git-paid 0.0.0-stage → 2.1.0

package/bin/git-paid.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { scanTargetUrl } from "../lib/engine.js";
+import { authenticateUser } from "../lib/auth.js";
+import { applyLocalSeoFixes } from "../lib/fixer.js";
+import { sendTestVerificationEmail } from "../lib/inbox.js";
+import {
+  startPostbuildMcpServer,
+  syncPostbuildToVault,
+  installAgentSkillFiles,
+  autoVerifyInboxLinks,
+  runStatefulMcpSimulation
+} from "../lib/mcp.js";
+import { runHeadlessDirectorySubmit } from "../lib/submitter.js";
+
+const args = process.argv.slice(2);
+const subcmd = (args[0] || "").toLowerCase();
+
+// Stdio MCP Server mode: DO NOT print ASCII banners to stdout (stdout is JSON-RPC 2.0)
+if (subcmd === "mcp" || args.includes("--mcp")) {
+  startPostbuildMcpServer();
+} else {
+  await runCli();
+}
+
+async function runCli() {
+  console.log("\n========================================================");
+  console.log("  postbuild (postbuild.dev) — `git paid` CLI & MCP");
+  console.log("  git push ships your code. git paid sells it.");
+  console.log("========================================================\n");
+
+  if (subcmd === "--help" || subcmd === "-h" || subcmd === "help") {
+    console.log("  Usage:");
+    console.log("    npx git-paid <url>             Run 8-point SEO/paywall audit & generate Launch Kit");
+    console.log("    git paid submit [url]          Headless Chromium/Edge directory form submitter + OTP verifier");
+    console.log("    git paid fix [url]             Auto-write robots.txt, sitemap.xml, llms.txt & pSEO into public/");
+    console.log("    git paid inbox [bot-email]     Check & auto-verify <slug>-bot@postbuild.dev links & OTPs");
+    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.0)");
+    console.log("    git paid init-agent            Scaffold .agent/skills/postbuild/SKILL.md & MCP config");
+    console.log("    git paid vault [path]          Sync live telemetry & Bento cockpit to Obsidian VaultOS");
+    console.log("    git paid login <email|key>     Authenticate with your Stripe Launch Pass or pb_live_ key\n");
+    process.exit(0);
+  }
+
+  if (subcmd === "submit") {
+    const targetUrl = args.find((a, i) => i > 0 && !a.startsWith("--")) || "https://postbuild.dev";
+    console.log(`  [*] Running Headless Directory Form Submitter for: ${targetUrl} ...`);
+    const submitRes = await runHeadlessDirectorySubmit({
+      targetUrl,
+      limit: 6,
+      useHeadless: !args.includes("--no-headless"),
+      cwd: process.cwd()
+    });
+    console.log(`  [+] Headless Browser Engine: ${submitRes.headlessBrowser}`);
+    console.log(`  [+] Provisioned Bot Inbox:   ${submitRes.botEmail}`);
+    console.log(`  [+] Total Directories Pinged:${submitRes.totalDirectoriesDispatched}\n`);
+    console.log("  --- Headless Form Inspection & Submission Receipts ---");
+    for (const r of submitRes.formReceipts) {
+      console.log(
+        `  [SUBMIT] ${r.name.padEnd(24)} (DR ${r.dr}) via ${r.engineUsed} -> Fields: [${r.mappedFields.slice(0, 5).join(", ")}]`
+      );
+    }
+    console.log("\n  --- @postbuild.dev Inbox Auto-Verification ---");
+    console.log(
+      `  [INBOX]  ${submitRes.inboxVerification.inboxAddress} -> ${submitRes.inboxVerification.autoVerifiedCount} confirmation links auto-verified`
+    );
+    if (submitRes.inboxVerification.extractedOtps.length > 0) {
+      for (const o of submitRes.inboxVerification.extractedOtps) {
+        console.log(`  [OTP]    Extracted code ${o.otp} from ${o.from}`);
+      }
+    }
+    if (submitRes.receiptFile) {
+      console.log(`  [WRITE]  Saved launch receipts to ${submitRes.receiptFile}\n`);
+    }
+    process.exit(0);
+  }
+
+  if (subcmd === "init-agent" || subcmd === "agent") {
+    const res = installAgentSkillFiles({ cwd: process.cwd() });
+    console.log(`  [+] Scaffolded Agent Skill: ${res.skillMdPath}`);
+    console.log(`  [+] Powered by:             postbuild-mcp@2.1.0 (Stateful Delta Compaction)\n`);
+    console.log("  Add this to your Claude Code / Cursor / Antigravity MCP config:\n");
+    console.log(JSON.stringify(res.mcpConfigSnippet, null, 2));
+    console.log("");
+    process.exit(0);
+  }
+
+  if (subcmd === "vault" || subcmd === "vaultos") {
+    const vaultArg =
+      args.find((a, i) => i > 0 && !a.startsWith("--") && !/^https?:\/\//i.test(a)) ||
+      "C:\\Users\\Bennett\\Bennett Labs";
+    const urlArgs = args.filter((a, i) => i > 0 && /^https?:\/\//i.test(a));
+    const targetUrls = urlArgs.length ? urlArgs : ["https://postbuild.dev", "https://payarity.com"];
+
+    console.log(`  [*] Syncing Postbuild MCP Telemetry to Obsidian VaultOS...`);
+    console.log(`  [*] Target Vault: ${vaultArg}`);
+    console.log(`  [*] Domains:      ${targetUrls.join(", ")}\n`);
+
+    const syncRes = await syncPostbuildToVault({
+      vaultPath: vaultArg,
+      urls: targetUrls
+    });
+
+    for (const p of syncRes.telemetry.projects) {
+      console.log(
+        `  [OK] ${p.domain.padEnd(20)} Score: ${p.readinessScore}/100 | pSEO: ${p.pseoCount} | Dirs: ${p.directoryCount} | MCP: ${p.mcpReductionPct}`
+      );
+    }
+    console.log("\n  --- VaultOS Files Updated ---");
+    for (const f of syncRes.writtenVaultFiles) {
+      console.log(`  [WRITE] ${f}`);
+    }
+    console.log("");
+    process.exit(0);
+  }
+
+  if (subcmd === "benchmark") {
+    const targetUrl = args[1] || "https://postbuild.dev";
+    const sim = await runStatefulMcpSimulation({ url: targetUrl });
+    console.log(JSON.stringify(sim, null, 2));
+    process.exit(0);
+  }
+
+  if (subcmd === "login") {
+    const input = args[1] || "";
+    if (!input) {
+      console.log("  Usage: git paid login <email-or-pb_live_key>\n");
+      process.exit(1);
+    }
+    const auth = await authenticateUser(
+      input.startsWith("pb_live_") ? { token: input } : { email: input }
+    );
+    if (!auth.ok) {
+      console.log(`  [!] Login failed: ${auth.error}\n`);
+      process.exit(1);
+    }
+    const globalDir = path.join(os.homedir(), ".postbuild");
+    fs.mkdirSync(globalDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(globalDir, "credentials.json"),
+      JSON.stringify(
+        { email: auth.email, plan: auth.plan, token: auth.token, updatedAt: new Date().toISOString() },
+        null,
+        2
+      ),
+      "utf8"
+    );
+    console.log(`  [+] Authenticated as: ${auth.email}`);
+    console.log(`  [+] Active Plan:      ${auth.plan}`);
+    console.log(`  [+] License Key:      ${auth.token.slice(0, 28)}...`);
+    console.log(`  [ok] Saved credentials to ~/.postbuild/credentials.json\n`);
+    process.exit(0);
+  }
+
+  if (subcmd === "inbox") {
+    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || "postbuild-bot@postbuild.dev";
+    if (args.includes("--test")) {
+      await sendTestVerificationEmail(inboxAddr, "postbuild.dev");
+    }
+    const res = await autoVerifyInboxLinks(inboxAddr);
+    console.log(
+      `  [*] Verification Inbox: ${res.inboxAddress} (${res.totalMessages} messages, ${res.verifiedCount} auto-verified)\n`
+    );
+    if (res.messages.length === 0) {
+      console.log("  No verification emails yet. Run `git paid inbox --test` to test OTP & link extraction.\n");
+    } else {
+      for (const m of res.messages.slice(0, 8)) {
+        console.log(`  From:    ${m.from}`);
+        console.log(`  Subject: ${m.subject}`);
+        if (m.otpCode) console.log(`  OTP:     ${m.otpCode}`);
+        if (m.primaryLink) console.log(`  Verify:  ${m.primaryLink} [${m.autoVerified ? "AUTO-VERIFIED" : "PENDING"}]`);
+        console.log("  --------------------------------------------------------");
+      }
+    }
+    process.exit(0);
+  }
+
+  const isFixMode = subcmd === "fix" || subcmd === "init" || args.includes("--fix");
+  const targetArg =
+    args.find((a) => !a.startsWith("--") && !["scan", "dispatch", "fix", "init"].includes(a.toLowerCase())) ||
+    "https://postbuild.dev";
+
+  console.log(`  [*] Scanning Target: ${targetArg} ...`);
+
+  const report = await scanTargetUrl(targetArg);
+
+  console.log(`  [+] Provisioned Bot Inbox:  ${report.botEmail}`);
+  console.log(`  [+] Readiness Score:        ${report.readinessScore} / 100`);
+  console.log(`  [+] Auto-SEO Pages Ready:   ${report.pseoPages.length} high-intent routes`);
+  console.log(`  [+] Directory Launch Queue: ${report.directoryCount} AI, Dev & Startup Directories\n`);
+
+  console.log("  --- Audit Signals ---");
+  for (const c of report.checks) {
+    const icon = c.passed ? "[PASS]" : "[WARN]";
+    console.log(`  ${icon} ${c.label.padEnd(40)} -> ${c.detail}`);
+  }
+
+  const fixResult = applyLocalSeoFixes(report, {
+    cwd: process.cwd(),
+    overwritePublic: isFixMode || args.includes("--force")
+  });
+
+  console.log(`\n  --- Local Repository Auto-Fix (${fixResult.framework}) ---`);
+  for (const f of fixResult.writtenFiles) {
+    console.log(`  [WRITE] ${f.path.padEnd(36)} (${f.role})`);
+  }
+
+  console.log("\n  -> Live Workspace & MCP Studio: https://postbuild.dev\n");
+}

package/brand/README.md

@@ -0,0 +1,54 @@
+# `postbuild` (`git paid`) — Official Brand Kit
+
+> **`git push` ships your code. `git paid` sells it.**
+
+## 1. Brand Assets
+
+All assets are available in both `/brand/` (repository root) and `/public/brand/` (served live at `https://postbuild.dev/brand/...`):
+
+| Asset | File | Dimensions | Format | Usage |
+| :--- | :--- | :--- | :--- | :--- |
+| **Brand Icon (PNG)** | [`postbuild-icon.png`](./postbuild-icon.png) | `512 × 512 px` | PNG | Stripe Icon, App Store / Directory listings, OAuth apps |
+| **Horizontal Logo (PNG)** | [`postbuild-logo.png`](./postbuild-logo.png) | `1000 × 260 px` | PNG | Stripe Checkout Header Logo, Invoices, Receipts, Press Kits |
+| **Brand Icon (SVG)** | [`postbuild-icon.svg`](./postbuild-icon.svg) | Vector (`64 × 64`) | SVG | Web UI, Favicons, Scalable vector contexts |
+| **Horizontal Logo (SVG)** | [`postbuild-logo.svg`](./postbuild-logo.svg) | Vector (`1000 × 260`) | SVG | High-DPI headers, documentation, print |
+
+---
+
+## 2. Visual Symbolism (`2 × 2` Grid)
+
+The `postbuild` mark represents the two-stage developer lifecycle inside a clean `2 × 2` architectural grid:
+1. **Top Row (`git push` — Ship the build)**: Deep Slate build module (`#0F172A`) on the left pushing outward into the Sky Blue deployment arrow (`#0284C7`) on the right.
+2. **Bottom Row (`git paid` — Monetize & distribute)**: Muted Slate post-build artifact (`#64748B`) on the left converting into the Emerald Green revenue badge (`$`, `#10B981`) on the right.
+
+---
+
+## 3. Color Palette
+
+| Role | Color Name | Hex Code | RGB | Usage |
+| :--- | :--- | :--- | :--- | :--- |
+| **Primary / Brand** | Deep Slate | `#0F172A` | `rgb(15, 23, 42)` | Wordmark, primary CTAs, Stripe **Brand Color** |
+| **Accent (`git paid`)** | Emerald Green | `#10B981` | `rgb(16, 185, 129)` | `$` revenue badge, `git paid` pill, Stripe **Accent Color** |
+| **Secondary (`git push`)** | Sky Blue | `#0284C7` | `rgb(2, 132, 199)` | Deployment arrow (`→`), technical indicators |
+| **Structural Muted** | Slate Gray | `#64748B` | `rgb(100, 116, 139)` | Secondary build block, supporting labels |
+| **Surface / Canvas** | Crisp Alabaster | `#F8FAFC` | `rgb(248, 250, 252)` | App background, card surfaces |
+| **Pure White** | White | `#FFFFFF` | `rgb(255, 255, 255)` | Icon & Logo container surface |
+
+---
+
+## 4. Typography
+
+- **Wordmark (`postbuild`)**: Always lowercase (`postbuild`), set in **Plus Jakarta Sans / Inter ExtraBold (`800`)** with `-0.045em` letter-spacing.
+- **CLI Companion (`git paid`)**: Always lowercase (`git paid`), set in **JetBrains Mono Bold (`700`)** inside an emerald tint pill (`#ECFDF5` fill, `#A7F3D0` border, `#047857` text).
+
+---
+
+## 5. Official Stripe & Directory Copy
+
+- **Business Name**: `postbuild`
+- **Website**: `https://postbuild.dev`
+- **Statement Descriptor**: `POSTBUILD.DEV` (Shortened: `POSTBUILD`)
+- **One-Line Tagline**:
+  > Automated post-build technical SEO, programmatic metadata, and directory launch kits for software developers.
+- **Full Business Description**:
+  > `postbuild` (`https://postbuild.dev`) is a developer SaaS platform and CLI tool (`git paid` / `npx postbuild`) that automates post-build technical SEO audits, structured metadata (JSON-LD, OpenGraph, robots.txt, sitemaps), programmatic SEO route packs, and curated SaaS directory launch kits for software developers and product teams.

package/brand/postbuild-icon.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 64 64" fill="none">
+  <rect width="64" height="64" rx="14" fill="#FFFFFF"/>
+  
+  <!-- Top-left build block (git push source) -->
+  <rect x="7" y="7" width="20" height="20" rx="5.5" stroke="#0F172A" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Bottom-left build block (git paid source) -->
+  <rect x="7" y="37" width="20" height="20" rx="5.5" stroke="#64748B" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Top-right arrow (git push) -->
+  <path d="M36 17H56M56 17L47.5 8.5M56 17L47.5 25.5" stroke="#0284C7" stroke-width="5.2" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <!-- Bottom-right emerald badge + crisp typographic $ (git paid) -->
+  <rect x="35" y="35" width="22" height="22" rx="6.5" fill="#10B981"/>
+  <text x="46" y="52.5" text-anchor="middle" fill="#FFFFFF" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif" font-size="18.5" font-weight="800">$</text>
+
+</svg>

package/brand/postbuild-logo.svg

@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1000" height="260" viewBox="0 0 1000 260" fill="none">
+  <rect width="1000" height="260" fill="#FFFFFF"/>
+  <g transform="translate(36, 26) scale(3.25)">
+    
+  <!-- Top-left build block (git push source) -->
+  <rect x="7" y="7" width="20" height="20" rx="5.5" stroke="#0F172A" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Bottom-left build block (git paid source) -->
+  <rect x="7" y="37" width="20" height="20" rx="5.5" stroke="#64748B" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Top-right arrow (git push) -->
+  <path d="M36 17H56M56 17L47.5 8.5M56 17L47.5 25.5" stroke="#0284C7" stroke-width="5.2" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <!-- Bottom-right emerald badge + crisp typographic $ (git paid) -->
+  <rect x="35" y="35" width="22" height="22" rx="6.5" fill="#10B981"/>
+  <text x="46" y="52.5" text-anchor="middle" fill="#FFFFFF" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif" font-size="18.5" font-weight="800">$</text>
+
+  </g>
+  <text x="276" y="176" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif" font-size="144" font-weight="800" letter-spacing="-5.5">postbuild</text>
+</svg>

package/lib/auth.js

@@ -0,0 +1,208 @@
+// Zero-DB Auth, Email OTP via Resend & Cryptographic License Verification for postbuild (postbuild.dev)
+
+import crypto from "node:crypto";
+import { getStripeClient } from "./stripe.js";
+
+const SECRET = process.env.POSTBUILD_AUTH_SECRET || process.env.STRIPE_WEBHOOK_SECRET || "postbuild-dev-secret-key-2026";
+
+export function signLicenseToken({ email, plan = "launch_pass", domain = "*" }) {
+  const payload = {
+    email: (email || "").toLowerCase().trim(),
+    plan,
+    domain,
+    iat: Math.floor(Date.now() / 1000)
+  };
+  const base64Payload = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const sig = crypto.createHmac("sha256", SECRET).update(base64Payload).digest("base64url").slice(0, 24);
+  return `pb_live_${base64Payload}.${sig}`;
+}
+
+export function verifyLicenseToken(token) {
+  if (!token || typeof token !== "string" || !token.startsWith("pb_live_")) {
+    return { valid: false };
+  }
+  const raw = token.slice("pb_live_".length);
+  const [base64Payload, sig] = raw.split(".");
+  if (!base64Payload || !sig) return { valid: false };
+
+  const expectedSig = crypto.createHmac("sha256", SECRET).update(base64Payload).digest("base64url").slice(0, 24);
+  if (sig !== expectedSig) return { valid: false };
+
+  try {
+    const payload = JSON.parse(Buffer.from(base64Payload, "base64url").toString("utf8"));
+    return { valid: true, ...payload };
+  } catch {
+    return { valid: false };
+  }
+}
+
+function createSignedOtpChallenge(email, otpCode, plan = "launch_pass") {
+  const exp = Math.floor(Date.now() / 1000) + 600; // 10 minutes
+  const data = `${email.toLowerCase().trim()}:${otpCode}:${plan}:${exp}`;
+  const sig = crypto.createHmac("sha256", SECRET).update(data).digest("base64url").slice(0, 24);
+  const encoded = Buffer.from(JSON.stringify({ email: email.toLowerCase().trim(), plan, exp })).toString("base64url");
+  return `${encoded}.${sig}`;
+}
+
+function verifySignedOtpChallenge(challengeToken, otpCode) {
+  if (!challengeToken || !otpCode) return { valid: false };
+  const [encoded, sig] = String(challengeToken).split(".");
+  if (!encoded || !sig) return { valid: false };
+  try {
+    const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    if (!parsed.exp || Math.floor(Date.now() / 1000) > parsed.exp) {
+      return { valid: false, error: "Verification code expired. Please request a new code." };
+    }
+    const data = `${parsed.email}:${String(otpCode).trim()}:${parsed.plan}:${parsed.exp}`;
+    const expectedSig = crypto.createHmac("sha256", SECRET).update(data).digest("base64url").slice(0, 24);
+    if (sig !== expectedSig) {
+      return { valid: false, error: "Invalid 6-digit verification code." };
+    }
+    return { valid: true, email: parsed.email, plan: parsed.plan };
+  } catch {
+    return { valid: false, error: "Invalid verification challenge." };
+  }
+}
+
+async function sendLoginOtpViaResend(email, otpCode, licenseToken) {
+  const resendKey = (process.env.RESEND_API_KEY || "").trim();
+  if (!resendKey) {
+    return { sent: false, reason: "missing_resend_key" };
+  }
+  try {
+    const resp = await fetch("https://api.resend.com/emails", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${resendKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        from: "postbuild <login@postbuild.dev>",
+        to: [email],
+        subject: `${otpCode} is your postbuild verification code`,
+        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; max-width: 520px; margin: 0 auto; padding: 28px; border: 1px solid #e2e8f0; border-radius: 14px; color: #0f172a;">
+          <h2 style="margin: 0 0 8px; font-size: 20px;">postbuild · Account Verification</h2>
+          <p style="color: #475569; font-size: 14px; line-height: 1.6;">Enter this 6-digit verification code on <strong>postbuild.dev</strong> to view your Stripe receipts and manage your subscription:</p>
+          <div style="background: #ecfdf5; border: 1px solid #6ee7b7; color: #047857; font-family: monospace; font-size: 28px; font-weight: 800; letter-spacing: 6px; text-align: center; padding: 14px; border-radius: 10px; margin: 18px 0;">${otpCode}</div>
+          <p style="color: #475569; font-size: 13px; line-height: 1.6;">Your active CLI License Key (for <code>git paid login</code>):</p>
+          <pre style="background: #f8fafc; border: 1px solid #e2e8f0; padding: 10px; border-radius: 8px; font-size: 11px; overflow-x: auto;">${licenseToken}</pre>
+        </div>`
+      })
+    });
+    return { sent: resp.ok };
+  } catch {
+    return { sent: false };
+  }
+}
+
+export async function authenticateUser({ email, token, sessionId, otpCode, challengeToken }) {
+  // 1. If user passes an existing pb_live_ token, verify cryptographic HMAC signature
+  if (token && token.startsWith("pb_live_")) {
+    const verified = verifyLicenseToken(token);
+    if (verified.valid) {
+      return {
+        ok: true,
+        authenticated: true,
+        email: verified.email,
+        plan: verified.plan,
+        domain: verified.domain,
+        token
+      };
+    }
+    return { ok: false, authenticated: false, error: "Invalid pb_live_ license key signature." };
+  }
+
+  // 2. If user is completing Step 2 of Email OTP verification
+  if (otpCode && challengeToken) {
+    const check = verifySignedOtpChallenge(challengeToken, otpCode);
+    if (!check.valid) {
+      return { ok: false, authenticated: false, error: check.error || "Invalid verification code." };
+    }
+    const issued = signLicenseToken({ email: check.email, plan: check.plan, domain: "*" });
+    return {
+      ok: true,
+      authenticated: true,
+      email: check.email,
+      plan: check.plan,
+      domain: "*",
+      token: issued
+    };
+  }
+
+  const stripe = getStripeClient();
+
+  // 3. If user returned from Stripe Checkout with unguessable session_id (cs_...), verify session via StripeClient
+  if (sessionId && stripe) {
+    const session = await stripe.checkout.sessions.retrieve(sessionId);
+    if (session && session.payment_status !== "unpaid") {
+      const custEmail = (session.customer_details?.email || email || "founder@postbuild.dev").toLowerCase().trim();
+      const plan = session.metadata?.plan_id || "launch_pass";
+      const domain = session.client_reference_id || session.metadata?.target_domain || "*";
+      const newToken = signLicenseToken({ email: custEmail, plan, domain });
+      return {
+        ok: true,
+        authenticated: true,
+        email: custEmail,
+        plan,
+        domain,
+        token: newToken
+      };
+    }
+  }
+
+  // 4. If user enters an email address, verify they have a record in Stripe and require a 6-digit email OTP code (or their pb_live_ key)
+  const cleanEmail = (email || "").toLowerCase().trim();
+  if (!cleanEmail || !cleanEmail.includes("@")) {
+    return { ok: false, authenticated: false, error: "Enter your email address or pb_live_ license key." };
+  }
+
+  if (stripe) {
+    const customers = await stripe.customers.list({ email: cleanEmail, limit: 1 });
+    let hasPurchase = Array.isArray(customers.data) && customers.data.length > 0;
+
+    if (!hasPurchase) {
+      const sessions = await stripe.checkout.sessions.list({ limit: 20 });
+      hasPurchase = sessions.data.some(
+        (s) =>
+          s.payment_status !== "unpaid" &&
+          (s.customer_details?.email || s.customer_email || "").toLowerCase().trim() === cleanEmail
+      );
+    }
+
+    if (!hasPurchase) {
+      return {
+        ok: false,
+        authenticated: false,
+        error: "No active Launch Pass found for this email in Stripe. Purchase a Launch Pass ($29) first."
+      };
+    }
+
+    const generatedOtp = String(Math.floor(100000 + Math.random() * 900000));
+    const challenge = createSignedOtpChallenge(cleanEmail, generatedOtp, "launch_pass");
+    const licenseForEmail = signLicenseToken({ email: cleanEmail, plan: "launch_pass", domain: "*" });
+    const emailResult = await sendLoginOtpViaResend(cleanEmail, generatedOtp, licenseForEmail);
+
+    if (emailResult.sent) {
+      return {
+        ok: true,
+        authenticated: false,
+        requiresOtp: true,
+        email: cleanEmail,
+        challengeToken: challenge,
+        message: `We emailed a 6-digit verification code to ${cleanEmail}. Enter it below to unlock your billing & receipts.`
+      };
+    }
+
+    return {
+      ok: false,
+      authenticated: false,
+      error: "For security, email-only lookup is disabled until RESEND_API_KEY is set in Vercel. Please sign in using your pb_live_... license key."
+    };
+  }
+
+  return {
+    ok: false,
+    authenticated: false,
+    error: "Please sign in with your pb_live_... license key."
+  };
+}

package/lib/directories.js

@@ -0,0 +1,123 @@
+// Complete 85-Directory Database for Postbuild (postbuild.dev)
+// Curated startup, AI, developer, indie SaaS, and software discovery directories.
+
+export const DIRECTORIES = [
+  // Tier 1: Major Launch Boards & Communities (1-15)
+  { id: "dir-01", name: "Product Hunt", url: "https://www.producthunt.com/posts/new", dr: 91, category: "Launch Board", authType: "OAuth / Magic Link", autoSubmit: true },
+  { id: "dir-02", name: "Hacker News (Show HN)", url: "https://news.ycombinator.com/submit", dr: 92, category: "Developer Community", authType: "Account Session", autoSubmit: true },
+  { id: "dir-03", name: "AlternativeTo", url: "https://alternativeto.net/add-application/", dr: 86, category: "Software Discovery", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-04", name: "There's An AI For That", url: "https://theresanaiforthat.com/submit/", dr: 82, category: "AI Directory", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-05", name: "Indie Hackers Products", url: "https://www.indiehackers.com/products", dr: 81, category: "Indie SaaS", authType: "Email Link", autoSubmit: true },
+  { id: "dir-06", name: "Futurepedia", url: "https://www.futurepedia.io/submit-tool", dr: 79, category: "AI Directory", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-07", name: "SaaSHub", url: "https://www.saashub.com/submit", dr: 77, category: "Software Directory", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-08", name: "BetaList", url: "https://betalist.com/submit", dr: 76, category: "Early Adopters", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-09", name: "FutureTools.io", url: "https://www.futuretools.io/submit-a-tool", dr: 75, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-10", name: "Toolify.ai", url: "https://www.toolify.ai/submit", dr: 74, category: "AI Directory", authType: "Direct Form + Email", autoSubmit: true },
+  { id: "dir-11", name: "G2 Software", url: "https://www.g2.com/products/new", dr: 90, category: "B2B Software", authType: "Work Email (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-12", name: "Crozdesk", url: "https://crozdesk.com/vendors", dr: 73, category: "B2B SaaS", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-13", name: "SourceForge", url: "https://sourceforge.net/create/", dr: 91, category: "Developer Tools", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-14", name: "Slant.co", url: "https://www.slant.co", dr: 80, category: "Comparison Engine", authType: "Account Session", autoSubmit: true },
+  { id: "dir-15", name: "StackShare", url: "https://stackshare.io/submit", dr: 82, category: "Developer Stack", authType: "GitHub / Email", autoSubmit: true },
+
+  // Tier 2: Developer & Open-Source Directories (16-30)
+  { id: "dir-16", name: "DevHunt", url: "https://devhunt.org/login", dr: 68, category: "Developer Tools", authType: "GitHub / Email", autoSubmit: true },
+  { id: "dir-17", name: "OpenAlternative", url: "https://openalternative.co/submit", dr: 66, category: "Open Source", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-18", name: "Console.dev", url: "https://console.dev/submit", dr: 69, category: "Developer Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-19", name: "LibHunt", url: "https://www.libhunt.com", dr: 72, category: "Developer Libraries", authType: "GitHub Link", autoSubmit: true },
+  { id: "dir-20", name: "Awesome Lists Index", url: "https://awesomelists.top", dr: 61, category: "Open Source", authType: "PR / Form", autoSubmit: true },
+  { id: "dir-21", name: "FindDevTools", url: "https://finddevtools.com/submit", dr: 54, category: "Developer Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-22", name: "DevPages", url: "https://www.devpages.io/submit", dr: 52, category: "Developer Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-23", name: "Tooling.one", url: "https://tooling.one/submit", dr: 49, category: "Developer Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-24", name: "Daily.dev Picks", url: "https://daily.dev", dr: 76, category: "Developer Feed", authType: "Email Link", autoSubmit: true },
+  { id: "dir-25", name: "CodeGems", url: "https://codegems.io", dr: 48, category: "Developer Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-26", name: "HelloGitHub", url: "https://hellogithub.com", dr: 64, category: "Open Source", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-27", name: "RepoTrends", url: "https://repotrends.com", dr: 51, category: "Developer Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-28", name: "Selfh.st", url: "https://selfh.st/submit", dr: 62, category: "Self-Hosted / Dev", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-29", name: "CLI.club", url: "https://cli.club", dr: 46, category: "CLI Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-30", name: "TerminalTroves", url: "https://terminaltrove.com/submit/", dr: 58, category: "CLI & Terminal", authType: "Direct Form", autoSubmit: true },
+
+  // Tier 3: Indie Launch & Maker Platforms (31-50)
+  { id: "dir-31", name: "Uneed.best", url: "https://www.uneed.best/submit-a-tool", dr: 64, category: "Indie Launch", authType: "Magic Link (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-32", name: "MicroLaunch", url: "https://microlaunch.net/submit", dr: 59, category: "Indie Launch", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-33", name: "TinyLaunch", url: "https://tinylaunch.com/submit", dr: 54, category: "Indie Launch", authType: "Direct Form + Email", autoSubmit: true },
+  { id: "dir-34", name: "Launching Next", url: "https://www.launchingnext.com/submit/", dr: 67, category: "Startup Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-35", name: "SideProjectors", url: "https://www.sideprojectors.com/project/submit", dr: 62, category: "Side Projects", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-36", name: "StartupBase", url: "https://startupbase.io/submit", dr: 61, category: "Startup Directory", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-37", name: "Peerlist Spotlight", url: "https://peerlist.io/projects", dr: 74, category: "Maker Network", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-38", name: "1000.tools", url: "https://1000.tools/submit", dr: 57, category: "Indie Tools", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-39", name: "Fazier", url: "https://fazier.com/launch", dr: 56, category: "Indie Launch", authType: "Magic Link (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-40", name: "Huzzler", url: "https://huzzler.so/products", dr: 55, category: "Indie Founders", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-41", name: "IndiePage", url: "https://indiepa.ge", dr: 63, category: "Maker Portfolio", authType: "Magic Link (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-42", name: "BetaPage", url: "https://betapage.co/submit-startup", dr: 68, category: "Startup Launch", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-43", name: "StartupBuffer", url: "https://startupbuffer.com/site/submit", dr: 60, category: "Startup Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-44", name: "StartupStash", url: "https://startupstash.com/add-listing/", dr: 72, category: "Startup Resources", authType: "Direct Form + Email", autoSubmit: true },
+  { id: "dir-45", name: "KillerStartups", url: "https://www.killerstartups.com/submit-startup", dr: 71, category: "Startup Reviews", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-46", name: "CrazyAboutStartups", url: "https://www.crazyaboutstartups.com/submit-startup/", dr: 55, category: "Startup Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-47", name: "Startups.fyi", url: "https://www.startups.fyi/submit", dr: 58, category: "Startup Discovery", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-48", name: "NoCodeList", url: "https://nocodelist.co/submit", dr: 57, category: "Modern Software", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-49", name: "Makerlog Products", url: "https://getmakerlog.com", dr: 60, category: "Maker Community", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-50", name: "wip.co Products", url: "https://wip.co", dr: 63, category: "Maker Community", authType: "Account Session", autoSubmit: true },
+
+  // Tier 4: AI & Automation Directories (51-70)
+  { id: "dir-51", name: "TopAI.tools", url: "https://topai.tools/submit", dr: 69, category: "AI Directory", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-52", name: "AI Scout", url: "https://aiscout.net/submit-listing/", dr: 58, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-53", name: "Easy With AI", url: "https://easywithai.com/submit-tool/", dr: 66, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-54", name: "AI Tool Hunt", url: "https://www.aitoolhunt.com/submit", dr: 61, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-55", name: "Insidr.ai", url: "https://www.insidr.ai/submit-tools/", dr: 65, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-56", name: "AI Valley", url: "https://aivalley.ai/submit-tool/", dr: 57, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-57", name: "AllThingsAI", url: "https://allthingsai.com/submit", dr: 64, category: "AI Directory", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-58", name: "AIDir.cc", url: "https://aidir.cc/submit", dr: 49, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-59", name: "OpenTools.ai", url: "https://opentools.ai/submit-a-tool", dr: 67, category: "AI Directory", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-60", name: "AIxploria", url: "https://www.aixploria.com/en/add-ai/", dr: 71, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-61", name: "SaaS AI Tools", url: "https://saasaitools.com/submit/", dr: 59, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-62", name: "GPTE.ai", url: "https://gpte.ai/submit-a-tool/", dr: 62, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-63", name: "AI Center", url: "https://aicenter.ai/submit", dr: 53, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-64", name: "AI Tools Directory", url: "https://aitoolsdirectory.com/submit-tool", dr: 63, category: "AI Directory", authType: "Direct Form + Email", autoSubmit: true },
+  { id: "dir-65", name: "NextGenTools", url: "https://www.nxgntools.com/submit", dr: 55, category: "AI & SaaS", authType: "Magic Link (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-66", name: "BasedTools", url: "https://www.basedtools.ai/submit", dr: 54, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-67", name: "Tap4 AI", url: "https://tap4.ai/submit", dr: 58, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-68", name: "WaildWorld AI", url: "https://waildworld.com/submit", dr: 48, category: "AI Directory", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-69", name: "AgentLocker", url: "https://agentlocker.ai/submit", dr: 51, category: "AI Agents", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-70", name: "MCP.so Directory", url: "https://mcp.so/submit", dr: 64, category: "MCP & Agents", authType: "GitHub / Form", autoSubmit: true },
+
+  // Tier 5: SaaS, Growth & Niche Directories (71-85)
+  { id: "dir-71", name: "SaaSWorthy", url: "https://www.saasworthy.com/offerings", dr: 74, category: "SaaS Directory", authType: "Work Email (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-72", name: "GetApp / Capterra", url: "https://www.capterra.com/vendors/sign-up", dr: 90, category: "B2B Software", authType: "Work Email (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-73", name: "SoftwareSuggest", url: "https://www.softwaresuggest.com/vendors", dr: 76, category: "SaaS Directory", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-74", name: "GoodFirms", url: "https://www.goodfirms.co/get-listed", dr: 84, category: "Software Directory", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-75", name: "TrustRadius", url: "https://www.trustradius.com/vendor", dr: 85, category: "B2B Software", authType: "Work Email (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-76", name: "Serchen", url: "https://www.serchen.com/get-listed/", dr: 68, category: "Cloud & SaaS", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-77", name: "Cloudswave", url: "https://www.cloudswave.com", dr: 61, category: "Cloud SaaS", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-78", name: "Feedough Startups", url: "https://www.feedough.com/submit-your-startup/", dr: 69, category: "Startup Media", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-79", name: "EU-Startups Directory", url: "https://www.eu-startups.com/directory/", dr: 78, category: "Startup Directory", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-80", name: "F6S Startup Network", url: "https://www.f6s.com", dr: 83, category: "Founder Network", authType: "OTP (@postbuild.dev)", autoSubmit: true },
+  { id: "dir-81", name: "Gust Startups", url: "https://gust.com", dr: 80, category: "Startup Platform", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-82", name: "IndieDeals", url: "https://indiedeals.co/submit", dr: 50, category: "Deals & Launch", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-83", name: "PitchWall", url: "https://pitchwall.co", dr: 65, category: "Product Pitch", authType: "Email Verification", autoSubmit: true },
+  { id: "dir-84", name: "Land-book", url: "https://land-book.com/submit", dr: 73, category: "Landing Design", authType: "Direct Form", autoSubmit: true },
+  { id: "dir-85", name: "OnePageLove", url: "https://onepagelove.com/submit", dr: 79, category: "Landing Showcase", authType: "Direct Form", autoSubmit: true }
+];
+
+export function buildPrefilledDirectoryUrl(dir, launchKit) {
+  try {
+    const u = new URL(dir.url);
+    const utmTarget = launchKit?.utmUrl || launchKit?.targetUrl || "https://postbuild.dev";
+    const name = launchKit?.productName || "Postbuild";
+    const tagline = launchKit?.tagline || "Ship code, automate SEO and directory dispatch";
+
+    if (dir.url.includes("news.ycombinator.com/submit")) {
+      u.searchParams.set("u", utmTarget);
+      u.searchParams.set("t", `Show HN: ${name} – ${tagline}`);
+      return u.toString();
+    }
+    u.searchParams.set("url", utmTarget);
+    u.searchParams.set("name", name);
+    u.searchParams.set("tagline", tagline);
+    if (launchKit?.makerEmail) {
+      u.searchParams.set("email", launchKit.makerEmail);
+    }
+    return u.toString();
+  } catch {
+    return dir.url;
+  }
+}