@cosmicdrift/kumiko-samples 0.386.0 → 0.388.0

package/packages/bundled-features/src/secrets/web/constants.ts

@@ -1,9 +1,9 @@
-// secrets bundle constants — default RBAC for set/delete/list (#2296).
+// secrets bundle constants — default RBAC for set/delete/list.
 
 import type { AccessRule } from "@cosmicdrift/kumiko-framework/engine";
 
 // Default-RBAC of the set/delete/list handlers, hard-wired to ["TenantAdmin"]
-// before #2296. Apps with their own role vocabulary override via
+// before this default was established. Apps with their own role vocabulary override via
 // createSecretsFeature({ roles }) or createSecretsFeature({ access }) — the
 // rotate job stays untouched, it's a manual/ops path across all tenants by
 // design, not a per-tenant RBAC surface.

package/packages/bundled-features/src/seo/feature.ts

@@ -1,4 +1,4 @@
-// kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
+// kumiko-lint-ignore app-feature-structure feature.ts is over 300 lines and not yet split
 import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import {
   defineFeature,
@@ -274,8 +274,8 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       });
     }
 
-    // Boot-Check body als named function extrahiert — direkt unit-testbar,
-    // gleiches "thin job-shell ruft testable function"-Pattern wie
+    // Boot-check body extracted as a named function—directly unit-testable,
+    // following the same "thin job-shell calls testable function" pattern as
     // legal-pages' runLegalPagesBootCheck.
     r.job(
       "seo-boot-check",

package/packages/bundled-features/src/sessions/constants.ts

@@ -9,7 +9,7 @@ export const SessionHandlers = {
   revoke: "sessions:write:user-session:revoke",
   revokeAllOthers: "sessions:write:user-session:revoke-all-others",
   /** Privileged: System-Caller (cross-feature) revokes ALL live sessions
-   *  fuer einen User. Genutzt von user-data-rights:restrict-account
+   *  for a user. Used by user-data-rights:restrict-account
    *  (DSGVO Art. 18 Account-Freeze). */
   revokeAllForUser: "sessions:write:user-session:revoke-all-for-user",
 } as const;

package/packages/bundled-features/src/sessions/feature.ts

@@ -51,7 +51,7 @@ export type SessionsFeatureOptions = {
   // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
   // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
-  // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
+  // — lives on the sessions feature now that sessionStore is the wiring.
   readonly expiresInMs?: number;
   // Access preset for the admin list/detail queries and screens; they expose decrypted
   // IP/user-agent of every session in the tenant. A preset name, not a role array, because
@@ -59,8 +59,10 @@ export type SessionsFeatureOptions = {
   readonly adminAccess?: "admin" | "systemAdmin";
 };
 
-export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
-export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;
+// The returned unbind only clears the binding while it is still this revoker, so a stack that
+// stops later cannot unbind a newer stack sharing the same feature instance.
+export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => () => void;
+export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => () => void;
 
 // Reads the late-bind setter off a mounted sessions feature's exports.
 // run{Prod,Dev}App call it once the DB connection is concrete — the feature
@@ -119,23 +121,23 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // events (the row columns ARE the audit trail). Registering it as
       // r.entity would make it a rebuildable implicit projection whose replay
       // finds zero session events and swaps an empty shadow over the live
-      // table — wiping every active session on the next projection rebuild
-      // (#498/#494). r.storeTable keeps the migration DDL but opts the
+      // table — wiping every active session on the next projection rebuild.
+      // r.storeTable keeps the migration DDL but opts the
       // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
       // which are direct-write stores too.
       r.storeTable(
         deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, { source: "unmanaged" }),
         {
           reason: "read_side.user_sessions_direct_write",
-          // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
+          // sessionCreator encrypts ip/userAgent via encryptForDirectWrite.
           piiEncryptedOnWrite: true,
         },
       );
 
-      // Self-registers as auth-foundation's sessionStore provider (#1371) —
+      // Self-registers as auth-foundation's sessionStore provider —
       // wraps the same createSessionCallbacks() used by the manual
-      // buildServer({ auth: { ... } }) wiring above; a future issue (#1372)
-      // removes that manual wiring once the middleware resolves generically
+      // buildServer({ auth: { ... } }) wiring above; removes that manual
+      // wiring once the middleware resolves generically
       // via resolveSessionStore().
       r.useExtension(EXT_SESSION_STORE, "default", {
         build: (deps): SessionStore => {
@@ -153,7 +155,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
         },
       } satisfies SessionStoreProvider);
 
-      // Custom domain-event for cross-instance access-invalidation (#1559).
+      // Custom domain-event for cross-instance access-invalidation.
       // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
       // revoke-all-others) enforces it at append time. revoke-all-for-user
       // appends via the low-level append() instead (needs to anchor on
@@ -161,7 +163,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // consult the registry, so that callsite parses against
       // sessionRevokedSchema explicitly, same guarantee via a different path.
       // No projection: the payload IS the read, consumed directly off the
-      // event-store NOTIFY (#1560).
+      // event-store NOTIFY.
       r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, { piiFields: "none" });
 
       const handlers = {
@@ -236,6 +238,9 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
 
       const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
         boundAutoRevoke = revoker;
+        return () => {
+          if (boundAutoRevoke === revoker) boundAutoRevoke = undefined;
+        };
       };
 
       r.translations({ keys: SESSIONS_I18N });

package/packages/bundled-features/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -64,8 +64,8 @@ export const revokeAllForUserWrite = defineWriteHandler({
       },
     );
 
-    // Lightweight append alongside the direct-write above (#1559) — see
-    // revoke.write.ts for why this isn't a lifecycle event on
+    // Lightweight append alongside the direct-write above; see revoke.write.ts
+    // for why this isn't a lifecycle event on
     // store_user_sessions. Uses the low-level append() (not
     // ctx.unsafeAppendEvent) because this handler is deliberately
     // cross-tenant: the privileged caller's own tenantId (what

package/packages/bundled-features/src/sessions/handlers/revoke-all-others.write.ts

@@ -46,8 +46,8 @@ export const revokeAllOthersWrite = defineWriteHandler({
       { userId: event.user.id, revokedAt: null, id: { ne: keepSid } },
     );
 
-    // Lightweight append alongside the direct-write above (#1559) — see
-    // revoke.write.ts for why this isn't a lifecycle event on
+    // Lightweight append alongside the direct-write above; see revoke.write.ts
+    // for why this isn't a lifecycle event on
     // store_user_sessions. Skipped when nothing was revoked (no other
     // live sessions) — a spurious invalidation would be the failure mode.
     if (updated.length > 0) {

package/packages/bundled-features/src/sessions/handlers/revoke.write.ts

@@ -50,7 +50,7 @@ export const revokeWrite = defineWriteHandler({
     );
 
     if (updated.length > 0) {
-      // Lightweight append alongside the direct-write above (#1559) — NOT a
+      // Lightweight append alongside the direct-write above — NOT a
       // lifecycle event for store_user_sessions (that table stays an
       // unmanaged direct-write store, see feature.ts). Own aggregate id per
       // revoke, no predecessor to satisfy, no version_conflict against a

package/packages/bundled-features/src/sessions/schema/user-session.ts

@@ -18,9 +18,9 @@ import { USER_SESSION_ENTITY_NAME } from "../constants.ts";
 // mutate them via ctx.db inside a transaction, but no user request can bypass
 // the revocation flow by poking the column directly.
 export const userSessionEntity = createEntity({
-  // Entity-Key ist "user-session" (mit Dash), toTableName's snake-case-
-  // Transform käme auf "read_user-sessions" → kein valides SQL ohne Quoting.
-  // Deshalb expliziter Override auf den read_-konformen Namen.
+  // The entity key is "user-session"; snake-casing it would produce
+  // "read_user-sessions", which is invalid SQL without quoting. Use an explicit
+  // override with a valid read_-prefixed table name.
   table: "store_user_sessions",
   // sid-as-PK: the sessionCreator callback generates the UUID, returns it to
   // the framework; the framework stamps it as `jti`; here the same value is
@@ -84,7 +84,7 @@ export const userSessionEntity = createEntity({
 // Unmanaged direct-write store (r.storeTable in feature.ts, no event stream —
 // revocation is a column write, not an aggregate). Handlers write via ctx.db;
 // source: "unmanaged" makes the meta Writable so those writes compile. See
-// feature.ts for the rebuild-exclusion rationale (#494/#498).
+// feature.ts for the rebuild-exclusion rationale.
 export const userSessionTable = deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, {
   source: "unmanaged",
 });

package/packages/bundled-features/src/sessions/screens.ts

@@ -28,7 +28,7 @@ export const createSessionListScreen = (
   pageSize: MAX_LIST_LIMIT,
   // Mirrors list.query's own fallback (unrecognised/absent sort → createdAt
   // desc) — kept in sync by hand, boot-validator only requires the field
-  // be present once the query accepts `sort` (fw#2230).
+  // be present once the query accepts `sort`.
   defaultSort: { field: "createdAt", dir: "desc" },
   columns: [
     { field: "id", label: i18nKey("sessions.list.col.id") },
@@ -90,7 +90,7 @@ export const createSessionDetailScreen = (
           // The shim (projection-detail-shim.ts) stamps every field as
           // type:"text" — field.renderer is the only way this screen
           // type reaches real per-type formatting instead of a raw ISO
-          // string (fw#2245).
+          // string.
           { field: "createdAt", renderer: { format: "timestamp" } },
           { field: "expiresAt", renderer: { format: "timestamp" } },
           { field: "revokedAt", renderer: { format: "timestamp" } },

package/packages/bundled-features/src/sessions/session-callbacks.ts

@@ -256,11 +256,11 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
         );
 
         // Lightweight append alongside the direct-write above, same pattern
-        // as revoke.write.ts (#1559) — this callback is the password-change
+        // as revoke.write.ts — this callback is the password-change
         // auto-revoke path (sessions/feature.ts postSave hook) and has no
         // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
         // append() like revoke-all-for-user.write.ts does. Without this, the
-        // access-invalidation consumer (#1560) never hears about a password
+        // access-invalidation consumer never hears about a password
         // change and an already-open SSE stream survives it — the exact
         // "stale JWT mid-stream" gap this feature exists to close.
         if (result.length > 0) {

package/packages/bundled-features/src/sessions/session-revoked-event.ts

@@ -2,11 +2,11 @@ import * as z from "zod";
 
 // Lightweight custom event appended alongside the direct-write
 // updateMany() in revoke.write.ts / revoke-all-others.write.ts /
-// revoke-all-for-user.write.ts (#1559). store_user_sessions itself stays
+// revoke-all-for-user.write.ts. store_user_sessions itself stays
 // an unmanaged direct-write store (see feature.ts) — the row columns are
 // the audit trail, this event is NOT a CRUD/lifecycle event for that
 // table and carries no projection. Its only job is to give cross-instance
-// consumers (access-invalidation, #1560) something to LISTEN for via the
+// consumers (access-invalidation) something to LISTEN for via the
 // existing event-store NOTIFY, keyed by the affected userId.
 //
 // _SHORT/_QN pair mirrors cap-counter's rolling-incremented event:

package/packages/bundled-features/src/shared/assert-no-where-rule-in-ownership-write.ts

@@ -1,6 +1,6 @@
 import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
 
-// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// Boot validation rejects `{ kind: "where" }` in access.write too;
 // failing at factory time names the option instead of an entity scope.
 export function assertNoWhereRuleInOwnershipWrite(
   factoryName: string,

package/packages/bundled-features/src/shared/decrypt-stored-pii.ts

@@ -2,13 +2,14 @@ import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
+  PII_ERASED_SENTINEL,
 } from "@cosmicdrift/kumiko-framework/crypto";
 
 // Raw reads (fetchOne/selectMany) return the stored column value — with an
 // active KMS that is ciphertext (self-describing: it names its own subject,
 // so no entity/field context is needed for key selection). `field` must
 // still match the field name used at encrypt time — it is part of the
-// AAD (#1263), so a mismatch fails decrypt loud rather than silently
+// AAD, so a mismatch fails decrypt loud rather than silently
 // letting ciphertext cut-and-pasted from another field decrypt. An erased
 // subject yields the sentinel, which matches no real value.
 export async function decryptStoredPii(
@@ -24,3 +25,12 @@ export async function decryptStoredPii(
   const decrypted = out[field];
   return typeof decrypted === "string" ? decrypted : value;
 }
+
+// Null for an erased subject: the sentinel must never be mailed or shown as an address.
+export async function decryptStoredUserEmail(
+  stored: string,
+  fallbackRequestId: string,
+): Promise<string | null> {
+  const email = await decryptStoredPii(stored, "email", fallbackRequestId);
+  return email === PII_ERASED_SENTINEL ? null : email;
+}

package/packages/bundled-features/src/shared/encrypt-for-direct-write.ts

@@ -11,7 +11,7 @@ import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
 // go through this instead, and the feature declares { piiEncryptedOnWrite:
-// true } at the registration site (enforced by the registry, #820).
+// true } at the registration site (enforced by the registry).
 export async function encryptForDirectWrite(
   entity: EntityDefinition,
   entityName: string,

package/packages/bundled-features/src/shared/index.ts

@@ -15,7 +15,7 @@ export {
   classifyStoredEnvelope,
   type StoredEnvelopeClassification,
 } from "./classify-stored-envelope.ts";
-export { decryptStoredPii } from "./decrypt-stored-pii.ts";
+export { decryptStoredPii, decryptStoredUserEmail } from "./decrypt-stored-pii.ts";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
 export { entitiesOf } from "./entities-of.ts";
 export { isWithinGracePeriod } from "./grace-period.ts";

package/packages/bundled-features/src/shared/mail-template-body.ts

@@ -11,8 +11,14 @@ export function mailTextWithSlotsHtml(text: string): string {
   );
 }
 
-export function mailParagraph(text: string): string {
-  return `<p>${mailTextWithSlotsHtml(text)}</p>`;
+type MailParagraphOptions = { readonly showIf?: string };
+
+function paragraphOpenTag(options: MailParagraphOptions | undefined): string {
+  return options?.showIf === undefined ? "<p>" : `<p data-if="${escapeHtmlAttr(options.showIf)}">`;
+}
+
+export function mailParagraph(text: string, options?: MailParagraphOptions): string {
+  return `${paragraphOpenTag(options)}${mailTextWithSlotsHtml(text)}</p>`;
 }
 
 export function mailHeading(text: string): string {
@@ -27,8 +33,9 @@ export function mailParagraphWithLink(
   text: string,
   linkLabel: string,
   linkVariable: string,
+  options?: MailParagraphOptions,
 ): string {
-  return `<p>${mailTextWithSlotsHtml(text)} <a href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(linkLabel)}</a></p>`;
+  return `${paragraphOpenTag(options)}${mailTextWithSlotsHtml(text)} <a href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(linkLabel)}</a></p>`;
 }
 
 // One table row per list entry; the cell shows the entry's `field`.

package/packages/bundled-features/src/shared/map-with-concurrency.ts

@@ -16,17 +16,18 @@ export async function mapWithConcurrency<T, R>(
   fn: (item: T, index: number) => Promise<R>,
 ): Promise<R[]> {
   const results: R[] = new Array(items.length);
-  let nextIndex = 0;
+  const unclaimed = items.entries();
   let failed = false;
   async function worker(): Promise<void> {
     for (;;) {
       // skip: another worker already failed — stop claiming new items.
       if (failed) return;
-      const index = nextIndex++;
+      const claimed = unclaimed.next();
       // skip: cursor exhausted, normal worker-loop exit
-      if (index >= items.length) return;
+      if (claimed.done) return;
+      const [index, item] = claimed.value;
       try {
-        results[index] = await fn(items[index] as T, index);
+        results[index] = await fn(item, index);
       } catch (err) {
         failed = true;
         throw err;

package/packages/bundled-features/src/shared/parent-visibility.ts

@@ -91,7 +91,7 @@ export async function hostRowIsGone(
   return row === undefined || row["isDeleted"] === true;
 }
 
-// Write-path half of the parentRef gate (fw#2766). Resolves the join entity's
+// Write-path half of the parentRef gate. Resolves the join entity's
 // own `parentRef` declaration from the registry — the same object the read
 // path's SQL gate reads — so the field names and the allowedTypes allowlist
 // exist in exactly one place instead of once per path.
@@ -104,7 +104,7 @@ export async function joinRowParentIsVisible(
 ): Promise<boolean> {
   const parentRef = registry.getEntity(joinEntityName)?.parentRef;
   // A mount whose join entity lost its declaration can't derive a gate —
-  // deny rather than silently fall back to the pre-#2766 open behaviour.
+  // deny rather than silently fall back to the open behaviour.
   if (parentRef === undefined) return false;
 
   const entityType = payload[parentRef.entityTypeField];

package/packages/bundled-features/src/shared/password-hashing.ts

@@ -43,7 +43,7 @@ export async function verifyPassword(hashString: string, password: string): Prom
   }
 }
 
-// Anti-enumeration timing equaliser (#774). The login handler runs this on
+// Anti-enumeration timing equaliser. The login handler runs this on
 // the no-user / no-hash path so a missing account costs the same argon2
 // latency as a real verify — otherwise response timing leaks whether an
 // email is registered. Derived from hashPassword once and cached, so it

package/packages/bundled-features/src/shared/signup-handover.ts

@@ -1,5 +1,4 @@
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): signup-request runs in whichever browser the activation
+// Cross-device try-first handover: signup-request runs in whichever browser the activation
 // link ends up opened in, which may not be the one holding the anonymous
 // visitor's tenant-handover grant. This extension point lets
 // auth-email-password bind a verified grant to the signup token server-side

package/packages/bundled-features/src/shared/single-use-token-store.ts

@@ -25,7 +25,7 @@
 //
 // Every key is derived from sha256(token), never the raw token — Redis key
 // names, MONITOR output, replica traffic, and memory/backup dumps never
-// carry the bearer secret in the clear (#2174). The by-subject entry stores
+// carry the bearer secret in the clear. The by-subject entry stores
 // the *hash* of the live token, not the token itself, so it can only be
 // used to invalidate (delete the matching forward entry) — never to
 // recover or resend the original token. A resend therefore always mints a

package/packages/bundled-features/src/step-dispatcher/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Deliver job validates its payload at the trigger",
+    "detail": "The deliver job now declares its payload schema, so a manual trigger with an invalid payload is rejected up front instead of throwing inside the handler and consuming all retries."
+  },
   {
     "version": "0.365.1",
     "type": "fix",

package/packages/bundled-features/src/step-dispatcher/feature.ts

@@ -75,6 +75,7 @@ export function createStepDispatcherFeature(): FeatureDefinition {
         retries: DELIVER_RETRIES,
         backoff: "exponential",
         maxPerTenant: { limit: DELIVER_MAX_PER_TENANT, onLimit: "defer" },
+        schema: deliverJobPayloadSchema,
         escapeHatch: { reason: DELIVER_ESCAPE_HATCH_REASON },
       },
       async (payload, ctx) => {

package/packages/bundled-features/src/subscription-dodo/changes.json

@@ -0,0 +1,14 @@
+[
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "New subscription provider for Dodo Payments",
+    "detail": "createSubscriptionDodoFeature() registers the \"dodo\" subscription provider (Merchant of Record). It verifies Standard Webhooks signatures, maps Dodo events to the foundation events, creates hosted checkouts and portal sessions, and switches plans in the app through previewPlanSwitch and applyPlanSwitch. Config keys are api-key, webhook-secret, billing-live and environment. Plan switches need a Product Collection in Dodo."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "dodoEnvSchema declares the Dodo product id slots",
+    "detail": "dodoEnvSchema({ prices: [\"PRO\"] }) adds one optional DODO_PRODUCT_PRO slot per plan next to the API key and webhook key, and checks the pdt_ prefix. It is the counterpart to stripeEnvSchema."
+  }
+]

package/packages/bundled-features/src/subscription-dodo/client.ts

@@ -0,0 +1,45 @@
+// Thin JSON-over-fetch client for the Dodo Payments REST API. All traffic goes
+// through the injected `send`, which defaults to the SSRF-safe egress in
+// feature.ts and is replaced by a mock in tests.
+
+import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+
+export type DodoSend = (url: string, init?: RequestInit) => Promise<Response>;
+
+export type DodoRequest = {
+  readonly method: "GET" | "POST" | "PATCH";
+  /** Path segments interpolated into it must already be encodeURIComponent'ed. */
+  readonly path: string;
+  readonly query?: Readonly<Record<string, string>>;
+  readonly body?: unknown;
+};
+
+export type DodoTarget = { readonly baseUrl: string; readonly apiKey: string };
+
+// Never carries the response body or the key: both can hold customer data or secrets.
+export class DodoHttpError extends Error {
+  readonly status: number;
+  constructor(request: DodoRequest, status: number) {
+    super(`subscription-dodo: ${request.method} ${request.path} failed with status ${status}`);
+    this.name = "DodoHttpError";
+    this.status = status;
+  }
+}
+
+export function createDodoHttp(send: DodoSend) {
+  return async (target: DodoTarget, request: DodoRequest): Promise<unknown> => {
+    const query = request.query ? `?${new URLSearchParams(request.query).toString()}` : "";
+    const response = await send(`${target.baseUrl}${request.path}${query}`, {
+      method: request.method,
+      headers: {
+        Authorization: `Bearer ${target.apiKey}`,
+        Accept: "application/json",
+        ...(request.body !== undefined && { "Content-Type": "application/json" }),
+      },
+      ...(request.body !== undefined && { body: JSON.stringify(request.body) }),
+    });
+    if (!response.ok) throw new DodoHttpError(request, response.status);
+    const text = await response.text();
+    return text.length === 0 ? null : parseJsonOrThrow<unknown>(text, "subscription-dodo response");
+  };
+}

package/packages/bundled-features/src/subscription-dodo/constants.ts

@@ -0,0 +1,24 @@
+export const SUBSCRIPTION_DODO_FEATURE = "subscription-dodo" as const;
+
+// Must match the path segment in the webhook URL `/api/subscription/webhook/dodo`.
+export const DODO_PROVIDER_NAME = "dodo" as const;
+
+// Config-key short-names, qualified to `subscription-dodo:config:<name>` at
+// registry-build. api-key + webhook-secret are backing:"secrets".
+export const DODO_API_KEY_CONFIG = "api-key" as const;
+export const DODO_WEBHOOK_SECRET_CONFIG = "webhook-secret" as const;
+export const DODO_BILLING_LIVE_CONFIG = "billingLive" as const;
+export const DODO_ENVIRONMENT_CONFIG = "environment" as const;
+
+// Separate from billingLive on purpose: staging runs Dodo's test API with
+// billingLive on, production flips both.
+export const DodoEnvironments = {
+  test: "test",
+  live: "live",
+} as const;
+export type DodoEnvironment = (typeof DodoEnvironments)[keyof typeof DodoEnvironments];
+
+export const DODO_BASE_URLS: Readonly<Record<DodoEnvironment, string>> = {
+  test: "https://test.dodopayments.com",
+  live: "https://live.dodopayments.com",
+};