pierre-review 0.1.57 → 0.1.58

package/dist/api/plugins/auth.js

@@ -30,6 +30,8 @@ export function registerAccountContext(app) {
                     displayName: null,
                     avatarUrl: null,
                     isLocal: true,
+                    plan: 'free',
+                    stripeCustomerId: null,
                 };
         }
     });
@@ -65,10 +67,14 @@ export async function registerSession(app) {
         },
     });
 }
-// Cloud only: 401 any unauthenticated /api data route. Skips /api/health and
-// /api/auth/* (sign-in itself) and all non-/api requests (the SPA + landing are
-// served openly; the frontend gate handles the signed-out UI). MUST be registered
-// AFTER registerAccountContext so req.account is already resolved.
+// Cloud only: 401 any unauthenticated /api data route. Skips /api/health,
+// /api/auth/* (sign-in itself), /api/billing/webhook (Stripe posts
+// unauthenticated — verified by signature instead) and all non-/api requests
+// (the SPA + landing are served openly; the frontend gate handles the signed-out
+// UI). MUST be registered AFTER registerAccountContext so req.account is already
+// resolved. Also the cloud-only ENTITLEMENT gate: an authenticated free-plan
+// account gets 402 on the Pro plugin's /api/pro/* routes (local accounts are
+// always entitled — isLocal never reaches the cloud gate anyway).
 export function registerAuthGate(app) {
     app.addHook('onRequest', async (req, reply) => {
         const path = req.url.split('?')[0] ?? req.url;
@@ -78,11 +84,24 @@ export function registerAuthGate(app) {
             return;
         if (path.startsWith('/api/auth/'))
             return;
+        if (path === '/api/billing/webhook')
+            return;
+        // The pricing page's "Get Pro" is a plain browser navigation from the public
+        // landing; the route itself bounces anonymous visitors to sign-in instead of
+        // dead-ending them on a JSON 401.
+        if (path === '/api/billing/checkout')
+            return;
         if (!req.account) {
             await reply.code(401).send({
                 error: 'Unauthorized',
                 message: 'Sign in with GitHub to continue.',
             });
+            return;
+        }
+        if (path.startsWith('/api/pro/') &&
+            !req.account.isLocal &&
+            req.account.plan === 'free') {
+            await reply.code(402).send({ error: 'pro required' });
         }
     });
 }

package/dist/api/routes/billing.js

@@ -0,0 +1,204 @@
+// Stripe billing seam ("carve the path"): a checkout redirect + the webhook that
+// flips `accounts.plan`. Deliberately dependency-free — signature verification is
+// hand-rolled with node:crypto (no stripe SDK), and the whole feature is inert
+// until STRIPE_PAYMENT_LINK_URL / STRIPE_WEBHOOK_SECRET are set (the webhook
+// replies 501 unconfigured). Registered unconditionally in app.ts, both modes.
+//
+// Entitlement flows from `accounts.plan`: /api/me intersects the capability
+// singleton with the plan (pro/contract.ts entitledProCapabilities) and the cloud
+// auth gate 402s free-plan /api/pro/* requests (api/plugins/auth.ts). Local
+// accounts are always fully entitled — this file never affects local behavior.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { config } from '../../config.js';
+import { getAccountById, getAccountByStripeCustomerId, setAccountPlan, } from '../../auth/account.js';
+// Stripe's default signature tolerance: reject events older/newer than 5 minutes
+// (replay protection).
+export const STRIPE_SIGNATURE_TOLERANCE_SEC = 300;
+/**
+ * Verify a Stripe webhook signature (the `stripe-signature` header) without the
+ * stripe SDK. Header format: `t=<unix-seconds>,v1=<hex>[,v1=<hex>…]` (multiple
+ * v1 entries appear during secret rotation). The signed payload is
+ * `<t>.<rawBody>`; the signature is HMAC-SHA256(secret) over it, hex-encoded.
+ * Compared timing-safely against every v1; the timestamp must be within
+ * STRIPE_SIGNATURE_TOLERANCE_SEC of `nowMs`.
+ */
+export function verifyStripeSignature(rawBody, header, secret, nowMs = Date.now()) {
+    let ts = null;
+    const v1s = [];
+    for (const part of header.split(',')) {
+        const idx = part.indexOf('=');
+        if (idx < 0)
+            continue;
+        const key = part.slice(0, idx).trim();
+        const value = part.slice(idx + 1).trim();
+        if (!value)
+            continue;
+        if (key === 't') {
+            const n = Number.parseInt(value, 10);
+            if (Number.isFinite(n))
+                ts = n;
+        }
+        else if (key === 'v1') {
+            v1s.push(value);
+        }
+    }
+    if (ts == null || v1s.length === 0)
+        return false;
+    if (Math.abs(nowMs / 1000 - ts) > STRIPE_SIGNATURE_TOLERANCE_SEC)
+        return false;
+    const expected = createHmac('sha256', secret)
+        .update(`${ts}.`)
+        .update(rawBody)
+        .digest('hex');
+    const expectedBuf = Buffer.from(expected, 'utf-8');
+    return v1s.some((sig) => {
+        const sigBuf = Buffer.from(sig, 'utf-8');
+        return (sigBuf.length === expectedBuf.length && timingSafeEqual(sigBuf, expectedBuf));
+    });
+}
+// Stripe `customer` fields are a string id or an expanded object with `.id`.
+function customerIdOf(value) {
+    if (typeof value === 'string' && value !== '')
+        return value;
+    if (value != null &&
+        typeof value === 'object' &&
+        typeof value.id === 'string') {
+        return value.id;
+    }
+    return null;
+}
+/** Map a parsed Stripe event to the plan action it implies. Pure. */
+export function stripeEventAction(event) {
+    if (event == null || typeof event !== 'object')
+        return { kind: 'ignore' };
+    const { type, data } = event;
+    if (typeof type !== 'string')
+        return { kind: 'ignore' };
+    const obj = (data?.object ?? null);
+    if (obj == null || typeof obj !== 'object')
+        return { kind: 'ignore' };
+    if (type === 'checkout.session.completed' ||
+        type === 'checkout.session.async_payment_succeeded') {
+        // Delayed-notification methods (SEPA, ACH…) fire `completed` with
+        // payment_status 'unpaid' and confirm later via async_payment_succeeded —
+        // only grant once the money actually landed. `no_payment_required` covers
+        // trials.
+        const paid = obj['payment_status'] === 'paid' ||
+            obj['payment_status'] === 'no_payment_required';
+        if (!paid)
+            return { kind: 'ignore' };
+        const ref = obj['client_reference_id'];
+        const accountId = typeof ref === 'string' && /^\d+$/.test(ref)
+            ? Number.parseInt(ref, 10)
+            : typeof ref === 'number' && Number.isInteger(ref)
+                ? ref
+                : null;
+        return {
+            kind: 'checkout_completed',
+            accountId,
+            stripeCustomerId: customerIdOf(obj['customer']),
+        };
+    }
+    if (type === 'customer.subscription.updated' ||
+        type === 'customer.subscription.deleted') {
+        const status = obj['status'];
+        const active = type !== 'customer.subscription.deleted' &&
+            (status === 'active' || status === 'trialing');
+        return {
+            kind: 'subscription_status',
+            customerId: customerIdOf(obj['customer']),
+            plan: active ? 'pro' : 'free',
+        };
+    }
+    return { kind: 'ignore' };
+}
+export async function billingRoutes(app) {
+    // Redirect the signed-in user to the Stripe Payment Link, tagging the checkout
+    // with their account id (client_reference_id rides the Payment Link URL and
+    // comes back on checkout.session.completed). Exempted from the cloud auth gate
+    // (it's a plain browser navigation from the public pricing page), so it must
+    // handle anonymous visitors itself: bounce them to sign-in rather than a 401.
+    app.get('/api/billing/checkout', async (req, reply) => {
+        if (!config.stripePaymentLinkUrl) {
+            return reply.redirect('/pricing?checkout=unavailable', 302);
+        }
+        if (!req.account) {
+            return reply.redirect('/api/auth/login', 302);
+        }
+        const url = new URL(config.stripePaymentLinkUrl);
+        url.searchParams.set('client_reference_id', String(req.account.id));
+        return reply.redirect(url.toString(), 302);
+    });
+    // The webhook needs the RAW request body (the signature signs the exact bytes).
+    // Fastify content-type parsers are ENCAPSULATED, so registering the buffer
+    // parser inside this nested plugin scope affects ONLY the routes declared here
+    // — the rest of the API keeps normal JSON parsing (proven by billing.test.ts).
+    await app.register(async (scope) => {
+        scope.addContentTypeParser('application/json', { parseAs: 'buffer' }, (_req, body, done) => {
+            done(null, body);
+        });
+        // Stripe posts unauthenticated (exempted from the auth gate); authenticity
+        // comes from the signature. Never 500 on an unknown account — Stripe retries
+        // on non-2xx, and an unknown account is a data mismatch, not a server fault.
+        scope.post('/api/billing/webhook', async (req, reply) => {
+            if (!config.stripeWebhookSecret) {
+                return reply.code(501).send({ error: 'billing not configured' });
+            }
+            const raw = req.body;
+            if (!Buffer.isBuffer(raw)) {
+                return reply.code(400).send({ error: 'expected a JSON body' });
+            }
+            const sig = req.headers['stripe-signature'];
+            if (typeof sig !== 'string' ||
+                !verifyStripeSignature(raw, sig, config.stripeWebhookSecret)) {
+                return reply.code(400).send({ error: 'invalid signature' });
+            }
+            let event;
+            try {
+                event = JSON.parse(raw.toString('utf-8'));
+            }
+            catch {
+                return reply.code(400).send({ error: 'invalid JSON' });
+            }
+            const action = stripeEventAction(event);
+            if (action.kind === 'checkout_completed') {
+                const account = action.accountId != null ? await getAccountById(action.accountId) : null;
+                if (account) {
+                    // client_reference_id is attacker-influencable (it rides the public
+                    // Payment Link URL), so never let a new checkout re-bind an account
+                    // that already has a DIFFERENT Stripe customer — that would orphan
+                    // the original subscription's webhooks.
+                    const rebind = account.stripeCustomerId != null &&
+                        action.stripeCustomerId != null &&
+                        account.stripeCustomerId !== action.stripeCustomerId;
+                    await setAccountPlan(account.id, 'pro', rebind ? undefined : action.stripeCustomerId);
+                    if (rebind) {
+                        req.log.warn({
+                            accountId: account.id,
+                            existingCustomerId: account.stripeCustomerId,
+                            newCustomerId: action.stripeCustomerId,
+                        }, 'stripe checkout for an account already bound to a different customer — kept the existing binding');
+                    }
+                    req.log.info({ accountId: account.id }, 'stripe checkout completed — plan set to pro');
+                }
+                else {
+                    req.log.warn({ clientReferenceId: action.accountId }, 'stripe checkout completed for unknown account — ignored');
+                }
+            }
+            else if (action.kind === 'subscription_status') {
+                const account = action.customerId
+                    ? await getAccountByStripeCustomerId(action.customerId)
+                    : null;
+                if (account) {
+                    await setAccountPlan(account.id, action.plan);
+                    req.log.info({ accountId: account.id, plan: action.plan }, 'stripe subscription status — plan updated');
+                }
+                else {
+                    req.log.warn({ customerId: action.customerId }, 'stripe subscription event for unknown customer — ignored');
+                }
+            }
+            return { received: true };
+        });
+    });
+}
+//# sourceMappingURL=billing.js.map

package/dist/api/routes/me.js

@@ -1,7 +1,7 @@
 import { config } from '../../config.js';
 import { accountToLocalUser } from '../../auth/account.js';
 import { accountIdOf } from '../plugins/auth.js';
-import { getProCapabilities } from '../../pro/contract.js';
+import { EMPTY_CAPABILITIES, entitledProCapabilities, } from '../../pro/contract.js';
 import { getFyiProvider } from '../../feed/fyi-provider.js';
 import { dismissMyTurn, getCompletedDismissals, getFeedLastSeenAt, getMyTurn, markFeedSeen, undismissMyTurn, } from '../../db/queries.js';
 const dismissSchema = {
@@ -44,7 +44,9 @@ export async function meRoutes(app) {
             newFeedItems,
             // Claude Review is now the Pro `claudeReview` capability (in `pro` below).
             deploymentMode: config.deploymentMode,
-            pro: getProCapabilities(),
+            // Per-account entitlement: local = full capabilities (unchanged); cloud =
+            // full only when the account's plan isn't 'free' (Stripe billing seam).
+            pro: req.account ? entitledProCapabilities(req.account) : EMPTY_CAPABILITIES,
         };
     });
     app.get('/api/my-turn', async (req) => getMyTurn(accountIdOf(req)));

package/dist/app.js

@@ -19,6 +19,7 @@ import { feedRoutes } from './api/routes/feed.js';
 import { mergersRoutes } from './api/routes/mergers.js';
 import { insightsRoutes } from './api/routes/insights.js';
 import { activityRoutes } from './api/routes/activity.js';
+import { billingRoutes } from './api/routes/billing.js';
 export async function buildApp() {
     const app = Fastify({
         // In production (the installed CLI) the per-request "incoming request" /
@@ -131,6 +132,9 @@ export async function buildApp() {
     await app.register(mergersRoutes);
     await app.register(insightsRoutes);
     await app.register(activityRoutes);
+    // Stripe billing seam (checkout redirect + webhook). Registered in both modes;
+    // inert until the STRIPE_* env vars are set (webhook 501s unconfigured).
+    await app.register(billingRoutes);
     // Claude Review moved into the @pierre/pro plugin (its routes register there, gated on the
     // `claudeReview` capability). The SDK-run / diff-prep / GitHub-post infra + the tables stay
     // in core behind the ctx.review seam; nothing to register here.

package/dist/auth/account.js

@@ -32,6 +32,8 @@ function rowToAccount(row) {
         displayName: row.displayName,
         avatarUrl: row.avatarUrl,
         isLocal: row.isLocal,
+        plan: row.plan === 'pro' ? 'pro' : 'free',
+        stripeCustomerId: row.stripeCustomerId,
     };
 }
 // Module cache of the local account, set by ensureLocalAccount() at startup so
@@ -178,6 +180,28 @@ export async function getAccountById(id) {
         .execute();
     return rows[0] ? rowToAccount(rows[0]) : null;
 }
+/**
+ * Set an account's billing plan (and, when known, its Stripe customer id).
+ * Called only by the Stripe webhook handler (api/routes/billing.ts).
+ */
+export async function setAccountPlan(accountId, plan, stripeCustomerId) {
+    const { accounts } = schema;
+    const set = { plan };
+    if (stripeCustomerId != null)
+        set.stripeCustomerId = stripeCustomerId;
+    await db.update(accounts).set(set).where(eq(accounts.id, accountId)).execute();
+}
+/** Resolve an account by its Stripe customer id (subscription webhooks). */
+export async function getAccountByStripeCustomerId(customerId) {
+    const { accounts } = schema;
+    const rows = await db
+        .select()
+        .from(accounts)
+        .where(eq(accounts.stripeCustomerId, customerId))
+        .limit(1)
+        .execute();
+    return rows[0] ? rowToAccount(rows[0]) : null;
+}
 /**
  * Resolve an account's owner to a row in `users` (by login) if they've appeared
  * in any synced repo. Returns null when "you" haven't authored/acted anywhere

package/dist/coding/agent.js

@@ -44,6 +44,7 @@ const RESOLVE_TOOLS = [
 const RESOLVE_DISALLOWED_TOOLS = ['Bash', 'NotebookEdit'];
 // Models that accept the `effort` option (Haiku 4.5 rejects it — the API 400s).
 const EFFORT_CAPABLE_MODELS = new Set([
+    'claude-sonnet-5',
     'claude-opus-4-8',
     'claude-sonnet-4-6',
 ]);

package/dist/config.js

@@ -128,9 +128,17 @@ export const config = {
     // HSTS_MAX_AGE=0 as a kill switch. `preload` is intentionally NOT sent — it is
     // hard to undo; opt in manually once the domain is proven.
     hstsMaxAge: intFromEnv('HSTS_MAX_AGE', 31536000),
+    // ---- Stripe billing (optional; NOT required by assertCloudConfig) ----
+    // Payment Link URL for the Pro plan — GET /api/billing/checkout 302s to it with
+    // client_reference_id=<accountId> appended. Empty = checkout unavailable.
+    stripePaymentLinkUrl: process.env.STRIPE_PAYMENT_LINK_URL ?? '',
+    // Webhook signing secret (whsec_…) for POST /api/billing/webhook. Empty = the
+    // webhook replies 501 and no billing state ever changes.
+    stripeWebhookSecret: process.env.STRIPE_WEBHOOK_SECRET ?? '',
     // Pro plugin master gate. Pro is local-only for now; bind.ts skips the dynamic
-    // import entirely when false.
-    proEnabled: !isCloud,
+    // import entirely when false. PRO_DISABLED=true forces pure-OSS mode even when
+    // the submodule is checked out (used to exercise/capture the free tier).
+    proEnabled: !isCloud && process.env.PRO_DISABLED !== 'true',
     // Per-repo digest (Pro, Workstream 2) config — consumed by @pierre/pro, kept in
     // core so the model id / budgets live in one place and aren't hardcoded at call
     // sites. Inert until the plugin is present AND digestEnabled.

package/dist/db/migrations/0025_account_billing.sql

@@ -0,0 +1,7 @@
+-- Stripe billing seam (additive). `plan` ('free' | 'pro', default 'free') is set ONLY by
+-- the Stripe webhook (api/routes/billing.ts) — the OAuth upsert never touches it, so a
+-- re-login can't reset a paid plan. `stripe_customer_id` (cus_…) is captured from
+-- checkout.session.completed so subscription webhooks can resolve the account.
+-- The Postgres baseline is regenerated separately via `pnpm db:generate:pg`.
+ALTER TABLE `accounts` ADD `plan` text NOT NULL DEFAULT 'free';--> statement-breakpoint
+ALTER TABLE `accounts` ADD `stripe_customer_id` text;

package/dist/db/migrations/meta/_journal.json

@@ -176,6 +176,13 @@
       "when": 1780800000015,
       "tag": "0024_pr_head_ref_name",
       "breakpoints": true
+    },
+    {
+      "idx": 25,
+      "version": "6",
+      "when": 1783296000000,
+      "tag": "0025_account_billing",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0014_wakeful_bill_hollister.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "accounts" ADD COLUMN "plan" text DEFAULT 'free' NOT NULL;--> statement-breakpoint
+ALTER TABLE "accounts" ADD COLUMN "stripe_customer_id" text;