@profullstack/builtindie 0.1.4 → 0.7.1

package/src/service.ts

@@ -5,22 +5,47 @@
  *   submit   URL in, a listing out: everything fetched, pictures saved. Free.
  *            Anonymous launches go live at once; a signed-in submitter checks a draft first.
  *   publish  the draft goes live on today's board
- *   claim    the domain's owner proves it with a DNS TXT record and takes the listing
+ *   claim    the domain's owner proves it (a DNS TXT record, or the badge with their token) and takes the listing
  *   refetch  read the homepage again (the maker changed their logo)
  *   verify   the maker put our badge on their site: a followed link back
- *   feature  pay in crypto (CoinPay) to sit on top for a week
+ *   feature  pay on CoinPay's hosted checkout (any coin or PayPal) to sit on top for a week
+ *   vote, comment, review, share   what members do on a listing; each pays karma (karma.ts)
+ *   redeem   a credit code (@profullstack/redeem-credits) adds Featured days to a member's balance
+ *   invites  3 single-use invite codes each (@profullstack/affiliates); a new member who
+ *            joins through one gives both of them INVITE_BONUS_DAYS Featured days
  *
  * Products are described in the LogicSRC open specs: each one is an OpenSite
  * record (logicsrc.com/docs/opensite) and an OpenProfile.md with Kind
  * organization (logicsrc.com/docs/openprofile); a maker is an OpenProfile.md
  * of their own, which we read and link to.
  */
-import { createHmac, timingSafeEqual } from 'node:crypto'
+import { createHmac, randomBytes } from 'node:crypto'
 import { Resolver } from 'node:dns/promises'
 import { keyedSection, listSection, makeOpenProfile, renderOpenProfile } from '@profullstack/openprofile'
 import { autofetch, clip, FetchError, normalizeUrl, readProfile, safeFetch, SOCIAL_KINDS, videoFrom, type FetchOptions, type SiteInfo, type Video } from './fetch.js'
 import { Media, screenshot } from './media.js'
-import { dayOf, makerIdFor, newId, Store, type Product, type User } from './db.js'
+import { dayOf, makerIdFor, newId, Store, type Comment, type Product, type Review, type User } from './db.js'
+import { Karma, SHARE_NETWORKS } from './karma.js'
+import { cleanTags } from './tags.js'
+import { validEmail } from './auth.js'
+import { CoinPay, CoinPayError, readWebhook, verifyWebhook } from '@profullstack/coinpay-onboard'
+import { Credits, sqliteStore as creditStore } from '@profullstack/redeem-credits'
+import { Affiliates, sqliteStore as affiliateStore } from '@profullstack/affiliates'
+
+/** The unit a credit code grants: days a listing sits in the Featured slot. */
+export const FEATURED_DAYS = 'featured_days'
+/** Single-use invite codes each member can hand out. Scarce on purpose: an invite should mean something. */
+export const INVITES_PER_PERSON = 3
+/** Featured days both people get when an invite code is used by someone new. */
+export const INVITE_BONUS_DAYS = 2
+/** What a refused credit code means, in words. */
+const REDEEM_REASONS: Record<string, string> = {
+  invalid: 'That code is not valid.',
+  expired: 'That code has expired.',
+  used_up: 'That code has been used.',
+  already_redeemed: 'You already redeemed that code.',
+  revoked: 'That code was withdrawn.',
+}
 
 export class InputError extends Error {
   constructor(message: string, readonly field?: string) {
@@ -28,19 +53,20 @@ export class InputError extends Error {
   }
 }
 
-export type CoinPayConfig = { baseUrl: string; apiKey: string; businessId: string; webhookSecret: string }
+export type CoinPayConfig = { baseUrl: string; apiKey: string; businessId: string; webhookSecret: string; /** Tests pass their own. */ fetch?: typeof fetch }
 export type Config = {
   origin: string
   coinpay: CoinPayConfig | null
   featureUsd: number
   featureDays: number
-  chains: string[]
   fetch?: FetchOptions
   screenshots?: boolean
   /** Secret behind each person's claim token. */
   claimSecret?: string
   /** TXT lookups; tests pass their own. */
   resolveTxt?: (name: string) => Promise<string[][]>
+  /** Karma per free Featured week (KARMA_PER_CREDIT, default 500). */
+  karmaPerCredit?: number
 }
 
 /** The record an owner adds: `_built-indie.<domain> TXT "built-indie-verify=<token>"` (or the same on the domain itself). */
@@ -51,38 +77,89 @@ export const CLAIM_PREFIX = 'built-indie-verify='
  * TXT records as public resolvers see them: every answer from 1.1.1.1 and 9.9.9.9, merged.
  * One Resolver per server on purpose: Bun 1.4's node:dns Resolver given two servers
  * answers ENOTFOUND for a record each of them serves alone, so no claim could succeed.
+ * And fresh Resolvers per lookup: a long-lived one caches NXDOMAIN for the zone's SOA
+ * minimum (often 30 min), so a maker who checks before adding the record stays refused.
  */
-const PUBLIC_DNS = ['1.1.1.1', '9.9.9.9'].map((server) => {
-  const r = new Resolver({ timeout: 4000, tries: 2 })
-  r.setServers([server])
-  return r
-})
-export async function publicTxt(name: string, resolvers: Pick<Resolver, 'resolveTxt'>[] = PUBLIC_DNS): Promise<string[][]> {
+const publicDns = () =>
+  ['1.1.1.1', '9.9.9.9'].map((server) => {
+    const r = new Resolver({ timeout: 4000, tries: 2 })
+    r.setServers([server])
+    return r
+  })
+export async function publicTxt(name: string, resolvers: Pick<Resolver, 'resolveTxt'>[] = publicDns()): Promise<string[][]> {
   const answers = await Promise.all(resolvers.map((r) => r.resolveTxt(name).catch(() => [] as string[][])))
   return answers.flat()
 }
 
-export const CHAIN_LABELS: Record<string, string> = {
-  USDC_POL: 'USDC on Polygon', USDC_SOL: 'USDC on Solana', USDC_ETH: 'USDC on Ethereum', USDT_POL: 'USDT on Polygon',
-  BTC: 'Bitcoin', ETH: 'Ether', SOL: 'Solana', POL: 'Polygon', DOGE: 'Dogecoin', BCH: 'Bitcoin Cash', XRP: 'XRP', ADA: 'Cardano', BNB: 'BNB',
-}
-export const DEFAULT_CHAINS = Object.keys(CHAIN_LABELS)
-export const SETTLED = new Set(['paid', 'completed', 'confirmed', 'forwarded', 'succeeded', 'settled'])
+/** Who is paying for a Featured slot: the email is required by CoinPay; the account is the member id, or the email for a guest. */
+export type Buyer = { email: string; accountId?: string | null }
 
 export type Edit = Partial<{ name: string; tagline: string; description: string; tags: string[] | string; makerName: string; makerProfile: string; videos: string[] | string; socials: Record<string, string>; remove: string[] | string }>
 
 const list = (v: string[] | string | undefined) => (Array.isArray(v) ? v : String(v ?? '').split(/[\n,]+/)).map((s) => s.trim()).filter(Boolean)
 
 export class BuiltIndie {
-  constructor(readonly store: Store, readonly media: Media, readonly config: Config) {}
+  readonly karma: Karma
+  /** Redeemable credit codes: Featured days, in the app's own database (credit_* tables). */
+  readonly credits: Credits
+  /** Scarce invite codes (aff_* tables). The open per-member link stays the app's own invite program. */
+  readonly affiliates: Affiliates
+  constructor(readonly store: Store, readonly media: Media, readonly config: Config) {
+    this.karma = new Karma(store, config.karmaPerCredit ?? 500)
+    this.credits = new Credits(creditStore(store.db as never))
+    this.affiliates = new Affiliates(affiliateStore(store.db as never), { defaultQuota: INVITES_PER_PERSON })
+  }
+
+  /** Featured days this member holds (from credit codes and invite bonuses), not yet spent on a listing. */
+  featuredDays(user: Pick<User, 'id'>): Promise<number> {
+    return this.credits.balance(user.id, FEATURED_DAYS)
+  }
+
+  /** Redeem a credit code for the signed-in member. Returns what it added, in words; a refused code throws. */
+  async redeem(user: Pick<User, 'id'>, code: string): Promise<{ message: string; days: number }> {
+    if (!code.trim()) throw new InputError('Enter a code.', 'code')
+    const r = await this.credits.redeem(code, user.id)
+    if (!r.ok) throw new InputError(REDEEM_REASONS[r.reason] ?? 'That code did not work.', 'code')
+    const g = r.grant
+    const what = g.unit === FEATURED_DAYS ? `${g.amount} Featured day${g.amount === 1 ? '' : 's'}` : `${g.amount} ${g.unit}`
+    const message = g.every === 'month' ? `Added ${what} every month${g.months ? ` for ${g.months} months` : ''}.` : `Added ${what}.`
+    return { message: `${message} Use ${g.amount === 1 ? 'it' : 'them'} on any live listing you own.`, days: await this.featuredDays(user) }
+  }
+
+  /** Spend Featured days from the balance on a live listing: the same featured_until a paid week extends. */
+  async spendFeaturedDays(p: Product, user: User, days: number): Promise<Product> {
+    if (p.status !== 'live') throw new InputError('Only a live listing can be featured.')
+    if (!this.store.canEdit(p, user)) throw new InputError('You can only feature a listing you submitted or own.')
+    const want = Math.floor(Number(days))
+    if (!Number.isFinite(want) || want < 1) throw new InputError('Pick at least one day.', 'days')
+    const r = await this.credits.spend(user.id, FEATURED_DAYS, want, `featured ${p.slug}`)
+    if (!r.ok) throw new InputError(r.balance ? `You have ${r.balance} Featured day${r.balance === 1 ? '' : 's'} left.` : 'You have no Featured days. Redeem a code or use an invite.', 'days')
+    this.store.extendFeatured(p.id, want)
+    return this.store.product(p.id)!
+  }
+
+  /**
+   * Someone new signed up through a scarce invite code: the code is spent, both get
+   * INVITE_BONUS_DAYS Featured days, and the invite counts in the invite program
+   * (the same invites row an invite link makes, so a sign-up is never counted twice).
+   */
+  async acceptInvite(code: string, user: User): Promise<{ ok: boolean; reason?: string; inviterId?: string }> {
+    const r = await this.affiliates.redeemInvite(code, user.id)
+    if (!r.ok) return { ok: false, reason: r.reason }
+    const bonus = { unit: FEATURED_DAYS, amount: INVITE_BONUS_DAYS } as const
+    await this.credits.grant(user.id, bonus, `invited by ${r.inviterId}`)
+    await this.credits.grant(r.inviterId, bonus, `invited ${user.id}`)
+    this.store.recordInvite(user.id, this.store.inviteCode(r.inviterId))
+    return { ok: true, inviterId: r.inviterId }
+  }
 
   /** A product page's public address. */
   link(p: Pick<Product, 'slug'>): string {
     return `${this.config.origin}/p/${p.slug}`
   }
 
-  /** Read the URL and make a draft. A URL already live comes back as `existing` instead. */
-  async submit(input: { url: string; makerName?: string; makerProfile?: string }, submitter: string, user: User | null = null): Promise<{ product: Product; existing: boolean }> {
+  /** Read the URL and make a draft. A URL already live comes back as `existing` instead. `unlimited` (the admin) skips the hourly cap. */
+  async submit(input: { url: string; makerName?: string; makerProfile?: string }, submitter: string, user: User | null = null, unlimited = false): Promise<{ product: Product; existing: boolean }> {
     let url: URL
     try {
       url = normalizeUrl(input.url)
@@ -91,7 +168,7 @@ export class BuiltIndie {
     }
     const already = this.store.byUrl(url.href)
     if (already?.status === 'live') return { product: already, existing: true }
-    if (this.store.submissionsFrom(submitter, Date.now() - 3600_000) >= 10) throw new InputError('That is a lot of launches in an hour. Try again later.')
+    if (!unlimited && this.store.submissionsFrom(submitter, Date.now() - 3600_000) >= 10) throw new InputError('That is a lot of launches in an hour. Try again later.')
     const info = await this.read(url.href)
     const id = newId()
     const pictures = await this.pictures(id, info)
@@ -129,22 +206,88 @@ export class BuiltIndie {
     return createHmac('sha256', this.config.claimSecret ?? 'built.indie').update(`claim:${user.id}:${p.domain}`).digest('base64url').slice(0, 24)
   }
 
-  /** Look for the claim record at _built-indie.<domain>, then on the domain itself (and its apex for www). */
-  async claim(p: Product, user: User): Promise<{ ok: boolean; looked: string[] }> {
+  /**
+   * Two proofs, either one claims it: the TXT record at _built-indie.<domain> (or on the
+   * domain itself, and its apex for www), or, failing DNS, our badge on the homepage
+   * carrying this person's badge id (`/images.svg?id=<id>`, the easy way). Kept for
+   * badges already placed: `/badge/<slug>.svg?claim=<token>`, or the bare
+   * `built-indie-verify=<token>` anywhere in the HTML, e.g. a meta tag. A badge that
+   * claims also earns the followed link and the ✓, as `verify` would.
+   */
+  async claim(p: Product, user: User): Promise<{ ok: boolean; looked: string[]; method?: 'dns' | 'badge' }> {
     if (p.status === 'hidden') throw new InputError('This product was taken down.')
     if (p.ownerId === user.id) return { ok: true, looked: [] }
-    const want = `${CLAIM_PREFIX}${this.claimToken(p, user)}`
+    const token = this.claimToken(p, user)
+    const want = `${CLAIM_PREFIX}${token}`
     const bare = p.domain.replace(/^www\./, '')
     const names = [...new Set([`${CLAIM_LABEL}.${bare}`, bare, p.domain])]
+    const looked = [...names, p.url]
     const lookup = this.config.resolveTxt ?? publicTxt
     for (const name of names) {
       const records = await lookup(name).catch(() => [] as string[][])
       if (records.some((chunks) => chunks.join('').trim() === want)) {
-        this.store.claim(p.id, user.id)
-        return { ok: true, looked: names }
+        this.claimed(p, user, false)
+        return { ok: true, looked, method: 'dns' }
       }
     }
-    return { ok: false, looked: names }
+    const html = await this.homepage(p)
+    const own = this.badgeIds(html).some((id) => {
+      const b = this.store.badge(id)
+      return b?.productId === p.id && b.userId === user.id
+    })
+    if (own) {
+      this.claimed(p, user, true)
+      return { ok: true, looked, method: 'badge' }
+    }
+    if (this.hasClaimBadge(html, token)) {
+      this.claimed(p, user, this.linksBack(html))
+      return { ok: true, looked, method: 'badge' }
+    }
+    return { ok: false, looked }
+  }
+
+  /** The claim took: ownership, karma for it, and for the badge when it was the proof. */
+  private claimed(p: Product, user: User, verified: boolean): void {
+    this.store.claim(p.id, user.id)
+    if (verified) this.store.setVerified(p.id, Date.now())
+    const now = this.store.product(p.id)!
+    if (now.status === 'live') this.karma.claimed(now, user.id)
+    if (verified && now.status === 'live') this.karma.badgeVerified(now)
+  }
+
+  /** The product's homepage HTML, read the safe way (no private addresses, robots honoured); '' if it will not load. */
+  private async homepage(p: Product): Promise<string> {
+    const r = await safeFetch(p.url, { ...this.config.fetch, accept: 'text/html' }).catch(() => null)
+    return r && r.status < 300 ? new TextDecoder().decode(r.body) : ''
+  }
+
+  private ourHosts(): string {
+    return `(?:${new URL(this.config.origin).hostname.replace(/\./g, '\\.')}|built\\.indie)`
+  }
+
+  /** A followed-link-worthy link back to us. */
+  private linksBack(html: string): boolean {
+    return new RegExp(`href=["']?https?://${this.ourHosts()}(/|["'])`, 'i').test(html)
+  }
+
+  /** Every link or image URL in the page that points at our host. */
+  private ourUrls(html: string): string[] {
+    if (!html) return []
+    return [...html.matchAll(new RegExp(`(?:href|src)\\s*=\\s*["']?((?:https?:)?//${this.ourHosts()}/[^"'\\s>]*)`, 'gi'))].map((m) => m[1]!)
+  }
+
+  /** The ids of every `/images.svg?id=<id>` badge on our host in the page. */
+  badgeIds(html: string): string[] {
+    const ids = this.ourUrls(html).map((u) => u.match(/\/images\.svg\?(?:[^#]*?(?:&|&amp;))?id=([A-Za-z0-9_-]+)/)?.[1])
+    return [...new Set(ids.filter((id): id is string => Boolean(id)))]
+  }
+
+  /** A link or image on our host whose URL carries claim=<token>, or the bare verify string anywhere. */
+  private hasClaimBadge(html: string, token: string): boolean {
+    if (!html) return false
+    const exact = (prefix: string) => new RegExp(`${prefix}${token}(?![A-Za-z0-9_-])`)
+    if (exact(CLAIM_PREFIX).test(html)) return true
+    return this.ourUrls(html).some((u) => exact('[?&](?:amp;)?claim=').test(u))
   }
 
   private async read(url: string): Promise<SiteInfo> {
@@ -175,7 +318,86 @@ export class BuiltIndie {
   publish(p: Product): Product {
     if (p.status === 'hidden') throw new InputError('This product was taken down.')
     if (!p.name.trim()) throw new InputError('Give it a name', 'name')
-    return this.store.update(p.id, { status: 'live' })!
+    const live = this.store.update(p.id, { status: 'live' })!
+    this.karma.launched(live)
+    // A claim made while it was a draft pays once it is live.
+    if (live.ownerId) this.karma.claimed(live, live.ownerId)
+    // An invited member's first live listing earns whoever invited them a free Featured week.
+    const inviter = p.submitterUser ? this.store.earnInvite(p.submitterUser, p.id) : null
+    if (inviter) {
+      this.karma.inviteConverted(inviter, p.id)
+      this.onInviteEarned?.(inviter, live)
+    }
+    return live
+  }
+
+  // What members do on a listing. Anyone may vote; comments and reviews need an account.
+
+  /** One vote per visitor (their address); a signed-in voter is noted and earns karma. True when it counted. */
+  vote(p: Product, voter: string, user: User | null = null): boolean {
+    if (p.status !== 'live') throw new InputError('Only a live listing takes votes.')
+    if (!this.store.vote(p.id, voter, Date.now(), user?.id ?? null)) return false
+    this.karma.voted(p, user?.id ?? null)
+    return true
+  }
+
+  comment(p: Product, user: User, text: string, parentId?: string | null): Comment {
+    if (p.status !== 'live') throw new InputError('Only a live listing takes comments.')
+    const body = String(text ?? '').replace(/\r\n?/g, '\n').replace(/\n{3,}/g, '\n\n').trim().slice(0, 2000)
+    if (body.length < 2) throw new InputError('Write something first.', 'body')
+    let parent: Comment | null = null
+    if (parentId) {
+      parent = this.store.comment(parentId)
+      if (!parent || parent.productId !== p.id || parent.deletedAt) throw new InputError('That comment is gone.', 'parent')
+      // One level of replies: answering a reply answers its thread.
+      if (parent.parentId) parent = this.store.comment(parent.parentId)
+    }
+    const c = this.store.addComment({ productId: p.id, userId: user.id, parentId: parent?.id ?? null, body })
+    this.karma.commented(p, user.id, c)
+    return c
+  }
+
+  /** Delete a comment: its author, or the admin. Takes back the karma it earned. */
+  deleteComment(id: string, user: User | null, admin = false): Comment {
+    const c = this.store.comment(id)
+    if (!c || c.deletedAt) throw new InputError('No such comment.')
+    if (!admin && c.userId !== user?.id) throw new InputError('Only its author can delete a comment.')
+    this.store.deleteComment(id)
+    this.karma.uncommented(id)
+    return c
+  }
+
+  review(p: Product, user: User, rating: unknown, text: unknown): Review {
+    if (p.status !== 'live') throw new InputError('Only a live listing takes reviews.')
+    const stars = Number(rating)
+    if (!Number.isInteger(stars) || stars < 1 || stars > 5) throw new InputError('Pick 1 to 5 stars.', 'rating')
+    const body = String(text ?? '').replace(/\r\n?/g, '\n').trim().slice(0, 2000)
+    const r = this.store.putReview({ productId: p.id, userId: user.id, rating: stars, body })
+    this.karma.reviewed(p, user.id, r)
+    return r
+  }
+
+  deleteReview(p: Product, userId: string): boolean {
+    const gone = this.store.deleteReview(p.id, userId)
+    if (gone) this.karma.unreviewed(p, userId)
+    return gone
+  }
+
+  /** A share button clicked. Pays a signed-in member (once per listing, network and day). */
+  share(p: Product, user: User | null, network: string): { counted: boolean } {
+    if (p.status !== 'live') throw new InputError('Only a live listing can be shared.')
+    if (!(SHARE_NETWORKS as readonly string[]).includes(network)) throw new InputError(`network is one of ${SHARE_NETWORKS.join(', ')}`, 'network')
+    return { counted: this.karma.shared(p, user?.id ?? null, network) }
+  }
+
+  /** Called when a listing earns its submitter's inviter a credit: the server mails them and refreshes the board. */
+  onInviteEarned?: (inviterId: string, product: Product) => void
+
+  /** Spend one invite credit on a live listing: featured for the usual number of days, free. */
+  redeemCredit(p: Product, user: User): Product {
+    if (p.status !== 'live') throw new InputError('Only a live listing can be featured.')
+    if (!this.store.redeemCredit(user.id, p.id, this.config.featureDays)) throw new InputError('No invite credits left. Invite a maker who launches to earn one.')
+    return this.store.product(p.id)!
   }
 
   async refetch(p: Product): Promise<Product> {
@@ -193,7 +415,7 @@ export class BuiltIndie {
     }
     if (e.tagline !== undefined) patch.tagline = clip(e.tagline, 90)
     if (e.description !== undefined) patch.description = clip(e.description, 1200)
-    if (e.tags !== undefined) patch.tags = [...new Set(list(e.tags).map((t) => t.toLowerCase().replace(/^#/, '').replace(/[^a-z0-9 +#.-]/g, '').slice(0, 24)).filter((t) => t.length >= 2))].slice(0, 6)
+    if (e.tags !== undefined) patch.tags = cleanTags(list(e.tags))
     if (e.makerName !== undefined) patch.makerName = clip(e.makerName, 60)
     if (e.videos !== undefined) {
       const videos: Video[] = []
@@ -249,13 +471,12 @@ export class BuiltIndie {
     return this.store.update(p.id, { makerProfile: r.url.href, makerId: maker.id, makerVerified: verified, makerName: clip(name?.trim() || profile.name, 60) })!
   }
 
-  /** Has the maker linked back to us from their homepage? */
+  /** Has the maker linked back to us from their homepage, or put this listing's badge (any account's id) on it? */
   async verify(p: Product): Promise<boolean> {
-    const r = await safeFetch(p.url, { ...this.config.fetch, accept: 'text/html' }).catch(() => null)
-    const html = r && r.status < 300 ? new TextDecoder().decode(r.body) : ''
-    const ours = new URL(this.config.origin).hostname
-    const ok = new RegExp(`href=["']?https?://(${ours.replace(/\./g, '\\.')}|built\\.indie)(/|["'])`, 'i').test(html)
+    const html = await this.homepage(p)
+    const ok = this.linksBack(html) || this.badgeIds(html).some((id) => this.store.badge(id)?.productId === p.id)
     this.store.setVerified(p.id, ok ? Date.now() : null)
+    if (ok && p.status === 'live') this.karma.badgeVerified(p)
     return ok
   }
 
@@ -319,61 +540,73 @@ export class BuiltIndie {
     )
   }
 
-  /** Start a crypto payment to feature a product; returns where to send the buyer. */
-  async feature(p: Product, chain: string, fetcher: typeof fetch = fetch): Promise<{ checkoutUrl: string; ref: string }> {
+  /**
+   * Start a CoinPay hosted checkout session to feature a product; returns where to send
+   * the buyer. The buyer picks any coin or PayPal on CoinPay's page, so there is no
+   * currency picker here.
+   */
+  async feature(p: Product, buyer: Buyer): Promise<{ checkoutUrl: string; ref: string; sessionId: string; methods: string[] }> {
     const cp = this.config.coinpay
     if (!cp) throw new InputError('Featuring is not set up on this server yet.')
     if (p.status !== 'live') throw new InputError('Publish it first.')
-    if (!this.config.chains.includes(chain)) throw new InputError('Pick a currency from the list', 'chain')
-    const res = await fetcher(`${cp.baseUrl}/api/payments/create`, {
-      method: 'POST',
-      headers: { authorization: `Bearer ${cp.apiKey}`, 'content-type': 'application/json' },
-      body: JSON.stringify({
-        business_id: cp.businessId,
+    const email = validEmail(buyer.email)
+    if (!email) throw new InputError('Enter your email: CoinPay sends the receipt there', 'email')
+    const accountId = String(buyer.accountId ?? '').trim() || email
+    const ref = `fp_${randomBytes(9).toString('base64url')}`
+    const link = this.link(p)
+    const client = new CoinPay({ token: cp.apiKey, base: cp.baseUrl, fetch: cp.fetch ?? fetch })
+    let session
+    try {
+      session = await client.createCheckoutSession({
         amount: this.config.featureUsd,
         currency: 'USD',
-        blockchain: chain,
-        payment_method: 'crypto',
         description: `built.indie: feature ${p.name} for ${this.config.featureDays} days`,
-        metadata: { product_id: p.id, product: 'feature' },
-        success_url: `${this.link(p)}?featured=1`,
-        cancel_url: this.link(p),
-      }),
-      signal: AbortSignal.timeout(20_000),
-    })
-    if (!res.ok) throw new Error(`CoinPay said ${res.status}: ${(await res.text()).slice(0, 200)}`)
-    const body = (await res.json()) as any
-    const payment = body?.payment ?? body
-    const ref = String(payment?.id ?? payment?.payment_id ?? '')
-    if (!ref) throw new Error('CoinPay returned no payment reference')
+        customerEmail: email,
+        accountId,
+        property: new URL(this.config.origin || 'https://built.indie.pit.world').hostname,
+        metadata: { product_id: p.id, product: 'feature', days: this.config.featureDays, payment_ref: ref },
+        successUrl: `${link}?featured=1`,
+        cancelUrl: link,
+        expiresInMinutes: 60,
+      })
+    } catch (e) {
+      throw new Error(`CoinPay said ${e instanceof CoinPayError ? e.status : 'error'}: ${(e as Error).message.slice(0, 200)}`)
+    }
+    if (!session?.id || !session.url) throw new Error('CoinPay returned no checkout session')
     // Written before the buyer leaves: a webhook can beat the redirect.
-    this.store.addPayment({ ref, productId: p.id, amountUsd: this.config.featureUsd, chain, days: this.config.featureDays })
-    return { checkoutUrl: `${cp.baseUrl}/pay/${ref}`, ref }
+    this.store.addPayment({ ref, productId: p.id, amountUsd: this.config.featureUsd, chain: 'checkout', days: this.config.featureDays, checkoutSessionId: session.id, email, accountId })
+    return { checkoutUrl: session.url, ref, sessionId: session.id, methods: session.methods ?? [] }
   }
 
-  /** CoinPay's webhook: `t=<unix>,v1=<hmac of "t.body">`; the payload is { data: { payment_id, status } }. */
-  webhook(raw: string, header: string | undefined, nowSeconds = Date.now() / 1000): { ok: boolean; status?: number } {
+  /**
+   * CoinPay's webhook: `X-CoinPay-Signature: t=<unix>,v1=<hmac of "t.body">` over the raw
+   * bytes; the body is nested, `{ id: evt_..., type, data: { payment_id, status,
+   * checkout_session_id, metadata } }`. Paid = payment.confirmed (a PayPal capture has
+   * status 'completed') or payment.forwarded; one session can send both, so settling is
+   * once per local payment.
+   */
+  webhook(raw: string, header: string | undefined, nowSeconds = Date.now() / 1000): { ok: boolean; status?: number; settled?: boolean } {
     const cp = this.config.coinpay
     if (!cp?.webhookSecret || !header) return { ok: false, status: 401 }
-    const parts = Object.fromEntries(header.split(',').map((kv) => kv.split('=').map((s) => s.trim())))
-    const t = Number(parts.t)
-    if (!Number.isFinite(t) || !parts.v1 || Math.abs(nowSeconds - t) > 300) return { ok: false, status: 401 }
-    const expected = Buffer.from(createHmac('sha256', cp.webhookSecret).update(`${parts.t}.${raw}`).digest('hex'), 'hex')
-    const given = Buffer.from(String(parts.v1), 'hex')
-    if (expected.length !== given.length || !timingSafeEqual(expected, given)) return { ok: false, status: 401 }
-    let payload: any
+    if (!verifyWebhook(raw, header, cp.webhookSecret, nowSeconds * 1000)) return { ok: false, status: 401 }
+    let payload: unknown
     try {
       payload = JSON.parse(raw)
     } catch {
       return { ok: false, status: 400 }
     }
-    const data = payload?.data ?? payload
-    const ref = String(data?.payment_id ?? data?.id ?? '')
-    const status = String(data?.status ?? payload?.type?.replace(/^payment\./, '') ?? '').toLowerCase()
-    if (!ref || !this.store.payment(ref)) return { ok: true }
-    if (SETTLED.has(status)) this.store.settle(ref)
-    else if (status) this.store.setPaymentStatus(ref, status)
-    return { ok: true }
+    const ev = readWebhook(payload)
+    const row =
+      (ev.checkoutSessionId && this.store.paymentBySession(ev.checkoutSessionId)) ||
+      (typeof ev.metadata.payment_ref === 'string' && this.store.payment(ev.metadata.payment_ref)) ||
+      (ev.paymentId && this.store.payment(ev.paymentId)) ||
+      null
+    if (!row) return { ok: true }
+    if (ev.paymentId) this.store.notePaymentId(row.ref, ev.paymentId, ev.method || null)
+    if (ev.paid) return { ok: true, settled: this.store.settle(row.ref) }
+    const status = ev.status || ev.type.replace(/^payment\./, '')
+    if (status) this.store.setPaymentStatus(row.ref, status)
+    return { ok: true, settled: false }
   }
 }
 

package/src/tags.ts

@@ -0,0 +1,92 @@
+/**
+ * Tags: one shape for every tag, and topics inferred from a listing's own words
+ * when its homepage declares none (no keywords meta, JSON-LD category or
+ * opensite.json tags). Inference is a fixed vocabulary, so it is cheap,
+ * offline and the same on every run.
+ */
+
+export const MAX_TAGS = 6
+
+/** Lower case, no leading #, only a-z 0-9 space + # . -, 2 to 24 characters; null if nothing is left. */
+export function normalizeTag(raw: string): string | null {
+  const t = String(raw)
+    .toLowerCase()
+    .replace(/^#/, '')
+    .replace(/application$/, '')
+    .replace(/[^a-z0-9 +#.-]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim()
+  return t.length >= 2 && t.length <= 24 ? t : null
+}
+
+/** Normalized, unique, at most `max`. */
+export function cleanTags(raw: Iterable<string>, max = MAX_TAGS): string[] {
+  const out = new Set<string>()
+  for (const r of raw) {
+    const t = normalizeTag(r)
+    if (t) out.add(t)
+    if (out.size >= max) break
+  }
+  return [...out]
+}
+
+/** Topic, and the words that mean it. Earlier topics win a tie. */
+const TOPICS: [string, RegExp][] = [
+  ['ai', /\b(ai|llms?|gpt|claude|codex|opencode|agentic|ai agents?|open models?|whisper(\.cpp)?)\b/g],
+  ['agents', /\b(agents?|agentic)\b/g],
+  ['developer tools', /\b(developers?|cli|apis?|sdk|codebase|coding|git|webhooks?|npm|registry|registries|ci\/?cd)\b/g],
+  ['game', /\b(games?|gaming|gamers?|play|shooter|multiplayer|co-op|campaign)\b/g],
+  ['tactical', /\b(operatives?|tactical|combat|military|war)\b/g],
+  ['sports', /\b(sports?|youth-sports|athletes?|league|fixtures|teams? in the world)\b/g],
+  ['crypto', /\b(crypto|bitcoin|btc|eth|usdc|sol|stablecoins?|lightning|web3|wallets?|coinpay)\b/g],
+  ['payments', /\b(payments?|checkout|pay link|get paid|pays you|invoices?|billing|pay by the)\b/g],
+  ['sms', /\b(sms|texts?|texting|phone numbers?|sim( cards?)?|carrier)\b/g],
+  ['verification', /\b(otp|2fa|verification( codes?)?|one-time codes?)\b/g],
+  ['email', /\b(e-?mail|newsletters?|inbox)\b/g],
+  ['voice', /\b(voice|calls?|dials?|phone tree|on hold)\b/g],
+  ['customer support', /\b(customer support|phone tree|helpdesk|support tickets?)\b/g],
+  ['video', /\b(videos?|reels?|films?|demo video|highlight)\b/g],
+  ['tv', /\b(iptv|tv( guide)?|live-tv|channels?|m3u|xtream)\b/g],
+  ['music', /\b(music|spotify|albums?|songs?|genres?)\b/g],
+  ['audio', /\b(audio|podcasts?|recordings?|transcripts?|transcri\w+)\b/g],
+  ['news', /\b(news|newsrooms?|headlines|journalism|the desk)\b/g],
+  ['alerts', /\b(reminders?|alerts?|notifications?|get told|never miss|before it drops)\b/g],
+  ['jobs', /\b(jobs?|hiring|freelanc\w*|gigs?|careers?)\b/g],
+  ['health', /\b(health|telehealth|medical|patients?|clinics?|prescriptions?|labs)\b/g],
+  ['food', /\b(recipes?|cookbooks?|food|cooking|ingredients)\b/g],
+  ['cannabis', /\b(cannabis|dispensar(y|ies)|weed)\b/g],
+  ['directory', /\b(directory|directories|listings?|search engine|compared)\b/g],
+  ['data', /\b(database|datasets?|structured data|feeds?|json|real-time public data)\b/g],
+  ['marketing', /\b(ads|advertis\w*|promot\w*|seo|marketing|launch sites|submissions?)\b/g],
+  ['automation', /\b(automat\w*|workflows?|deterministic)\b/g],
+  ['open source', /\b(open-source|open source|foss|self-host\w*)\b/g],
+  ['security', /\b(security|malware|encrypt\w*|vulnerab\w*|privacy|audit)\b/g],
+  ['photos', /\b(photos?|images?|pictures?|backgrounds?|camera)\b/g],
+  ['terminal', /\b(terminal|ssh|tmux|bbs|bulletin board)\b/g],
+  ['no-code', /\b(no-code|your own words|describe what you want)\b/g],
+  ['open standards', /\b(standards|schemas?|specs?|conventions|primitives)\b/g],
+  ['shopping', /\b(shop|buy|marketplace|e-?commerce|store)\b/g],
+  ['art', /\b(tattoos?|artistry|artist)\b/g],
+  ['automotive', /\b(auto detailing|cars?|automotive)\b/g],
+  ['cigars', /\b(cigars?|spliffs?|tobacco)\b/g],
+  ['events', /\b(events?|meetups?|herf|every other sunday)\b/g],
+  ['productivity', /\b(productivity|organi[sz]e|searchable|right folder)\b/g],
+]
+
+/** Up to `max` topics the text is about, most mentioned first. */
+export function inferTags(text: string, max = 4): string[] {
+  const t = ` ${text.toLowerCase()} `
+  return TOPICS.map(([tag, re], i) => ({ tag, i, n: t.match(re)?.length ?? 0 }))
+    .filter((s) => s.n > 0)
+    // "never miss a game" is a match, not a video game.
+    .filter((s, _, all) => s.tag !== 'game' || !all.some((o) => o.tag === 'sports'))
+    .sort((a, b) => b.n - a.n || a.i - b.i)
+    .slice(0, max)
+    .map((s) => s.tag)
+}
+
+/** What a listing is tagged with: its declared tags, else topics from its name, tagline and description. */
+export function tagsFor(declared: string[], text: { name?: string; tagline?: string; description?: string }): string[] {
+  const own = cleanTags(declared)
+  return own.length ? own : inferTags([text.name, text.tagline, text.description].filter(Boolean).join('. '))
+}