@xuda.io/account_module 1.2.2255 → 1.2.2257

package/index.mjs

@@ -197,6 +197,9 @@ export const update_account_info = async function (req, job_id, headers) {
     return { code: -1310, data: error };
   }
   if (!change) {
+    if (account_obj.account_info?.profile_picture && !account_obj.account_info?.profile_avatar && account_obj.account_info.profile_avatar_stat !== 2) {
+      set_account_profile_picture(uid, uid, account_obj.account_info, job_id, headers, account_profile_info);
+    }
     return { code: 1300, data: 'no change' };
   }
 
@@ -219,6 +222,59 @@ export const update_account_info = async function (req, job_id, headers) {
     }
   }
 
+  // Opportunistic Stripe consolidation. Any time the user updates
+  // their account info, also check if they're still on the legacy
+  // 3-subscription model and migrate them to the consolidated
+  // 1-subscription-with-3-items model in the background. The
+  // migration helper is idempotent — already-consolidated accounts
+  // and accounts without a stripe_customer_id return immediately
+  // with no side effects — so this is cheap to run on every save.
+  //
+  // Fire-and-forget: we don't await it so the user's update_account_info
+  // response isn't blocked on Stripe API calls (creating a new sub +
+  // scheduling 3 cancels can take several seconds). The migration
+  // logs its own errors; if it fails for a particular account the
+  // user can still operate normally on the legacy model and we'll
+  // retry on the next update_account_info call.
+  if (account_obj.stripe_customer_id && !account_obj.stripe_subscription_id) {
+    stripe_ms
+      .migrate_account_to_consolidated({ uid })
+      .then((r) => {
+        if (r?.code === 1) {
+          console.log(`[update_account_info] migration result for ${uid}:`, typeof r.data === 'string' ? r.data : `migrated → ${r.data?.new_sub_id}`);
+        } else if (r?.code < 0) {
+          console.warn(`[update_account_info] migration failed for ${uid}:`, r?.data);
+        }
+      })
+      .catch((err) => {
+        console.warn(`[update_account_info] migration errored for ${uid}:`, err?.message || err);
+      });
+  } else if (account_obj.stripe_subscription_id) {
+    // Already on the consolidated model — but if the original
+    // migration used `trial_end` (older code path) the Stripe
+    // dashboard still shows the sub as "trialing". Idempotently
+    // swap it for a no-trial equivalent (cancel + recreate with
+    // `billing_cycle_anchor`). First invoice date stays exactly
+    // the same so the customer sees no billing change.
+    stripe_ms
+      .end_consolidated_trial({ uid })
+      .then((r) => {
+        if (r?.code === 1) {
+          const data = r.data;
+          if (typeof data === 'object' && data?.new_sub_id) {
+            console.log(`[update_account_info] trial removed for ${uid}: new sub ${data.new_sub_id}`);
+          }
+          // Quiet otherwise — "no consolidated sub" / "no active
+          // trial" are the common no-op cases and would spam logs.
+        } else if (r?.code < 0) {
+          console.warn(`[update_account_info] end_consolidated_trial failed for ${uid}:`, r?.data);
+        }
+      })
+      .catch((err) => {
+        console.warn(`[update_account_info] end_consolidated_trial errored for ${uid}:`, err?.message || err);
+      });
+  }
+
   if (save_ret.code > 0) {
     return { code: 1300, data: 'ok' };
   }
@@ -494,6 +550,455 @@ export const increment_account_usage = async function (req) {
   }
 };
 
+// ──────────────────────────────────────────────────────────────────
+// Per-deployment billing helpers.
+//
+// HISTORY: an earlier iteration of unified billing had an hourly
+// cron (`accrue_deployment_costs`) that walked every active
+// deployment and pushed accrual into a `deployment_usage` doc per
+// VPS, then flushed those docs to Stripe at end-of-cycle. That
+// approach had cron-coupling, off-by-one bugs at hour boundaries,
+// drift, and a parallel state machine to keep in sync.
+//
+// CURRENT: on-demand. Both the dashboard's `accrued_so_far` /
+// `projected_total` numbers AND the Stripe invoice items at cycle
+// close are computed from `app_cost.created_ts` /
+// `app_cost.terminated_ts` directly. No cron, no accumulator
+// docs. See compute_cycle_billable_amount in deploy_module/cost.mjs
+// for the math. Result: per-second accuracy automatically, idempotent
+// flush, zero between-event state.
+//
+// Only the `backfill_app_costs` one-shot remains here — it stamps
+// `app_cost.*` onto legacy deployments that pre-date the per-VPS
+// ledger, anchoring `created_ts = now` so past hours stay unbilled.
+// ──────────────────────────────────────────────────────────────────
+
+// Doc types that own a billable droplet / add-on bundle. Used by the
+// backfill query to scope its selector — and reusable as a constant
+// elsewhere should anything need to filter by "is this a billable
+// app type?".
+const BILLABLE_APP_TYPES = ['vps', 'datacenter', 'instance', 'balancer'];
+
+// Stamp `app_cost.terminated_ts` on an app doc IMMEDIATELY, without
+// waiting for the destroy job to pick up. Called from the dashboard
+// the instant the user confirms a destroy so the billing UI reacts
+// without delay.
+//
+// Why we need this: destroy_app runs with { job: true } — i.e. the
+// HTTP call queues a background job and returns right away. The job
+// worker eventually executes destroy_app server-side, which marks
+// terminated_ts at the START of its own execution. But during the
+// window between "request returns" and "job worker starts", the
+// app doc still looks billable. The dashboard refresh in that
+// window sees the old state — exactly the "GUI doesn't react /
+// second refresh fixes it" symptom.
+//
+// This endpoint sidesteps the job queue entirely. It's a synchronous
+// 2-line write — no DO API calls, no destroy chain. The dashboard
+// calls it BEFORE the destroy_app job, returns can render the new
+// billing state without waiting on infra teardown.
+//
+// Idempotent: if terminated_ts is already set, returns immediately.
+export const mark_app_terminated = async function (req) {
+  const { app_id } = req || {};
+  if (!app_id) return { code: -1, data: 'app_id required' };
+  try {
+    const ret = await db_module.get_couch_doc('xuda_master', app_id);
+    if (ret.code < 0) return { code: -1, data: 'app not found' };
+    const app_doc = ret.data;
+    if (!app_doc.app_cost) return { code: 1, data: 'no app_cost — nothing to mark' };
+    if (app_doc.app_cost.terminated_ts) return { code: 1, data: 'already terminated' };
+    app_doc.app_cost.terminated_ts = Date.now();
+    await db_module.save_couch_doc('xuda_master', app_doc);
+    return { code: 1, data: { terminated_ts: app_doc.app_cost.terminated_ts } };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
+// -------------------------------------------------------------------
+//  Abuse detection — see the "How can we detect abuse?" plan.
+// -------------------------------------------------------------------
+
+// Admin emails get access to the abuse triage endpoints. Keep this in
+// sync with the dashboard's admin-route gate. Lives here (not in
+// config) so a compromised config_dev.json can't grant admin access.
+const ADMIN_EMAILS = new Set(['info@ioshka.com']);
+
+const is_admin_email = (email) => {
+  if (!email) return false;
+  return ADMIN_EMAILS.has(String(email).toLowerCase());
+};
+
+// Get the active billing cycle bounds for an account, on demand from
+// Stripe. Used by recompute_abuse_signals to scope its "this cycle"
+// counters correctly. Returns { cycle_start_ts, cycle_end_ts } in ms
+// or null if Stripe isn't reachable / customer not found.
+const get_account_cycle_bounds = async (account) => {
+  if (!account?.stripe_customer_id) return null;
+  try {
+    const stripe_ms = await import(`${module_path}/stripe_module/index_ms.mjs`);
+    // get_upcoming_invoice returns the upcoming invoice for the customer.
+    // Its period_start/period_end define the active cycle window. If
+    // that endpoint isn't available, we approximate from docDate.
+    const upcoming = await stripe_ms
+      .get_upcoming_invoice({
+        customer_id: account.stripe_customer_id,
+      })
+      .catch(() => null);
+    if (upcoming?.data?.period_start && upcoming?.data?.period_end) {
+      return {
+        cycle_start_ts: upcoming.data.period_start * 1000,
+        cycle_end_ts: upcoming.data.period_end * 1000,
+      };
+    }
+  } catch (_) {}
+  // Fallback: rolling 30-day window from now. Approximation good enough
+  // for abuse signals — exact cycle bounds only matter for invoicing.
+  const now = Date.now();
+  return { cycle_start_ts: now - 30 * 24 * 60 * 60 * 1000, cycle_end_ts: now };
+};
+
+// Walk an account's deployments and update its abuse_signals object.
+// Idempotent — safe to call on every cycle close, on resize, or on
+// admin demand. Returns the computed signals shape + any flags raised.
+//
+// Rules implemented (from the abuse plan):
+//   Rule 1 (negative_margin)        — margin_ratio < 0 AND provider > $5
+//   Rule 2 (resize_churn)           — >3 short segments OR >10 resizes this cycle
+//   Rule 3 (new_account_high_spec)  — account age < 7d AND any deploy > $150/mo
+//
+// Rules 4/5/6 need additional data sources (project history view, Stripe
+// payment_failed webhook, fingerprint capture) and ship in later phases.
+export const recompute_abuse_signals = async function (req) {
+  const { uid } = req || {};
+  if (!uid) return { code: -1, data: 'uid required' };
+
+  try {
+    const acct_ret = await db_module.get_couch_doc('xuda_accounts', uid);
+    if (acct_ret.code < 0) return { code: -1, data: 'account not found' };
+    const account = acct_ret.data;
+
+    const cost_mod = await import(`${module_path}/deploy_module/cost.mjs`);
+    const { compute_cycle_billable_amount, is_billable } = cost_mod;
+
+    const bounds = await get_account_cycle_bounds(account);
+    const cycle_start_ts = bounds?.cycle_start_ts || Date.now() - 30 * 24 * 60 * 60 * 1000;
+    const cycle_end_ts = bounds?.cycle_end_ts || Date.now();
+
+    // Walk apps via the user_apps view.
+    const apps_ret = await db_module.get_couch_view('xuda_master', 'user_apps', {
+      startkey: [uid, ''],
+      endkey: [uid, 'ZZZZZ'],
+      include_docs: true,
+    });
+
+    let resizes_this_cycle = 0;
+    let short_segments_this_cycle = 0;
+    let total_billed = 0;
+    let total_provider = 0;
+    let max_monthly_spec = 0;
+
+    for (const row of apps_ret?.data?.rows || []) {
+      const doc = row.doc;
+      if (!is_billable(doc)) continue;
+
+      // Count cycle-relevant resizes by examining history[] entries
+      // whose closing timestamp falls inside the cycle window.
+      for (const seg of doc.app_cost.history || []) {
+        if (seg.to_ts > cycle_start_ts && seg.to_ts <= cycle_end_ts) {
+          resizes_this_cycle++;
+          if (seg.to_ts - seg.from_ts < 60 * 60 * 1000) short_segments_this_cycle++;
+        }
+      }
+
+      const billed = compute_cycle_billable_amount(doc, cycle_start_ts, cycle_end_ts);
+      total_billed += billed;
+
+      // Provider cost: use provider_cost_monthly if populated (Phase B
+      // will fill this from DO billing API). Until then approximate as
+      // monthly_hosting (assume 0% markup baseline — conservative for
+      // detecting negative margin).
+      const provider_monthly = doc.app_cost.provider_cost_monthly ?? doc.app_cost.monthly_hosting ?? 0;
+      const cycle_ms = cycle_end_ts - cycle_start_ts;
+      const window_start = Math.max(doc.app_cost.created_ts || cycle_start_ts, cycle_start_ts);
+      const window_end = Math.min(doc.app_cost.terminated_ts || cycle_end_ts, cycle_end_ts);
+      if (window_end > window_start && cycle_ms > 0) {
+        total_provider += provider_monthly * ((window_end - window_start) / cycle_ms);
+      }
+
+      if (doc.app_cost.monthly_total > max_monthly_spec) {
+        max_monthly_spec = doc.app_cost.monthly_total;
+      }
+    }
+
+    const account_age_ms = Date.now() - (account.docDate || account.created_ts || Date.now());
+    const account_age_days = account_age_ms / (24 * 60 * 60 * 1000);
+    const margin_ratio = total_provider > 0 ? (total_billed - total_provider) / total_provider : 0;
+
+    // Apply rules — first flag wins.
+    let flag = null;
+    let flag_detail = null;
+    if (total_provider > 5 && margin_ratio < 0) {
+      flag = 'negative_margin';
+      flag_detail = `provider $${total_provider.toFixed(2)} > billed $${total_billed.toFixed(2)} (margin ${(margin_ratio * 100).toFixed(0)}%)`;
+    } else if (short_segments_this_cycle > 3 || resizes_this_cycle > 10) {
+      flag = 'resize_churn';
+      flag_detail = `${resizes_this_cycle} resizes, ${short_segments_this_cycle} sub-1h segments`;
+    } else if (account_age_days < 7 && max_monthly_spec > 150) {
+      flag = 'new_account_high_spec';
+      flag_detail = `${account_age_days.toFixed(1)}d old, biggest VPS $${max_monthly_spec}/mo`;
+    }
+
+    const prev = account.abuse_signals || {};
+    const signals = {
+      resizes_this_cycle,
+      short_segments_this_cycle,
+      destroy_recreate_pairs: prev.destroy_recreate_pairs || 0, // populated by Rule 4 (later)
+      account_age_days,
+      total_provider_cost: Number(total_provider.toFixed(2)),
+      total_billed_amount: Number(total_billed.toFixed(2)),
+      margin_ratio: Number(margin_ratio.toFixed(4)),
+      max_monthly_spec,
+      cycle_start_ts,
+      cycle_end_ts,
+      computed_at: Date.now(),
+      flagged: !!flag,
+      flag_reason: flag,
+      flag_detail,
+      flag_ts: flag ? prev.flag_ts || Date.now() : null, // sticky until reviewed
+      reviewed_by: flag ? prev.reviewed_by || null : null,
+      reviewed_at: flag ? prev.reviewed_at || null : null,
+    };
+
+    account.abuse_signals = signals;
+    await db_module.save_couch_doc('xuda_accounts', account);
+
+    return { code: 1, data: signals };
+  } catch (err) {
+    console.error('[recompute_abuse_signals]', err.message);
+    return { code: -1, data: err.message };
+  }
+};
+
+// Admin-only: list every account currently flagged. The dashboard's
+// /admin/abuse page reads from here.
+export const get_flagged_accounts = async function (req) {
+  const { uid: caller_uid } = req || {};
+  if (!caller_uid) return { code: -1, data: 'unauthorized' };
+  try {
+    const caller_ret = await db_module.get_couch_doc('xuda_accounts', caller_uid);
+    if (caller_ret.code < 0 || !is_admin_email(caller_ret.data.email)) {
+      return { code: -1, data: 'unauthorized' };
+    }
+
+    // No view yet — scan via find_couch_query on abuse_signals.flagged.
+    // Acceptable at small scale; index this if the flagged list grows.
+    const find_ret = await db_module.find_couch_query('xuda_accounts', {
+      selector: { 'abuse_signals.flagged': true },
+      limit: 500,
+    });
+
+    const rows = (find_ret?.docs || []).map((a) => ({
+      uid: a._id,
+      email: a.email,
+      first_name: a.first_name,
+      last_name: a.last_name,
+      username: a.username,
+      stripe_customer_id: a.stripe_customer_id,
+      abuse_signals: a.abuse_signals,
+      stat: a.stat,
+      docDate: a.docDate,
+    }));
+
+    // Sort: unreviewed first, then most recent flag.
+    rows.sort((a, b) => {
+      const ar = a.abuse_signals?.reviewed_by ? 1 : 0;
+      const br = b.abuse_signals?.reviewed_by ? 1 : 0;
+      if (ar !== br) return ar - br;
+      return (b.abuse_signals?.flag_ts || 0) - (a.abuse_signals?.flag_ts || 0);
+    });
+
+    return { code: 1, data: rows };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
+// Admin-only: sweep every account that has a stripe_customer_id and
+// recompute its abuse_signals. Used by the admin page's "Run sweep"
+// button so signals get refreshed without waiting for the next
+// invoice.upcoming webhook. Returns counts (flagged / clean / errors).
+export const sweep_abuse_signals = async function (req) {
+  const { uid: caller_uid } = req || {};
+  if (!caller_uid) return { code: -1, data: 'unauthorized' };
+  try {
+    const caller_ret = await db_module.get_couch_doc('xuda_accounts', caller_uid);
+    if (caller_ret.code < 0 || !is_admin_email(caller_ret.data.email)) {
+      return { code: -1, data: 'unauthorized' };
+    }
+
+    const accounts_ret = await db_module.find_couch_query('xuda_accounts', {
+      selector: { stripe_customer_id: { $exists: true } },
+      limit: 1000,
+    });
+    const accounts = accounts_ret?.docs || [];
+
+    const summary = { scanned: 0, flagged: 0, clean: 0, errors: [] };
+    for (const acct of accounts) {
+      summary.scanned++;
+      try {
+        const r = await recompute_abuse_signals({ uid: acct._id });
+        if (r?.code < 0) {
+          summary.errors.push({ uid: acct._id, message: r.data });
+        } else if (r?.data?.flagged) {
+          summary.flagged++;
+        } else {
+          summary.clean++;
+        }
+      } catch (err) {
+        summary.errors.push({ uid: acct._id, message: err.message });
+      }
+    }
+    return { code: 1, data: summary };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
+// Admin-only: mark an account's current flag as reviewed (cleared until
+// next recompute raises it again). Records who reviewed + when.
+export const mark_account_reviewed = async function (req) {
+  const { uid: caller_uid, target_uid, note } = req || {};
+  if (!caller_uid || !target_uid) return { code: -1, data: 'uid + target_uid required' };
+  try {
+    const caller_ret = await db_module.get_couch_doc('xuda_accounts', caller_uid);
+    if (caller_ret.code < 0 || !is_admin_email(caller_ret.data.email)) {
+      return { code: -1, data: 'unauthorized' };
+    }
+
+    const target_ret = await db_module.get_couch_doc('xuda_accounts', target_uid);
+    if (target_ret.code < 0) return { code: -1, data: 'target account not found' };
+    const target = target_ret.data;
+
+    if (!target.abuse_signals) target.abuse_signals = {};
+    target.abuse_signals.reviewed_by = caller_ret.data.email;
+    target.abuse_signals.reviewed_at = Date.now();
+    target.abuse_signals.review_note = note || null;
+    target.abuse_signals.flagged = false; // cleared
+
+    await db_module.save_couch_doc('xuda_accounts', target);
+    return { code: 1, data: target.abuse_signals };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
+// One-shot backfill: stamp `app_cost.*` onto legacy deployments,
+// anchored at `last_billed_ts = now` so the cron starts forward-only.
+// Idempotent — re-running on a doc that already has app_cost.last_billed_ts
+// is a no-op.
+//
+// opts:
+//   dry_run: boolean — compute, don't save.
+//   limit: number — cap on docs processed (canary backfill).
+//   app_id: string — backfill only this specific app.
+export const backfill_app_costs = async function (opts = {}) {
+  const { dry_run = false, limit = null, app_id = null } = opts || {};
+
+  // compute_app_cost lives in deploy_module/cost.mjs. Imported via
+  // the same cross-module path convention used elsewhere in this
+  // file (see fs_module / db_module imports at the top). Falls back
+  // to inline noop if the import fails so the backfill can at least
+  // log what it WOULD have done.
+  let compute_app_cost;
+  try {
+    const cost_mod = await import(`${module_path}/deploy_module/cost.mjs`);
+    compute_app_cost = cost_mod.compute_app_cost;
+  } catch (err) {
+    return { code: -1, data: `cost.mjs not importable from account_module: ${err.message}` };
+  }
+
+  const start = Date.now();
+  const summary = {
+    started_at: new Date().toISOString(),
+    dry_run,
+    scanned: 0,
+    stamped: 0,
+    terminated: 0,
+    skipped: 0,
+    nothing_to_bill: 0,
+    errors: [],
+  };
+
+  const APP_STATUS_DELETED = 4;
+
+  let selector;
+  if (app_id) {
+    selector = { _id: app_id };
+  } else {
+    selector = {
+      docType: 'app',
+      $or: [{ app_type: { $in: BILLABLE_APP_TYPES } }, { is_deployment: true }],
+    };
+  }
+
+  const find_ret = await db_module.find_couch_query('xuda_master', { selector, limit: limit || 99999 });
+  const docs = find_ret?.docs || [];
+
+  for (const doc of docs) {
+    summary.scanned++;
+    try {
+      let action = 'skipped';
+      let reason = '';
+
+      if (doc.app_cost?.last_billed_ts) {
+        reason = 'already has app_cost.last_billed_ts';
+      } else if (!doc.deploy_data) {
+        reason = 'no deploy_data';
+      } else if (!BILLABLE_APP_TYPES.includes(doc.app_type) && !doc.is_deployment) {
+        reason = `app_type ${doc.app_type} not billable`;
+      } else {
+        const has_addons = doc.deploy_data?.enable_backups || doc.deploy_data?.enable_ai_maintenance || doc.deploy_data?.enable_ai_instructions || doc.deploy_data?.enable_offline || doc.deploy_data?.enable_utility_screen || doc.deploy_data?.enable_user_assist;
+        if (doc.is_deployment && !has_addons && !doc.deploy_data?.app_server_type) {
+          reason = 'deployment without addons → datacenter bears cost';
+        } else {
+          const cost = compute_app_cost(doc.deploy_data);
+          if (!cost) {
+            action = 'nothing-to-bill';
+            reason = 'monthly_total = 0';
+          } else {
+            if (doc.app_status_code === APP_STATUS_DELETED) {
+              cost.terminated_ts = doc.app_status_data ? new Date(doc.app_status_data).getTime() : Date.now();
+              action = 'terminated';
+            } else {
+              action = 'stamped';
+            }
+            reason = `monthly=$${cost.monthly_total}`;
+            doc.app_cost = cost;
+            if (!dry_run) {
+              await db_module.save_couch_doc('xuda_master', doc);
+            }
+          }
+        }
+      }
+
+      if (action === 'stamped') summary.stamped++;
+      else if (action === 'terminated') summary.terminated++;
+      else if (action === 'nothing-to-bill') summary.nothing_to_bill++;
+      else summary.skipped++;
+
+      if (!summary.per_doc) summary.per_doc = [];
+      summary.per_doc.push({ _id: doc._id, app_type: doc.app_type, app_name: doc.app_name, action, reason });
+    } catch (err) {
+      summary.errors.push({ _id: doc._id, message: err.message });
+    }
+  }
+
+  summary.duration_ms = Date.now() - start;
+  return summary;
+};
+
 export const get_account_data = async function (req) {
   var { uid, enforce_usage } = req;
 
@@ -705,15 +1210,31 @@ export const did_you_know_tips = async function (req, job_id, headers) {
   }
 };
 
+const _warned_no_account_project_id = new Set();
+
 export const get_active_account_profile_info = async function (uid, profile_id) {
   try {
     const acc_obj = await db_module.get_couch_doc_native('xuda_accounts', uid);
 
-    if (!acc_obj.account_project_id) throw new Error(`acc ${acc_obj._id} has no account_project_id`);
+    if (!acc_obj.account_project_id) {
+      if (!_warned_no_account_project_id.has(acc_obj._id)) {
+        _warned_no_account_project_id.add(acc_obj._id);
+        console.warn(`[get_active_account_profile_info] acc ${acc_obj._id} has no account_project_id; returning null`);
+      }
+      return { uid, account_profile_id: null, app_id: null, is_main: false, account_profile_obj: null };
+    }
 
-    let active_account_profile_id = profile_id || acc_obj.account_info.active_account_profile_id;
+    // Fallback chain: explicit profile_id > active_account_profile_id > top-level account_profile_id.
+    // Recovers gracefully from accounts where active_account_profile_id was never set during boarding
+    // (e.g. interrupted Google signup flow), instead of throwing on every chat-widget poll.
+    let active_account_profile_id = profile_id || acc_obj.account_info?.active_account_profile_id || acc_obj.account_profile_id;
 
-    if (!active_account_profile_id) throw new Error(`acc ${acc_obj._id} has no active_account_profile_id`);
+    if (!active_account_profile_id) {
+      // Soft-fail: log once and return a degraded response. Callers that need a real profile
+      // should null-check `account_profile_obj`. The chat widget treats this as anonymous visitor.
+      console.warn(`[get_active_account_profile_info] acc ${acc_obj._id} has neither active_account_profile_id nor account_profile_id; returning null`);
+      return { uid, account_profile_id: null, app_id: acc_obj.account_project_id, is_main: false, account_profile_obj: null };
+    }
 
     const account_profile_obj = await db_module.get_app_couch_doc_native(acc_obj.account_project_id, active_account_profile_id);
     if (account_profile_obj.share_item_id) {
@@ -1955,13 +2476,13 @@ export const onboarding_completed = async function (req, job_id, headers) {
 
     let account_doc = await db_module.get_couch_doc_native('xuda_accounts', uid);
 
-    if (!account_doc.account_info?.profile_picture) {
-      throw new Error(`missing profile_picture`);
-    }
-
-    if (!account_doc.account_info?.profile_avatar) {
-      throw new Error(`missing profile_avatar`);
-    }
+    // NOTE: neither profile_picture nor profile_avatar are required
+    // to complete onboarding. The client UI labels step 4 "(optional)"
+    // and lets the user skip — matching that here means a successful
+    // client flow always succeeds server-side too. Anything they skip
+    // can be added later from Settings → Profile. The avatar service
+    // can also time out or fail transiently, and we don't want a
+    // generation hiccup to block someone from finishing signup.
 
     account_doc.account_info.full_name = `${account_doc.account_info.first_name} ${account_doc.account_info.last_name}`;
 
@@ -3238,11 +3759,11 @@ export const get_account_profiles = async function (req) {
   let profile_docs = { docs: [], total_docs: profiles.total_docs };
   for await (let doc of profiles.docs) {
     doc = await get_account_profile_info(uid, doc);
-    // if (doc.main) {
-    //   profile_docs.docs.unshift(doc);
-    // } else {
-    profile_docs.docs.push(doc);
-    // }
+    if (doc.main) {
+      profile_docs.docs.unshift(doc);
+    } else {
+      profile_docs.docs.push(doc);
+    }
   }
 
   if (!profile_id) {
@@ -3253,17 +3774,16 @@ export const get_account_profiles = async function (req) {
     }
   }
 
-  if (filter_type === 'all' && !profile_id && !search && active_tab && profile_docs.docs[0].main) {
-    //profile_docs.docs.length === 1 &&
-    // return empty state if no custom profile defined by user
-    return {
-      code: 1,
-      data: {
-        docs: [],
-        total_docs: 0,
-      },
-    };
-  }
+  // if (filter_type === 'all' && !profile_id && !search && active_tab && profile_docs.docs.length === 1 && profile_docs.docs[0].main) {
+  //   // return empty state if no custom profile defined by user
+  //   return {
+  //     code: 1,
+  //     data: {
+  //       docs: [],
+  //       total_docs: 0,
+  //     },
+  //   };
+  // }
 
   return {
     code: 1,
@@ -3881,6 +4401,7 @@ export const read_accounts_emails = async function () {
   const active_accounts = await db_module.find_couch_query('xuda_accounts', { selector: { stat: 3, docType: 'account' }, limit: 99999 });
   for await (let account_doc of active_accounts.docs) {
     if (!account_doc?.account_info?.active_account_profile_id) continue;
+    if (account_doc.membership_plan == 'free' && account_doc.ai_workspace_plan == 'free_ai_workspace') continue;
     email_msa.refresh_mailboxes({ uid: account_doc._id });
   }
 };

package/index_ms.mjs

@@ -33,6 +33,35 @@ export const increment_account_usage = async function (...args) {
   return await broker.send_to_queue("increment_account_usage", ...args);
 };
 
+// accrue_deployment_costs removed — on-demand billing computes
+// from app_cost timestamps. See compute_cycle_billable_amount in
+// deploy_module/cost.mjs and the get_billing_metrics +
+// flush_deployment_usage_to_stripe entry points in stripe_module.
+
+export const backfill_app_costs = async function (...args) {
+  return await broker.send_to_queue("backfill_app_costs", ...args);
+};
+
+export const mark_app_terminated = async function (...args) {
+  return await broker.send_to_queue("mark_app_terminated", ...args);
+};
+
+export const recompute_abuse_signals = async function (...args) {
+  return await broker.send_to_queue("recompute_abuse_signals", ...args);
+};
+
+export const get_flagged_accounts = async function (...args) {
+  return await broker.send_to_queue("get_flagged_accounts", ...args);
+};
+
+export const mark_account_reviewed = async function (...args) {
+  return await broker.send_to_queue("mark_account_reviewed", ...args);
+};
+
+export const sweep_abuse_signals = async function (...args) {
+  return await broker.send_to_queue("sweep_abuse_signals", ...args);
+};
+
 export const get_account_data = async function (...args) {
   return await broker.send_to_queue("get_account_data", ...args);
 };

package/index_msa.mjs

@@ -33,6 +33,33 @@ export const increment_account_usage =  function (...args) {
    broker.send_to_queue_async("increment_account_usage", ...args);
 };
 
+// accrue_deployment_costs removed — on-demand billing. See
+// compute_cycle_billable_amount in deploy_module/cost.mjs.
+
+export const backfill_app_costs = function (...args) {
+  broker.send_to_queue_async("backfill_app_costs", ...args);
+};
+
+export const mark_app_terminated = function (...args) {
+  broker.send_to_queue_async("mark_app_terminated", ...args);
+};
+
+export const recompute_abuse_signals = function (...args) {
+  broker.send_to_queue_async("recompute_abuse_signals", ...args);
+};
+
+export const get_flagged_accounts = function (...args) {
+  broker.send_to_queue_async("get_flagged_accounts", ...args);
+};
+
+export const mark_account_reviewed = function (...args) {
+  broker.send_to_queue_async("mark_account_reviewed", ...args);
+};
+
+export const sweep_abuse_signals = function (...args) {
+  broker.send_to_queue_async("sweep_abuse_signals", ...args);
+};
+
 export const get_account_data =  function (...args) {
    broker.send_to_queue_async("get_account_data", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.2255",
+  "version": "1.2.2257",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {

package/scripts/run_backfill.mjs

@@ -0,0 +1,51 @@
+// One-shot backfill runner.
+//
+// Usage (from /var/xuda on dev/prod, with XUDA_HOME and XUDA_CONFIG set
+// the same way the cpi services have them):
+//
+//   node cpi/account_module/scripts/run_backfill.mjs           # full backfill
+//   node cpi/account_module/scripts/run_backfill.mjs --dry-run # compute, don't save
+//   node cpi/account_module/scripts/run_backfill.mjs --limit=5 # first 5 docs only
+//   node cpi/account_module/scripts/run_backfill.mjs --app-id=vps-abc123  # one doc
+//
+// Idempotent — safe to re-run if the first pass errored partway.
+// Each doc with a populated app_cost.last_billed_ts is silently
+// skipped on subsequent runs.
+
+import path from 'path';
+
+if (!global._conf) {
+  global._conf = (
+    await import(path.join(process.env.XUDA_HOME, process.env.XUDA_CONFIG), {
+      with: { type: 'json' },
+    })
+  ).default;
+}
+
+const argv = process.argv.slice(2);
+const opts = {};
+for (const a of argv) {
+  if (a === '--dry-run') opts.dry_run = true;
+  else if (a.startsWith('--limit=')) opts.limit = parseInt(a.split('=')[1], 10);
+  else if (a.startsWith('--app-id=')) opts.app_id = a.split('=')[1];
+  else console.warn(`Unknown arg: ${a}`);
+}
+
+const module_path = path.join(process.env.XUDA_HOME, 'cpi') + (!_conf.is_debug ? '/node_modules/@xuda.io' : '');
+const { backfill_app_costs } = await import(`${module_path}/account_module/index.mjs`);
+
+console.log('Running backfill with opts:', opts);
+const summary = await backfill_app_costs(opts);
+
+const { per_doc, ...headline } = summary;
+console.log('\n=== Backfill summary ===');
+console.log(JSON.stringify(headline, null, 2));
+
+if (per_doc?.length) {
+  const fs = await import('fs');
+  const out = path.join(process.env.XUDA_HOME || process.cwd(), `backfill_app_cost_log_${Date.now()}.json`);
+  fs.writeFileSync(out, JSON.stringify(per_doc, null, 2));
+  console.log(`\nPer-doc log written to: ${out}`);
+}
+
+process.exit(summary.errors?.length ? 1 : 0);

package/scripts/run_migrate_account.mjs

@@ -0,0 +1,54 @@
+// Migrate a single account from legacy 3-subscription model to the
+// consolidated 1-subscription-with-3-items model.
+//
+// Usage (from /var/xuda on dev/prod, with XUDA_HOME and XUDA_CONFIG set):
+//
+//   node cpi/account_module/scripts/run_migrate_account.mjs --uid=<UID>
+//   node cpi/account_module/scripts/run_migrate_account.mjs --uid=<UID> --dry-run
+//
+// Idempotent — running on an already-consolidated account is a no-op.
+// Use --dry-run first to preview which subs would be cancelled and
+// when the new sub would start billing.
+
+import path from 'path';
+
+if (!global._conf) {
+  global._conf = (
+    await import(path.join(process.env.XUDA_HOME, process.env.XUDA_CONFIG), {
+      with: { type: 'json' },
+    })
+  ).default;
+}
+
+const argv = process.argv.slice(2);
+const opts = {};
+for (const a of argv) {
+  if (a === '--dry-run') opts.dry_run = true;
+  else if (a.startsWith('--uid=')) opts.uid = a.split('=')[1];
+  else console.warn(`Unknown arg: ${a}`);
+}
+
+if (!opts.uid) {
+  console.error('--uid=<UID> is required');
+  process.exit(1);
+}
+
+const module_path = path.join(process.env.XUDA_HOME, 'cpi') + (!_conf.is_debug ? '/node_modules/@xuda.io' : '');
+const { migrate_account_to_consolidated } = await import(`${module_path}/stripe_module/index.mjs`);
+
+console.log(`Migrating account ${opts.uid}${opts.dry_run ? ' (DRY RUN)' : ''}...`);
+const result = await migrate_account_to_consolidated(opts);
+console.log('\n=== Result ===');
+console.log(JSON.stringify(result, null, 2));
+
+if (result.code === 1) {
+  if (opts.dry_run) {
+    console.log('\nDry run complete. Re-run without --dry-run to actually migrate.');
+  } else {
+    console.log(`\n✓ Account ${opts.uid} migrated. New sub will start billing at unix ts ${result.data?.starts_billing_at_unix_ts}.`);
+  }
+  process.exit(0);
+} else {
+  console.error(`\n✗ Migration failed: ${result.data}`);
+  process.exit(1);
+}

package/scripts/run_migrate_all.mjs

@@ -0,0 +1,109 @@
+// Bulk migrate EVERY account from the legacy 3-subscription model to
+// the consolidated 1-subscription-with-3-items model.
+//
+// Idempotent — accounts already on the consolidated model return
+// "already consolidated" and are skipped silently. Per-account errors
+// don't stop the loop; the summary at the end lists what failed.
+//
+// Usage (from /var/xuda on dev/prod, with XUDA_HOME and XUDA_CONFIG set):
+//
+//   node cpi/account_module/scripts/run_migrate_all.mjs --dry-run
+//   node cpi/account_module/scripts/run_migrate_all.mjs
+//   node cpi/account_module/scripts/run_migrate_all.mjs --limit=5  # canary first N
+//
+// On dev this is fine to run at any time. On prod, prefer the
+// per-account script (run_migrate_account.mjs) or the webhook-driven
+// gradual migration so each customer migrates at their natural
+// cycle boundary.
+
+import path from 'path';
+
+if (!global._conf) {
+  global._conf = (
+    await import(path.join(process.env.XUDA_HOME, process.env.XUDA_CONFIG), {
+      with: { type: 'json' },
+    })
+  ).default;
+}
+
+const argv = process.argv.slice(2);
+const opts = { dry_run: false, limit: null };
+for (const a of argv) {
+  if (a === '--dry-run') opts.dry_run = true;
+  else if (a.startsWith('--limit=')) opts.limit = parseInt(a.split('=')[1], 10);
+  else console.warn(`Unknown arg: ${a}`);
+}
+
+const module_path = path.join(process.env.XUDA_HOME, 'cpi') + (!_conf.is_debug ? '/node_modules/@xuda.io' : '');
+const db_module = await import(`${module_path}/db_module/index.mjs`);
+const { migrate_account_to_consolidated } = await import(`${module_path}/stripe_module/index.mjs`);
+
+console.log(`Bulk migration ${opts.dry_run ? '(DRY RUN)' : ''}${opts.limit ? ` limit=${opts.limit}` : ''}...`);
+
+const accounts_ret = await db_module.get_couch_view_raw('xuda_accounts', 'all_accounts', {});
+const accounts = (accounts_ret?.rows || []).map((r) => r.value).filter((a) => a?._id);
+
+console.log(`Found ${accounts.length} accounts.\n`);
+
+const summary = {
+  scanned: 0,
+  migrated: 0,
+  already: 0,
+  skipped_no_stripe: 0,
+  failed: 0,
+  errors: [],
+  per_account: [],
+};
+
+const todo = opts.limit ? accounts.slice(0, opts.limit) : accounts;
+
+for (const acct of todo) {
+  summary.scanned++;
+
+  // Skip accounts that don't have any Stripe presence yet (e.g.
+  // half-created test accounts) — there's nothing to migrate.
+  if (!acct.stripe_customer_id) {
+    summary.skipped_no_stripe++;
+    summary.per_account.push({ uid: acct._id, action: 'skipped', reason: 'no stripe_customer_id' });
+    continue;
+  }
+
+  try {
+    const result = await migrate_account_to_consolidated({ uid: acct._id, dry_run: opts.dry_run });
+    if (result.code === 1) {
+      const data = result.data || '';
+      const isAlready = typeof data === 'string' && (data.includes('already') || data.includes('reconciled'));
+      if (isAlready) {
+        summary.already++;
+        summary.per_account.push({ uid: acct._id, action: 'already', reason: data });
+      } else {
+        summary.migrated++;
+        summary.per_account.push({ uid: acct._id, action: opts.dry_run ? 'dry-run-ok' : 'migrated', reason: typeof data === 'object' ? `new_sub=${data.new_sub_id} starts=${data.starts_billing_at_unix_ts}` : data });
+      }
+    } else {
+      summary.failed++;
+      summary.errors.push({ uid: acct._id, reason: result.data });
+      summary.per_account.push({ uid: acct._id, action: 'failed', reason: result.data });
+    }
+  } catch (err) {
+    summary.failed++;
+    summary.errors.push({ uid: acct._id, reason: err.message });
+    summary.per_account.push({ uid: acct._id, action: 'errored', reason: err.message });
+  }
+
+  // Tiny gap between accounts so we don't hammer Stripe with bursts.
+  await new Promise((r) => setTimeout(r, 250));
+}
+
+const { per_account, ...headline } = summary;
+console.log('\n=== Bulk migration summary ===');
+console.log(JSON.stringify(headline, null, 2));
+
+if (per_account.length) {
+  const fs = await import('fs');
+  const out = path.join(process.env.XUDA_HOME || process.cwd(), `bulk_migrate_log_${Date.now()}.json`);
+  fs.writeFileSync(out, JSON.stringify(per_account, null, 2));
+  console.log(`\nPer-account log written to: ${out}`);
+}
+
+process.exit(summary.failed ? 1 : 0);