akeso-check 0.1.0

package/README.md

@@ -0,0 +1,63 @@
+# Akeso Check
+
+Tests whether your Stripe-backed app grants and revokes paid access correctly.
+When someone pays, cancels, fails a card, or gets a refund, does your app get
+it right? Grade A to F, in plain English.
+
+Runs on your machine. Nothing leaves it.
+
+## Use
+
+In your project folder:
+
+```
+npx akeso-check
+```
+
+Reads your code, writes `akeso-report.html`, and opens it. Seconds.
+
+The full test, with your dev server running:
+
+```
+npx akeso-check --lifecycle-url http://localhost:3000
+```
+
+A pretend customer is run through ten billing situations: checkout, trial end,
+renewal, a failing card, cancel at period end, immediate cancel, reactivation,
+refund, the same event delivered twice, events out of order. After each one,
+your app's own code is asked whether that customer still has paid access. The
+report gets the graded results. About a minute.
+
+Options:
+
+- `--account <id>` run every scenario against one real account id (for deployed
+  test environments; the account is reset between scenarios)
+- `--webhook-secret <whsec_...>` override the signing secret (normally read
+  from your project's env files, locally)
+- `--html <path>` where to write the report
+- `--no-open` do not open the report
+- `--json` machine-readable output instead
+
+## Privacy
+
+There is no account and no server. Your code, keys, and customer data are read
+locally and sent nowhere. The report is a file on your disk. The package has
+zero dependencies and every line is plain JavaScript you can read.
+
+Lifecycle tests refuse to run against a project configured with a live-mode
+Stripe key. The temporary access probe it adds during a run is removed when
+the run ends, and it never writes anything else to your app.
+
+## Honesty rules
+
+- Every result comes from an executed run. Nothing is stubbed.
+- A dead server, a rejected delivery, or any failure of the tool itself is
+  reported as "could not test", never as your app's grade.
+- A pass that cannot be proven (for example, access that was already on) is
+  reported as not provable, never as a pass.
+
+## Covers
+
+Stripe Billing subscriptions on Next.js or Node apps with Postgres or
+Supabase. One plan field, one active subscription per account. Anything else
+is out of scope and the report says so.

package/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: akeso-check
+description: Test whether this Stripe-backed app grants and revokes paid access correctly. Run when the user asks to check their billing, paywall, subscription access, or Stripe webhooks. Nothing leaves the machine.
+---
+
+You are running Akeso Check inside the user's own project. Nothing is
+transmitted anywhere; every credential stays in their env files.
+
+1. Run `node <akeso-check>/bin/akeso-check.mjs .` and read the JSON with
+   `--json` if needed.
+2. If a webhook handler was found and a TEST-mode Stripe key exists, start the
+   user's dev server, then rerun with
+   `--lifecycle-url http://localhost:<port> --html akeso-report.html --open`.
+3. Never run lifecycle scenarios against a live-mode key. If only a live key
+   exists, say so and stop at static analysis.
+4. Open the report for the user and summarise the grade in one sentence of
+   plain English. Do not soften an F.

package/bin/akeso-check.mjs

@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { readFile, writeFile } from "node:fs/promises";
+import { detect } from "../src/detect.mjs";
+import { runLifecycle } from "../src/lifecycle.mjs";
+import { renderReport } from "../src/report.mjs";
+import { installProbe, removeProbe } from "../src/probe.mjs";
+
+/* The whole Check, in the order a stranger meets it:
+ *   npx akeso-check                    → static pass, graded report, opens
+ *   npx akeso-check --lifecycle-url http://localhost:3000
+ *                                      → probe auto-installed, scenarios run,
+ *                                        probe removed, merged report, opens
+ * Options: --account <id> (map scenarios onto one real account, reset between),
+ * --webhook-secret <whsec_…>, --html <path>, --no-open, --json.
+ * Every default favours the founder who read nothing: something visible always
+ * comes out, and the terminal always says what to do next. */
+
+const args = process.argv.slice(2);
+const flagValue = (name) => {
+  const i = args.indexOf(name);
+  return i !== -1 ? args[i + 1] : null;
+};
+const root = path.resolve(args[0] && !args[0].startsWith("--") ? args[0] : process.cwd());
+
+const detection = await detect(root);
+
+/* The webhook signing secret comes from the project's own env files, read
+   locally and never printed. A shell export or flag can override. */
+async function projectWebhookSecret() {
+  const flag = flagValue("--webhook-secret");
+  if (flag) return flag;
+  if (process.env.STRIPE_WEBHOOK_SECRET) return process.env.STRIPE_WEBHOOK_SECRET;
+  for (const file of [".env.local", ".env", ".env.development.local", ".env.development"]) {
+    const text = await readFile(path.join(root, file), "utf8").catch(() => null);
+    if (!text) continue;
+    const match = text.match(/^\s*STRIPE_WEBHOOK_SECRET\s*=\s*"?([^"\s#]+)/m);
+    if (match) return match[1];
+  }
+  return null;
+}
+
+async function probeAnswers(url) {
+  try {
+    const response = await fetch(`${url}?account=akeso-warmup`, { signal: AbortSignal.timeout(4000) });
+    if (!response.ok) return false;
+    const body = await response.json();
+    return typeof body.billingEntitled === "boolean";
+  } catch { return false; }
+}
+
+let lifecycle = null;
+let probeNote = null;
+const base = (flagValue("--lifecycle-url") || "").replace(/\/$/, "");
+if (base) {
+  /* The promise on the tin: lifecycle tests never run against a live-mode
+     setup. Delivered events can change entitlement state in whatever database
+     the target app writes to. */
+  if (detection.stripe.liveKeyPresent && !detection.stripe.lifecycleTestable) {
+    console.error("\nThis project is configured with a LIVE Stripe key.");
+    console.error("The lifecycle test changes entitlement state in the app it points at,");
+    console.error("so it only runs against test-mode projects. Switch your env to a test");
+    console.error("key (sk_test_...) and run it again.\n");
+    process.exit(1);
+  }
+  const edgeFunction = detection.webhookHandlers[0]?.file.match(/^supabase\/functions\/([^/]+)\//)?.[1];
+  const webhookPath = edgeFunction
+    ? `/functions/v1/${edgeFunction}`
+    : detection.webhookHandlers[0]
+      ? "/" + detection.webhookHandlers[0].file.replace(/^app/, "api").replace(/\/route\.(ts|js|mjs|tsx)$/, "").replace(/^api\/api/, "api")
+      : "/api/stripe/webhook";
+  const webhookUrl = `${base}${webhookPath.startsWith("/api") || webhookPath.startsWith("/functions") ? webhookPath : "/api/stripe/webhook"}`;
+
+  const secret = await projectWebhookSecret();
+  if (!secret) {
+    console.error("\nNo STRIPE_WEBHOOK_SECRET found in this project's env files.");
+    console.error("The lifecycle pass signs events the way Stripe does, with your app's own");
+    console.error("signing secret. Without it every delivery would be rejected as forged.");
+    console.error("Add it to .env.local, or pass --webhook-secret whsec_…\n");
+    process.exit(1);
+  }
+
+  /* Find a probe, or install the temporary one and let the dev server pick it
+     up. Removal happens no matter how the run ends. */
+  let probeUrl = null;
+  let installed = null;
+  for (const candidate of [`${base}/api/__akeso_probe`, `${base}/__akeso_probe`]) {
+    if (await probeAnswers(candidate)) { probeUrl = candidate; break; }
+  }
+  if (!probeUrl) {
+    installed = await installProbe(root, detection);
+    if (!installed.wired) {
+      probeNote = `A probe stub was written to ${path.relative(root, installed.routeFile)}. The Check could not safely pick your access function (${installed.reason}). Complete the two marked lines (or ask your coding agent to), then run this again.`;
+      await removeProbe(installed.routeFile).catch(() => {});
+      installed = null;
+    } else {
+      process.stdout.write(`\nAdded a temporary probe (${path.relative(root, installed.routeFile)}, removed after the run), waiting for your dev server to pick it up`);
+      const candidate = `${base}${installed.urlPath}`;
+      for (let i = 0; i < 30 && !probeUrl; i += 1) {
+        if (await probeAnswers(candidate)) probeUrl = candidate;
+        else { process.stdout.write("."); await new Promise((r) => setTimeout(r, 1000)); }
+      }
+      console.log();
+      if (!probeUrl) probeNote = "The temporary probe never came up at " + candidate + ". Is the dev server running at that address? Start it and run this again.";
+    }
+  }
+
+  if (probeUrl) {
+    const account = flagValue("--account");
+    const local = /^https?:\/\/(localhost|127\.0\.0\.1)/.test(base);
+    try {
+      lifecycle = await runLifecycle({
+        webhookUrl,
+        probeUrl,
+        webhookSecret: secret,
+        ...(account ? { accountFor: () => account, resetBeforeEach: true } : {}),
+        settleMs: local ? 150 : 1000,
+      });
+    } finally {
+      if (installed) await removeProbe(installed.routeFile).catch(() => {});
+    }
+  }
+}
+
+if (args.includes("--json")) {
+  console.log(JSON.stringify({ detection, lifecycle }, null, 2));
+  process.exit(0);
+}
+
+const { framework, stripe, database, webhookHandlers, accessDecisionSites, capabilities } = detection;
+
+console.log(`\nAkeso Check: looking at ${root}`);
+console.log(`Scanned ${detection.scannedFiles} source files.\n`);
+
+console.log(`App        : ${framework.framework}${framework.packageName ? ` (${framework.packageName})` : ""}`);
+console.log(`Stripe     : ${stripe.secretKey ? `${stripe.secretKey.mode} key ending …${stripe.secretKey.lastFour}` : "no key found"}${stripe.sdkInstalled ? "" : stripe.secretKey ? " (SDK not installed)" : ""}`);
+console.log(`Database   : ${database.kind}${database.supabase ? ` (${database.supabase.urlHost})` : ""}`);
+
+if (webhookHandlers.length) {
+  const handler = webhookHandlers[0];
+  console.log(`\nWebhook handler: ${handler.file}`);
+  console.log(`  signature verified : ${handler.verifiesSignature ? "yes" : "NOT SEEN. Anyone could forge events"}`);
+  console.log(`  raw body handling  : ${handler.rawBodySeen ? "seen" : "not seen. Verification may fail at runtime"}`);
+  console.log(`  events handled     : ${handler.handledEvents.length ? handler.handledEvents.join(", ") : "none of the required set"}`);
+  if (handler.missingEvents.length) console.log(`  events MISSING     : ${handler.missingEvents.join(", ")}`);
+} else {
+  console.log("\nWebhook handler: none found.");
+}
+
+if (accessDecisionSites.length) {
+  console.log("\nWhere paid access appears to be decided (ranked, needs confirming):");
+  for (const site of accessDecisionSites.slice(0, 5)) {
+    console.log(`  ${String(site.score).padStart(2)}  ${site.file}${site.clientSideOnly ? "  [client-side, bypassable]" : ""}`);
+    console.log(`      ${site.evidence.join("; ")}`);
+  }
+} else {
+  console.log("\nWhere paid access is decided: could not find any candidate.");
+}
+
+if (lifecycle) {
+  console.log(`\nLifecycle: grade ${lifecycle.grade.letter}. ${lifecycle.grade.reason}`);
+  for (const result of lifecycle.results) {
+    const mark = result.outcome === "pass" ? "✓" : result.outcome === "fail" ? "✗" : "—";
+    console.log(`  ${mark} ${result.name}`);
+  }
+}
+if (probeNote) console.log(`\n⚠ ${probeNote}`);
+for (const blocker of capabilities.blockers) console.log(`⚠ ${blocker}`);
+
+/* Something visible always comes out: the report, and the next step. */
+const out = flagValue("--html") || path.join(root, "akeso-report.html");
+await writeFile(out, renderReport({ detection, lifecycle }));
+console.log(`\nReport: ${out}`);
+if (process.env.CODESPACES) {
+  console.log(`To view it: right-click ${path.basename(out)} in the file list on the left and choose Download, then open the downloaded file.`);
+} else if (!args.includes("--no-open")) {
+  const { spawn } = await import("node:child_process");
+  spawn(process.platform === "darwin" ? "open" : "xdg-open", [out], { stdio: "ignore", detached: true });
+}
+
+if (!lifecycle && !probeNote) {
+  if (detection.webhookHandlers[0]?.file.startsWith("supabase/functions/")) {
+    console.log(`\nThis app's webhook is a Supabase Edge Function. The full pretend-customer`);
+    console.log(`test for that shape is not supported yet; the report above covers`);
+    console.log(`everything that can be read from the code.`);
+  } else {
+    console.log(`\nNext, the real test (a pretend customer pays, cancels, gets refunded):`);
+    console.log(`  1. start your dev server (usually: npm run dev)`);
+    console.log(`  2. npx akeso-check --lifecycle-url http://localhost:3000`);
+  }
+}
+console.log();

package/examples/report-broken.html

@@ -0,0 +1,72 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Akeso Check — broken-fixture</title>
+<style>
+  :root { --bg:#fcfcfd; --ink:#16181d; --ink2:#5b6270; --ink3:#8a919e; --line:#e6e8ec;
+    --ok:#12784b; --warn:#96620a; --bad:#b3261e; --note:#2f4a78; }
+  @media (prefers-color-scheme: dark) { :root { --bg:#111317; --ink:#e9ebef; --ink2:#a4abb8;
+    --ink3:#767d8a; --line:#282c34; --ok:#4cbe83; --warn:#dfa94c; --bad:#ef8578; --note:#8aa9dc; } }
+  * { box-sizing:border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink); font:16px/1.55 ui-sans-serif,-apple-system,system-ui,sans-serif; -webkit-font-smoothing:antialiased; }
+  .shell { max-width:640px; margin:0 auto; padding:40px 24px 100px; }
+  .local { font-size:12.5px; color:var(--ink3); border:1px solid var(--line); border-radius:20px; display:inline-block; padding:3px 12px; margin-bottom:34px; }
+  .gradeCard { border:1px solid var(--line); border-radius:10px; padding:30px 28px; display:flex; gap:26px; align-items:center; }
+  .gradeLetter { font-size:76px; font-weight:700; line-height:1; letter-spacing:-.04em; }
+  .g-A,.g-B { color:var(--ok); } .g-C { color:var(--warn); } .g-D,.g-F { color:var(--bad); } .g-\? { color:var(--ink3); }
+  .gradeCard h1 { margin:0 0 6px; font-size:22px; letter-spacing:-.02em; }
+  .gradeCard p { margin:0; color:var(--ink2); font-size:15px; }
+  .app { font-size:13px; color:var(--ink3); margin-top:10px; }
+  h2 { font-size:12px; font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--ink3); margin:44px 0 4px; }
+  .rows { border-top:1px solid var(--line); }
+  .row { display:flex; gap:12px; padding:11px 0; border-bottom:1px solid var(--line); align-items:baseline; font-size:15px; }
+  .mark { width:18px; text-align:center; flex:none; font-weight:600; }
+  .row.ok .mark { color:var(--ok); } .row.warn .mark { color:var(--warn); }
+  .row.bad .mark { color:var(--bad); } .row.bad .name { color:var(--bad); font-weight:600; }
+  .row.note .mark { color:var(--note); } .row.mute { color:var(--ink3); }
+  .name { flex:1; } .name.wide { flex:auto; }
+  .detail { color:var(--ink3); font-size:13.5px; text-align:right; max-width:40%; }
+  ul.limits { margin:8px 0 0; padding-left:20px; color:var(--ink2); font-size:14.5px; }
+  ul.limits li { margin-bottom:7px; }
+  .cta { margin-top:48px; border:1px solid var(--line); border-radius:10px; padding:22px 24px; }
+  .cta h3 { margin:0 0 6px; font-size:17px; } .cta p { margin:0 0 14px; color:var(--ink2); font-size:14.5px; }
+  .cta a { display:inline-block; background:var(--ink); color:var(--bg); text-decoration:none; border-radius:7px; padding:10px 18px; font-size:15px; font-weight:500; }
+  footer { margin-top:44px; font-size:12.5px; color:var(--ink3); }
+</style></head><body><div class="shell">
+  <div class="local">🔒 This report is a file on your computer. Nothing was sent anywhere.</div>
+  <div class="gradeCard">
+    <div class="gradeLetter g-F">F</div>
+    <div>
+      <h1>Canceled customers keep paid access.</h1>
+      <p>Customers who cancel keep their paid access. This leaks money every day until it is fixed.</p>
+      <div class="app">broken-fixture · next-app-router · supabase · Stripe test</div>
+    </div>
+  </div>
+
+  <h2>What a pretend customer went through</h2>
+  <div class="rows"><div class="row ok"><span class="mark">✓</span><span class="name">New payment unlocks access</span><span class="detail"></span></div>
+<div class="row warn"><span class="mark">✗</span><span class="name">Trial ends, subscription becomes active</span><span class="detail">expected access, the app says no access</span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Monthly renewal payment keeps access</span><span class="detail"></span></div>
+<div class="row warn"><span class="mark">✗</span><span class="name">Card fails, retries exhaust: access ends</span><span class="detail">expected no access, the app says access</span></div>
+<div class="row bad"><span class="mark">✗</span><span class="name">Customer cancels; period ends: access ends</span><span class="detail">expected no access, the app says access</span></div>
+<div class="row bad"><span class="mark">✗</span><span class="name">Immediate cancellation removes access</span><span class="detail">expected no access, the app says access</span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Customer un-cancels before the period ends</span><span class="detail"></span></div>
+<div class="row note"><span class="mark">•</span><span class="name">Latest charge refunded (follows the app's own policy)</span><span class="detail">app's policy: keeps access</span></div>
+<div class="row warn"><span class="mark">✗</span><span class="name">The same event delivered twice</span><span class="detail">expected no access, the app says access</span></div>
+<div class="row warn"><span class="mark">✗</span><span class="name">An old 'still active' event arrives after cancellation</span><span class="detail">expected no access, the app says access</span></div></div>
+
+  <h2>What the code itself shows</h2>
+  <div class="rows"><div class="row bad"><span class="mark">✗</span><span class="name wide">The webhook handler does not verify Stripe's signature. Anyone who finds the URL can forge payment events.</span></div>
+<div class="row warn"><span class="mark">!</span><span class="name wide">The handler ignores 6 of the 7 lifecycle events: invoice.paid, invoice.payment_failed, customer.subscription.created, customer.subscription.updated, customer.subscription.deleted, charge.refunded.</span></div></div>
+
+  <h2>What this did not check</h2>
+  <ul class="limits"><li>Only the billing lifecycle was tested — not login, checkout UI, or anything else.</li>
+<li>Events were delivered locally with your app's own webhook secret. If your handler re-fetches objects from Stripe's API, run the sandbox mode with your Stripe test key for full fidelity.</li></ul>
+
+  <div class="cta">
+    <h3>Want this fixed?</h3>
+    <p>The Fix Plan is an automated repair — signature verification, every lifecycle event handled, and a nightly self-check — delivered as a pull request you (or your coding agent) apply. Then re-run this Check and watch it go green.</p>
+    <a href="https://akeso.dev/fix">Get the Fix Plan — $49</a>
+  </div>
+
+  <footer>Akeso Check · 2026-08-30 20:08 · 10 lifecycle scenarios · local run</footer>
+</div></body></html>

package/examples/report-fixed.html

@@ -0,0 +1,67 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Akeso Check — fixed-fixture</title>
+<style>
+  :root { --bg:#fcfcfd; --ink:#16181d; --ink2:#5b6270; --ink3:#8a919e; --line:#e6e8ec;
+    --ok:#12784b; --warn:#96620a; --bad:#b3261e; --note:#2f4a78; }
+  @media (prefers-color-scheme: dark) { :root { --bg:#111317; --ink:#e9ebef; --ink2:#a4abb8;
+    --ink3:#767d8a; --line:#282c34; --ok:#4cbe83; --warn:#dfa94c; --bad:#ef8578; --note:#8aa9dc; } }
+  * { box-sizing:border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink); font:16px/1.55 ui-sans-serif,-apple-system,system-ui,sans-serif; -webkit-font-smoothing:antialiased; }
+  .shell { max-width:640px; margin:0 auto; padding:40px 24px 100px; }
+  .local { font-size:12.5px; color:var(--ink3); border:1px solid var(--line); border-radius:20px; display:inline-block; padding:3px 12px; margin-bottom:34px; }
+  .gradeCard { border:1px solid var(--line); border-radius:10px; padding:30px 28px; display:flex; gap:26px; align-items:center; }
+  .gradeLetter { font-size:76px; font-weight:700; line-height:1; letter-spacing:-.04em; }
+  .g-A,.g-B { color:var(--ok); } .g-C { color:var(--warn); } .g-D,.g-F { color:var(--bad); } .g-\? { color:var(--ink3); }
+  .gradeCard h1 { margin:0 0 6px; font-size:22px; letter-spacing:-.02em; }
+  .gradeCard p { margin:0; color:var(--ink2); font-size:15px; }
+  .app { font-size:13px; color:var(--ink3); margin-top:10px; }
+  h2 { font-size:12px; font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--ink3); margin:44px 0 4px; }
+  .rows { border-top:1px solid var(--line); }
+  .row { display:flex; gap:12px; padding:11px 0; border-bottom:1px solid var(--line); align-items:baseline; font-size:15px; }
+  .mark { width:18px; text-align:center; flex:none; font-weight:600; }
+  .row.ok .mark { color:var(--ok); } .row.warn .mark { color:var(--warn); }
+  .row.bad .mark { color:var(--bad); } .row.bad .name { color:var(--bad); font-weight:600; }
+  .row.note .mark { color:var(--note); } .row.mute { color:var(--ink3); }
+  .name { flex:1; } .name.wide { flex:auto; }
+  .detail { color:var(--ink3); font-size:13.5px; text-align:right; max-width:40%; }
+  ul.limits { margin:8px 0 0; padding-left:20px; color:var(--ink2); font-size:14.5px; }
+  ul.limits li { margin-bottom:7px; }
+  .cta { margin-top:48px; border:1px solid var(--line); border-radius:10px; padding:22px 24px; }
+  .cta h3 { margin:0 0 6px; font-size:17px; } .cta p { margin:0 0 14px; color:var(--ink2); font-size:14.5px; }
+  .cta a { display:inline-block; background:var(--ink); color:var(--bg); text-decoration:none; border-radius:7px; padding:10px 18px; font-size:15px; font-weight:500; }
+  footer { margin-top:44px; font-size:12.5px; color:var(--ink3); }
+</style></head><body><div class="shell">
+  <div class="local">🔒 This report is a file on your computer. Nothing was sent anywhere.</div>
+  <div class="gradeCard">
+    <div class="gradeLetter g-A">A</div>
+    <div>
+      <h1>Your billing lifecycle holds up.</h1>
+      <p>Every lifecycle scenario passed.</p>
+      <div class="app">fixed-fixture · next-app-router · supabase · Stripe test</div>
+    </div>
+  </div>
+
+  <h2>What a pretend customer went through</h2>
+  <div class="rows"><div class="row ok"><span class="mark">✓</span><span class="name">New payment unlocks access</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Trial ends, subscription becomes active</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Monthly renewal payment keeps access</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Card fails, retries exhaust: access ends</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Customer cancels; period ends: access ends</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Immediate cancellation removes access</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Customer un-cancels before the period ends</span><span class="detail"></span></div>
+<div class="row note"><span class="mark">•</span><span class="name">Latest charge refunded (follows the app's own policy)</span><span class="detail">app's policy: removes access</span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">The same event delivered twice</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">An old 'still active' event arrives after cancellation</span><span class="detail"></span></div></div>
+
+  <h2>What the code itself shows</h2>
+  <div class="rows"><div class="row ok"><span class="mark">✓</span><span class="name wide">Signature verified against the raw body, and all 7 lifecycle events are handled.</span></div></div>
+
+  <h2>What this did not check</h2>
+  <ul class="limits"><li>Only the billing lifecycle was tested — not login, checkout UI, or anything else.</li>
+<li>Events were delivered locally with your app's own webhook secret. If your handler re-fetches objects from Stripe's API, run the sandbox mode with your Stripe test key for full fidelity.</li></ul>
+
+  
+
+  <footer>Akeso Check · 2026-08-30 20:08 · 10 lifecycle scenarios · local run</footer>
+</div></body></html>

package/examples/report-reelpals-broken.html

@@ -0,0 +1,68 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Akeso Check · watch-this</title>
+<style>
+  :root { --bg:#fcfcfd; --ink:#16181d; --ink2:#5b6270; --ink3:#8a919e; --line:#e6e8ec;
+    --ok:#12784b; --warn:#96620a; --bad:#b3261e; --note:#2f4a78; }
+  @media (prefers-color-scheme: dark) { :root { --bg:#111317; --ink:#e9ebef; --ink2:#a4abb8;
+    --ink3:#767d8a; --line:#282c34; --ok:#4cbe83; --warn:#dfa94c; --bad:#ef8578; --note:#8aa9dc; } }
+  * { box-sizing:border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink); font:16px/1.55 ui-sans-serif,-apple-system,system-ui,sans-serif; -webkit-font-smoothing:antialiased; }
+  .shell { max-width:640px; margin:0 auto; padding:40px 24px 100px; }
+  .local { font-size:12.5px; color:var(--ink3); border:1px solid var(--line); border-radius:20px; display:inline-block; padding:3px 12px; margin-bottom:34px; }
+  .gradeCard { border:1px solid var(--line); border-radius:10px; padding:30px 28px; display:flex; gap:26px; align-items:center; }
+  .gradeLetter { font-size:76px; font-weight:700; line-height:1; letter-spacing:-.04em; }
+  .g-A,.g-B { color:var(--ok); } .g-C { color:var(--warn); } .g-D,.g-F { color:var(--bad); } .g-\? { color:var(--ink3); }
+  .gradeCard h1 { margin:0 0 6px; font-size:22px; letter-spacing:-.02em; }
+  .gradeCard p { margin:0; color:var(--ink2); font-size:15px; }
+  .app { font-size:13px; color:var(--ink3); margin-top:10px; }
+  h2 { font-size:12px; font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--ink3); margin:44px 0 4px; }
+  .intro { margin:2px 0 12px; color:var(--ink2); font-size:14.5px; }
+  .rows { border-top:1px solid var(--line); }
+  .row { display:flex; gap:12px; padding:11px 0; border-bottom:1px solid var(--line); align-items:baseline; font-size:15px; }
+  .mark { width:18px; text-align:center; flex:none; font-weight:600; }
+  .row.ok .mark { color:var(--ok); } .row.warn .mark { color:var(--warn); }
+  .row.bad .mark { color:var(--bad); } .row.bad .name { color:var(--bad); font-weight:600; }
+  .row.note .mark { color:var(--note); } .row.mute { color:var(--ink3); }
+  .name { flex:1; } .name.wide { flex:auto; }
+  .detail { color:var(--ink3); font-size:13.5px; text-align:right; max-width:40%; }
+  ul.limits { margin:8px 0 0; padding-left:20px; color:var(--ink2); font-size:14.5px; }
+  ul.limits li { margin-bottom:7px; }
+  .cta { margin-top:48px; border:1px solid var(--line); border-radius:10px; padding:22px 24px; }
+  .cta h3 { margin:0 0 6px; font-size:17px; } .cta p { margin:0 0 14px; color:var(--ink2); font-size:14.5px; }
+  .cta a { display:inline-block; background:var(--ink); color:var(--bg); text-decoration:none; border-radius:7px; padding:10px 18px; font-size:15px; font-weight:500; }
+  footer { margin-top:44px; font-size:12.5px; color:var(--ink3); }
+</style></head><body><div class="shell">
+  <div class="local">This report is a file on your computer. Nothing was sent anywhere.</div>
+  <div class="gradeCard">
+    <div class="gradeLetter g-F">F</div>
+    <div>
+      <h1>Canceled customers keep paid access.</h1>
+      <p>This leaks money every day until it is fixed.</p>
+      <div class="app">watch-this, a Next.js app, with Supabase, Stripe test mode</div>
+    </div>
+  </div>
+
+  <h2>What we tested</h2>
+  <p class="intro">Akeso acted out ten billing situations against your app: paying, canceling, a failing card, a refund. After each one it asked your app the same question: does this customer still have paid access?</p>
+  <div class="rows"><div class="row ok"><span class="mark">✓</span><span class="name">New payment unlocks access</span><span class="detail"></span></div>
+<div class="row mute"><span class="mark">?</span><span class="name">Trial ends, subscription becomes active</span><span class="detail">not provable: access was already on when this scenario started</span></div>
+<div class="row mute"><span class="mark">?</span><span class="name">Monthly renewal payment keeps access</span><span class="detail">not provable: access was already on when this scenario started</span></div>
+<div class="row warn"><span class="mark">✗</span><span class="name">Card fails, retries exhaust: access ends</span><span class="detail">access should have ended, but your app still grants it</span></div>
+<div class="row bad"><span class="mark">✗</span><span class="name">Customer cancels; period ends: access ends</span><span class="detail">access should have ended, but your app still grants it</span></div>
+<div class="row bad"><span class="mark">✗</span><span class="name">Immediate cancellation removes access</span><span class="detail">access should have ended, but your app still grants it</span></div>
+<div class="row mute"><span class="mark">?</span><span class="name">Customer un-cancels before the period ends</span><span class="detail">not provable: access was already on when this scenario started</span></div>
+<div class="row note"><span class="mark">•</span><span class="name">Latest charge refunded (follows the app's own policy)</span><span class="detail">your app's policy: keeps access</span></div>
+<div class="row warn"><span class="mark">✗</span><span class="name">The same event delivered twice</span><span class="detail">access should have ended, but your app still grants it</span></div>
+<div class="row warn"><span class="mark">✗</span><span class="name">An old 'still active' event arrives after cancellation</span><span class="detail">access should have ended, but your app still grants it</span></div></div>
+
+  <h2>What your code shows</h2>
+  <p class="intro">Read from your webhook handler and access checks, before anything ran.</p>
+  <div class="rows"><div class="row warn"><span class="mark">!</span><span class="name wide">The handler ignores 6 of the 7 lifecycle events: invoice.paid, invoice.payment_failed, customer.subscription.created, customer.subscription.updated, customer.subscription.deleted, charge.refunded.</span></div></div>
+
+  <h2>What this did not check</h2>
+  <ul class="limits"><li>Only the billing lifecycle was tested. Not login, checkout UI, or anything else.</li>
+<li>Events were delivered locally with your app's own webhook secret. If your handler re-fetches objects from Stripe's API, run the sandbox mode with your Stripe test key for full fidelity.</li></ul>
+
+  <footer>Akeso Check · 2026-08-31 20:38 · 10 lifecycle scenarios · local run</footer>
+</div></body></html>

package/examples/report-reelpals-fixed.html

@@ -0,0 +1,70 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Akeso Check · watch-this</title>
+<style>
+  :root { --bg:#fcfcfd; --ink:#16181d; --ink2:#5b6270; --ink3:#8a919e; --line:#e6e8ec;
+    --ok:#12784b; --warn:#96620a; --bad:#b3261e; --note:#2f4a78; }
+  @media (prefers-color-scheme: dark) { :root { --bg:#111317; --ink:#e9ebef; --ink2:#a4abb8;
+    --ink3:#767d8a; --line:#282c34; --ok:#4cbe83; --warn:#dfa94c; --bad:#ef8578; --note:#8aa9dc; } }
+  * { box-sizing:border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink); font:16px/1.55 ui-sans-serif,-apple-system,system-ui,sans-serif; -webkit-font-smoothing:antialiased; }
+  .shell { max-width:640px; margin:0 auto; padding:40px 24px 100px; }
+  .local { font-size:12.5px; color:var(--ink3); border:1px solid var(--line); border-radius:20px; display:inline-block; padding:3px 12px; margin-bottom:34px; }
+  .gradeCard { border:1px solid var(--line); border-radius:10px; padding:30px 28px; display:flex; gap:26px; align-items:center; }
+  .gradeLetter { font-size:76px; font-weight:700; line-height:1; letter-spacing:-.04em; }
+  .g-A,.g-B { color:var(--ok); } .g-C { color:var(--warn); } .g-D,.g-F { color:var(--bad); } .g-\? { color:var(--ink3); }
+  .gradeCard h1 { margin:0 0 6px; font-size:22px; letter-spacing:-.02em; }
+  .gradeCard p { margin:0; color:var(--ink2); font-size:15px; }
+  .app { font-size:13px; color:var(--ink3); margin-top:10px; }
+  h2 { font-size:12px; font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--ink3); margin:44px 0 4px; }
+  .intro { margin:2px 0 12px; color:var(--ink2); font-size:14.5px; }
+  .rows { border-top:1px solid var(--line); }
+  .row { display:flex; gap:12px; padding:11px 0; border-bottom:1px solid var(--line); align-items:baseline; font-size:15px; }
+  .mark { width:18px; text-align:center; flex:none; font-weight:600; }
+  .row.ok .mark { color:var(--ok); } .row.warn .mark { color:var(--warn); }
+  .row.bad .mark { color:var(--bad); } .row.bad .name { color:var(--bad); font-weight:600; }
+  .row.note .mark { color:var(--note); } .row.mute { color:var(--ink3); }
+  .name { flex:1; } .name.wide { flex:auto; }
+  .detail { color:var(--ink3); font-size:13.5px; text-align:right; max-width:40%; }
+  ul.limits { margin:8px 0 0; padding-left:20px; color:var(--ink2); font-size:14.5px; }
+  ul.limits li { margin-bottom:7px; }
+  .cta { margin-top:48px; border:1px solid var(--line); border-radius:10px; padding:22px 24px; }
+  .cta h3 { margin:0 0 6px; font-size:17px; } .cta p { margin:0 0 14px; color:var(--ink2); font-size:14.5px; }
+  .cta a { display:inline-block; background:var(--ink); color:var(--bg); text-decoration:none; border-radius:7px; padding:10px 18px; font-size:15px; font-weight:500; }
+  footer { margin-top:44px; font-size:12.5px; color:var(--ink3); }
+</style></head><body><div class="shell">
+  <div class="local">This report is a file on your computer. Nothing was sent anywhere.</div>
+  <div class="gradeCard">
+    <div class="gradeLetter g-A">A</div>
+    <div>
+      <h1>Your billing lifecycle holds up.</h1>
+      <p>Every lifecycle scenario passed.</p>
+      <div class="app">watch-this, a Next.js app, with Supabase, Stripe test mode</div>
+    </div>
+  </div>
+
+  <h2>What we tested</h2>
+  <p class="intro">Akeso acted out ten billing situations against your app: paying, canceling, a failing card, a refund. After each one it asked your app the same question: does this customer still have paid access?</p>
+  <div class="rows"><div class="row ok"><span class="mark">✓</span><span class="name">New payment unlocks access</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Trial ends, subscription becomes active</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Monthly renewal payment keeps access</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Card fails, retries exhaust: access ends</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Customer cancels; period ends: access ends</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Immediate cancellation removes access</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">Customer un-cancels before the period ends</span><span class="detail"></span></div>
+<div class="row note"><span class="mark">•</span><span class="name">Latest charge refunded (follows the app's own policy)</span><span class="detail">your app's policy: removes access</span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">The same event delivered twice</span><span class="detail"></span></div>
+<div class="row ok"><span class="mark">✓</span><span class="name">An old 'still active' event arrives after cancellation</span><span class="detail"></span></div></div>
+
+  <h2>What your code shows</h2>
+  <p class="intro">Read from your webhook handler and access checks, before anything ran.</p>
+  <div class="rows"><div class="row ok"><span class="mark">✓</span><span class="name wide">Signature verified against the raw body, and all 7 lifecycle events are handled.</span></div></div>
+
+  <h2>What this did not check</h2>
+  <ul class="limits"><li>Only the billing lifecycle was tested. Not login, checkout UI, or anything else.</li>
+<li>Events were delivered locally with your app's own webhook secret. If your handler re-fetches objects from Stripe's API, run the sandbox mode with your Stripe test key for full fidelity.</li></ul>
+
+  
+
+  <footer>Akeso Check · 2026-08-31 20:56 · 10 lifecycle scenarios · local run</footer>
+</div></body></html>

package/fixtures/broken-app/.env.local

@@ -0,0 +1,5 @@
+# Fixture credentials — deliberately fake, test-mode shaped.
+STRIPE_SECRET_KEY=sk_test_fixturefixturefixturefixture1234
+STRIPE_WEBHOOK_SECRET=whsec_fixturefixturefixture5678
+NEXT_PUBLIC_SUPABASE_URL=https://fixture.supabase.co
+NEXT_PUBLIC_SUPABASE_ANON_KEY=sb_pub_fixture

package/fixtures/broken-app/app/api/stripe/webhook/route.ts

@@ -0,0 +1,18 @@
+// The classic vibe-coded handler: grants on payment, never revokes.
+// checkout.session.completed is handled; every cancellation and failure
+// event is silently ignored, so canceled customers keep access forever.
+import Stripe from "stripe";
+import { createClient } from "@supabase/supabase-js";
+
+const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
+
+export async function POST(request: Request) {
+  const body = await request.json(); // parsed body: signature can never verify
+  const event = body; // no constructEvent — anyone can forge this
+
+  if (event.type === "checkout.session.completed") {
+    const supabase = createClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!);
+    await supabase.from("profiles").update({ is_pro: true }).eq("id", event.data.object.client_reference_id);
+  }
+  return Response.json({ received: true });
+}

package/fixtures/broken-app/lib/access.ts

@@ -0,0 +1,8 @@
+// Where this app decides who has paid access.
+import { createClient } from "@supabase/supabase-js";
+
+export async function isPro(userId: string) {
+  const supabase = createClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!);
+  const { data } = await supabase.from("profiles").select("is_pro").eq("id", userId).single();
+  return Boolean(data?.is_pro);
+}