@profullstack/builtindie 0.1.4 → 0.7.1

package/OpenStack.md

@@ -48,7 +48,7 @@ Launch your indie product with one URL: we read the homepage and the LogicSRC fi
 
 ## Services
 
-- CoinPay: crypto payments for Featured
+- CoinPay: hosted checkout sessions for Featured (any coin or PayPal)
 - Resend: sign-in links
 - crawlproof: analytics and ads
 - Headless Chrome: homepage screenshots, run as nobody

package/README.md

@@ -14,9 +14,24 @@ Paste a URL and built.indie reads the homepage the way a careful person would: t
 
 Then it goes on today's board. People upvote (one per visitor). The board resets at midnight UTC; yesterday's winners get "#1 Product of the day" on their page and badge.
 
-**Free to launch, no account.** Anyone can launch any site. To edit a listing, sign in (an emailed link) and **claim** it by adding a DNS TXT record, `_built-indie.<domain>` → `built-indie-verify=<token>`. A signed-in submitter can edit until the owner claims it.
+**Free to launch, no account.** Anyone can launch any site. To edit a listing, sign in (an emailed link) and **claim** it. The easy way is the badge: put `<img src="https://built.indie.pit.world/images.svg?id=<id>">` on the homepage, where the id is unique to that listing and your account (the claim page, `claim.md`, the API and the CLI hand you the full snippet). Finding it claims the listing for you and earns the followed link and the ✓ in one step. Or add a DNS TXT record, `_built-indie.<domain>` → `built-indie-verify=<token>`. (Badges placed earlier as `/badge/<slug>.svg?claim=<token>` still claim.) A signed-in submitter can edit until the owner claims it.
 
-Viral bits: a live badge with the upvote count (`/badge/<slug>.svg`) that turns a link back into a followed link and a ✓ once we see it on the homepage, share buttons, an OG card per product, RSS, and an optional crypto-paid **Featured** slot (CoinPay).
+Viral bits: a live badge with the upvote count (`/badge/<slug>.svg`) that turns a link back into a followed link and a ✓ once we see it on the homepage, share buttons, an OG card per product, RSS, and an optional paid **Featured** slot: CoinPay's hosted checkout, where the buyer picks any coin or PayPal.
+
+**Tags.** Every listing is tagged with what its homepage declares (opensite.json `tags`/`keywords`, `<meta name="keywords">`, `article:tag`, JSON-LD `keywords`, `applicationCategory` and `genre`, manifest `categories`). A site that declares none gets up to four topics read from its own name, tagline and description (`src/tags.ts`), and listings launched before that are backfilled on start. Owners edit them on the listing. Browse at `/tags` and `/t/<tag>`; `GET /api/v1/tags`, `GET /api/v1/products?tag=<tag>`, `builtindie tags [tag]`, MCP `list_tags` and `tagged`.
+
+**Invite program.** Every account has an invite link, `/i/<code>` (on `/invite`, `/me`, `builtindie invite`, `GET /api/v1/invites`, MCP `my_invites`). When a new member who signed up through it gets their first listing live, the inviter earns a credit: a free **Featured** week (the same slot that costs $19 in crypto). Spend it on any listing you own from `/invite`, the listing's page, `builtindie credit <slug>`, `POST /api/v1/products/<slug>/credit` or MCP `feature_with_credit`. Once per new member, never yourself; the code rides in the magic link, so it counts when the mail opens in another browser; an admin takedown of the listing takes back an unspent credit. The inviter gets an email when a credit lands.
+
+**Credit codes and invite codes (0.7.0).** A credit code (`CR-XXXX-XXXX-XXXX-XXXX`, [@profullstack/redeem-credits](https://www.npmjs.com/package/@profullstack/redeem-credits), unit `featured_days`) adds Featured days to a member's balance: "Have a code?" on `/me`, `POST /api/v1/redeem`, `builtindie redeem <code>`, MCP `redeem_code`. The days go on any live listing you own through the same `featured_until` a paid week extends (`/me`, the listing's Feature card, `POST /api/v1/products/<slug>/feature-days {"days":n}`, `builtindie feature-days <slug> <n>`, MCP `feature_with_days`). Every member also has **3 single-use invite codes** ([@profullstack/affiliates](https://www.npmjs.com/package/@profullstack/affiliates)) on `/invite#codes`, `POST /api/v1/invites`, `builtindie invite-code`, MCP `create_invite`: someone new who signs up through `/i/INV-…` gives both people **2 Featured days**, and the sign-up counts once in the invite program above (same `invites` row). `?ref=<your invite code>` on any page is your invite link too (the same `bi_ref` cookie, first touch). Mint codes on the server:
+
+```sh
+cd /opt/built.indie && /root/.bun/bin/bun $(readlink -f node_modules/.bin/redeem-credits) mint \
+  --db /root/.local/share/built-indie/built-indie.db --unit featured_days --amount 7 --label "for Ada"
+```
+
+**Leaderboard.** `/leaderboard` ranks the top inviters (week, month, all time) with badges, on [@profullstack/leaderboard](https://github.com/profullstack/leaderboard). It projects the `invites` table, so there is no second ledger; badges live in the `lb_` tables of the same database. The package also serves `/leaderboard.json`, `/leaderboard/invites.json|.xml`, a share card per member at `/leaderboard/u/<id>`, and a widget any site can embed (`/leaderboard/embed.js`). Members appear by the name they set on `/invite`, else as "Maker of <their best listing>"; never by email.
+
+**Browse and search.** A search box in the header of every page (press `/`; it suggests launches as you type) opens `/search`: a facet rail in the style of [r4ck.dev](https://r4ck.dev) with counts for category, tags, when it launched, what it has (✓ verified, claimed, video, llms.txt, OpenSite/OpenProfile/OpenStack/OpenSaaS), what it is built with (OpenStack.md) and maker, plus sort and active-filter chips. Values in one facet are OR'd, facets are AND'd, and each facet counts as if only it changed. Tags are what the page or the maker said; categories are a fixed set of twenty-one read from a listing's tags, name, tagline and description (`src/browse.ts`), so every launch is filed even with no tags. `/c/<category>` and `/t/<tag>` are indexable pages for one filter; the same query is `GET /api/v1/search` (products + facets), `GET /api/v1/categories`, `builtindie search … --category ai --has verified --facets`, and the MCP `search` / `list_categories` tools.
 
 Every product is published back as an OpenSite record (`/p/<slug>/opensite.json`) and an OpenProfile (`/p/<slug>/openprofile.md`); makers are OpenProfiles too (`/makers/<id>/openprofile.md`). Icons are the [OpenIcon](https://github.com/profullstack/openicon) reference set.
 
@@ -28,11 +43,17 @@ curl -fsSL https://built.indie.pit.world/install.sh | sh
 builtindie                       # TUI: today's board, ←/→ boards, v upvote, l launch
 builtindie launch yourproduct.com
 builtindie top week
+builtindie search crm --category ai --has verified   # filters, as on /search
 builtindie show linear
 builtindie vote linear
 builtindie preview any.site --json
-BUILTINDIE_KEY=bi_… builtindie claim linear   # prints the TXT record, then checks it
+BUILTINDIE_KEY=bi_… builtindie claim linear   # prints your badge and the TXT record, then checks them
 BUILTINDIE_KEY=bi_… builtindie edit linear --tagline "…"
+BUILTINDIE_KEY=bi_… builtindie invite          # your invite link and free Featured credits
+BUILTINDIE_KEY=bi_… builtindie credit linear   # spend one: Featured for a week
+BUILTINDIE_KEY=bi_… builtindie redeem CR-…      # a credit code: Featured days
+BUILTINDIE_KEY=bi_… builtindie invite-code     # one of your 3 single-use invites
+BUILTINDIE_KEY=bi_… builtindie feature linear  # or pay: a CoinPay checkout link (any coin or PayPal)
 
 claude mcp add builtindie -- bunx @profullstack/builtindie mcp
 ```
@@ -54,7 +75,7 @@ bun test
 | `BUILTINDIE_DATA` | where the database and pictures live (default ~/.local/share/built-indie) |
 | `BUILTINDIE_ADMIN_KEY` | bearer that may take a listing down |
 | `RESEND_API_KEY`, `MAIL_FROM` | sign-in mail; without them the link is logged |
-| `COINPAY_API_KEY`, `COINPAY_BUSINESS_ID`, `COINPAY_WEBHOOK_SECRET` | Featured payments |
+| `COINPAY_API_KEY`, `COINPAY_BUSINESS_ID`, `COINPAY_WEBHOOK_SECRET` | Featured payments: a CoinPay hosted checkout session per purchase, settled by the signed webhook at `/hooks/coinpay` |
 | `FEATURE_USD`, `FEATURE_DAYS` | price and length of Featured (19, 7) |
 | `BUILTINDIE_CHROME` | Chrome path, or `off`; `BUILTINDIE_SCREENSHOTS=off` skips screenshots |
 | `CRAWLPROOF_SITE`, `CRAWLPROOF_AD_SLOT` | analytics and ads; `off` turns either off |
@@ -62,3 +83,11 @@ bun test
 Production runs on dev2 under `bin/install.sh` (OpenInstall); every merge to main deploys. See `OpenStack.md`.
 
 MIT. Part of the [Moshpit ring](https://pit.world/ring).
+
+## Karma (0.6.0)
+
+Signed-in members earn karma for launching (+10), upvoting (+1, 20 a day), reviewing (+5, stars and 30+ characters), commenting (+2, 10 a day), sharing (+1, 5 a day), claiming (+5), a verified badge (+5) and an invited maker who launches (+25); listing owners get +1 per upvote and +2 per review from members. Acting on your own listing earns nothing; admin imports earn nothing. Every 500 karma (`KARMA_PER_CREDIT`) grants a free Featured week, spent like an invite credit. The ledger is append-only (`karma_events`, dedupe key per fact; reversals are negative rows). `/leaderboard` shows the karma board (default) and the inviters board; `GET /api/v1/karma`, `GET /api/v1/leaderboard?board=karma&period=week`; CLI `karma`, `leaderboard`, `comment`, `review`; MCP `my_karma`, `leaderboard`, `comment`, `review`. Same rules as pwamart.com.
+
+## Sign in with CoinPay
+
+Set `COINPAY_OAUTH_CLIENT_ID` and `COINPAY_OAUTH_CLIENT_SECRET` (an OAuth client at coinpayportal.com with redirect `<origin>/api/v1/coinpay/callback`) and /login and /me show "Sign in with CoinPay" (OIDC, code + PKCE S256). Accounts link by CoinPay `sub` in `user_identities`, never by email.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/builtindie",
-  "version": "0.1.4",
+  "version": "0.7.1",
   "description": "built.indie: launch your indie product with one URL. We fetch the logo, screenshots, videos, llms.txt, OpenSite and OpenProfile from your homepage; people upvote; you get a badge. Web (PWA), API, CLI, TUI and MCP.",
   "license": "MIT",
   "type": "module",
@@ -23,15 +23,24 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.17.0",
-    "@profullstack/coinpay-onboard": "^0.1.1",
-    "@profullstack/hqtui": "^0.10.3",
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "@profullstack/affiliates": "0.1.0",
+    "@profullstack/coinpay-onboard": "0.2.0",
+    "@profullstack/footer": "latest",
+    "@profullstack/hqtui": "^0.11.1",
+    "@profullstack/leaderboard": "^0.3.1",
     "@profullstack/openprofile": "^0.2.0",
-    "hono": "^4.13.13",
-    "zod": "^3.25.0"
+    "@profullstack/profile": "0.1.6",
+    "@profullstack/redeem-credits": "0.1.0",
+    "@profullstack/stack": "0.5.0",
+    "hono": "^4.13.14",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@types/bun": "^1.4.3",
+    "@types/bun": "^1.4.4",
     "typescript": "^7.0.2"
+  },
+  "overrides": {
+    "zod": "^4.6.7"
   }
 }

package/public/app.js

@@ -1,4 +1,12 @@
 // built.indie: vote without a page load, copy buttons, progress while we read a site, the service worker.
+// A share button: tell the server before the share window opens (a signed-in member earns karma).
+document.addEventListener('click', (e) => {
+  const btn = e.target.closest('[data-share]')
+  const slug = btn?.closest('[data-share-slug]')?.dataset.shareSlug
+  if (!btn || !slug) return
+  const url = '/p/' + encodeURIComponent(slug) + '/share?net=' + encodeURIComponent(btn.dataset.share)
+  if (!(navigator.sendBeacon && navigator.sendBeacon(url))) fetch(url, { method: 'POST', keepalive: true }).catch(() => {})
+}, true)
 document.addEventListener('click', async (e) => {
   const copy = e.target.closest('[data-copy]')
   if (copy) {
@@ -32,4 +40,54 @@ document.addEventListener('submit', (e) => {
   note.textContent = form.dataset.busy
   form.append(note)
 })
+// Search, on every page: "/" jumps to it; typing suggests launches (Enter still opens the full results).
+const box = document.querySelector('[data-suggest]')
+if (box) {
+  const input = box.querySelector('input')
+  const list = box.querySelector('.suggest')
+  let timer, seq = 0
+  const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`)
+  const items = () => [...list.querySelectorAll('a')]
+  const close = () => { list.hidden = true; input.removeAttribute('aria-activedescendant') }
+  document.addEventListener('keydown', (e) => {
+    if (e.key !== '/' || e.metaKey || e.ctrlKey || e.altKey || /^(INPUT|TEXTAREA|SELECT)$/.test(document.activeElement?.tagName) || document.activeElement?.isContentEditable) return
+    e.preventDefault()
+    input.focus()
+    input.select()
+  })
+  input.addEventListener('input', () => {
+    clearTimeout(timer)
+    const q = input.value.trim()
+    if (q.length < 2) return close()
+    timer = setTimeout(async () => {
+      const mine = ++seq
+      try {
+        const r = await (await fetch('/api/v1/search?facets=0&limit=6&q=' + encodeURIComponent(q), { headers: { accept: 'application/json' } })).json()
+        if (mine !== seq) return
+        list.innerHTML = r.products.map((p) => `<a href="/p/${esc(p.slug)}" role="option">${p.logo ? `<img src="${esc(p.logo)}" alt="">` : `<b class="logo logo-letter">${esc(p.name.slice(0, 1).toUpperCase())}</b>`}<span><b>${esc(p.name)}</b><small>${esc(p.tagline || p.domain)}</small></span></a>`).join('') + `<a class="all" href="/search?q=${encodeURIComponent(q)}" role="option">${r.total ? `All ${r.total} result${r.total === 1 ? '' : 's'} for “${esc(q)}” →` : `No launches match “${esc(q)}”. Browse everything →`}</a>`
+        list.hidden = false
+      } catch {}
+    }, 140)
+  })
+  input.addEventListener('keydown', (e) => {
+    const all = items()
+    if (list.hidden || !all.length) return
+    const at = all.findIndex((a) => a.getAttribute('aria-selected') === 'true')
+    if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+      e.preventDefault()
+      const step = e.key === 'ArrowDown' ? 1 : -1
+      const next = all[at < 0 ? (step > 0 ? 0 : all.length - 1) : (at + step + all.length) % all.length]
+      all.forEach((a) => a.removeAttribute('aria-selected'))
+      next.setAttribute('aria-selected', 'true')
+    } else if (e.key === 'Enter' && at >= 0) {
+      e.preventDefault()
+      location.href = all[at].href
+    } else if (e.key === 'Escape') close()
+  })
+  document.addEventListener('click', (e) => { if (!box.contains(e.target)) close() })
+}
+// Browse: sorting applies at once; on a phone the filters start folded behind a button.
+document.querySelectorAll('[data-autosubmit] select').forEach((s) => s.addEventListener('change', () => s.form.submit()))
+const facets = document.querySelector('[data-facets]')
+if (facets && matchMedia('(max-width: 860px)').matches) facets.open = false
 if ('serviceWorker' in navigator) navigator.serviceWorker.register('/sw.js').catch(() => {})

package/public/style.css

@@ -128,16 +128,11 @@ a.tag:hover { color: var(--text); text-decoration: none; }
 .pic img { width: 100%; height: 90px; object-fit: cover; border-radius: 8px; border: 1px solid var(--line); display: block; margin-bottom: .3rem; background: var(--bg); }
 .pic input { width: auto; }
 .payee { text-align: center; padding: 2rem 0 .5rem; }
-.ad-unit { margin: 24px auto; display: flex; justify-content: center; }
-.ad-unit iframe { border: 0; display: block; background: transparent; }
-.ad-text_link { max-width: 820px; padding: 0 16px; }
-.ad-text_link iframe { width: 100%; height: 40px; }
-.ad-banner_300x250 iframe { width: 300px; height: 250px; }
-.ad-banner_728x90 iframe { width: 728px; max-width: 100%; height: 90px; }
-@media (max-width: 760px) { .ad-banner_728x90 { display: none; } }
-@media (max-width: 340px) { .ad-banner_300x250 { margin-inline: calc(50% - 50vw); } }
-footer { max-width: 820px; margin: 2rem auto 0; padding: 1.5rem 16px 2.5rem; border-top: 1px solid var(--line); color: var(--muted); font-size: .88rem; display: flex; gap: 1rem; flex-wrap: wrap; justify-content: space-between; }
-footer a { color: var(--muted); }
+.ad-unit { max-width: 820px; margin: 10px auto; padding: 0 16px; }
+.ad-unit iframe { border: 0; display: block; background: transparent; width: 100%; height: 40px; }
+/* @profullstack/footer (src/ring-footer.ts) on one wrapping row: links, ring nav, copyright. */
+footer.pfs-footer { margin-top: 2rem; border-top: 1px solid var(--line); color: var(--muted); font-size: .88rem; }
+footer.pfs-footer .pfs-footer__inner { max-width: 820px; padding: 1rem 16px; flex-direction: row; flex-wrap: wrap; justify-content: center; gap: .5rem 1.25rem; }
 @media (max-width: 560px) {
   .url-row { flex-direction: column; }
   .gallery img { height: 190px; }
@@ -152,7 +147,8 @@ footer a { color: var(--muted); }
 .ring-bar .ring-home { color: var(--accent); font-weight: 700; }
 .ring-bar .ring-sites { display: inline-flex; gap: 12px; padding: 0 12px; border-left: 1px solid var(--line); border-right: 1px solid var(--line); }
 .ring-bar [aria-current='page'] { color: var(--text); }
-@media (max-width: 640px) { .ring-bar .ring-sites, .ring-bar .ring-home span { display: none; } }
+.ring-bar .ring-start { margin-left: auto; color: var(--accent); font-weight: 700; }
+@media (max-width: 640px) { .ring-bar .ring-home span { display: none; } }
 /* OpenIcon icons: inline SVG in currentColor */
 .i { width: 1em; height: 1em; vertical-align: -.125em; flex: none; }
 .chip .i, .btn .i { margin-right: .15em; }
@@ -160,3 +156,109 @@ footer a { color: var(--muted); }
 .mini-h { font-size: .95rem; margin: 1.1rem 0 .4rem; display: flex; gap: .4rem; align-items: center; }
 .stack p { margin: .25rem 0; }
 .plans { list-style: none; padding: 0; margin: 0; display: grid; gap: .25rem; }
+.invite-promo { display: grid; grid-template-columns: 1.2fr 1fr; gap: 1.2rem; align-items: start; border-color: var(--accent); }
+.invite-promo h2 { font-size: 1.2rem; }
+.invite-promo .row { margin-bottom: 0; }
+@media (max-width: 640px) { .invite-promo { grid-template-columns: 1fr; } }
+.invite-promo .mini-h { margin: 0 0 .4rem; color: var(--muted); font-weight: 600; }
+.inviters .row-item { padding: .45rem .3rem; }
+.stats { text-align: center; }
+.stats div { display: flex; flex-direction: column; background: var(--bg); border: 1px solid var(--line); border-radius: 10px; padding: .7rem; }
+.stats b { font-size: 1.6rem; }
+/* @profullstack/leaderboard widget, in our colours (it injects its own CSS at runtime, hence the specificity). */
+:root { --bi-panel: var(--panel); --bi-text: var(--text); --bi-muted: var(--muted); --bi-line: var(--line); --bi-accent: var(--accent); --bi-gold: var(--gold); }
+.card .pflb.pflb { --bg: var(--bi-panel); --fg: var(--bi-text); --muted: var(--bi-muted); --line: var(--bi-line); --accent: var(--bi-accent); --gold: var(--bi-gold); --hi: color-mix(in srgb, var(--bi-accent) 12%, var(--bi-panel)); }
+.tag-cloud { display: flex; flex-wrap: wrap; gap: .5rem; line-height: 1.6; }
+/* search, on every page (header), and browse (/search, /c/<category>, /t/<tag>) */
+.top.wide, main.wide { max-width: 1120px; }
+.top-search { position: relative; flex: 1 1 220px; max-width: 380px; margin: 0; }
+.top-search input { width: 100%; padding: .45rem 2rem .45rem .8rem; border-radius: 999px; font-size: .92rem; margin: 0; }
+.top-search kbd { position: absolute; right: .6rem; top: 50%; transform: translateY(-50%); font: .72rem ui-monospace, monospace; color: var(--muted); border: 1px solid var(--line); border-radius: 4px; padding: 0 .3rem; pointer-events: none; }
+.top-search input:focus + kbd, .top-search input:not(:placeholder-shown) + kbd { display: none; }
+.suggest { position: absolute; z-index: 20; top: calc(100% + 6px); left: 0; right: 0; min-width: 280px; background: var(--panel); border: 1px solid var(--line); border-radius: 12px; box-shadow: 0 12px 32px #0006; padding: .3rem; }
+.suggest a { display: flex; align-items: center; gap: .6rem; padding: .45rem .55rem; border-radius: 8px; color: var(--text); }
+.suggest a:hover, .suggest a[aria-selected="true"] { background: var(--line); text-decoration: none; }
+.suggest img, .suggest .logo-letter { width: 28px; height: 28px; border-radius: 7px; flex: none; font-size: .85rem; }
+.suggest span { min-width: 0; display: flex; flex-direction: column; line-height: 1.3; }
+.suggest small { color: var(--muted); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.suggest .all { border-top: 1px solid var(--line); border-radius: 0 0 8px 8px; margin-top: .2rem; color: var(--accent); font-size: .88rem; }
+@media (max-width: 640px) { .top-search { order: 3; flex-basis: 100%; max-width: none; } .top-search kbd { display: none; } }
+.tag.cat { background: color-mix(in srgb, var(--accent) 16%, transparent); color: var(--text); }
+.browse { display: grid; grid-template-columns: 250px 1fr; gap: 1.5rem; align-items: start; }
+.facets { position: sticky; top: 1rem; max-height: calc(100vh - 2rem); overflow-y: auto; scrollbar-width: thin; }
+.facets > summary.facets-toggle { display: none; }
+.facet-rail { display: grid; gap: .5rem; }
+.facet-group { border: 1px solid var(--line); border-radius: 10px; background: var(--panel); }
+.facet-group summary { margin: 0; padding: .55rem .8rem; font-size: .78rem; text-transform: uppercase; letter-spacing: .07em; color: var(--muted); list-style: none; display: flex; align-items: center; gap: .4rem; }
+.facet-group summary::-webkit-details-marker { display: none; }
+.facet-group summary::after { content: "+"; margin-left: auto; font-family: ui-monospace, monospace; }
+.facet-group[open] summary::after { content: "−"; }
+.facet-group ul { list-style: none; margin: 0; padding: 0 .35rem .4rem; max-height: 340px; overflow-y: auto; }
+.facet-item { display: grid; grid-template-columns: 1rem 1fr auto; gap: .5rem; align-items: center; padding: .3rem .45rem; border-radius: 6px; color: var(--muted); font-size: .9rem; }
+.facet-item:hover { background: var(--line); color: var(--text); text-decoration: none; }
+.facet-check { width: .9rem; height: .9rem; border: 1.5px solid var(--muted); border-radius: 4px; }
+.facet-check.radio { border-radius: 50%; }
+.facet-item.on { color: var(--text); font-weight: 600; }
+.facet-item.on .facet-check { background: var(--accent); border-color: var(--accent); box-shadow: inset 0 0 0 2px var(--panel); }
+.facet-label { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.facet-count { font: .74rem ui-monospace, monospace; color: var(--muted); }
+.facet-n { background: var(--accent); color: var(--accent-ink); border-radius: 999px; padding: 0 .45rem; font-size: .72rem; letter-spacing: 0; }
+.results { min-width: 0; }
+.results-head { display: flex; justify-content: space-between; align-items: flex-end; gap: 1rem; flex-wrap: wrap; }
+.results-head .page-h { margin-bottom: .1rem; }
+.results-head p { margin: 0; }
+.sort-form { margin: 0; }
+.sort-form select { margin: 0; width: auto; padding: .4rem .6rem; }
+.chips { list-style: none; padding: 0; margin: .8rem 0; display: flex; gap: .4rem; flex-wrap: wrap; }
+.chip.on { border-color: var(--accent); }
+.chip.clear { color: var(--muted); }
+.pager { display: flex; justify-content: center; align-items: center; gap: 1rem; margin: 1.2rem 0; }
+@media (max-width: 860px) {
+  .browse { grid-template-columns: 1fr; gap: .5rem; }
+  .facets { position: static; max-height: none; overflow: visible; }
+  .facets > summary.facets-toggle { display: inline-flex; align-items: center; gap: .4rem; margin: .4rem 0; padding: .4rem .9rem; border: 1px solid var(--line); border-radius: 999px; background: var(--panel); font-size: .9rem; list-style: none; }
+  .facets-toggle::-webkit-details-marker { display: none; }
+  .facets[open] > .facets-toggle { border-color: var(--accent); }
+}
+/* Karma, reviews, comments (0.6.0). */
+.karma-promo { border-color: var(--gold); }
+.karma { font-size: .78rem; color: var(--gold); font-variant-numeric: tabular-nums; white-space: nowrap; }
+.karma-total { color: var(--gold); font-variant-numeric: tabular-nums; }
+.stars-mini { color: var(--gold); font-size: .78rem; margin-inline-end: .35rem; white-space: nowrap; }
+.stars { color: var(--gold); letter-spacing: .05em; }
+.stars .off { color: var(--line); }
+.discuss { margin-block: 1rem; }
+.thread { list-style: none; padding: 0; margin: 0 0 .8rem; display: grid; gap: .7rem; }
+.thread.replies { margin: .5rem 0 0; padding-inline-start: 1rem; border-inline-start: 2px solid var(--line); }
+.post header { display: flex; flex-wrap: wrap; align-items: baseline; gap: .4rem; }
+.post .body { overflow-wrap: anywhere; }
+.post .body p { margin: .25rem 0; }
+.post.deleted { opacity: .7; }
+.reply summary { cursor: pointer; color: var(--muted); }
+.comment-form, .review-form { display: grid; gap: .5rem; margin-top: .6rem; }
+.comment-form textarea, .review-form textarea { field-sizing: content; min-block-size: 3lh; }
+.comment-form button { justify-self: start; }
+/* Stars as radio buttons, highest first in the DOM so :checked ~ fills the lower ones (row-reverse puts 1 on the left). */
+.rate { border: 0; padding: 0; margin: 0; display: inline-flex; flex-direction: row-reverse; justify-content: flex-end; gap: .1rem; }
+.rate legend { float: inline-start; inline-size: 100%; font-size: .9rem; color: var(--muted); margin-bottom: .2rem; }
+.rate input { position: absolute; opacity: 0; inline-size: 1px; block-size: 1px; }
+.rate label { font-size: 1.6rem; line-height: 1; cursor: pointer; color: var(--line); transition: color .12s, scale .12s; }
+.rate input:checked ~ label, .rate label:hover, .rate label:hover ~ label { color: var(--gold); }
+.rate input:focus-visible + label { outline: 2px solid var(--accent); outline-offset: 2px; border-radius: 4px; }
+.rate label:hover { scale: 1.15; }
+.progress { block-size: .6rem; border-radius: 999px; background: var(--line); overflow: hidden; margin: .4rem 0 .8rem; }
+.progress span { display: block; block-size: 100%; background: linear-gradient(90deg, var(--accent), var(--gold)); border-radius: inherit; transition: inline-size .4s; }
+.ledger { list-style: none; padding: 0; margin: 0 0 .8rem; display: grid; gap: .25rem; }
+.ledger .pts { display: inline-block; min-inline-size: 2.6rem; font-weight: 700; color: var(--ok); font-variant-numeric: tabular-nums; }
+.ledger .pts.neg { color: var(--fail); }
+table.earn { inline-size: 100%; border-collapse: collapse; font-size: .92rem; }
+table.earn th, table.earn td { text-align: start; padding: .4rem .5rem; border-bottom: 1px solid var(--line); vertical-align: top; }
+table.earn td.pts { color: var(--gold); font-weight: 700; white-space: nowrap; }
+@media (max-width: 640px) { table.earn td:nth-child(3) { display: block; padding-top: 0; border: 0; } }
+.or { text-align: center; margin: .6rem 0; }
+.coinpay-btn { display: flex; justify-content: center; gap: .4rem; }
+
+/* The shared profile fields (@profullstack/profile renderProfileFields), made to read like the email box beside them. */
+.pfs-profile { border: 0; margin: 0; padding: 0; min-width: 0; }
+.pfs-profile__optional { color: var(--muted); font-weight: 400; }
+.pfs-profile__error { color: var(--fail); font-size: 0.85rem; margin: 0.25rem 0 0; }

package/src/auth.ts

@@ -20,6 +20,8 @@ export type Mailer = (mail: Mail) => Promise<unknown>
 
 export function resendMailer(apiKey: string, from: string, fetchImpl: typeof fetch = fetch): Mailer {
   return async ({ to, subject, text, html }) => {
+    // A CoinPay-only member has a placeholder address (…@coinpay.invalid): there is nobody to mail.
+    if (to.endsWith('.invalid')) return
     const res = await fetchImpl('https://api.resend.com/emails', {
       method: 'POST',
       headers: { authorization: `Bearer ${apiKey}`, 'content-type': 'application/json' },
@@ -48,14 +50,15 @@ export class Auth {
   constructor(private store: Store, private mailer: Mailer, private now = () => Date.now()) {}
 
   /** Always resolves the same way, so nobody learns who has an account. */
-  async sendLink(emailInput: string, next: string | null, base: string): Promise<boolean> {
+  async sendLink(emailInput: string, next: string | null, base: string, ref: string | null = null, profile: object | null = null): Promise<boolean> {
     const email = validEmail(emailInput)
     if (!email) return false
     const db = this.store.db
     const recent = (db.query('SELECT COUNT(*) AS n FROM magic_links WHERE email = ? AND created_at > ?').get(email, this.now() - 15 * 60_000) as { n: number }).n
     if (recent >= 5) return true
     const token = randomBytes(24).toString('base64url')
-    db.query('INSERT INTO magic_links (token_hash, email, next, created_at, expires_at) VALUES (?, ?, ?, ?, ?)').run(hashKey(token), email, safeNext(next), this.now(), this.now() + LINK_MINUTES * 60_000)
+    // The invite code rides in the link, so it counts even when the mail opens in another browser.
+    db.query('INSERT INTO magic_links (token_hash, email, next, ref, created_at, expires_at, profile) VALUES (?, ?, ?, ?, ?, ?, ?)').run(hashKey(token), email, safeNext(next), ref ? String(ref).slice(0, 80) : null, this.now(), this.now() + LINK_MINUTES * 60_000, profile ? JSON.stringify(profile) : null)
     const url = `${base}/auth/verify?token=${token}`
     const text = `Sign in to built.indie:\n\n${url}\n\nThe link works once, for ${LINK_MINUTES} minutes. If you did not ask for it, ignore this email.`
     const html = `<p>Sign in to <strong>built.indie</strong>:</p><p><a href="${url}" style="display:inline-block;padding:10px 18px;background:#ff5c39;color:#fff;border-radius:8px;text-decoration:none;font-weight:700">Sign in</a></p><p style="color:#666;font-size:13px">Or open ${url}<br>The link works once, for ${LINK_MINUTES} minutes. If you did not ask for it, ignore this email.</p>`
@@ -67,14 +70,15 @@ export class Auth {
     return true
   }
 
-  /** One use, then it is gone. Returns the user (made on first sign-in) and where to go. */
-  consumeLink(token: string): { user: User; next: string | null } | null {
+  /** One use, then it is gone. Returns the user (made on first sign-in, `created`), where to go, the invite code it carried, and the signup form's profile fields. */
+  consumeLink(token: string): { user: User; next: string | null; created: boolean; ref: string | null; profile: Record<string, unknown> | null } | null {
     const hash = hashKey(String(token))
     const db = this.store.db
-    const row = db.query('SELECT email, next, expires_at FROM magic_links WHERE token_hash = ?').get(hash) as { email: string; next: string | null; expires_at: number } | null
+    const row = db.query('SELECT email, next, ref, expires_at, profile FROM magic_links WHERE token_hash = ?').get(hash) as { email: string; next: string | null; ref: string | null; expires_at: number; profile: string | null } | null
     db.query('DELETE FROM magic_links WHERE token_hash = ? OR expires_at < ?').run(hash, this.now())
     if (!row || row.expires_at < this.now()) return null
-    return { user: this.store.findOrCreateUser(row.email), next: row.next }
+    const created = !this.store.userByEmail(row.email)
+    return { user: this.store.findOrCreateUser(row.email), next: row.next, created, ref: row.ref, profile: row.profile ? JSON.parse(row.profile) : null }
   }
 
   createSession(userId: string): string {