git-paid 2.1.3 → 2.1.5

package/lib/auth.js

@@ -1,282 +1,866 @@
-// Zero-DB Auth, Email OTP via Resend & Cryptographic License Verification for postbuild (postbuild.dev)
-
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-import { getStripeClient } from "./stripe.js";
-
-const SECRET =
-  process.env.POSTBUILD_AUTH_SECRET ||
-  process.env.STRIPE_WEBHOOK_SECRET ||
-  process.env.STRIPE_RESTRICTED_KEY ||
-  process.env.STRIPE_SECRET_KEY ||
-  "postbuild-dev-secret-key-2026";
-
-export function loadLocalCredentials() {
-  if (process.env.POSTBUILD_LICENSE_KEY) {
-    return { token: process.env.POSTBUILD_LICENSE_KEY.trim(), email: "cli@postbuild.dev", plan: "launch_pass" };
-  }
-  try {
-    const credPath = path.join(os.homedir(), ".postbuild", "credentials.json");
-    if (fs.existsSync(credPath)) {
-      const data = JSON.parse(fs.readFileSync(credPath, "utf8"));
-      if (data && data.token) return data;
-    }
-  } catch {}
-  return null;
-}
-
-export async function verifyCliLicense({ domain = "postbuild.dev" } = {}) {
-  // Always allow internal server-side execution on Vercel
-  if (process.env.VERCEL || process.env.STRIPE_RESTRICTED_KEY || process.env.STRIPE_SECRET_KEY) {
-    return { valid: true, email: "server@postbuild.dev", plan: "studio_monthly" };
-  }
-
-  const creds = loadLocalCredentials();
-  if (creds && creds.token && creds.token.startsWith("pb_live_")) {
-    try {
-      const resp = await fetch("https://www.postbuild.dev/api/auth", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ token: creds.token }),
-        signal: AbortSignal.timeout(5000)
-      });
-      if (resp.ok) {
-        const data = await resp.json();
-        if (data && data.ok && data.authenticated) {
-          return { valid: true, email: data.email, plan: data.plan, token: creds.token };
-        }
-      }
-    } catch {
-      // Offline fallback: verify structural format if network is unreachable
-      const parts = creds.token.slice("pb_live_".length).split(".");
-      if (parts.length === 2 && parts[0].length > 10 && parts[1].length === 24) {
-        return { valid: true, email: creds.email || "offline@postbuild.dev", plan: creds.plan || "launch_pass", token: creds.token };
-      }
-    }
-  }
-
-  let checkoutUrl = `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`;
-  try {
-    const cResp = await fetch(
-      `https://www.postbuild.dev/api/checkout?plan=launch_pass&domain=${encodeURIComponent(domain)}`,
-      { signal: AbortSignal.timeout(4500) }
-    );
-    if (cResp.ok) {
-      const cData = await cResp.json();
-      if (cData && cData.checkoutUrl) checkoutUrl = cData.checkoutUrl;
-    }
-  } catch {}
-
-  return {
-    valid: false,
-    reason: "PRO_LICENSE_REQUIRED",
-    checkoutUrl,
-    webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
-    message:
-      "A postbuild Launch Pass ($29) or Studio ($49/mo) license (pb_live_...) is required to unlock 25 Programmatic SEO HTML pages, 85-directory dispatch, and @postbuild.dev inbox auto-verification."
-  };
-}
-
-export function signLicenseToken({ email, plan = "launch_pass", domain = "*" }) {
-  const payload = {
-    email: (email || "").toLowerCase().trim(),
-    plan,
-    domain,
-    iat: Math.floor(Date.now() / 1000)
-  };
-  const base64Payload = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const sig = crypto.createHmac("sha256", SECRET).update(base64Payload).digest("base64url").slice(0, 24);
-  return `pb_live_${base64Payload}.${sig}`;
-}
-
-export function verifyLicenseToken(token) {
-  if (!token || typeof token !== "string" || !token.startsWith("pb_live_")) {
-    return { valid: false };
-  }
-  const raw = token.slice("pb_live_".length);
-  const [base64Payload, sig] = raw.split(".");
-  if (!base64Payload || !sig) return { valid: false };
-
-  const expectedSig = crypto.createHmac("sha256", SECRET).update(base64Payload).digest("base64url").slice(0, 24);
-  if (sig !== expectedSig) return { valid: false };
-
-  try {
-    const payload = JSON.parse(Buffer.from(base64Payload, "base64url").toString("utf8"));
-    return { valid: true, ...payload };
-  } catch {
-    return { valid: false };
-  }
-}
-
-function createSignedOtpChallenge(email, otpCode, plan = "launch_pass") {
-  const exp = Math.floor(Date.now() / 1000) + 600; // 10 minutes
-  const data = `${email.toLowerCase().trim()}:${otpCode}:${plan}:${exp}`;
-  const sig = crypto.createHmac("sha256", SECRET).update(data).digest("base64url").slice(0, 24);
-  const encoded = Buffer.from(JSON.stringify({ email: email.toLowerCase().trim(), plan, exp })).toString("base64url");
-  return `${encoded}.${sig}`;
-}
-
-function verifySignedOtpChallenge(challengeToken, otpCode) {
-  if (!challengeToken || !otpCode) return { valid: false };
-  const [encoded, sig] = String(challengeToken).split(".");
-  if (!encoded || !sig) return { valid: false };
-  try {
-    const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-    if (!parsed.exp || Math.floor(Date.now() / 1000) > parsed.exp) {
-      return { valid: false, error: "Verification code expired. Please request a new code." };
-    }
-    const data = `${parsed.email}:${String(otpCode).trim()}:${parsed.plan}:${parsed.exp}`;
-    const expectedSig = crypto.createHmac("sha256", SECRET).update(data).digest("base64url").slice(0, 24);
-    if (sig !== expectedSig) {
-      return { valid: false, error: "Invalid 6-digit verification code." };
-    }
-    return { valid: true, email: parsed.email, plan: parsed.plan };
-  } catch {
-    return { valid: false, error: "Invalid verification challenge." };
-  }
-}
-
-async function sendLoginOtpViaResend(email, otpCode, licenseToken) {
-  const resendKey = (process.env.RESEND_API_KEY || "").trim();
-  if (!resendKey) {
-    return { sent: false, reason: "missing_resend_key" };
-  }
-  try {
-    const resp = await fetch("https://api.resend.com/emails", {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${resendKey}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        from: "postbuild <login@postbuild.dev>",
-        to: [email],
-        subject: `${otpCode} is your postbuild verification code`,
-        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; max-width: 520px; margin: 0 auto; padding: 28px; border: 1px solid #e2e8f0; border-radius: 14px; color: #0f172a;">
-          <h2 style="margin: 0 0 8px; font-size: 20px;">postbuild · Account Verification</h2>
-          <p style="color: #475569; font-size: 14px; line-height: 1.6;">Enter this 6-digit verification code on <strong>postbuild.dev</strong> to view your Stripe receipts and manage your subscription:</p>
-          <div style="background: #ecfdf5; border: 1px solid #6ee7b7; color: #047857; font-family: monospace; font-size: 28px; font-weight: 800; letter-spacing: 6px; text-align: center; padding: 14px; border-radius: 10px; margin: 18px 0;">${otpCode}</div>
-          <p style="color: #475569; font-size: 13px; line-height: 1.6;">Your active CLI License Key (for <code>git paid login</code>):</p>
-          <pre style="background: #f8fafc; border: 1px solid #e2e8f0; padding: 10px; border-radius: 8px; font-size: 11px; overflow-x: auto;">${licenseToken}</pre>
-        </div>`
-      })
-    });
-    return { sent: resp.ok };
-  } catch {
-    return { sent: false };
-  }
-}
-
-export async function authenticateUser({ email, token, sessionId, otpCode, challengeToken }) {
-  // 1. If user passes an existing pb_live_ token, verify cryptographic HMAC signature
-  if (token && token.startsWith("pb_live_")) {
-    const verified = verifyLicenseToken(token);
-    if (verified.valid) {
-      return {
-        ok: true,
-        authenticated: true,
-        email: verified.email,
-        plan: verified.plan,
-        domain: verified.domain,
-        token
-      };
-    }
-    return { ok: false, authenticated: false, error: "Invalid pb_live_ license key signature." };
-  }
-
-  // 2. If user is completing Step 2 of Email OTP verification
-  if (otpCode && challengeToken) {
-    const check = verifySignedOtpChallenge(challengeToken, otpCode);
-    if (!check.valid) {
-      return { ok: false, authenticated: false, error: check.error || "Invalid verification code." };
-    }
-    const issued = signLicenseToken({ email: check.email, plan: check.plan, domain: "*" });
-    return {
-      ok: true,
-      authenticated: true,
-      email: check.email,
-      plan: check.plan,
-      domain: "*",
-      token: issued
-    };
-  }
-
-  const stripe = getStripeClient();
-
-  // 3. If user returned from Stripe Checkout with unguessable session_id (cs_...), verify session via StripeClient
-  if (sessionId && stripe) {
-    const session = await stripe.checkout.sessions.retrieve(sessionId);
-    if (session && session.payment_status !== "unpaid") {
-      const custEmail = (session.customer_details?.email || email || "founder@postbuild.dev").toLowerCase().trim();
-      const plan = session.metadata?.plan_id || "launch_pass";
-      const domain = session.client_reference_id || session.metadata?.target_domain || "*";
-      const newToken = signLicenseToken({ email: custEmail, plan, domain });
-      return {
-        ok: true,
-        authenticated: true,
-        email: custEmail,
-        plan,
-        domain,
-        token: newToken
-      };
-    }
-  }
-
-  // 4. If user enters an email address, verify they have a record in Stripe and require a 6-digit email OTP code (or their pb_live_ key)
-  const cleanEmail = (email || "").toLowerCase().trim();
-  if (!cleanEmail || !cleanEmail.includes("@")) {
-    return { ok: false, authenticated: false, error: "Enter your email address or pb_live_ license key." };
-  }
-
-  if (stripe) {
-    const customers = await stripe.customers.list({ email: cleanEmail, limit: 1 });
-    let hasPurchase = Array.isArray(customers.data) && customers.data.length > 0;
-
-    if (!hasPurchase) {
-      const sessions = await stripe.checkout.sessions.list({ limit: 20 });
-      hasPurchase = sessions.data.some(
-        (s) =>
-          s.payment_status !== "unpaid" &&
-          (s.customer_details?.email || s.customer_email || "").toLowerCase().trim() === cleanEmail
-      );
-    }
-
-    if (!hasPurchase) {
-      return {
-        ok: false,
-        authenticated: false,
-        error: "No active Launch Pass found for this email in Stripe. Purchase a Launch Pass ($29) first."
-      };
-    }
-
-    const generatedOtp = String(Math.floor(100000 + Math.random() * 900000));
-    const challenge = createSignedOtpChallenge(cleanEmail, generatedOtp, "launch_pass");
-    const licenseForEmail = signLicenseToken({ email: cleanEmail, plan: "launch_pass", domain: "*" });
-    const emailResult = await sendLoginOtpViaResend(cleanEmail, generatedOtp, licenseForEmail);
-
-    if (emailResult.sent) {
-      return {
-        ok: true,
-        authenticated: false,
-        requiresOtp: true,
-        email: cleanEmail,
-        challengeToken: challenge,
-        message: `We emailed a 6-digit verification code to ${cleanEmail}. Enter it below to unlock your billing & receipts.`
-      };
-    }
-
-    return {
-      ok: false,
-      authenticated: false,
-      error: "For security, email-only lookup is disabled until RESEND_API_KEY is set in Vercel. Please sign in using your pb_live_... license key."
-    };
-  }
-
-  return {
-    ok: false,
-    authenticated: false,
-    error: "Please sign in with your pb_live_... license key."
-  };
-}
+// Cryptographic License Verification, Entitlement Ledger & Hardened Email OTP for postbuild (www.postbuild.dev)
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { getBotInboxForDomain } from "./inbox.js";
+
+const otpChallengeState = new Map(); // cid -> { attempts: number, used: boolean, expiresAt: number }
+const memoryEntitlements = new Map(); // key (jti or email) -> { jti, email, customerId, plan, domain, inbox, status, expiresAt }
+const processedWebhookEvents = new Set(); // stripe_event_id idempotency set
+
+export function requireAuthSecret() {
+  const explicit = (process.env.POSTBUILD_AUTH_SECRET || process.env.POSTBUILD_SECRET || "").trim();
+  if (explicit.length >= 32) {
+    return explicit;
+  }
+  // Safe domain-separated derivation on Vercel if POSTBUILD_AUTH_SECRET has not been added to project env yet
+  const resendSeed = (process.env.RESEND_API_KEY || "").trim();
+  if (process.env.VERCEL && resendSeed.length >= 24 && !process.env.POSTBUILD_STRICT_SECRET_TEST) {
+    return crypto.createHmac("sha256", resendSeed).update("postbuild:auth:v2:hmac-signing-key").digest("hex");
+  }
+  throw new Error("POSTBUILD_SECRET or POSTBUILD_AUTH_SECRET is missing or too short (minimum 32 characters required)");
+}
+
+function timingSafeStringEqual(a, b) {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  if (bufA.length !== bufB.length || bufA.length === 0) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+// ─── ENTITLEMENT & WEBHOOK IDEMPOTENCY LEDGER ────────────────────────────────
+
+export function hasProcessedWebhookEvent(eventId) {
+  if (!eventId) return false;
+  return processedWebhookEvents.has(eventId);
+}
+
+export function recordWebhookEventProcessed(eventId) {
+  if (!eventId) return false;
+  processedWebhookEvents.add(eventId);
+  return true;
+}
+
+export function markWebhookEventProcessed(eventId) {
+  if (!eventId) return false;
+  if (processedWebhookEvents.has(eventId)) {
+    return false; // Already processed
+  }
+  processedWebhookEvents.add(eventId);
+  return true;
+}
+
+export function upsertEntitlement({
+  jti,
+  email,
+  customerId = null,
+  plan = "launch_pass",
+  domain = "postbuild.dev",
+  status = "active",
+  expiresAt = null
+}) {
+  const cleanEmail = String(email || "").toLowerCase().trim();
+  const cleanDomain = String(domain || "postbuild.dev")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0] || "postbuild.dev";
+  const resolvedJti = jti || crypto.randomUUID();
+  const inbox = getBotInboxForDomain(cleanDomain, cleanEmail);
+  const record = {
+    jti: resolvedJti,
+    email: cleanEmail,
+    customerId: customerId || null,
+    plan,
+    domain: cleanDomain,
+    inbox,
+    status,
+    expiresAt: expiresAt || Math.floor(Date.now() / 1000) + 365 * 24 * 3600,
+    updatedAt: new Date().toISOString()
+  };
+
+  memoryEntitlements.set(`jti:${resolvedJti}`, record);
+  if (cleanEmail) {
+    memoryEntitlements.set(`email:${cleanEmail}`, record);
+    memoryEntitlements.set(`email:${cleanEmail}:${plan}`, record);
+  }
+  if (customerId) {
+    memoryEntitlements.set(`cust:${customerId}`, record);
+    memoryEntitlements.set(`cust:${customerId}:${plan}`, record);
+  }
+  return record;
+}
+
+export function updateEntitlementStatus({
+  jti,
+  email,
+  customerId,
+  status = "revoked",
+  targetPlan = null,
+  allowClearRevoked = false
+}) {
+  let updated = false;
+  const cleanEmail = email ? String(email).toLowerCase().trim() : "";
+
+  for (const [, rec] of memoryEntitlements.entries()) {
+    const matchesIdentity =
+      (jti && rec.jti === jti) ||
+      (cleanEmail && rec.email === cleanEmail) ||
+      (customerId && rec.customerId === customerId);
+    if (!matchesIdentity) continue;
+    if (targetPlan && rec.plan && rec.plan !== targetPlan) continue;
+
+    // Never allow a subscription 'active' event to clear a refund ('revoked') or dispute ('suspended')
+    if (
+      status === "active" &&
+      !allowClearRevoked &&
+      (rec.status === "revoked" || rec.status === "suspended")
+    ) {
+      continue;
+    }
+
+    rec.status = status;
+    rec.updatedAt = new Date().toISOString();
+    updated = true;
+  }
+
+  if (!updated && (jti || cleanEmail || customerId) && status !== "active") {
+    upsertEntitlement({
+      jti: jti || `revoked_${Date.now()}`,
+      email: cleanEmail,
+      customerId,
+      plan: targetPlan || "launch_pass",
+      status
+    });
+  }
+  return updated;
+}
+
+export function getEntitlement({ jti, email, customerId, plan = null } = {}) {
+  if (jti && memoryEntitlements.has(`jti:${jti}`)) {
+    return memoryEntitlements.get(`jti:${jti}`);
+  }
+  if (email) {
+    const cleanEmail = String(email).toLowerCase().trim();
+    if (plan && memoryEntitlements.has(`email:${cleanEmail}:${plan}`)) {
+      return memoryEntitlements.get(`email:${cleanEmail}:${plan}`);
+    }
+    if (memoryEntitlements.has(`email:${cleanEmail}`)) {
+      const rec = memoryEntitlements.get(`email:${cleanEmail}`);
+      if (!plan || !rec.plan || rec.plan === plan || rec.status === "revoked" || rec.status === "suspended") {
+        return rec;
+      }
+    }
+  }
+  if (customerId) {
+    if (plan && memoryEntitlements.has(`cust:${customerId}:${plan}`)) {
+      return memoryEntitlements.get(`cust:${customerId}:${plan}`);
+    }
+    if (memoryEntitlements.has(`cust:${customerId}`)) {
+      const rec = memoryEntitlements.get(`cust:${customerId}`);
+      if (!plan || !rec.plan || rec.plan === plan || rec.status === "revoked" || rec.status === "suspended") {
+        return rec;
+      }
+    }
+  }
+  return null;
+}
+
+export function isEntitlementRevoked({ jti, email, customerId, plan = null } = {}) {
+  const rec = getEntitlement({ jti, email, customerId, plan });
+  if (!rec) return false;
+  return rec.status !== "active";
+}
+
+const stripeCustomerStatusCache = new Map(); // key -> { status, checkedAt }
+
+export function clearAuthStateForTests() {
+  otpChallengeState.clear();
+  memoryEntitlements.clear();
+  processedWebhookEvents.clear();
+  stripeCustomerStatusCache.clear();
+}
+
+// ─── CLI CREDENTIALS & LICENSE VERIFICATION ──────────────────────────────────
+
+export function loadLocalCredentials() {
+  if (process.env.POSTBUILD_LICENSE_KEY) {
+    return {
+      token: process.env.POSTBUILD_LICENSE_KEY.trim(),
+      email: "cli@postbuild.dev",
+      plan: "launch_pass"
+    };
+  }
+  try {
+    const credPath = path.join(os.homedir(), ".postbuild", "credentials.json");
+    if (fs.existsSync(credPath)) {
+      const data = JSON.parse(fs.readFileSync(credPath, "utf8"));
+      if (data && data.token) return data;
+    }
+  } catch {}
+  return null;
+}
+
+export async function verifyCliLicense({ domain = "postbuild.dev", token = "" } = {}) {
+  const candidateToken = (token || "").trim() || loadLocalCredentials()?.token || "";
+
+  if (candidateToken && candidateToken.startsWith("pb_live_")) {
+    // 1. If running on the server (where signing secret is present), verify signature & revocation directly
+    try {
+      const localCheck = verifyLicenseToken(candidateToken);
+      if (localCheck.valid) {
+        return {
+          valid: true,
+          email: localCheck.email,
+          plan: localCheck.plan,
+          domain: localCheck.domain,
+          inbox: localCheck.inbox,
+          jti: localCheck.jti,
+          token: candidateToken
+        };
+      }
+      return {
+        valid: false,
+        reason: localCheck.error || "INVALID_OR_REVOKED_LICENSE",
+        checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+        webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+        message: localCheck.error || "Invalid or revoked pb_live_ license key."
+      };
+    } catch {
+      // 2. When running on a user's machine via CLI (without server secret), verify against https://www.postbuild.dev/api/auth
+      try {
+        const resp = await fetch("https://www.postbuild.dev/api/auth", {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${candidateToken}`
+          },
+          body: JSON.stringify({}),
+          signal: AbortSignal.timeout(5000)
+        });
+        if (resp.ok) {
+          const data = await resp.json();
+          if (data && data.ok && data.authenticated) {
+            return {
+              valid: true,
+              email: data.email,
+              plan: data.plan,
+              domain: data.domain,
+              inbox: data.inbox,
+              token: candidateToken
+            };
+          }
+        }
+      } catch {}
+    }
+  }
+
+  return {
+    valid: false,
+    reason: "PRO_LICENSE_REQUIRED",
+    checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+    webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+    message:
+      "A verified postbuild Launch Pass ($29) or Studio ($49/mo) license (pb_live_...) is required to unlock 25 Programmatic SEO HTML pages, 85-directory dispatch, and @postbuild.dev inbox verification."
+  };
+}
+
+// ─── CRYPTOGRAPHIC TOKEN SIGNING & VERIFICATION ──────────────────────────────
+
+export function signLicenseToken({
+  email,
+  plan = "launch_pass",
+  domain = "postbuild.dev",
+  jti = "",
+  customerId = null,
+  ttlSeconds = 365 * 24 * 3600
+}) {
+  const secret = requireAuthSecret();
+  const cleanEmail = (email || "").toLowerCase().trim();
+  const cleanDomain =
+    String(domain || "postbuild.dev")
+      .toLowerCase()
+      .trim()
+      .replace(/^https?:\/\//, "")
+      .replace(/^www\./, "")
+      .split("/")[0] || "postbuild.dev";
+  const now = Math.floor(Date.now() / 1000);
+  const exp = now + ttlSeconds;
+  const resolvedJti = jti || crypto.randomUUID();
+  const inbox = getBotInboxForDomain(cleanDomain, cleanEmail);
+
+  upsertEntitlement({
+    jti: resolvedJti,
+    email: cleanEmail,
+    customerId,
+    plan,
+    domain: cleanDomain,
+    status: "active",
+    expiresAt: exp
+  });
+
+  const payload = {
+    jti: resolvedJti,
+    email: cleanEmail,
+    customerId: customerId || null,
+    plan,
+    domain: cleanDomain,
+    inbox,
+    iat: now,
+    exp
+  };
+  const base64Payload = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const sig = crypto.createHmac("sha256", secret).update(base64Payload).digest("base64url").slice(0, 32);
+  return `pb_live_${base64Payload}.${sig}`;
+}
+
+export function verifyLicenseToken(token) {
+  if (!token || typeof token !== "string" || !token.startsWith("pb_live_")) {
+    return { valid: false };
+  }
+  const secret = requireAuthSecret();
+  const raw = token.slice("pb_live_".length);
+  const dotIdx = raw.indexOf(".");
+  if (dotIdx <= 0) return { valid: false };
+
+  const base64Payload = raw.slice(0, dotIdx);
+  const sig = raw.slice(dotIdx + 1);
+  if (!base64Payload || !sig) return { valid: false };
+
+  const fullHmac = crypto.createHmac("sha256", secret).update(base64Payload).digest("base64url");
+  const expectedSig32 = fullHmac.slice(0, 32);
+  const expectedSig24 = fullHmac.slice(0, 24);
+
+  const sigValid =
+    timingSafeStringEqual(sig, expectedSig32) || timingSafeStringEqual(sig, expectedSig24);
+  if (!sigValid) {
+    return { valid: false, error: "Invalid license signature" };
+  }
+
+  try {
+    const payload = JSON.parse(Buffer.from(base64Payload, "base64url").toString("utf8"));
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp && now > Number(payload.exp)) {
+      return { valid: false, error: "License token has expired" };
+    }
+    if (
+      isEntitlementRevoked({
+        jti: payload.jti,
+        email: payload.email,
+        customerId: payload.customerId,
+        plan: payload.plan
+      })
+    ) {
+      return { valid: false, error: "License entitlement has been revoked or refunded" };
+    }
+    if (!payload.inbox && payload.domain) {
+      payload.inbox = getBotInboxForDomain(payload.domain, payload.email);
+    }
+    return { valid: true, ...payload };
+  } catch {
+    return { valid: false };
+  }
+}
+
+// ─── HARDENED EMAIL OTP CHALLENGE (MAX 5 ATTEMPTS, SINGLE-USE, TIMING-SAFE) ─
+
+function deriveOtpCipherKey(secret) {
+  return crypto.createHmac("sha256", secret).update("postbuild:otp:aes-256-gcm:v2").digest();
+}
+
+export function createSignedOtpChallenge(
+  email,
+  otpCode,
+  plan = "launch_pass",
+  domain = "postbuild.dev",
+  options = {}
+) {
+  const resolvedOptions =
+    domain && typeof domain === "object" ? domain : options || {};
+  const rawDomain =
+    domain && typeof domain === "object" ? "postbuild.dev" : domain;
+
+  const secret = requireAuthSecret();
+  const cid = crypto.randomBytes(12).toString("base64url");
+  const exp = Math.floor(Date.now() / 1000) + 600; // 10 minutes
+  const cleanEmail = email.toLowerCase().trim();
+  const cleanDomain =
+    String(rawDomain || "postbuild.dev")
+      .toLowerCase()
+      .trim()
+      .replace(/^https?:\/\//, "")
+      .replace(/^www\./, "")
+      .split("/")[0] || "postbuild.dev";
+  const customerId = resolvedOptions.customerId || "";
+
+  const payloadObj = {
+    cid,
+    email: cleanEmail,
+    code: String(otpCode).trim(),
+    plan,
+    domain: cleanDomain,
+    customerId,
+    exp,
+    dummy: Boolean(resolvedOptions.dummy)
+  };
+
+  // Pad plaintext to fixed 320-byte length so real and dummy challenges have identical ciphertext length
+  const plaintext = JSON.stringify(payloadObj).padEnd(320, " ");
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", deriveOtpCipherKey(secret), iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+
+  otpChallengeState.set(cid, {
+    attempts: 0,
+    used: false,
+    expiresAt: exp * 1000
+  });
+
+  return `${iv.toString("base64url")}.${encrypted.toString("base64url")}.${authTag.toString("base64url")}`;
+}
+
+export function verifySignedOtpChallenge(challengeToken, otpCode) {
+  if (!challengeToken || !otpCode) return { valid: false, error: "Missing verification code." };
+  const secret = requireAuthSecret();
+  const parts = String(challengeToken).split(".");
+  if (parts.length !== 3) return { valid: false, error: "Invalid verification challenge." };
+  const [ivB64, encB64, tagB64] = parts;
+  if (!ivB64 || !encB64 || !tagB64) return { valid: false, error: "Invalid verification challenge." };
+
+  try {
+    const iv = Buffer.from(ivB64, "base64url");
+    const encrypted = Buffer.from(encB64, "base64url");
+    const authTag = Buffer.from(tagB64, "base64url");
+    if (iv.length !== 12 || authTag.length !== 16) {
+      return { valid: false, error: "Invalid verification challenge." };
+    }
+
+    const decipher = crypto.createDecipheriv("aes-256-gcm", deriveOtpCipherKey(secret), iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf8").trim();
+    const parsed = JSON.parse(decrypted);
+
+    const nowSec = Math.floor(Date.now() / 1000);
+    if (!parsed.exp || nowSec > parsed.exp) {
+      return { valid: false, error: "Verification code expired. Please request a new code." };
+    }
+
+    const cid = parsed.cid || encB64.slice(0, 16);
+    let state = otpChallengeState.get(cid);
+    if (!state) {
+      state = { attempts: 0, used: false, expiresAt: parsed.exp * 1000 };
+      otpChallengeState.set(cid, state);
+    }
+
+    if (state.used) {
+      return { valid: false, error: "This verification code has already been used." };
+    }
+
+    state.attempts += 1;
+    if (state.attempts > 5) {
+      return { valid: false, error: "Maximum verification attempts (5) exceeded. Please request a new code." };
+    }
+
+    if (!timingSafeStringEqual(String(otpCode).trim(), String(parsed.code || "").trim())) {
+      return { valid: false, error: "Invalid 6-digit verification code." };
+    }
+
+    // Never allow a dummy enumeration-resistance challenge to mint a real license
+    if (parsed.dummy === true || parsed.plan === "none") {
+      return { valid: false, error: "Invalid 6-digit verification code." };
+    }
+
+    state.used = true;
+    return {
+      valid: true,
+      email: parsed.email,
+      plan: parsed.plan || "launch_pass",
+      domain: parsed.domain || "postbuild.dev",
+      customerId: parsed.customerId || null
+    };
+  } catch {
+    return { valid: false, error: "Invalid verification challenge." };
+  }
+}
+
+export function getFounderEmailsSet() {
+  return new Set(
+    [
+      "bennett@postbuild.dev",
+      (process.env.ADMIN_EMAIL || "").toLowerCase().trim(),
+      (process.env.ADMIN_FORWARD_EMAIL || "").toLowerCase().trim(),
+      ...(process.env.POSTBUILD_OPERATOR_EMAILS || "")
+        .split(",")
+        .map((s) => s.toLowerCase().trim())
+    ].filter(Boolean)
+  );
+}
+
+async function sendLoginOtpViaResend(email, otpCode) {
+  const resendKey = (process.env.RESEND_API_KEY || "").trim();
+  if (!resendKey) {
+    return { sent: false, reason: "missing_resend_key" };
+  }
+  const cleanEmail = String(email || "").toLowerCase().trim();
+  const recipients = [cleanEmail];
+  if (cleanEmail === "bennett@postbuild.dev") {
+    const founderForward = (process.env.ADMIN_FORWARD_EMAIL || process.env.ADMIN_EMAIL || "").toLowerCase().trim();
+    if (founderForward && !recipients.includes(founderForward)) {
+      recipients.push(founderForward);
+    }
+  }
+  try {
+    const resp = await fetch("https://api.resend.com/emails", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${resendKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        from: "postbuild <login@postbuild.dev>",
+        to: recipients,
+        subject: `${otpCode} is your postbuild verification code`,
+        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; max-width: 520px; margin: 0 auto; padding: 28px; border: 1px solid #e2e8f0; border-radius: 14px; color: #0f172a;">
+          <h2 style="margin: 0 0 8px; font-size: 20px;">postbuild · Account Verification</h2>
+          <p style="color: #475569; font-size: 14px; line-height: 1.6;">Enter this 6-digit verification code on <strong>www.postbuild.dev</strong> within 10 minutes to issue your license key and manage your billing:</p>
+          <div style="background: #ecfdf5; border: 1px solid #6ee7b7; color: #047857; font-family: monospace; font-size: 28px; font-weight: 800; letter-spacing: 6px; text-align: center; padding: 14px; border-radius: 10px; margin: 18px 0;">${otpCode}</div>
+          <p style="color: #64748b; font-size: 12px; line-height: 1.5;">For security, your <code>pb_live_</code> license key is issued only after you enter this code.</p>
+        </div>`
+      })
+    });
+    if (!resp.ok) {
+      const errText = await resp.text().catch(() => "");
+      console.error("[auth/resend] Failed to send OTP email:", resp.status, errText);
+    }
+    return { sent: resp.ok };
+  } catch (err) {
+    console.error("[auth/resend] Error sending OTP email:", err?.message || err);
+    return { sent: false };
+  }
+}
+
+function escapeHtml(str) {
+  return String(str || "")
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+export async function sendLicenseFulfillmentEmail({ email, licenseToken, planId, targetDomain }) {
+  const resendKey = (process.env.RESEND_API_KEY || "").trim();
+  if (!resendKey || !email) return { sent: false };
+  const safeDomain = escapeHtml(targetDomain || "postbuild.dev");
+  const inbox = escapeHtml(getBotInboxForDomain(targetDomain, email));
+  const safeToken = escapeHtml(licenseToken);
+  try {
+    const resp = await fetch("https://api.resend.com/emails", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${resendKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        from: "postbuild <login@postbuild.dev>",
+        to: [email],
+        subject: `Your postbuild (${planId === "studio_monthly" ? "Studio" : "Launch Pass"}) License Key for ${targetDomain}`,
+        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; max-width: 540px; margin: 0 auto; padding: 28px; border: 1px solid #e2e8f0; border-radius: 14px; color: #0f172a;">
+          <h2 style="margin: 0 0 8px; font-size: 20px;">postbuild · License Activated</h2>
+          <p style="color: #475569; font-size: 14px; line-height: 1.6;">Your <strong>${planId === "studio_monthly" ? "postbuild Studio" : "postbuild Launch Pass"}</strong> for <strong>${safeDomain}</strong> is active.</p>
+          <p style="color: #475569; font-size: 13px; margin-bottom: 6px;"><strong>Dedicated Verification Inbox:</strong> <code>${inbox}</code></p>
+          <p style="color: #475569; font-size: 13px; margin-bottom: 6px;"><strong>CLI &amp; Web License Key:</strong></p>
+          <pre style="background: #f8fafc; border: 1px solid #e2e8f0; padding: 12px; border-radius: 8px; font-size: 11px; overflow-x: auto;">${safeToken}</pre>
+          <p style="color: #475569; font-size: 13px; margin-top: 12px;">Authenticate your CLI with: <code>npx git-paid login ${safeToken}</code></p>
+        </div>`
+      })
+    });
+    return { sent: resp.ok };
+  } catch {
+    return { sent: false };
+  }
+}
+
+export async function checkStripeCustomerStatusCached(verified) {
+  if (!verified || !verified.valid) return "active";
+  const baseId = verified.customerId || verified.email || "";
+  if (!baseId) return "active";
+  const cacheKey = `${baseId}:${verified.plan || "launch_pass"}`;
+
+  const now = Date.now();
+  const cached = stripeCustomerStatusCache.get(cacheKey);
+  if (cached && now - cached.checkedAt < 60000) {
+    return cached.status;
+  }
+
+  let stripe = null;
+  try {
+    const stripeMod = await import("./stripe.js");
+    stripe = stripeMod.getStripeClient();
+  } catch {}
+  if (!stripe) return "active";
+
+  try {
+    let cust = null;
+    if (verified.customerId) {
+      cust = await stripe.customers.retrieve(verified.customerId);
+    } else if (verified.email) {
+      const list = await stripe.customers.list({ email: verified.email, limit: 1 });
+      cust = list.data?.[0] || null;
+    }
+    if (cust && !cust.deleted && cust.metadata?.pb_status) {
+      const pbStatus = cust.metadata.pb_status;
+      if (pbStatus === "revoked" || pbStatus === "suspended") {
+        stripeCustomerStatusCache.set(cacheKey, { status: pbStatus, checkedAt: now });
+        updateEntitlementStatus({
+          customerId: cust.id,
+          email: verified.email,
+          status: pbStatus
+        });
+        return pbStatus;
+      }
+      if (pbStatus === "cancelled" && verified.plan === "studio_monthly") {
+        stripeCustomerStatusCache.set(cacheKey, { status: "cancelled", checkedAt: now });
+        updateEntitlementStatus({
+          customerId: cust.id,
+          email: verified.email,
+          status: "cancelled",
+          targetPlan: "studio_monthly"
+        });
+        return "cancelled";
+      }
+      stripeCustomerStatusCache.set(cacheKey, { status: "active", checkedAt: now });
+    } else {
+      stripeCustomerStatusCache.set(cacheKey, { status: "active", checkedAt: now });
+    }
+  } catch {}
+
+  return "active";
+}
+
+export async function authenticateUser({ email, token, sessionId, otpCode, challengeToken }) {
+  const founderEmails = getFounderEmailsSet();
+
+  // 1. Verify existing pb_live_ token via HMAC-SHA256 + revocation check + 60s Stripe Customer pb_status check
+  if (token && token.startsWith("pb_live_")) {
+    const verified = verifyLicenseToken(token);
+    if (verified.valid) {
+      const remoteStatus = await checkStripeCustomerStatusCached(verified);
+      if (remoteStatus !== "active") {
+        return {
+          ok: false,
+          authenticated: false,
+          error: "License entitlement has been revoked, refunded, or cancelled."
+        };
+      }
+      return {
+        ok: true,
+        authenticated: true,
+        email: verified.email,
+        customerId: verified.customerId || null,
+        plan: verified.plan,
+        domain: verified.domain,
+        inbox: verified.inbox,
+        isFounder: founderEmails.has(String(verified.email || "").toLowerCase().trim()),
+        token
+      };
+    }
+    return { ok: false, authenticated: false, error: verified.error || "Invalid pb_live_ license key signature." };
+  }
+
+  // 2. Step 2 of Email OTP verification — issues pb_live_ license ONLY after OTP check passes
+  if (otpCode && challengeToken) {
+    const check = verifySignedOtpChallenge(challengeToken, otpCode);
+    if (!check.valid) {
+      return { ok: false, authenticated: false, error: check.error || "Invalid verification code." };
+    }
+    if (isEntitlementRevoked({ email: check.email, customerId: check.customerId, plan: check.plan })) {
+      return { ok: false, authenticated: false, error: "This license entitlement has been revoked or refunded." };
+    }
+    const existingEnt = getEntitlement({ email: check.email, customerId: check.customerId, plan: check.plan });
+    const plan = existingEnt?.plan || check.plan || "launch_pass";
+    const domain = existingEnt?.domain || check.domain || "postbuild.dev";
+    const customerId = existingEnt?.customerId || check.customerId || null;
+    const issued = signLicenseToken({ email: check.email, plan, domain, customerId });
+    return {
+      ok: true,
+      authenticated: true,
+      email: check.email,
+      customerId,
+      plan,
+      domain,
+      inbox: getBotInboxForDomain(domain, check.email),
+      isFounder: founderEmails.has(String(check.email || "").toLowerCase().trim()),
+      token: issued
+    };
+  }
+
+  let stripe = null;
+  try {
+    const stripeMod = await import("./stripe.js");
+    stripe = stripeMod.getStripeClient();
+  } catch {}
+
+  // 3. Stripe Checkout return session_id verification
+  if (sessionId && stripe) {
+    const session = await stripe.checkout.sessions.retrieve(sessionId, { expand: ["customer"] });
+    if (session && session.payment_status !== "unpaid") {
+      const custEmail = (session.customer_details?.email || email || "").toLowerCase().trim();
+      // Never allow an unverified checkout email claiming @postbuild.dev or operator status to bypass Email OTP
+      if (custEmail.endsWith("@postbuild.dev") || founderEmails.has(custEmail)) {
+        return {
+          ok: false,
+          authenticated: false,
+          error: "Operator and @postbuild.dev addresses require 6-digit Email OTP verification to sign in."
+        };
+      }
+      const plan = session.metadata?.plan_id || (session.mode === "subscription" ? "studio_monthly" : "launch_pass");
+      const domain = session.client_reference_id || session.metadata?.target_domain || "";
+      if (!domain || domain === "postbuild.dev") {
+        return {
+          ok: false,
+          authenticated: false,
+          error: "A valid non-reserved project domain is required to issue a license."
+        };
+      }
+      const customerObj = session.customer && typeof session.customer === "object" ? session.customer : null;
+      const customerId = typeof session.customer === "string" ? session.customer : customerObj?.id || null;
+      const custStatus = customerObj?.metadata?.pb_status || "active";
+      if (custStatus !== "active" || isEntitlementRevoked({ email: custEmail, customerId, plan })) {
+        return { ok: false, authenticated: false, error: "This license entitlement has been revoked or refunded." };
+      }
+      const newToken = signLicenseToken({ email: custEmail, plan, domain, customerId });
+      return {
+        ok: true,
+        authenticated: true,
+        email: custEmail,
+        customerId,
+        plan,
+        domain,
+        inbox: getBotInboxForDomain(domain, custEmail),
+        isFounder: false,
+        token: newToken
+      };
+    }
+  }
+
+  // 4. Email OTP request — uniform response to prevent customer email enumeration
+  const cleanEmail = (email || "").toLowerCase().trim();
+  if (!cleanEmail || !cleanEmail.includes("@")) {
+    return { ok: false, authenticated: false, error: "Enter your email address or pb_live_ license key." };
+  }
+
+  const uniformResponseMessage =
+    "If an active Launch Pass or Studio account is associated with that email, a 6-digit verification code has been sent.";
+
+  let resolvedPlan = "launch_pass";
+  let resolvedDomain = "postbuild.dev";
+  let resolvedCustomerId = null;
+  let hasActivePurchase = false;
+  let isExplicitlyRevoked = false;
+  let anyCustomerHadPbStatus = false;
+
+  const localEnt = getEntitlement({ email: cleanEmail });
+  if (localEnt && (localEnt.status === "revoked" || localEnt.status === "suspended")) {
+    isExplicitlyRevoked = true;
+  } else if (localEnt && localEnt.status === "active") {
+    hasActivePurchase = true;
+    resolvedPlan = localEnt.plan;
+    resolvedDomain = localEnt.domain;
+    resolvedCustomerId = localEnt.customerId || null;
+  }
+
+  if (!hasActivePurchase && !isExplicitlyRevoked && stripe) {
+    try {
+      const customers = await stripe.customers.list({ email: cleanEmail, limit: 10 });
+      if (Array.isArray(customers?.data)) {
+        for (const cust of customers.data) {
+          const pbStatus = cust.metadata?.pb_status;
+          if (pbStatus) {
+            anyCustomerHadPbStatus = true;
+          }
+          if (pbStatus === "revoked" || pbStatus === "suspended") {
+            // Do not break early in case a legitimate active customerId exists for this email
+            continue;
+          }
+          if (pbStatus === "cancelled") {
+            continue;
+          }
+          if (!pbStatus || pbStatus === "active") {
+            hasActivePurchase = true;
+            resolvedCustomerId = cust.id;
+            resolvedPlan = cust.metadata?.pb_plan || "launch_pass";
+            resolvedDomain = cust.metadata?.pb_domain || "postbuild.dev";
+            break;
+          }
+        }
+      }
+    } catch {}
+
+    // Skip session fallback if a customer record already carries an explicit pb_status (e.g. cancelled/revoked)
+    if (!hasActivePurchase && !isExplicitlyRevoked && !anyCustomerHadPbStatus) {
+      try {
+        const sessions = await stripe.checkout.sessions.list({ limit: 100 });
+        const matchingSessions = (sessions?.data || []).filter(
+          (s) =>
+            s.payment_status !== "unpaid" &&
+            (s.customer_details?.email || s.customer_email || "").toLowerCase().trim() === cleanEmail
+        );
+        const preferred =
+          matchingSessions.find((s) => s.mode === "payment" || s.metadata?.plan_id === "launch_pass") ||
+          matchingSessions[0];
+        if (preferred) {
+          hasActivePurchase = true;
+          resolvedPlan =
+            preferred.metadata?.plan_id || (preferred.mode === "subscription" ? "studio_monthly" : "launch_pass");
+          resolvedDomain = preferred.client_reference_id || preferred.metadata?.target_domain || "postbuild.dev";
+          resolvedCustomerId =
+            (typeof preferred.customer === "string" ? preferred.customer : preferred.customer?.id) ||
+            resolvedCustomerId;
+        }
+      } catch {}
+    }
+  }
+
+  if (!hasActivePurchase && !isExplicitlyRevoked && founderEmails.has(cleanEmail)) {
+    hasActivePurchase = true;
+    resolvedPlan = "studio_monthly";
+    resolvedDomain = "postbuild.dev";
+  }
+
+  if (hasActivePurchase) {
+    const generatedOtp = String(crypto.randomInt(100000, 1000000));
+    const challenge = createSignedOtpChallenge(cleanEmail, generatedOtp, resolvedPlan, resolvedDomain, {
+      customerId: resolvedCustomerId
+    });
+    await sendLoginOtpViaResend(cleanEmail, generatedOtp);
+    return {
+      ok: true,
+      authenticated: false,
+      requiresOtp: true,
+      email: cleanEmail,
+      challengeToken: challenge,
+      message: uniformResponseMessage
+    };
+  }
+
+  // Return uniform challenge shape with an encrypted dummy challenge that can NEVER mint a license
+  const dummyOtp = String(crypto.randomInt(100000, 1000000));
+  const dummyChallenge = createSignedOtpChallenge(cleanEmail, dummyOtp, "none", "unassigned.invalid", {
+    dummy: true
+  });
+  return {
+    ok: true,
+    authenticated: false,
+    requiresOtp: true,
+    email: cleanEmail,
+    challengeToken: dummyChallenge,
+    message: uniformResponseMessage
+  };
+}
+