind a
+ * billing-portal session to the authenticated user server-side, so the client
+ * never supplies (and cannot forge) a customer id. Imported lazily for the same
+ * reason as {@link makeSupabaseUpsert}.
+ */
+async function makeSupabaseCustomerResolver(config) {
+    const url = Option.getOrUndefined(config.supabaseUrl);
+    const serviceRoleKey = Option.getOrUndefined(config.supabaseServiceRoleKey);
+    if (url === undefined || serviceRoleKey === undefined) {
+        return rejectUnconfigured("resolve-stripe-customer");
+    }
+    const { createClient } = await import("@supabase/supabase-js");
+    const client = createClient(url, Redacted.value(serviceRoleKey), {
+        auth: { persistSession: false, autoRefreshToken: false }
+    });
+    return async (userId) => {
+        const { data, error } = await client
+            .from("profiles")
+            .select("stripe_customer_id")
+            .eq("id", userId)
+            .maybeSingle();
+        if (error !== null) {
+            throw error;
+        }
+        const row = data;
+        return row?.stripe_customer_id ?? null;
+    };
+}
+export const StripeBillingLive = Layer.effect(BillingService, Effect.gen(function* () {
+    const { config } = yield* ProductConfigService;
+    const billing = config.billing;
+    const prices = pricesFrom(billing);
+    const upsert = yield* Effect.promise(() => makeSupabaseUpsert(config));
+    const resolveCustomerId = yield* Effect.promise(() => makeSupabaseCustomerResolver(config));
+    const deps = Option.match(stripeClient(billing), {
+        onNone: () => ({
+            createCheckoutUrl: rejectUnconfigured("create-checkout-session"),
+            createPortalUrl: rejectUnconfigured("create-portal-session"),
+            constructEvent: () => {
+                throw new ConfigurationError({ key: "STRIPE_SECRET_KEY", message: "STRIPE_SECRET_KEY is not configured" });
+            },
+            upsertSubscription: upsert
+        }),
+        onSome: (client) => liveDeps(client, billing, upsert, resolveCustomerId)
+    });
+    return makeStripeBillingService(deps, prices);
+}));
+//# sourceMappingURL=stripe-billing-live.js.map
+//# debugId=0c8d06fe-7859-5e40-934e-4c900fb0d1e1