git-paid 0.0.0-stage → 2.1.1

package/README.md

@@ -1,3 +1,115 @@
-# Temporary Holding Version
+# postbuild (`git-paid`)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> **`git push` ships your code. `git paid` sells it.**
+>
+> Autonomous Post-Build Technical SEO, 25-Route Programmatic SEO Generator, Dedicated `@postbuild.dev` Verification Inbox, 85-Directory Launch Dispatcher, and Stateful MCP Server for AI Coding Agents.
+
+- **Web Studio & Live Audit**: [https://postbuild.dev](https://postbuild.dev)
+- **CLI Binary**: `npx git-paid` (or `npx postbuild`)
+- **MCP Server**: `npx git-paid mcp`
+
+---
+
+## Quick Start
+
+Run directly from your project root after deploying to Vercel, Railway, Render, or Fly.io:
+
+```bash
+# 1. Run a live technical SEO & monetization readiness audit
+npx git-paid https://your-app.com
+
+# 2. Auto-generate & write robots.txt, sitemap.xml, llms.txt, and 25 static Programmatic SEO HTML pages
+npx git-paid fix https://your-app.com
+
+# 3. Dispatch your launch kit across 85 curated SaaS/AI directories with headless form inspection
+npx git-paid submit https://your-app.com --limit 10
+
+# 4. Poll your dedicated @postbuild.dev verification inbox & auto-verify inbound confirmation links / OTPs
+npx git-paid inbox https://your-app.com --verify
+
+# 5. Install agent skill files (.agent/skills/postbuild/SKILL.md & CLAUDE.md) into your repository
+npx git-paid skill
+```
+
+Need a git alias so `git paid` works natively alongside `git push`?
+
+```bash
+git config --global alias.paid '!npx git-paid'
+git paid https://your-app.com
+```
+
+---
+
+## What `git-paid` Automates After You Ship
+
+| Capability | Manual Post-Build Workflow | `git-paid` (`postbuild.dev`) |
+| :--- | :--- | :--- |
+| **Technical & AI Search SEO** | Hand-writing meta tags, JSON-LD, and crawler rules | Writes `robots.txt` (`OAI-SearchBot`, `PerplexityBot`, `ClaudeBot`), `sitemap.xml`, `llms.txt`, and `SoftwareApplication` JSON-LD in 1 command |
+| **25 Programmatic SEO Pages** | Days of keyword research and static page coding | Pre-renders 25 high-intent `/use-cases/*`, `/compare/*`, `/calculators/*`, `/guides/*`, `/templates/*`, `/alternatives/*`, and `/checklists/*` HTML landing pages |
+| **85-Directory Dispatch** | 14+ hours of repetitive form filling & UTM tagging | Synthesizes Show HN / Product Hunt / directory copy and dispatches via `git paid submit` |
+| **Verification Inbox (`@postbuild.dev`)** | Clutters personal inbox with 85+ confirmation emails | Provisions `<slug>-bot@postbuild.dev`, extracts 6-digit OTPs, and auto-clicks verification URLs |
+| **Self-Serve Stripe Checkout Gate** | Custom billing boilerplate | Drop-in `PostbuildCheckoutGate.jsx` + Customer Billing Portal & receipt management |
+
+---
+
+## Stateful MCP Server (`npx git-paid mcp`)
+
+`git-paid` includes a built-in **Stateful Model Context Protocol (MCP) Server** over `stdio` (JSON-RPC 2.0) designed for **Claude Code**, **Cursor**, **Windsurf**, and **Google Antigravity / Gemini**.
+
+Unlike stateless MCP servers that re-serialize identical directory lists and SEO payloads on every turn, the Postbuild MCP middleware provides:
+
+1. **Watermark Context Residuals (`unchanged@vN` / `updated@vN`)**:
+   - Turn 1 projects clean entity stubs; Turn 2+ emits lightweight `@vN` watermark deltas for unchanged records, cutting multi-turn token consumption by **75% to 84%**.
+2. **In-Memory Superset Query Cache (`<1ms` Latency)**:
+   - Follow-up filtered tool calls (`category`, `min_da`, `status`, `limit`) resolve in-memory in `<1ms` with zero redundant network round-trips.
+3. **Two-Phase Cryptographic OCC Write Guard (`ct_...`)**:
+   - Live directory dispatch mutations require a Phase 1 dry-run (`dry_run: true`) that issues an HMAC-signed `commit_token` (`ct_...`) before Phase 2 commits the launch state.
+4. **Untrusted Content Spotlighting**:
+   - External scraped metadata and inbound email bodies are automatically wrapped in `<<<UNTRUSTED_CONTENT_DATA_ONLY: ... >>>` delimiters to prevent indirect prompt injection.
+
+### Available MCP Tools
+
+| Tool Name | Description |
+| :--- | :--- |
+| `postbuild_scan` | Audits any live URL (8 technical/AI SEO & paywall checks), synthesizes launch copy, and caches working-set state. |
+| `postbuild_directories` | Queries the 85-directory catalog using the in-memory superset cache and `@vN` watermark deltas. |
+| `postbuild_pseo` | Queries and filters the 25 programmatic SEO routes with stateful delta compaction. |
+| `postbuild_dispatch` | Executes Two-Phase Cryptographic OCC directory dispatch (`dry_run: true` → `commit_token` → commit). |
+| `postbuild_inbox` | Polls `<slug>-bot@postbuild.dev`, extracts 6-digit OTPs, and auto-verifies inbound confirmation links. |
+| `postbuild_fix` | Writes `robots.txt`, `sitemap.xml`, `llms.txt`, `.postbuild/pseo/*.html`, and `PostbuildCheckoutGate.jsx` to disk. |
+| `postbuild_vault_sync` | Syncs live SEO scores, directory status, inbox OTPs, and MCP telemetry into an **Obsidian VaultOS** dashboard. |
+
+### MCP Configuration (`mcp_config.json` / `.cursor/mcp.json` / `claude_desktop_config.json`)
+
+```json
+{
+  "mcpServers": {
+    "postbuild": {
+      "command": "npx",
+      "args": ["-y", "git-paid", "mcp"]
+    }
+  }
+}
+```
+
+---
+
+## Obsidian VaultOS Integration
+
+Sync your live project launches directly into your **Obsidian VaultOS** command center:
+
+```bash
+npx git-paid vault https://your-app.com --vault "C:/Users/You/ObsidianVault"
+```
+
+Writes `_meta/postbuild-telemetry.json` and `_dashboards/Postbuild Launch.md` with live SEO readiness scores, 85-directory dispatch progress, `@postbuild.dev` OTP logs, and Buyer Intent Radar threads.
+
+---
+
+## License & Commercial Terms
+
+**Proprietary — Commercial Software (`postbuild.dev`)**
+
+Copyright © 2026 Bennett Moore ([https://postbuild.dev](https://postbuild.dev)). All rights reserved.
+
+The `git-paid` CLI and MCP client package may be installed and executed via `npm` / `npx` to interact with [https://postbuild.dev](https://postbuild.dev). Redistribution, re-hosting, or commercial resale of the underlying platform, directory dispatch engine, or source bundle without an active license from [https://postbuild.dev](https://postbuild.dev) is prohibited.

package/bin/git-paid.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { scanTargetUrl } from "../lib/engine.js";
+import { authenticateUser } from "../lib/auth.js";
+import { applyLocalSeoFixes } from "../lib/fixer.js";
+import { sendTestVerificationEmail } from "../lib/inbox.js";
+import {
+  startPostbuildMcpServer,
+  syncPostbuildToVault,
+  installAgentSkillFiles,
+  autoVerifyInboxLinks,
+  runStatefulMcpSimulation
+} from "../lib/mcp.js";
+import { runHeadlessDirectorySubmit } from "../lib/submitter.js";
+
+const args = process.argv.slice(2);
+const subcmd = (args[0] || "").toLowerCase();
+
+// Stdio MCP Server mode: DO NOT print ASCII banners to stdout (stdout is JSON-RPC 2.0)
+if (subcmd === "mcp" || args.includes("--mcp")) {
+  startPostbuildMcpServer();
+} else {
+  await runCli();
+}
+
+async function runCli() {
+  console.log("\n========================================================");
+  console.log("  postbuild (postbuild.dev) — `git paid` CLI & MCP");
+  console.log("  git push ships your code. git paid sells it.");
+  console.log("========================================================\n");
+
+  if (subcmd === "--help" || subcmd === "-h" || subcmd === "help") {
+    console.log("  Usage:");
+    console.log("    npx git-paid <url>             Run 8-point SEO/paywall audit & generate Launch Kit");
+    console.log("    git paid submit [url]          Headless Chromium/Edge directory form submitter + OTP verifier");
+    console.log("    git paid fix [url]             Auto-write robots.txt, sitemap.xml, llms.txt & pSEO into public/");
+    console.log("    git paid inbox [bot-email]     Check & auto-verify <slug>-bot@postbuild.dev links & OTPs");
+    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.0)");
+    console.log("    git paid init-agent            Scaffold .agent/skills/postbuild/SKILL.md & MCP config");
+    console.log("    git paid vault [path]          Sync live telemetry & Bento cockpit to Obsidian VaultOS");
+    console.log("    git paid login <email|key>     Authenticate with your Stripe Launch Pass or pb_live_ key\n");
+    process.exit(0);
+  }
+
+  if (subcmd === "submit") {
+    const targetUrl = args.find((a, i) => i > 0 && !a.startsWith("--")) || "https://postbuild.dev";
+    console.log(`  [*] Running Headless Directory Form Submitter for: ${targetUrl} ...`);
+    const submitRes = await runHeadlessDirectorySubmit({
+      targetUrl,
+      limit: 6,
+      useHeadless: !args.includes("--no-headless"),
+      cwd: process.cwd()
+    });
+    console.log(`  [+] Headless Browser Engine: ${submitRes.headlessBrowser}`);
+    console.log(`  [+] Provisioned Bot Inbox:   ${submitRes.botEmail}`);
+    console.log(`  [+] Total Directories Pinged:${submitRes.totalDirectoriesDispatched}\n`);
+    console.log("  --- Headless Form Inspection & Submission Receipts ---");
+    for (const r of submitRes.formReceipts) {
+      console.log(
+        `  [SUBMIT] ${r.name.padEnd(24)} (DR ${r.dr}) via ${r.engineUsed} -> Fields: [${r.mappedFields.slice(0, 5).join(", ")}]`
+      );
+    }
+    console.log("\n  --- @postbuild.dev Inbox Auto-Verification ---");
+    console.log(
+      `  [INBOX]  ${submitRes.inboxVerification.inboxAddress} -> ${submitRes.inboxVerification.autoVerifiedCount} confirmation links auto-verified`
+    );
+    if (submitRes.inboxVerification.extractedOtps.length > 0) {
+      for (const o of submitRes.inboxVerification.extractedOtps) {
+        console.log(`  [OTP]    Extracted code ${o.otp} from ${o.from}`);
+      }
+    }
+    if (submitRes.receiptFile) {
+      console.log(`  [WRITE]  Saved launch receipts to ${submitRes.receiptFile}\n`);
+    }
+    process.exit(0);
+  }
+
+  if (subcmd === "init-agent" || subcmd === "agent") {
+    const res = installAgentSkillFiles({ cwd: process.cwd() });
+    console.log(`  [+] Scaffolded Agent Skill: ${res.skillMdPath}`);
+    console.log(`  [+] Powered by:             postbuild-mcp@2.1.0 (Stateful Delta Compaction)\n`);
+    console.log("  Add this to your Claude Code / Cursor / Antigravity MCP config:\n");
+    console.log(JSON.stringify(res.mcpConfigSnippet, null, 2));
+    console.log("");
+    process.exit(0);
+  }
+
+  if (subcmd === "vault" || subcmd === "vaultos") {
+    const vaultArg =
+      args.find((a, i) => i > 0 && !a.startsWith("--") && !/^https?:\/\//i.test(a)) ||
+      "C:\\Users\\Bennett\\Bennett Labs";
+    const urlArgs = args.filter((a, i) => i > 0 && /^https?:\/\//i.test(a));
+    const targetUrls = urlArgs.length ? urlArgs : ["https://postbuild.dev", "https://payarity.com"];
+
+    console.log(`  [*] Syncing Postbuild MCP Telemetry to Obsidian VaultOS...`);
+    console.log(`  [*] Target Vault: ${vaultArg}`);
+    console.log(`  [*] Domains:      ${targetUrls.join(", ")}\n`);
+
+    const syncRes = await syncPostbuildToVault({
+      vaultPath: vaultArg,
+      urls: targetUrls
+    });
+
+    for (const p of syncRes.telemetry.projects) {
+      console.log(
+        `  [OK] ${p.domain.padEnd(20)} Score: ${p.readinessScore}/100 | pSEO: ${p.pseoCount} | Dirs: ${p.directoryCount} | MCP: ${p.mcpReductionPct}`
+      );
+    }
+    console.log("\n  --- VaultOS Files Updated ---");
+    for (const f of syncRes.writtenVaultFiles) {
+      console.log(`  [WRITE] ${f}`);
+    }
+    console.log("");
+    process.exit(0);
+  }
+
+  if (subcmd === "benchmark") {
+    const targetUrl = args[1] || "https://postbuild.dev";
+    const sim = await runStatefulMcpSimulation({ url: targetUrl });
+    console.log(JSON.stringify(sim, null, 2));
+    process.exit(0);
+  }
+
+  if (subcmd === "login") {
+    const input = args[1] || "";
+    if (!input) {
+      console.log("  Usage: git paid login <email-or-pb_live_key>\n");
+      process.exit(1);
+    }
+    const auth = await authenticateUser(
+      input.startsWith("pb_live_") ? { token: input } : { email: input }
+    );
+    if (!auth.ok) {
+      console.log(`  [!] Login failed: ${auth.error}\n`);
+      process.exit(1);
+    }
+    const globalDir = path.join(os.homedir(), ".postbuild");
+    fs.mkdirSync(globalDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(globalDir, "credentials.json"),
+      JSON.stringify(
+        { email: auth.email, plan: auth.plan, token: auth.token, updatedAt: new Date().toISOString() },
+        null,
+        2
+      ),
+      "utf8"
+    );
+    console.log(`  [+] Authenticated as: ${auth.email}`);
+    console.log(`  [+] Active Plan:      ${auth.plan}`);
+    console.log(`  [+] License Key:      ${auth.token.slice(0, 28)}...`);
+    console.log(`  [ok] Saved credentials to ~/.postbuild/credentials.json\n`);
+    process.exit(0);
+  }
+
+  if (subcmd === "inbox") {
+    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || "postbuild-bot@postbuild.dev";
+    if (args.includes("--test")) {
+      await sendTestVerificationEmail(inboxAddr, "postbuild.dev");
+    }
+    const res = await autoVerifyInboxLinks(inboxAddr);
+    console.log(
+      `  [*] Verification Inbox: ${res.inboxAddress} (${res.totalMessages} messages, ${res.verifiedCount} auto-verified)\n`
+    );
+    if (res.messages.length === 0) {
+      console.log("  No verification emails yet. Run `git paid inbox --test` to test OTP & link extraction.\n");
+    } else {
+      for (const m of res.messages.slice(0, 8)) {
+        console.log(`  From:    ${m.from}`);
+        console.log(`  Subject: ${m.subject}`);
+        if (m.otpCode) console.log(`  OTP:     ${m.otpCode}`);
+        if (m.primaryLink) console.log(`  Verify:  ${m.primaryLink} [${m.autoVerified ? "AUTO-VERIFIED" : "PENDING"}]`);
+        console.log("  --------------------------------------------------------");
+      }
+    }
+    process.exit(0);
+  }
+
+  const isFixMode = subcmd === "fix" || subcmd === "init" || args.includes("--fix");
+  const targetArg =
+    args.find((a) => !a.startsWith("--") && !["scan", "dispatch", "fix", "init"].includes(a.toLowerCase())) ||
+    "https://postbuild.dev";
+
+  console.log(`  [*] Scanning Target: ${targetArg} ...`);
+
+  const report = await scanTargetUrl(targetArg);
+
+  console.log(`  [+] Provisioned Bot Inbox:  ${report.botEmail}`);
+  console.log(`  [+] Readiness Score:        ${report.readinessScore} / 100`);
+  console.log(`  [+] Auto-SEO Pages Ready:   ${report.pseoPages.length} high-intent routes`);
+  console.log(`  [+] Directory Launch Queue: ${report.directoryCount} AI, Dev & Startup Directories\n`);
+
+  console.log("  --- Audit Signals ---");
+  for (const c of report.checks) {
+    const icon = c.passed ? "[PASS]" : "[WARN]";
+    console.log(`  ${icon} ${c.label.padEnd(40)} -> ${c.detail}`);
+  }
+
+  const fixResult = applyLocalSeoFixes(report, {
+    cwd: process.cwd(),
+    overwritePublic: isFixMode || args.includes("--force")
+  });
+
+  console.log(`\n  --- Local Repository Auto-Fix (${fixResult.framework}) ---`);
+  for (const f of fixResult.writtenFiles) {
+    console.log(`  [WRITE] ${f.path.padEnd(36)} (${f.role})`);
+  }
+
+  console.log("\n  -> Live Workspace & MCP Studio: https://postbuild.dev\n");
+}

package/brand/README.md

@@ -0,0 +1,54 @@
+# `postbuild` (`git paid`) — Official Brand Kit
+
+> **`git push` ships your code. `git paid` sells it.**
+
+## 1. Brand Assets
+
+All assets are available in both `/brand/` (repository root) and `/public/brand/` (served live at `https://postbuild.dev/brand/...`):
+
+| Asset | File | Dimensions | Format | Usage |
+| :--- | :--- | :--- | :--- | :--- |
+| **Brand Icon (PNG)** | [`postbuild-icon.png`](./postbuild-icon.png) | `512 × 512 px` | PNG | Stripe Icon, App Store / Directory listings, OAuth apps |
+| **Horizontal Logo (PNG)** | [`postbuild-logo.png`](./postbuild-logo.png) | `1000 × 260 px` | PNG | Stripe Checkout Header Logo, Invoices, Receipts, Press Kits |
+| **Brand Icon (SVG)** | [`postbuild-icon.svg`](./postbuild-icon.svg) | Vector (`64 × 64`) | SVG | Web UI, Favicons, Scalable vector contexts |
+| **Horizontal Logo (SVG)** | [`postbuild-logo.svg`](./postbuild-logo.svg) | Vector (`1000 × 260`) | SVG | High-DPI headers, documentation, print |
+
+---
+
+## 2. Visual Symbolism (`2 × 2` Grid)
+
+The `postbuild` mark represents the two-stage developer lifecycle inside a clean `2 × 2` architectural grid:
+1. **Top Row (`git push` — Ship the build)**: Deep Slate build module (`#0F172A`) on the left pushing outward into the Sky Blue deployment arrow (`#0284C7`) on the right.
+2. **Bottom Row (`git paid` — Monetize & distribute)**: Muted Slate post-build artifact (`#64748B`) on the left converting into the Emerald Green revenue badge (`$`, `#10B981`) on the right.
+
+---
+
+## 3. Color Palette
+
+| Role | Color Name | Hex Code | RGB | Usage |
+| :--- | :--- | :--- | :--- | :--- |
+| **Primary / Brand** | Deep Slate | `#0F172A` | `rgb(15, 23, 42)` | Wordmark, primary CTAs, Stripe **Brand Color** |
+| **Accent (`git paid`)** | Emerald Green | `#10B981` | `rgb(16, 185, 129)` | `$` revenue badge, `git paid` pill, Stripe **Accent Color** |
+| **Secondary (`git push`)** | Sky Blue | `#0284C7` | `rgb(2, 132, 199)` | Deployment arrow (`→`), technical indicators |
+| **Structural Muted** | Slate Gray | `#64748B` | `rgb(100, 116, 139)` | Secondary build block, supporting labels |
+| **Surface / Canvas** | Crisp Alabaster | `#F8FAFC` | `rgb(248, 250, 252)` | App background, card surfaces |
+| **Pure White** | White | `#FFFFFF` | `rgb(255, 255, 255)` | Icon & Logo container surface |
+
+---
+
+## 4. Typography
+
+- **Wordmark (`postbuild`)**: Always lowercase (`postbuild`), set in **Plus Jakarta Sans / Inter ExtraBold (`800`)** with `-0.045em` letter-spacing.
+- **CLI Companion (`git paid`)**: Always lowercase (`git paid`), set in **JetBrains Mono Bold (`700`)** inside an emerald tint pill (`#ECFDF5` fill, `#A7F3D0` border, `#047857` text).
+
+---
+
+## 5. Official Stripe & Directory Copy
+
+- **Business Name**: `postbuild`
+- **Website**: `https://postbuild.dev`
+- **Statement Descriptor**: `POSTBUILD.DEV` (Shortened: `POSTBUILD`)
+- **One-Line Tagline**:
+  > Automated post-build technical SEO, programmatic metadata, and directory launch kits for software developers.
+- **Full Business Description**:
+  > `postbuild` (`https://postbuild.dev`) is a developer SaaS platform and CLI tool (`git paid` / `npx postbuild`) that automates post-build technical SEO audits, structured metadata (JSON-LD, OpenGraph, robots.txt, sitemaps), programmatic SEO route packs, and curated SaaS directory launch kits for software developers and product teams.

package/brand/postbuild-icon.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 64 64" fill="none">
+  <rect width="64" height="64" rx="14" fill="#FFFFFF"/>
+  
+  <!-- Top-left build block (git push source) -->
+  <rect x="7" y="7" width="20" height="20" rx="5.5" stroke="#0F172A" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Bottom-left build block (git paid source) -->
+  <rect x="7" y="37" width="20" height="20" rx="5.5" stroke="#64748B" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Top-right arrow (git push) -->
+  <path d="M36 17H56M56 17L47.5 8.5M56 17L47.5 25.5" stroke="#0284C7" stroke-width="5.2" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <!-- Bottom-right emerald badge + crisp typographic $ (git paid) -->
+  <rect x="35" y="35" width="22" height="22" rx="6.5" fill="#10B981"/>
+  <text x="46" y="52.5" text-anchor="middle" fill="#FFFFFF" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif" font-size="18.5" font-weight="800">$</text>
+
+</svg>

package/brand/postbuild-logo.svg

@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1000" height="260" viewBox="0 0 1000 260" fill="none">
+  <rect width="1000" height="260" fill="#FFFFFF"/>
+  <g transform="translate(36, 26) scale(3.25)">
+    
+  <!-- Top-left build block (git push source) -->
+  <rect x="7" y="7" width="20" height="20" rx="5.5" stroke="#0F172A" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Bottom-left build block (git paid source) -->
+  <rect x="7" y="37" width="20" height="20" rx="5.5" stroke="#64748B" stroke-width="5" fill="#F8FAFC"/>
+  <!-- Top-right arrow (git push) -->
+  <path d="M36 17H56M56 17L47.5 8.5M56 17L47.5 25.5" stroke="#0284C7" stroke-width="5.2" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <!-- Bottom-right emerald badge + crisp typographic $ (git paid) -->
+  <rect x="35" y="35" width="22" height="22" rx="6.5" fill="#10B981"/>
+  <text x="46" y="52.5" text-anchor="middle" fill="#FFFFFF" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif" font-size="18.5" font-weight="800">$</text>
+
+  </g>
+  <text x="276" y="176" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif" font-size="144" font-weight="800" letter-spacing="-5.5">postbuild</text>
+</svg>

package/lib/auth.js

@@ -0,0 +1,208 @@
+// Zero-DB Auth, Email OTP via Resend & Cryptographic License Verification for postbuild (postbuild.dev)
+
+import crypto from "node:crypto";
+import { getStripeClient } from "./stripe.js";
+
+const SECRET = process.env.POSTBUILD_AUTH_SECRET || process.env.STRIPE_WEBHOOK_SECRET || "postbuild-dev-secret-key-2026";
+
+export function signLicenseToken({ email, plan = "launch_pass", domain = "*" }) {
+  const payload = {
+    email: (email || "").toLowerCase().trim(),
+    plan,
+    domain,
+    iat: Math.floor(Date.now() / 1000)
+  };
+  const base64Payload = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const sig = crypto.createHmac("sha256", SECRET).update(base64Payload).digest("base64url").slice(0, 24);
+  return `pb_live_${base64Payload}.${sig}`;
+}
+
+export function verifyLicenseToken(token) {
+  if (!token || typeof token !== "string" || !token.startsWith("pb_live_")) {
+    return { valid: false };
+  }
+  const raw = token.slice("pb_live_".length);
+  const [base64Payload, sig] = raw.split(".");
+  if (!base64Payload || !sig) return { valid: false };
+
+  const expectedSig = crypto.createHmac("sha256", SECRET).update(base64Payload).digest("base64url").slice(0, 24);
+  if (sig !== expectedSig) return { valid: false };
+
+  try {
+    const payload = JSON.parse(Buffer.from(base64Payload, "base64url").toString("utf8"));
+    return { valid: true, ...payload };
+  } catch {
+    return { valid: false };
+  }
+}
+
+function createSignedOtpChallenge(email, otpCode, plan = "launch_pass") {
+  const exp = Math.floor(Date.now() / 1000) + 600; // 10 minutes
+  const data = `${email.toLowerCase().trim()}:${otpCode}:${plan}:${exp}`;
+  const sig = crypto.createHmac("sha256", SECRET).update(data).digest("base64url").slice(0, 24);
+  const encoded = Buffer.from(JSON.stringify({ email: email.toLowerCase().trim(), plan, exp })).toString("base64url");
+  return `${encoded}.${sig}`;
+}
+
+function verifySignedOtpChallenge(challengeToken, otpCode) {
+  if (!challengeToken || !otpCode) return { valid: false };
+  const [encoded, sig] = String(challengeToken).split(".");
+  if (!encoded || !sig) return { valid: false };
+  try {
+    const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    if (!parsed.exp || Math.floor(Date.now() / 1000) > parsed.exp) {
+      return { valid: false, error: "Verification code expired. Please request a new code." };
+    }
+    const data = `${parsed.email}:${String(otpCode).trim()}:${parsed.plan}:${parsed.exp}`;
+    const expectedSig = crypto.createHmac("sha256", SECRET).update(data).digest("base64url").slice(0, 24);
+    if (sig !== expectedSig) {
+      return { valid: false, error: "Invalid 6-digit verification code." };
+    }
+    return { valid: true, email: parsed.email, plan: parsed.plan };
+  } catch {
+    return { valid: false, error: "Invalid verification challenge." };
+  }
+}
+
+async function sendLoginOtpViaResend(email, otpCode, licenseToken) {
+  const resendKey = (process.env.RESEND_API_KEY || "").trim();
+  if (!resendKey) {
+    return { sent: false, reason: "missing_resend_key" };
+  }
+  try {
+    const resp = await fetch("https://api.resend.com/emails", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${resendKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        from: "postbuild <login@postbuild.dev>",
+        to: [email],
+        subject: `${otpCode} is your postbuild verification code`,
+        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; max-width: 520px; margin: 0 auto; padding: 28px; border: 1px solid #e2e8f0; border-radius: 14px; color: #0f172a;">
+          <h2 style="margin: 0 0 8px; font-size: 20px;">postbuild · Account Verification</h2>
+          <p style="color: #475569; font-size: 14px; line-height: 1.6;">Enter this 6-digit verification code on <strong>postbuild.dev</strong> to view your Stripe receipts and manage your subscription:</p>
+          <div style="background: #ecfdf5; border: 1px solid #6ee7b7; color: #047857; font-family: monospace; font-size: 28px; font-weight: 800; letter-spacing: 6px; text-align: center; padding: 14px; border-radius: 10px; margin: 18px 0;">${otpCode}</div>
+          <p style="color: #475569; font-size: 13px; line-height: 1.6;">Your active CLI License Key (for <code>git paid login</code>):</p>
+          <pre style="background: #f8fafc; border: 1px solid #e2e8f0; padding: 10px; border-radius: 8px; font-size: 11px; overflow-x: auto;">${licenseToken}</pre>
+        </div>`
+      })
+    });
+    return { sent: resp.ok };
+  } catch {
+    return { sent: false };
+  }
+}
+
+export async function authenticateUser({ email, token, sessionId, otpCode, challengeToken }) {
+  // 1. If user passes an existing pb_live_ token, verify cryptographic HMAC signature
+  if (token && token.startsWith("pb_live_")) {
+    const verified = verifyLicenseToken(token);
+    if (verified.valid) {
+      return {
+        ok: true,
+        authenticated: true,
+        email: verified.email,
+        plan: verified.plan,
+        domain: verified.domain,
+        token
+      };
+    }
+    return { ok: false, authenticated: false, error: "Invalid pb_live_ license key signature." };
+  }
+
+  // 2. If user is completing Step 2 of Email OTP verification
+  if (otpCode && challengeToken) {
+    const check = verifySignedOtpChallenge(challengeToken, otpCode);
+    if (!check.valid) {
+      return { ok: false, authenticated: false, error: check.error || "Invalid verification code." };
+    }
+    const issued = signLicenseToken({ email: check.email, plan: check.plan, domain: "*" });
+    return {
+      ok: true,
+      authenticated: true,
+      email: check.email,
+      plan: check.plan,
+      domain: "*",
+      token: issued
+    };
+  }
+
+  const stripe = getStripeClient();
+
+  // 3. If user returned from Stripe Checkout with unguessable session_id (cs_...), verify session via StripeClient
+  if (sessionId && stripe) {
+    const session = await stripe.checkout.sessions.retrieve(sessionId);
+    if (session && session.payment_status !== "unpaid") {
+      const custEmail = (session.customer_details?.email || email || "founder@postbuild.dev").toLowerCase().trim();
+      const plan = session.metadata?.plan_id || "launch_pass";
+      const domain = session.client_reference_id || session.metadata?.target_domain || "*";
+      const newToken = signLicenseToken({ email: custEmail, plan, domain });
+      return {
+        ok: true,
+        authenticated: true,
+        email: custEmail,
+        plan,
+        domain,
+        token: newToken
+      };
+    }
+  }
+
+  // 4. If user enters an email address, verify they have a record in Stripe and require a 6-digit email OTP code (or their pb_live_ key)
+  const cleanEmail = (email || "").toLowerCase().trim();
+  if (!cleanEmail || !cleanEmail.includes("@")) {
+    return { ok: false, authenticated: false, error: "Enter your email address or pb_live_ license key." };
+  }
+
+  if (stripe) {
+    const customers = await stripe.customers.list({ email: cleanEmail, limit: 1 });
+    let hasPurchase = Array.isArray(customers.data) && customers.data.length > 0;
+
+    if (!hasPurchase) {
+      const sessions = await stripe.checkout.sessions.list({ limit: 20 });
+      hasPurchase = sessions.data.some(
+        (s) =>
+          s.payment_status !== "unpaid" &&
+          (s.customer_details?.email || s.customer_email || "").toLowerCase().trim() === cleanEmail
+      );
+    }
+
+    if (!hasPurchase) {
+      return {
+        ok: false,
+        authenticated: false,
+        error: "No active Launch Pass found for this email in Stripe. Purchase a Launch Pass ($29) first."
+      };
+    }
+
+    const generatedOtp = String(Math.floor(100000 + Math.random() * 900000));
+    const challenge = createSignedOtpChallenge(cleanEmail, generatedOtp, "launch_pass");
+    const licenseForEmail = signLicenseToken({ email: cleanEmail, plan: "launch_pass", domain: "*" });
+    const emailResult = await sendLoginOtpViaResend(cleanEmail, generatedOtp, licenseForEmail);
+
+    if (emailResult.sent) {
+      return {
+        ok: true,
+        authenticated: false,
+        requiresOtp: true,
+        email: cleanEmail,
+        challengeToken: challenge,
+        message: `We emailed a 6-digit verification code to ${cleanEmail}. Enter it below to unlock your billing & receipts.`
+      };
+    }
+
+    return {
+      ok: false,
+      authenticated: false,
+      error: "For security, email-only lookup is disabled until RESEND_API_KEY is set in Vercel. Please sign in using your pb_live_... license key."
+    };
+  }
+
+  return {
+    ok: false,
+    authenticated: false,
+    error: "Please sign in with your pb_live_... license key."
+  };
+}