git-paid 2.1.1 → 2.1.3

package/LICENSE

@@ -0,0 +1,117 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor
+      (including "postbuild", "git-paid", and "postbuild.dev"), except as
+      required for reasonable and customary use in describing the origin
+      of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Bennett Moore (https://postbuild.dev)
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0

package/README.md

@@ -106,10 +106,8 @@ Writes `_meta/postbuild-telemetry.json` and `_dashboards/Postbuild Launch.md` wi
 
 ---
 
-## License & Commercial Terms
+## License
 
-**Proprietary — Commercial Software (`postbuild.dev`)**
+**Apache-2.0** — Copyright © 2026 Bennett Moore ([https://postbuild.dev](https://postbuild.dev)).
 
-Copyright © 2026 Bennett Moore ([https://postbuild.dev](https://postbuild.dev)). All rights reserved.
-
-The `git-paid` CLI and MCP client package may be installed and executed via `npm` / `npx` to interact with [https://postbuild.dev](https://postbuild.dev). Redistribution, re-hosting, or commercial resale of the underlying platform, directory dispatch engine, or source bundle without an active license from [https://postbuild.dev](https://postbuild.dev) is prohibited.
+The `git-paid` CLI and MCP client are licensed under the [Apache License, Version 2.0](./LICENSE). Under Section 6 of the Apache-2.0 License, no permission is granted to use the `postbuild`, `git-paid`, or `postbuild.dev` trade names, trademarks, or logos. The hosted `postbuild.dev` cloud service, `@postbuild.dev` verification inbox infrastructure, and commercial Launch Pass / Studio tiers remain proprietary services of [https://postbuild.dev](https://postbuild.dev).

package/bin/git-paid.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { scanTargetUrl } from "../lib/engine.js";
-import { authenticateUser } from "../lib/auth.js";
+import { verifyCliLicense } from "../lib/auth.js";
 import { applyLocalSeoFixes } from "../lib/fixer.js";
 import { sendTestVerificationEmail } from "../lib/inbox.js";
 import {
@@ -25,6 +25,14 @@ if (subcmd === "mcp" || args.includes("--mcp")) {
   await runCli();
 }
 
+function printProGateBanner(licenseCheck, featureName) {
+  console.log(`  [LOCKED] ${featureName} requires an active postbuild Launch Pass ($29) or Studio ($49/mo) license.`);
+  console.log(`  [UNLOCK] Instant Stripe Checkout ($29 Launch Pass):`);
+  console.log(`           ${licenseCheck.checkoutUrl}\n`);
+  console.log(`  [LOGIN]  Already purchased? Authenticate your CLI & MCP server:`);
+  console.log(`           npx git-paid login <your-pb_live_key>\n`);
+}
+
 async function runCli() {
   console.log("\n========================================================");
   console.log("  postbuild (postbuild.dev) — `git paid` CLI & MCP");
@@ -33,19 +41,81 @@ async function runCli() {
 
   if (subcmd === "--help" || subcmd === "-h" || subcmd === "help") {
     console.log("  Usage:");
-    console.log("    npx git-paid <url>             Run 8-point SEO/paywall audit & generate Launch Kit");
-    console.log("    git paid submit [url]          Headless Chromium/Edge directory form submitter + OTP verifier");
-    console.log("    git paid fix [url]             Auto-write robots.txt, sitemap.xml, llms.txt & pSEO into public/");
-    console.log("    git paid inbox [bot-email]     Check & auto-verify <slug>-bot@postbuild.dev links & OTPs");
-    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.0)");
+    console.log("    npx git-paid <url>             Run free 8-point SEO/paywall audit & 5-directory preview");
+    console.log("    git paid login <pb_live_key>   Authenticate CLI & MCP with your Launch Pass / Studio license");
+    console.log("    git paid fix [url]             [PRO] Write 25 pSEO HTML pages, robots.txt, sitemap.xml & llms.txt");
+    console.log("    git paid submit [url]          [PRO] Headless 85-directory form submitter + OTP auto-verifier");
+    console.log("    git paid inbox [bot-email]     [PRO] Check & auto-verify <slug>-bot@postbuild.dev links & OTPs");
+    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.3)");
     console.log("    git paid init-agent            Scaffold .agent/skills/postbuild/SKILL.md & MCP config");
-    console.log("    git paid vault [path]          Sync live telemetry & Bento cockpit to Obsidian VaultOS");
-    console.log("    git paid login <email|key>     Authenticate with your Stripe Launch Pass or pb_live_ key\n");
+    console.log("    git paid vault [path]          [PRO] Sync live telemetry & Bento cockpit to Obsidian VaultOS\n");
+    process.exit(0);
+  }
+
+  if (subcmd === "login") {
+    const input = (args[1] || "").trim();
+    if (!input) {
+      console.log("  Usage: npx git-paid login <pb_live_key | cs_live_session_id | email>\n");
+      process.exit(1);
+    }
+
+    const payload = input.startsWith("pb_live_")
+      ? { token: input }
+      : input.startsWith("cs_")
+        ? { sessionId: input }
+        : { email: input };
+
+    let auth = null;
+    try {
+      const resp = await fetch("https://www.postbuild.dev/api/auth", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+        signal: AbortSignal.timeout(8000)
+      });
+      auth = await resp.json();
+    } catch (err) {
+      console.log(`  [!] Could not reach https://www.postbuild.dev/api/auth: ${err.message}\n`);
+      process.exit(1);
+    }
+
+    if (auth && auth.requiresOtp) {
+      console.log(`  [*] ${auth.message}`);
+      console.log(`  [*] Verify on https://www.postbuild.dev/?tab=account or use your pb_live_... key from the email.\n`);
+      process.exit(0);
+    }
+
+    if (!auth || !auth.ok || !auth.token) {
+      console.log(`  [!] Login failed: ${(auth && auth.error) || "Invalid license key."}\n`);
+      process.exit(1);
+    }
+
+    const globalDir = path.join(os.homedir(), ".postbuild");
+    fs.mkdirSync(globalDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(globalDir, "credentials.json"),
+      JSON.stringify(
+        { email: auth.email, plan: auth.plan, token: auth.token, updatedAt: new Date().toISOString() },
+        null,
+        2
+      ),
+      "utf8"
+    );
+    console.log(`  [+] Authenticated as: ${auth.email}`);
+    console.log(`  [+] Active Plan:      ${auth.plan}`);
+    console.log(`  [+] License Key:      ${auth.token.slice(0, 28)}...`);
+    console.log(`  [ok] Saved credentials to ~/.postbuild/credentials.json\n`);
     process.exit(0);
   }
 
   if (subcmd === "submit") {
     const targetUrl = args.find((a, i) => i > 0 && !a.startsWith("--")) || "https://postbuild.dev";
+    const license = await verifyCliLicense({ domain: targetUrl.replace(/^https?:\/\//, "") });
+    if (!license.valid) {
+      printProGateBanner(license, "85-Directory Headless Submitter & @postbuild.dev Auto-Verifier");
+      process.exit(1);
+    }
+
     console.log(`  [*] Running Headless Directory Form Submitter for: ${targetUrl} ...`);
     const submitRes = await runHeadlessDirectorySubmit({
       targetUrl,
@@ -77,10 +147,10 @@ async function runCli() {
     process.exit(0);
   }
 
-  if (subcmd === "init-agent" || subcmd === "agent") {
+  if (subcmd === "init-agent" || subcmd === "agent" || subcmd === "skill") {
     const res = installAgentSkillFiles({ cwd: process.cwd() });
     console.log(`  [+] Scaffolded Agent Skill: ${res.skillMdPath}`);
-    console.log(`  [+] Powered by:             postbuild-mcp@2.1.0 (Stateful Delta Compaction)\n`);
+    console.log(`  [+] Powered by:             postbuild-mcp@2.1.3 (Stateful Delta Compaction)\n`);
     console.log("  Add this to your Claude Code / Cursor / Antigravity MCP config:\n");
     console.log(JSON.stringify(res.mcpConfigSnippet, null, 2));
     console.log("");
@@ -88,6 +158,12 @@ async function runCli() {
   }
 
   if (subcmd === "vault" || subcmd === "vaultos") {
+    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    if (!license.valid) {
+      printProGateBanner(license, "Obsidian VaultOS Telemetry & Bento Dashboard Sync");
+      process.exit(1);
+    }
+
     const vaultArg =
       args.find((a, i) => i > 0 && !a.startsWith("--") && !/^https?:\/\//i.test(a)) ||
       "C:\\Users\\Bennett\\Bennett Labs";
@@ -123,39 +199,14 @@ async function runCli() {
     process.exit(0);
   }
 
-  if (subcmd === "login") {
-    const input = args[1] || "";
-    if (!input) {
-      console.log("  Usage: git paid login <email-or-pb_live_key>\n");
-      process.exit(1);
-    }
-    const auth = await authenticateUser(
-      input.startsWith("pb_live_") ? { token: input } : { email: input }
-    );
-    if (!auth.ok) {
-      console.log(`  [!] Login failed: ${auth.error}\n`);
+  if (subcmd === "inbox") {
+    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || "postbuild-bot@postbuild.dev";
+    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    if (!license.valid) {
+      printProGateBanner(license, "Dedicated @postbuild.dev Verification Inbox & OTP Auto-Verifier");
       process.exit(1);
     }
-    const globalDir = path.join(os.homedir(), ".postbuild");
-    fs.mkdirSync(globalDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(globalDir, "credentials.json"),
-      JSON.stringify(
-        { email: auth.email, plan: auth.plan, token: auth.token, updatedAt: new Date().toISOString() },
-        null,
-        2
-      ),
-      "utf8"
-    );
-    console.log(`  [+] Authenticated as: ${auth.email}`);
-    console.log(`  [+] Active Plan:      ${auth.plan}`);
-    console.log(`  [+] License Key:      ${auth.token.slice(0, 28)}...`);
-    console.log(`  [ok] Saved credentials to ~/.postbuild/credentials.json\n`);
-    process.exit(0);
-  }
 
-  if (subcmd === "inbox") {
-    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || "postbuild-bot@postbuild.dev";
     if (args.includes("--test")) {
       await sendTestVerificationEmail(inboxAddr, "postbuild.dev");
     }
@@ -185,24 +236,48 @@ async function runCli() {
   console.log(`  [*] Scanning Target: ${targetArg} ...`);
 
   const report = await scanTargetUrl(targetArg);
+  const license = await verifyCliLicense({ domain: report.domain });
 
-  console.log(`  [+] Provisioned Bot Inbox:  ${report.botEmail}`);
+  console.log(`  [+] Provisioned Bot Inbox:  ${report.botEmail} ${license.valid ? "[ACTIVE]" : "[LOCKED — $29 Launch Pass]"}`);
   console.log(`  [+] Readiness Score:        ${report.readinessScore} / 100`);
   console.log(`  [+] Auto-SEO Pages Ready:   ${report.pseoPages.length} high-intent routes`);
   console.log(`  [+] Directory Launch Queue: ${report.directoryCount} AI, Dev & Startup Directories\n`);
 
-  console.log("  --- Audit Signals ---");
+  console.log("  --- 8-Point Technical & Monetization Audit ---");
   for (const c of report.checks) {
     const icon = c.passed ? "[PASS]" : "[WARN]";
     console.log(`  ${icon} ${c.label.padEnd(40)} -> ${c.detail}`);
   }
 
+  if (isFixMode && !license.valid) {
+    console.log("");
+    printProGateBanner(license, "Auto-Fix Bundle (25 pSEO HTML Pages, llms.txt, sitemap.xml & 85-Directory CSV)");
+    process.exit(1);
+  }
+
+  if (!license.valid) {
+    console.log("\n  --- Directory Launch Queue Preview (First 5 of 85) ---");
+    for (const d of report.directories.slice(0, 5)) {
+      console.log(`  [PREVIEW] ${d.name.padEnd(26)} (DR ${d.dr}) -> ${d.category}`);
+    }
+    console.log(`  ... +80 additional high-DR directories locked.\n`);
+
+    console.log("  --- Programmatic SEO Route Preview (First 3 of 25) ---");
+    for (const p of report.pseoPages.slice(0, 3)) {
+      console.log(`  [PREVIEW] ${p.path.padEnd(42)} (${p.volume}, ${p.kd})`);
+    }
+    console.log(`  ... +22 additional Programmatic SEO HTML pages locked.\n`);
+
+    printProGateBanner(license, "Full 25-Page pSEO Generator, 85-Directory Dispatch & @postbuild.dev Inbox");
+    process.exit(0);
+  }
+
   const fixResult = applyLocalSeoFixes(report, {
     cwd: process.cwd(),
     overwritePublic: isFixMode || args.includes("--force")
   });
 
-  console.log(`\n  --- Local Repository Auto-Fix (${fixResult.framework}) ---`);
+  console.log(`\n  --- Local Repository Auto-Fix (${fixResult.framework} — Licensed to ${license.email}) ---`);
   for (const f of fixResult.writtenFiles) {
     console.log(`  [WRITE] ${f.path.padEnd(36)} (${f.role})`);
   }

package/lib/auth.js

@@ -1,9 +1,83 @@
 // Zero-DB Auth, Email OTP via Resend & Cryptographic License Verification for postbuild (postbuild.dev)
 
 import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
 import { getStripeClient } from "./stripe.js";
 
-const SECRET = process.env.POSTBUILD_AUTH_SECRET || process.env.STRIPE_WEBHOOK_SECRET || "postbuild-dev-secret-key-2026";
+const SECRET =
+  process.env.POSTBUILD_AUTH_SECRET ||
+  process.env.STRIPE_WEBHOOK_SECRET ||
+  process.env.STRIPE_RESTRICTED_KEY ||
+  process.env.STRIPE_SECRET_KEY ||
+  "postbuild-dev-secret-key-2026";
+
+export function loadLocalCredentials() {
+  if (process.env.POSTBUILD_LICENSE_KEY) {
+    return { token: process.env.POSTBUILD_LICENSE_KEY.trim(), email: "cli@postbuild.dev", plan: "launch_pass" };
+  }
+  try {
+    const credPath = path.join(os.homedir(), ".postbuild", "credentials.json");
+    if (fs.existsSync(credPath)) {
+      const data = JSON.parse(fs.readFileSync(credPath, "utf8"));
+      if (data && data.token) return data;
+    }
+  } catch {}
+  return null;
+}
+
+export async function verifyCliLicense({ domain = "postbuild.dev" } = {}) {
+  // Always allow internal server-side execution on Vercel
+  if (process.env.VERCEL || process.env.STRIPE_RESTRICTED_KEY || process.env.STRIPE_SECRET_KEY) {
+    return { valid: true, email: "server@postbuild.dev", plan: "studio_monthly" };
+  }
+
+  const creds = loadLocalCredentials();
+  if (creds && creds.token && creds.token.startsWith("pb_live_")) {
+    try {
+      const resp = await fetch("https://www.postbuild.dev/api/auth", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token: creds.token }),
+        signal: AbortSignal.timeout(5000)
+      });
+      if (resp.ok) {
+        const data = await resp.json();
+        if (data && data.ok && data.authenticated) {
+          return { valid: true, email: data.email, plan: data.plan, token: creds.token };
+        }
+      }
+    } catch {
+      // Offline fallback: verify structural format if network is unreachable
+      const parts = creds.token.slice("pb_live_".length).split(".");
+      if (parts.length === 2 && parts[0].length > 10 && parts[1].length === 24) {
+        return { valid: true, email: creds.email || "offline@postbuild.dev", plan: creds.plan || "launch_pass", token: creds.token };
+      }
+    }
+  }
+
+  let checkoutUrl = `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`;
+  try {
+    const cResp = await fetch(
+      `https://www.postbuild.dev/api/checkout?plan=launch_pass&domain=${encodeURIComponent(domain)}`,
+      { signal: AbortSignal.timeout(4500) }
+    );
+    if (cResp.ok) {
+      const cData = await cResp.json();
+      if (cData && cData.checkoutUrl) checkoutUrl = cData.checkoutUrl;
+    }
+  } catch {}
+
+  return {
+    valid: false,
+    reason: "PRO_LICENSE_REQUIRED",
+    checkoutUrl,
+    webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+    message:
+      "A postbuild Launch Pass ($29) or Studio ($49/mo) license (pb_live_...) is required to unlock 25 Programmatic SEO HTML pages, 85-directory dispatch, and @postbuild.dev inbox auto-verification."
+  };
+}
 
 export function signLicenseToken({ email, plan = "launch_pass", domain = "*" }) {
   const payload = {

package/lib/mcp.js

@@ -7,6 +7,7 @@ import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
 import { scanTargetUrl, searchBuyerIntentRadar, dispatchDirectories, DIRECTORIES } from "./engine.js";
+import { verifyCliLicense } from "./auth.js";
 import { applyLocalSeoFixes } from "./fixer.js";
 import { listInboxMessages, sendTestVerificationEmail } from "./inbox.js";
 import { withStatefulMcp, createGenericEntityAdapter } from "./stateful-mcp.js";
@@ -635,25 +636,37 @@ export const MCP_TOOLS = [
 export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio-session") {
   if (name === "postbuild_scan") {
     const report = await scanTargetUrl(args.url || "https://postbuild.dev");
+    const license = await verifyCliLicense({ domain: report.domain });
     getDomainDirectories(report.targetUrl, report);
     return {
       domain: report.domain,
       targetUrl: report.targetUrl,
       readinessScore: report.readinessScore,
       botEmail: report.botEmail,
+      licenseStatus: license.valid ? "PRO_ACTIVE" : "FREE_PREVIEW",
       checks: report.checks,
       pseoRouteCount: report.pseoPages.length,
-      directoryCount: report.directoryCount
+      directoryCount: report.directoryCount,
+      ...(license.valid
+        ? {}
+        : {
+            upgradeNotice: license.message,
+            checkoutUrl: license.checkoutUrl,
+            loginCommand: "npx git-paid login <your-pb_live_key>"
+          })
     };
   }
 
   if (name === "postbuild_directories") {
     const targetUrl = args.url || "https://postbuild.dev";
     const state = getDomainDirectories(targetUrl);
+    const license = await verifyCliLicense({ domain: state.domain });
     const catFilter = (args.category || "").toLowerCase();
     const statusFilter = (args.status || "").toLowerCase();
     const minDa = Number(args.min_da) || 0;
 
+    const maxAllowed = license.valid ? Number(args.limit) || 25 : 5;
+
     const records = await mcpDirectories.queryWithSupersetCache({
       sessionId,
       cacheKey: `dirs:${state.domain}`,
@@ -662,20 +675,34 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
         (!catFilter || d.category.toLowerCase().includes(catFilter)) &&
         (!statusFilter || d.status.toLowerCase().includes(statusFilter)) &&
         d.dr >= minDa,
-      limit: Number(args.limit) || 25,
+      limit: maxAllowed,
       bypassCache: Boolean(args.bypass_cache)
     });
 
-    return mcpDirectories.compactList({
+    const compacted = mcpDirectories.compactList({
       sessionId,
       records,
       bypassCache: Boolean(args.bypass_cache)
     });
+
+    if (!license.valid) {
+      return {
+        ...compacted,
+        _license_status: "PREVIEW_ONLY_5_OF_85",
+        _locked_directories: 80,
+        _checkout_url: license.checkoutUrl,
+        _unlock_instructions: "Purchase a $29 Launch Pass and run: npx git-paid login <pb_live_key>"
+      };
+    }
+    return compacted;
   }
 
   if (name === "postbuild_pseo") {
     const targetUrl = args.url || "https://postbuild.dev";
+    const license = await verifyCliLicense({ domain: targetUrl.replace(/^https?:\/\//, "") });
     const intentFilter = (args.intent || "").toLowerCase();
+    const maxAllowed = license.valid ? 25 : 3;
+
     const records = await mcpPseo.queryWithSupersetCache({
       sessionId,
       cacheKey: `pseo:${targetUrl}`,
@@ -688,20 +715,43 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
         }));
       },
       filter: (p) => !intentFilter || p.intent.toLowerCase().includes(intentFilter),
-      limit: 25,
+      limit: maxAllowed,
       bypassCache: Boolean(args.bypass_cache)
     });
 
-    return mcpPseo.compactList({
+    const compacted = mcpPseo.compactList({
       sessionId,
       records,
       bypassCache: Boolean(args.bypass_cache)
     });
+
+    if (!license.valid) {
+      return {
+        ...compacted,
+        _license_status: "PREVIEW_ONLY_3_OF_25",
+        _locked_routes: 22,
+        _checkout_url: license.checkoutUrl,
+        _unlock_instructions: "Purchase a $29 Launch Pass and run: npx git-paid login <pb_live_key>"
+      };
+    }
+    return compacted;
   }
 
   if (name === "postbuild_dispatch") {
     const targetUrl = args.url || "https://postbuild.dev";
     const state = getDomainDirectories(targetUrl);
+    const license = await verifyCliLicense({ domain: state.domain });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        domain: state.domain,
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
+    }
+
     const dryRun = args.dry_run !== undefined ? Boolean(args.dry_run) : true;
     const targetIds = Array.isArray(args.directory_ids) ? args.directory_ids : [];
 
@@ -765,6 +815,17 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_inbox") {
+    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
+    }
+
     const inboxAddr = args.inbox || "postbuild-bot@postbuild.dev";
     if (args.send_test) {
       await sendTestVerificationEmail(inboxAddr, "postbuild.dev");
@@ -790,6 +851,18 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
 
   if (name === "postbuild_fix") {
     const report = await scanTargetUrl(args.url || "https://postbuild.dev");
+    const license = await verifyCliLicense({ domain: report.domain });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        domain: report.domain,
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
+    }
+
     const fixRes = applyLocalSeoFixes(report, {
       cwd: args.cwd || process.cwd(),
       overwritePublic: true
@@ -798,6 +871,17 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_vault_sync") {
+    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
+    }
+
     return await syncPostbuildToVault({
       vaultPath: args.vault_path || "C:\\Users\\Bennett\\Bennett Labs",
       urls: Array.isArray(args.urls) && args.urls.length ? args.urls : ["https://postbuild.dev", "https://payarity.com"],

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "git-paid",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "git push ships your code. git paid sells it. Autonomous SEO, Paywall, MCP & Directory Launch Agent (postbuild.dev).",
   "type": "module",
-  "main": "server.js",
+  "main": "bin/git-paid.js",
   "bin": {
     "git-paid": "bin/git-paid.js",
     "postbuild": "bin/git-paid.js"
@@ -12,7 +12,8 @@
     "bin/",
     "lib/",
     "brand/",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
     "start": "node server.js",
@@ -36,7 +37,7 @@
     "url": "git+https://github.com/Rbm3267/postbuild.git"
   },
   "homepage": "https://postbuild.dev",
-  "license": "SEE LICENSE IN README.md",
+  "license": "Apache-2.0",
   "dependencies": {
     "stripe": "^23.1.0"
   }

package/server.js

@@ -1,252 +0,0 @@
-import http from "node:http";
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { scanTargetUrl, searchBuyerIntentRadar, dispatchDirectories } from "./lib/engine.js";
-import { createStripeCheckout, createCustomerPortalSession, verifyAndHandleStripeWebhook, configureStripeBrandingAndPortal, getCustomerBillingSummary, cancelCustomerSubscription } from "./lib/stripe.js";
-import { authenticateUser, verifyLicenseToken } from "./lib/auth.js";
-import { ingestInboundEmail, listInboxMessages, sendTestVerificationEmail } from "./lib/inbox.js";
-import { autoVerifyInboxLinks, runStatefulMcpSimulation, executeMcpToolCall } from "./lib/mcp.js";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const PORT = Number(process.env.POSTBUILD_PORT) || 8096;
-
-// Load local .env if present
-const envPath = path.join(__dirname, ".env");
-if (fs.existsSync(envPath)) {
-  const envContent = fs.readFileSync(envPath, "utf8");
-  for (const line of envContent.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eqIdx = trimmed.indexOf("=");
-    if (eqIdx > 0) {
-      const key = trimmed.slice(0, eqIdx).trim();
-      const val = trimmed.slice(eqIdx + 1).trim().replace(/^["']|["']$/g, "");
-      if (!process.env[key]) process.env[key] = val;
-    }
-  }
-}
-
-const MIME_TYPES = {
-  ".html": "text/html; charset=utf-8",
-  ".js": "application/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".xml": "application/xml; charset=utf-8",
-  ".txt": "text/plain; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".png": "image/png"
-};
-
-function readRawBuffer(req) {
-  return new Promise((resolve) => {
-    const chunks = [];
-    req.on("data", chunk => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
-    req.on("end", () => resolve(Buffer.concat(chunks)));
-  });
-}
-
-async function readJsonBody(req) {
-  const buf = await readRawBuffer(req);
-  try {
-    return buf.length ? JSON.parse(buf.toString("utf8")) : {};
-  } catch {
-    return {};
-  }
-}
-
-const server = http.createServer(async (req, res) => {
-  try {
-    const host = req.headers.host || `localhost:${PORT}`;
-    const parsed = new URL(req.url || "/", `http://${host}`);
-
-    if (parsed.pathname === "/api/scan") {
-      const target = parsed.searchParams.get("url") || "https://postbuild.dev";
-      const result = await scanTargetUrl(target);
-      res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-      res.end(JSON.stringify(result));
-      return;
-    }
-
-    if (parsed.pathname === "/api/radar") {
-      const q = parsed.searchParams.get("q") || "seo marketing indie hacker";
-      const threads = await searchBuyerIntentRadar(q);
-      res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-      res.end(JSON.stringify({ query: q, threads }));
-      return;
-    }
-
-    if (parsed.pathname === "/api/dispatch") {
-      const body = req.method === "POST" ? await readJsonBody(req) : {};
-      const action = body.action || parsed.searchParams.get("action") || "";
-      const inbox = body.inbox || body.to || parsed.searchParams.get("inbox") || "postbuild-bot@postbuild.dev";
-      if (action === "inbound_email") {
-        const msg = await ingestInboundEmail(body);
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify({ ok: true, message: msg }));
-        return;
-      }
-      if (action === "inbox_test") {
-        const domain = body.domain || parsed.searchParams.get("domain") || "postbuild.dev";
-        const msg = await sendTestVerificationEmail(inbox, domain);
-        const list = await listInboxMessages(inbox, { allowRemoteFallback: false });
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify({ ok: true, latest: msg, ...list }));
-        return;
-      }
-      if (action === "inbox_autoverify") {
-        const current = await listInboxMessages(inbox, { allowRemoteFallback: false });
-        if (current.count === 0) {
-          const domain = body.domain || parsed.searchParams.get("domain") || "postbuild.dev";
-          await sendTestVerificationEmail(inbox, domain);
-        }
-        const verified = await autoVerifyInboxLinks(inbox);
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify({ ok: true, ...verified }));
-        return;
-      }
-      if (action === "inbox_list") {
-        const list = await listInboxMessages(inbox, { allowRemoteFallback: false });
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify({ ok: true, ...list }));
-        return;
-      }
-      if (action === "mcp_simulate") {
-        const targetUrl = body.url || body.targetUrl || parsed.searchParams.get("url") || "https://postbuild.dev";
-        const sim = await runStatefulMcpSimulation({
-          url: targetUrl,
-          sessionId: body.sessionId || "local-studio-mcp"
-        });
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify({ ok: true, ...sim }));
-        return;
-      }
-      if (action === "mcp_call") {
-        const targetUrl = body.url || body.targetUrl || parsed.searchParams.get("url") || "https://postbuild.dev";
-        const toolName = body.tool || parsed.searchParams.get("tool") || "postbuild_directories";
-        const toolArgs = body.args || { url: targetUrl };
-        const output = await executeMcpToolCall(toolName, toolArgs, body.sessionId || "local-studio-session");
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify({ ok: true, tool: toolName, result: output }));
-        return;
-      }
-      const targetUrl = body.url || body.targetUrl || parsed.searchParams.get("url") || "https://postbuild.dev";
-      const directoryIds = Array.isArray(body.directoryIds) ? body.directoryIds : [];
-      const result = await dispatchDirectories({ targetUrl, directoryIds });
-      res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-      res.end(JSON.stringify(result));
-      return;
-    }
-
-    if (parsed.pathname === "/api/checkout") {
-      const body = req.method === "POST" ? await readJsonBody(req) : {};
-      const planId = body.plan || parsed.searchParams.get("plan") || "launch_pass";
-      const targetDomain = body.domain || parsed.searchParams.get("domain") || "postbuild.dev";
-      const customerEmail = body.email || parsed.searchParams.get("email") || "";
-      const coupon = body.coupon || parsed.searchParams.get("coupon") || "";
-      const origin = `http://${host}`;
-      const result = await createStripeCheckout({ planId, targetDomain, customerEmail, coupon, origin });
-      res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-      res.end(JSON.stringify(result));
-      return;
-    }
-
-    if (parsed.pathname === "/api/portal") {
-      const body = req.method === "POST" ? await readJsonBody(req) : {};
-      const action = body.action || parsed.searchParams.get("action") || "";
-      const token = body.token || parsed.searchParams.get("token") || "";
-      const subscriptionId = body.subscriptionId || parsed.searchParams.get("subscriptionId") || "";
-      if (action === "setup_branding") {
-        const iconPath = path.join(__dirname, "public", "brand", "postbuild-icon.png");
-        const iconBuf = fs.existsSync(iconPath) ? fs.readFileSync(iconPath) : null;
-        const brandingResult = await configureStripeBrandingAndPortal(iconBuf);
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify(brandingResult));
-        return;
-      }
-
-      const verified = verifyLicenseToken(token);
-      if (!verified.valid || !verified.email) {
-        res.writeHead(401, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(
-          JSON.stringify({
-            ok: false,
-            error: "Unauthorized: A verified pb_live_ license token is required to view receipts or manage billing."
-          })
-        );
-        return;
-      }
-
-      if (action === "billing_summary") {
-        const summary = await getCustomerBillingSummary({ customerEmail: verified.email });
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify(summary));
-        return;
-      }
-      if (action === "cancel_subscription") {
-        const cancelled = await cancelCustomerSubscription({
-          subscriptionId,
-          customerEmail: verified.email
-        });
-        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-        res.end(JSON.stringify(cancelled));
-        return;
-      }
-      const returnUrl = `http://${host}/?tab=account`;
-      const result = await createCustomerPortalSession({ customerEmail: verified.email, returnUrl });
-      res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-      res.end(JSON.stringify(result));
-      return;
-    }
-
-    if (parsed.pathname === "/api/webhook" && req.method === "POST") {
-      const rawBody = await readRawBuffer(req);
-      const sig = req.headers["stripe-signature"] || "";
-      const result = await verifyAndHandleStripeWebhook(rawBody, sig);
-      res.writeHead(result.status || 200, { "Content-Type": "application/json; charset=utf-8" });
-      res.end(JSON.stringify(result));
-      return;
-    }
-
-    if (parsed.pathname === "/api/auth") {
-      const body = req.method === "POST" ? await readJsonBody(req) : {};
-      const email = body.email || parsed.searchParams.get("email") || "";
-      const token = body.token || parsed.searchParams.get("token") || "";
-      const sessionId = body.sessionId || parsed.searchParams.get("session_id") || "";
-      const otpCode = body.otpCode || parsed.searchParams.get("otpCode") || "";
-      const challengeToken = body.challengeToken || parsed.searchParams.get("challengeToken") || "";
-      const result = await authenticateUser({ email, token, sessionId, otpCode, challengeToken });
-      res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
-      res.end(JSON.stringify(result));
-      return;
-    }
-
-    let safePath = parsed.pathname === "/" ? "/index.html" : parsed.pathname;
-    let filePath = path.join(__dirname, "public", safePath);
-    if (!fs.existsSync(filePath) && fs.existsSync(`${filePath}.html`)) {
-      filePath = `${filePath}.html`;
-    }
-
-    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
-      const ext = path.extname(filePath).toLowerCase();
-      res.writeHead(200, { "Content-Type": MIME_TYPES[ext] || "application/octet-stream" });
-      fs.createReadStream(filePath).pipe(res);
-      return;
-    }
-
-    // Fallback SPA route
-    const indexHtml = path.join(__dirname, "public", "index.html");
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    fs.createReadStream(indexHtml).pipe(res);
-  } catch (err) {
-    res.writeHead(500, { "Content-Type": "application/json; charset=utf-8" });
-    res.end(JSON.stringify({ error: err.message }));
-  }
-});
-
-server.listen(PORT, "0.0.0.0", () => {
-  console.log(`\n  postbuild (postbuild.dev) live at:`);
-  console.log(`  -> Local:     http://localhost:${PORT}`);
-  console.log(`  -> Tailscale: http://100.117.7.27:${PORT}\n`);
-});