sourcecode 1.36.1__tar.gz → 1.36.2__tar.gz

{sourcecode-1.36.1 → sourcecode-1.36.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.36.1
+Version: 1.36.2
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.36.1 → sourcecode-1.36.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.36.1"
+version = "1.36.2"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.36.1 → sourcecode-1.36.2}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.36.1"
+__version__ = "1.36.2"

{sourcecode-1.36.1 → sourcecode-1.36.2}/src/sourcecode/cli.py

@@ -6212,4 +6212,13 @@ def main_entry() -> None:
         except Exception:
             pass
     _preprocess_argv()
-    app()
+    try:
+        app()
+    finally:
+        # Best-effort "new version available" nudge. Only speaks on an
+        # interactive terminal; never blocks, raises, or affects exit status.
+        try:
+            from sourcecode.version_check import maybe_notify_update
+            maybe_notify_update(__version__)
+        except Exception:
+            pass

sourcecode-1.36.2/src/sourcecode/version_check.py

@@ -0,0 +1,149 @@
+"""Best-effort "new version available" nudge.
+
+Prints a single stderr line when a newer release exists on PyPI. Designed to be
+invisible unless it has something useful to say:
+
+  * Only runs in an interactive terminal (stderr.isatty()) — never pollutes
+    piped output, MCP stdio, CI logs, or test runners.
+  * Hits the network at most once per 24h (cached in
+    ~/.sourcecode/version_check.json); warm runs read the cache and are instant.
+  * Re-shows the same nudge at most ~once per 20h so it informs without nagging.
+  * Swallows every error and never blocks meaningfully (1.5s network timeout).
+
+Disable entirely with SOURCECODE_NO_UPDATE_CHECK=1 (also off under SOURCECODE_CI).
+The check reads PyPI only; it never touches the license in ~/.sourcecode/license.json.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Optional
+
+_CACHE_DIR = Path.home() / ".sourcecode"
+_CACHE_FILE = _CACHE_DIR / "version_check.json"
+_PYPI_URL = "https://pypi.org/pypi/sourcecode/json"
+_CHECK_TTL_SECONDS = 86_400   # refresh the PyPI lookup at most once per 24h
+_NOTIFY_TTL_SECONDS = 72_000  # re-show the nudge at most every ~20h
+_FETCH_TIMEOUT = 1.5
+
+
+def _disabled() -> bool:
+    """True when the nudge must stay silent (opt-out, CI, or non-interactive)."""
+    if os.environ.get("SOURCECODE_NO_UPDATE_CHECK"):
+        return True
+    if os.environ.get("SOURCECODE_CI"):
+        return True
+    try:
+        return not sys.stderr.isatty()
+    except Exception:
+        return True  # no usable stderr -> stay silent
+
+
+def _read_cache() -> dict:
+    try:
+        if _CACHE_FILE.exists():
+            return json.loads(_CACHE_FILE.read_text(encoding="utf-8"))
+    except Exception:
+        pass
+    return {}
+
+
+def _write_cache(data: dict) -> None:
+    try:
+        _CACHE_DIR.mkdir(parents=True, exist_ok=True)
+        tmp = _CACHE_FILE.with_suffix(".tmp")
+        tmp.write_text(json.dumps(data, ensure_ascii=False), encoding="utf-8")
+        tmp.replace(_CACHE_FILE)
+    except Exception:
+        pass
+
+
+def _age_seconds(iso: Optional[str]) -> float:
+    if not iso:
+        return float("inf")
+    try:
+        ts = datetime.fromisoformat(iso)
+        if ts.tzinfo is None:
+            ts = ts.replace(tzinfo=timezone.utc)
+        return (datetime.now(timezone.utc) - ts).total_seconds()
+    except Exception:
+        return float("inf")
+
+
+def _fetch_latest() -> Optional[str]:
+    import urllib.request
+    try:
+        req = urllib.request.Request(_PYPI_URL, headers={"Accept": "application/json"})
+        with urllib.request.urlopen(req, timeout=_FETCH_TIMEOUT) as resp:
+            data = json.loads(resp.read().decode("utf-8"))
+        return ((data.get("info") or {}).get("version")) or None
+    except Exception:
+        return None
+
+
+def _parse(v: str) -> tuple:
+    """Lenient dotted-numeric parse for the fallback path (no packaging dep)."""
+    parts = []
+    for chunk in str(v).split("."):
+        num = ""
+        for ch in chunk:
+            if ch.isdigit():
+                num += ch
+            else:
+                break
+        parts.append(int(num) if num else 0)
+    return tuple(parts)
+
+
+def _is_newer(latest: str, current: str) -> bool:
+    try:
+        from packaging.version import parse as _vparse  # type: ignore
+        return _vparse(latest) > _vparse(current)
+    except Exception:
+        return _parse(latest) > _parse(current)
+
+
+def maybe_notify_update(current_version: str) -> None:
+    """Print an upgrade nudge to stderr if PyPI has a newer release.
+
+    Best-effort and fully guarded: any failure is silently ignored. Safe to call
+    unconditionally from the CLI entry point.
+    """
+    if _disabled():
+        return
+    try:
+        cache = _read_cache()
+
+        # Refresh the cached "latest" at most once per TTL (the only network hit).
+        if _age_seconds(cache.get("checked_at")) >= _CHECK_TTL_SECONDS:
+            latest = _fetch_latest()
+            if latest:
+                cache["latest"] = latest
+                cache["checked_at"] = datetime.now(timezone.utc).isoformat()
+                _write_cache(cache)
+
+        latest = cache.get("latest")
+        if not latest or not _is_newer(latest, current_version):
+            return
+
+        # Throttle: don't nag for the same version more than once per ~20h.
+        if (
+            cache.get("notified_for") == latest
+            and _age_seconds(cache.get("notified_at")) < _NOTIFY_TTL_SECONDS
+        ):
+            return
+
+        sys.stderr.write(
+            f"\n[sourcecode] v{latest} is available (you have {current_version}). "
+            "Upgrade: pipx upgrade sourcecode  (pip: pip install -U sourcecode)\n"
+        )
+        sys.stderr.flush()
+
+        cache["notified_for"] = latest
+        cache["notified_at"] = datetime.now(timezone.utc).isoformat()
+        _write_cache(cache)
+    except Exception:
+        pass

sourcecode-1.36.2/supabase/.temp/cli-latest

@@ -0,0 +1 @@
+v2.106.0

sourcecode-1.36.2/supabase/functions/lemonsqueezy-webhook/index.ts

@@ -0,0 +1,220 @@
+import { serve } from "https://deno.land/std@0.177.0/http/server.ts";
+import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
+
+// Lemon Squeezy webhook. Source of truth for plan/status and the license key.
+// Deploy with --no-verify-jwt (Lemon Squeezy does not send a Supabase JWT;
+// HMAC signature is the authentication). Keep "Generate license keys" ON on
+// every Pro variant: LS emails the key to the customer and we store that same
+// native key here, so there is a single key system end to end.
+//
+// Ordering safety: LS delivers events out of order and Edge Functions run
+// concurrently. We never blind-upsert status. Instead apply_license_event()
+// (see supabase/sql/license_event_ordering.sql) locks the row and applies a
+// status change only when the event is not older than the last one applied,
+// using each event's own LS timestamp. A stale `subscription_paused`/`expired`
+// can therefore never clobber a newer paid state.
+const LEMON_SQUEEZY_WEBHOOK_SECRET = Deno.env.get("LEMON_SQUEEZY_WEBHOOK_SECRET")!;
+const SUPABASE_URL = Deno.env.get("SUPABASE_URL")!;
+const SUPABASE_SERVICE_ROLE_KEY = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
+
+const PRO_FEATURES = ["impact", "review-pr", "generate-tests", "mcp"];
+
+// The license key is delivered by this event (LS generates + emails it):
+const LICENSE_EVENTS = ["license_key_created"];
+// Activate / keep Pro:
+const ACTIVATE_EVENTS = [
+  "order_created",
+  "subscription_created",
+  "subscription_updated",
+  "subscription_resumed",
+  "subscription_unpaused",
+  "subscription_payment_success",
+];
+// Revocation — real end of access. NOT subscription_cancelled: that keeps
+// access until period end; LS sends subscription_expired when it actually ends.
+const REVOKE_EVENTS = [
+  "subscription_expired",
+  "subscription_paused",
+];
+const HANDLED_EVENTS = [...LICENSE_EVENTS, ...ACTIVATE_EVENTS, ...REVOKE_EVENTS];
+
+// Map a Lemon Squeezy subscription status to our access status. This is the
+// authoritative current state LS attaches to every subscription_* event, so we
+// prefer it over inferring from the event name (an out-of-order event still
+// carries the status that was true at its own event time, and the recency
+// guard in apply_license_event decides whether it wins).
+//   cancelled keeps access until period end (LS sends subscription_expired at
+//   the real end); past_due is a payment-retry grace window — keep access.
+function mapLsStatus(lsStatus: string | undefined): "active" | "inactive" | null {
+  switch ((lsStatus ?? "").toLowerCase()) {
+    case "on_trial":
+    case "active":
+    case "cancelled":
+    case "past_due":
+      return "active";
+    case "paused":
+    case "unpaid":
+    case "expired":
+      return "inactive";
+    default:
+      return null; // unknown -> do not infer a status
+  }
+}
+
+async function verifySignature(rawBody: string, signature: string): Promise<boolean> {
+  if (!signature) return false;
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(LEMON_SQUEEZY_WEBHOOK_SECRET),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const expected = await crypto.subtle.sign("HMAC", key, encoder.encode(rawBody));
+  const expectedHex = Array.from(new Uint8Array(expected))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+  return expectedHex === signature;
+}
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+
+serve(async (req: Request) => {
+  if (req.method !== "POST") return new Response("Method not allowed", { status: 405 });
+
+  const rawBody = await req.text();
+  const signature =
+    req.headers.get("X-Signature") ?? req.headers.get("x-signature") ?? "";
+
+  if (!(await verifySignature(rawBody, signature))) {
+    console.error("Invalid webhook signature");
+    return new Response("Unauthorized", { status: 401 });
+  }
+
+  let payload: Record<string, unknown>;
+  try {
+    payload = JSON.parse(rawBody);
+  } catch {
+    return new Response("Bad request: invalid JSON", { status: 400 });
+  }
+
+  const meta = payload.meta as Record<string, unknown>;
+  const data = payload.data as Record<string, unknown>;
+  const eventName = meta?.event_name as string;
+  const eventId = meta?.event_id as string | undefined;
+
+  if (!HANDLED_EVENTS.includes(eventName)) {
+    return json({ received: true, skipped: true });
+  }
+
+  const attributes = (data?.attributes ?? {}) as Record<string, unknown>;
+  const email = ((attributes?.user_email ?? attributes?.customer_email) as string ?? "")
+    .toLowerCase();
+
+  if (!email || !email.includes("@")) {
+    console.error("No valid email in payload", { eventName });
+    return new Response("Bad request: no email", { status: 400 });
+  }
+
+  // The license key only ever arrives on license_key_created.
+  const licenseKey = LICENSE_EVENTS.includes(eventName)
+    ? ((attributes?.key as string) ?? null)
+    : null;
+  if (LICENSE_EVENTS.includes(eventName) && !licenseKey) {
+    console.error("license_key_created without attributes.key");
+    return new Response("Bad request: no key", { status: 400 });
+  }
+
+  // Desired status: prefer LS's authoritative subscription status, fall back to
+  // event-name semantics. Non-subscription events (order/license) only activate.
+  let desiredStatus: "active" | "inactive" | null;
+  if (eventName.startsWith("subscription_")) {
+    desiredStatus = mapLsStatus(attributes?.status as string | undefined);
+    if (desiredStatus === null) {
+      desiredStatus = REVOKE_EVENTS.includes(eventName)
+        ? "inactive"
+        : ACTIVATE_EVENTS.includes(eventName)
+        ? "active"
+        : null;
+    }
+  } else if (LICENSE_EVENTS.includes(eventName) || ACTIVATE_EVENTS.includes(eventName)) {
+    desiredStatus = "active";
+  } else if (REVOKE_EVENTS.includes(eventName)) {
+    desiredStatus = "inactive";
+  } else {
+    desiredStatus = null;
+  }
+
+  // Recency key: the event's own LS timestamp, NOT our receipt time.
+  const eventAt =
+    (attributes?.updated_at as string) ??
+    (attributes?.created_at as string) ??
+    new Date().toISOString();
+
+  // Only grant features when we are activating; a revoke leaves them untouched.
+  const features = desiredStatus === "active" ? PRO_FEATURES : null;
+
+  const supabase = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
+
+  // Idempotency: skip if we already logged this exact event.
+  if (eventId) {
+    const { data: existing } = await supabase
+      .from("license_events").select("id").eq("event_id", eventId).maybeSingle();
+    if (existing) return json({ received: true, duplicate: true });
+  }
+
+  // Atomic, recency-guarded apply. A stale event cannot downgrade newer state.
+  const { data: rpcData, error: rpcErr } = await supabase.rpc("apply_license_event", {
+    p_email: email,
+    p_desired_status: desiredStatus,
+    p_event_at: eventAt,
+    p_features: features,
+    p_license_key: licenseKey,
+    p_plan: "pro",
+  });
+
+  if (rpcErr) {
+    console.error("apply_license_event", rpcErr);
+    return json({ error: "DB" }, 500); // LS retries; the apply is idempotent.
+  }
+  // PostgREST may return the composite as an object or a single-element array.
+  const row = (Array.isArray(rpcData) ? rpcData[0] : rpcData) as
+    | Record<string, unknown>
+    | null;
+  const userId = (row?.id as string | undefined) ?? null;
+
+  // Mirror period end into the subscriptions table on activation (informational;
+  // get-license reads users.status, not this row).
+  if (ACTIVATE_EVENTS.includes(eventName) && userId) {
+    const now = new Date().toISOString();
+    const periodEnd = (attributes?.renews_at ?? attributes?.ends_at ?? null) as string | null;
+    await supabase.from("subscriptions").upsert(
+      { user_id: userId, provider: "lemonsqueezy", status: "active",
+        current_period_end: periodEnd, created_at: now },
+      { onConflict: "user_id" },
+    );
+  }
+
+  // Reliable audit: a failed log returns 500 so LS retries. Because the apply
+  // above is idempotent (same event_at re-applies the same state) and the
+  // idempotency guard keys on this not-yet-inserted event_id, the retry safely
+  // reprocesses and re-attempts the log. No silent, unlogged state changes.
+  const { error: evErr } = await supabase.from("license_events").insert({
+    user_id: userId,
+    event_type: eventName,
+    event_id: eventId ?? null,
+    payload: JSON.parse(JSON.stringify(payload)),
+  });
+  if (evErr) {
+    console.error("license_event insert", evErr);
+    return json({ error: "audit_failed" }, 500);
+  }
+
+  console.log(`Processed ${eventName} for ${email} -> status=${desiredStatus}`);
+  return json({ received: true, email, event: eventName, status: desiredStatus });
+});

sourcecode-1.36.2/supabase/sql/license_event_ordering.sql

@@ -0,0 +1,93 @@
+-- License event ordering guard.
+--
+-- Problem this fixes: the Lemon Squeezy webhook used blind last-writer-wins
+-- upserts. LS delivers events out of order and Edge Functions run concurrently,
+-- so a stale/duplicate `subscription_paused`/`expired` arriving after a
+-- `subscription_payment_success` could clobber a paying customer's row to
+-- status='inactive'. There was no recency check and no atomicity.
+--
+-- This migration adds:
+--   1. users.last_event_at  — the LS event timestamp of the last APPLIED change.
+--   2. apply_license_event() — an atomic, recency-guarded upsert. A row is
+--      locked (FOR UPDATE), and a status change is applied only when the
+--      incoming event is not older than the last one we applied. Older events
+--      can never downgrade a newer state. The license_key is still persisted
+--      from an out-of-order event when the row has none yet (immutable fact).
+--
+-- Run order in the Supabase SQL editor: execute each statement block below.
+-- A named dollar-quote tag ($fn$) is used so the editor cannot mis-split the
+-- function body on the semicolons inside it.
+
+-- 1. Ordering column ---------------------------------------------------------
+alter table users
+  add column if not exists last_event_at timestamptz;
+
+-- 2. Atomic, recency-guarded apply function ----------------------------------
+create or replace function apply_license_event(
+  p_email          text,
+  p_desired_status text,            -- 'active' | 'inactive' | null (no status change)
+  p_event_at       timestamptz,
+  p_features       jsonb default null,
+  p_license_key    text  default null,
+  p_plan           text  default 'pro'
+) returns users
+language plpgsql
+as $fn$
+declare
+  v_row users;
+begin
+  -- Lock the existing row for this customer (no-op if absent).
+  select * into v_row from users where email = p_email for update;
+
+  -- New customer: insert. A brand-new event with no prior state wins.
+  if v_row.id is null then
+    insert into users (email, plan, status, features, license_key, last_event_at, updated_at)
+    values (
+      p_email,
+      coalesce(p_plan, 'pro'),
+      coalesce(p_desired_status, 'active'),
+      coalesce(p_features, '[]'::jsonb),
+      p_license_key,
+      p_event_at,
+      now()
+    )
+    returning * into v_row;
+    return v_row;
+  end if;
+
+  -- Existing row: apply state only if this event is NOT stale.
+  -- `>=` (not `>`) so a webhook retry with the same timestamp re-applies the
+  -- identical state harmlessly (idempotent).
+  if v_row.last_event_at is null or p_event_at >= v_row.last_event_at then
+    update users set
+      plan          = coalesce(p_plan, plan),
+      status        = coalesce(p_desired_status, status),
+      features      = coalesce(p_features, features),
+      license_key   = coalesce(p_license_key, license_key),
+      last_event_at = p_event_at,
+      updated_at    = now()
+    where id = v_row.id
+    returning * into v_row;
+  else
+    -- Stale event: never downgrade or clobber newer state. Still persist the
+    -- license key if we don't have one yet (key creation can arrive late).
+    if p_license_key is not null and v_row.license_key is null then
+      update users set license_key = p_license_key, updated_at = now()
+      where id = v_row.id
+      returning * into v_row;
+    end if;
+  end if;
+
+  return v_row;
+end;
+$fn$;
+
+-- 3. Lock down execution -----------------------------------------------------
+-- PostgREST grants EXECUTE to PUBLIC by default. Without this, anyone holding
+-- the anon key could call /rpc/apply_license_event and self-grant Pro. Only the
+-- service role (used by the Edge Function) may call it.
+revoke all on function apply_license_event(text, text, timestamptz, jsonb, text, text)
+  from public, anon, authenticated;
+
+grant execute on function apply_license_event(text, text, timestamptz, jsonb, text, text)
+  to service_role;

sourcecode-1.36.1/supabase/functions/lemonsqueezy-webhook/index.ts

@@ -1,163 +0,0 @@
-import { serve } from "https://deno.land/std@0.177.0/http/server.ts";
-import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
-
-// Lemon Squeezy webhook. Source of truth for plan/status and the license key.
-// Deploy with --no-verify-jwt (Lemon Squeezy does not send a Supabase JWT;
-// HMAC signature is the authentication). Keep "Generate license keys" ON on
-// every Pro variant: LS emails the key to the customer and we store that same
-// native key here, so there is a single key system end to end.
-const LEMON_SQUEEZY_WEBHOOK_SECRET = Deno.env.get("LEMON_SQUEEZY_WEBHOOK_SECRET")!;
-const SUPABASE_URL = Deno.env.get("SUPABASE_URL")!;
-const SUPABASE_SERVICE_ROLE_KEY = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
-
-const PRO_FEATURES = ["impact", "review-pr", "generate-tests", "mcp"];
-
-// The license key is delivered by this event (LS generates + emails it):
-const LICENSE_EVENTS = ["license_key_created"];
-// Activate / keep Pro:
-const ACTIVATE_EVENTS = [
-  "order_created",
-  "subscription_created",
-  "subscription_updated",
-  "subscription_resumed",
-  "subscription_unpaused",
-  "subscription_payment_success",
-];
-// Revocation — real end of access. NOT subscription_cancelled: that keeps
-// access until period end; LS sends subscription_expired when it actually ends.
-const REVOKE_EVENTS = [
-  "subscription_expired",
-  "subscription_paused",
-];
-const HANDLED_EVENTS = [...LICENSE_EVENTS, ...ACTIVATE_EVENTS, ...REVOKE_EVENTS];
-
-async function verifySignature(rawBody: string, signature: string): Promise<boolean> {
-  if (!signature) return false;
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(LEMON_SQUEEZY_WEBHOOK_SECRET),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"],
-  );
-  const expected = await crypto.subtle.sign("HMAC", key, encoder.encode(rawBody));
-  const expectedHex = Array.from(new Uint8Array(expected))
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
-  return expectedHex === signature;
-}
-
-const json = (body: unknown, status = 200) =>
-  new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-
-serve(async (req: Request) => {
-  if (req.method !== "POST") return new Response("Method not allowed", { status: 405 });
-
-  const rawBody = await req.text();
-  const signature =
-    req.headers.get("X-Signature") ?? req.headers.get("x-signature") ?? "";
-
-  if (!(await verifySignature(rawBody, signature))) {
-    console.error("Invalid webhook signature");
-    return new Response("Unauthorized", { status: 401 });
-  }
-
-  let payload: Record<string, unknown>;
-  try {
-    payload = JSON.parse(rawBody);
-  } catch {
-    return new Response("Bad request: invalid JSON", { status: 400 });
-  }
-
-  const meta = payload.meta as Record<string, unknown>;
-  const data = payload.data as Record<string, unknown>;
-  const eventName = meta?.event_name as string;
-  const eventId = meta?.event_id as string | undefined;
-
-  if (!HANDLED_EVENTS.includes(eventName)) {
-    return json({ received: true, skipped: true });
-  }
-
-  const attributes = data?.attributes as Record<string, unknown>;
-  const email = ((attributes?.user_email ?? attributes?.customer_email) as string ?? "")
-    .toLowerCase();
-
-  if (!email || !email.includes("@")) {
-    console.error("No valid email in payload", { eventName });
-    return new Response("Bad request: no email", { status: 400 });
-  }
-
-  const supabase = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
-
-  // Idempotency
-  if (eventId) {
-    const { data: existing } = await supabase
-      .from("license_events").select("id").eq("event_id", eventId).maybeSingle();
-    if (existing) return json({ received: true, duplicate: true });
-  }
-
-  const { data: existingUser } = await supabase
-    .from("users").select("id, license_key").eq("email", email).maybeSingle();
-
-  let userId = existingUser?.id;
-  const now = new Date().toISOString();
-
-  // #3  license_key_created -> store the native Lemon Squeezy key
-  if (LICENSE_EVENTS.includes(eventName)) {
-    const lsKey = attributes?.key as string;
-    if (!lsKey) {
-      console.error("license_key_created without attributes.key");
-      return new Response("Bad request: no key", { status: 400 });
-    }
-    const { data: up, error } = await supabase.from("users").upsert(
-      { email, plan: "pro", status: "active", features: PRO_FEATURES,
-        license_key: lsKey, updated_at: now },
-      { onConflict: "email", ignoreDuplicates: false },
-    ).select("id").single();
-    if (error) { console.error("upsert key", error); return json({ error: "DB" }, 500); }
-    userId = up?.id ?? userId;
-  }
-
-  // #4  Revocation -> status inactive (does NOT touch license_key or plan)
-  else if (REVOKE_EVENTS.includes(eventName)) {
-    const { error } = await supabase.from("users")
-      .update({ status: "inactive", updated_at: now }).eq("email", email);
-    if (error) console.error("revoke", error);
-    if (userId) {
-      await supabase.from("subscriptions").update({ status: "inactive" }).eq("user_id", userId);
-    }
-  }
-
-  // Activation -> plan pro + active (preserves existing license_key)
-  else {
-    const { data: up, error } = await supabase.from("users").upsert(
-      { email, plan: "pro", status: "active", features: PRO_FEATURES, updated_at: now },
-      { onConflict: "email", ignoreDuplicates: false },
-    ).select("id").single();
-    if (error) { console.error("upsert activate", error); return json({ error: "DB" }, 500); }
-    userId = up?.id ?? userId;
-
-    const periodEnd = (attributes?.renews_at ?? attributes?.ends_at ?? null) as string | null;
-    await supabase.from("subscriptions").upsert(
-      { user_id: userId, provider: "lemonsqueezy", status: "active",
-        current_period_end: periodEnd, created_at: now },
-      { onConflict: "user_id" },
-    );
-  }
-
-  // Audit
-  const { error: evErr } = await supabase.from("license_events").insert({
-    user_id: userId ?? null,
-    event_type: eventName,
-    event_id: eventId ?? null,
-    payload: JSON.parse(JSON.stringify(payload)),
-  });
-  if (evErr) console.error("license_event insert", evErr);
-
-  console.log(`Processed ${eventName} for ${email}`);
-  return json({ received: true, email, event: eventName });
-});