c76bf73 · d8add2a · 28935c4 · 292ddca · 37ed3bd · e023cba
@@ -72,7 +72,7 @@
Children report in; the parent never reaches in. Every ten minutes a spawned chi
## Callers
`POST /api/v1/forges {name, apps[], crew[], direction?, keepAccess?, modelKey?, budgetUsd?, size?, template?, dryRun}` (rw token, admin only) and the MCP `spawn` tool share `src/spawn/door.ts`. `size` is `small` (default), `medium` or `large`; anything else is a 422 on `size`. It is recorded in the plan, the ledger, `parent.json` and `GET /api/v1/forges`, but not enforced yet: it limits nothing. `dryRun` is true unless it is `false`: the answer is the plan, what is left behind, and `firstAdmin` (the caller's username, or `null` for an anonymous plan, where whoever claims the child becomes its admin), and nothing is made. `GET /api/v1/forges` lists the ledger's children. The child's org is its name; `crew` names the agents whose briefs travel. Errors: 401 unauthorized, 403 forbidden / cross_origin, 422 invalid, 409 refused / exists, 500 failed — each with one sentence. The MCP lets an `ro` token plan, never make.
`POST /api/v1/forges {name, apps[], crew[], direction?, keepAccess?, modelKey?, budgetUsd?, size?, template?, dryRun}` (rw token; a person who is signed in, and a paid plan only from an admin, a gift code, or a paid order below) and the MCP `spawn` tool share `src/spawn/door.ts`. `size` is `small` (default), `medium` or `large`; anything else is a 422 on `size`. It is recorded in the plan, the ledger, `parent.json` and `GET /api/v1/forges`, but not enforced yet: it limits nothing. `dryRun` is true unless it is `false`: the answer is the plan, what is left behind, and `firstAdmin` (the caller's username, or `null` for an anonymous plan, where whoever claims the child becomes its admin), and nothing is made. `GET /api/v1/forges` lists the ledger's children. The child's org is its name; `crew` names the agents whose briefs travel. Errors: 401 unauthorized, 403 forbidden / cross_origin, 422 invalid, 409 refused / exists, 500 failed — each with one sentence. The MCP lets an `ro` token plan, never make.
A spawn may also name a `size`: `small`, `medium` or `large` (`src/spawn/sizes.ts` maps each to CPU, memory and disk). It is recorded in the plan only when given, so a plan without one hashes as it always did, and an unknown size is a 422 on `size`. The New forge page and the terminal form both offer it, small preselected and not sent; the page shows a refusal beside the select, linked with `aria-describedby`. Nothing enforces the limits yet, and the table's numbers are provisional. `GET /api/v1/forges/sizes` (no sign-in, ETag, cached for 5 minutes) and the MCP tool `sizes` give the same answer — each size's CPU, memory and disk, read from that table, and one sentence on what it is for — so a page or an agent offering a size reads it there.
@@ -196,3 +196,13 @@
ledger (`spawn/sizes.ts`). **Unset means no quota.** A spawn that would pass a
declared limit is a 409 `refused` with one sentence naming it, and the New
forge page shows that sentence above the form when even a small forge would
not fit (`spawn/quota.ts`).
## The paid path: `/pricing`
A visitor with no account buys a forge. `GET /pricing` (public) lists the plans from the setting with their size, price and crew credit. A paid plan's button posts the forge's name and an email to `POST /pricing/order`, which checks the name is free (not a user, a child, a reserved word or another order's hold), writes an **order** (`forge_order`: name, plan, email, state `pending`) that holds the name for 30 minutes, and redirects to the provider's checkout. The buyer's ticket is an HttpOnly cookie scoped to `/pricing`; only its hash is kept.
When the order turns paid (the `checkout.session.completed` webhook, or `/pricing/done` asking the provider for the session, whichever is first) one `UPDATE … WHERE state = 'pending'` wins and goes on: `spawnDoor(..., { paid: true })` makes the forge on that plan, the entitlement is written, the order is `spawned`. A second delivery finds the order moved and changes nothing.
`/pricing/done` waits for the spawn, then mints a fresh claim link and shows it once, as `/forges/new` does; when mail is configured it is also mailed to the order's email. `/pricing/resend` re-sends a new link (the old one stops) to the order's own email only, and answers the same whether or not an order matched.
A paid order whose spawn fails (no capacity, a name taken in a race) becomes `failed`: a `billing.order_failed` event, the `paid_order` flow alarm, and a plain page to the buyer. On Settings → Billing an admin sees "Paid, not made" with **Retry** and a link to the provider's dashboard to refund. With no provider connected the paid plans show their size and say "ask the operator". Agents are refused as buyers.
@@ -49,6 +49,9 @@
Machine routes are not pages and have no entry: `/audit.csv`,
- `/` — `pages/site.ts` (`home`, studio mode in `studio/home.ts`) · where I am, what needs me · `/front` (same page for anyone), `/board`, `/asks` · colours 3 in `site.ts`, 7 in `studio/home.ts`.
- `/front` — `studio/home.ts` (`studioDoor`) · the signed-out door, and the site admin's controls over it · `/` for a signed-out reader · colours 7.
- `/pricing` — `pages/pricing.ts` · the plans and what each brings, and the sale: pick a plan and a name, then pay; the page the no-credit line points to · `/pricing/done`, `/settings/billing`, that line, `/` · none seen.
- `/pricing/done` — `pages/pricing.ts` (`pricingDone`) · after payment, the claim link, shown once · `/pricing`, `/pricing/resend` · none seen.
- `/pricing/resend` — `pages/pricing.ts` (`resendPage`) · a lost claim link sent again to the buyer's email · `/pricing` · none seen.
- `/explore` — `studio/explore.ts` · browse what the forge holds · `/search`, `/apps` · colours 2.
- `/board` — `pages/board.ts` (1,231 lines) · every app the viewer can see, with a wall mode · `/boards` (saved queries as panels), `/flow`, `/` · colour 1, sizes 6.
- `/board/returns` — `pages/returns.ts` · what the window's dollars bought · `/settings/subscriptions` spend tables, `/settings/usage` · none seen.
@@ -94,7 +97,6 @@
Machine routes are not pages and have no entry: `/audit.csv`,
- `/family` — `pages/family.ts` · parent, this forge and children as a tree · `/forges` (the same children) · colour 1.
- `/claim` — `pages/claim.ts` · claim a forge that was sent to me · none · colour 1.
- `/privacy` — `pages/privacy.ts` · what the forge keeps about a visitor, three plain lines, open to anyone · none · none seen.
- `/pricing` — `pricing.ts` · the plans and what each brings, the page the no-credit line points to · that line, `/` · none seen.
- `/first-admin` — `pages/first-admin.ts` · the first person becomes admin · none · none seen.
- `/fleet/graph` — `pages/fleet-graph.ts` · the fleet as a graph · `/family`, `/forges` · none seen.
- `/fleet` — `pages/fleet.ts` · the rows a fleet query line selects, as a table · `/fleet/graph` · none seen.
@@ -24,4 +24,4 @@
The home reads who may sign up, the plans and the buy links in one statement (`s
## When the crew has no credit
A forge whose crew has no key and no included credit says so once on its first screen: "The crew cannot build until you add a model key or pick a plan." (`NO_CREDIT_WORDS`, `crewFirstLine` in `src/web/studio/crew_key.ts`; the terminal's first screen says the same line as text, `crewFirstText`, with credit too). The key is a link to `/settings/subscriptions` (admins), the plan a link to `/pricing`, the plans on a page of their own (`src/web/pricing.ts`). With credit the line is the next step: make an app or bring a repository. A tell sent with no credit is kept, and the flash says the crew cannot build yet, with the same two ways forward; that holds for the first screen's own box (`app=forge`, kept as a thought) as for a tell to an app. `/pricing` has no terminal screen: its door there is the palette's *Get your own forge*.
A forge whose crew has no key and no included credit says so once on its first screen: "The crew cannot build until you add a model key or pick a plan." (`NO_CREDIT_WORDS`, `crewFirstLine` in `src/web/studio/crew_key.ts`; the terminal's first screen says the same line as text, `crewFirstText`, with credit too). The key is a link to `/settings/subscriptions` (admins), the plan a link to `/pricing`, the plans, and the sale, on a page of their own (`src/web/pages/pricing.ts`). With credit the line is the next step: make an app or bring a repository. A tell sent with no credit is kept, and the flash says the crew cannot build yet, with the same two ways forward; that holds for the first screen's own box (`app=forge`, kept as a thought) as for a tell to an app. `/pricing` has no terminal screen: its door there is the palette's *Get your own forge*.
@@ -0,0 +1,12 @@
# Buy a forge at /pricing (#11138)
Open `/pricing` with no account. Each plan shows its size, price and crew credit. Type the forge's name and an email, press the paid plan's button, pay at the provider's checkout, and the page you return to (`/pricing/done`) shows the claim link once. Open it to take the forge over.
- **Free plan:** its button goes to `/forges/new`.
- **Closed the tab?** `/pricing/resend`: name and email you bought with; a new link is mailed there (needs mail configured) and the old one stops.
- **No provider connected:** paid plans show their size and say "Ask the operator".
- **Operator:** connect Stripe under Settings → Billing. A paid order whose forge could not be made shows under "Paid, not made" with Retry and a link to the provider's dashboard to refund; a flow alarm names it.
- **Limits:** one client address may have 3 orders waiting at once (counted by socket address, never a header); a name is held 35 minutes and the provider's checkout stops being payable at 31, so a late payer never finds the name given away; a claim link is mailed again at most once a day per order.
- **Terminal:** no screen yet; checkout is browser-only (the provider's hosted page). Tracked in a follow-up issue.
      
        sentinelcrew
        3d ago
        outdated
      
      Name the terminal door here once the src/tui/ pricing screen exists (finding 1), and the per-address pending cap (finding 2).
    
- **Code:** `src/actions/order.ts` (rules), `src/billing/orders.ts` (store), `src/web/pages/pricing.ts` (pages). The paid path is described in `docs/SPAWN.md`.
- **Test:** `bun test test/pricing-order.test.ts`.
@@ -0,0 +1,241 @@
/**
 * The sale (#11138): a visitor picks a paid plan, a name and an email; the
 * name is held for 30 minutes (an order, `billing/orders.ts`) and the buyer
 * goes to the provider's checkout. When the order turns paid, by the webhook
 * or by the return page asking the provider for the session, whichever
 * comes first, the forge is made once through `spawnDoor` on that plan and
 * its entitlement written. A paid order whose forge cannot be made is
 * `failed`: an event, a flow alarm, and a plain sentence to the buyer; an
 * admin retries it or refunds at the provider. Never an agent as buyer.
 *
 * The claim link is shown once, on the return page, and mailed when the
 * forge can send mail. It is never kept: the page makes a fresh one when the
 * buyer arrives, and a buyer who left can ask for one by email.
 */
import type { App } from "../app.ts";
import { checkoutOf } from "../billing/checkout.ts";
import { getOrder, holdName, markResent, markShown, move, unmarkShown, pendingFrom, MAX_PENDING_PER_ADDRESS, CHECKOUT_MS, nameHeld, newId, newTicket, dropPending, pendingCount, setSession, spawnedFor, ticketFits, MAX_PENDING, type Order } from "../billing/orders.ts";
import { putEntitlement } from "../billing/store.ts";
import { getUserByName, type User } from "../core/users.ts";
import { publicOrigin } from "../core/public_origin.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { isChildName } from "../core/proposal_token.ts";
import type { Ctx } from "../http/context.ts";
import { spawnDoor } from "../spawn/door.ts";
import { FREE, getPlan, type Plan } from "../settings/plans.ts";
import { listChildrenNow, reissueClaimFor } from "./spawn.ts";
import { mayMail, sendCapped } from "./mail.ts";
import { mailerOf } from "./verify.ts";
export interface Refusal {
  readonly field: "name" | "email" | "plan" | "form";
  readonly message: string;
}
const ADDRESS = /^[^\s<>@,;:"\\]{1,64}@[^\s<>@,;:"\\]{1,190}$/;
export const NO_PROVIDER = "Paid plans are not on sale here yet: ask the operator.";
/** A spawn that stays `spawning` this long is taken as lost and may be retried. */
const STALE_MS = 5 * 60_000;
/** A claim link is mailed again at most once a day per order: a stranger cannot make it a mail-bomb. */
const RESEND_MS = 24 * 60 * 60_000;
/** A request-less context the forge itself acts through when no visitor is on the line (a webhook). */
function systemCtx(app: App): Ctx {
  const origin = publicOrigin(app.config.url, `http://localhost:${app.config.port}`);
  return {
    app,
    request: new Request(`${origin}/pricing`, { method: "POST" }),
    url: new URL(`${origin}/pricing`),
    params: {},
    auth: { user: undefined, scope: undefined, via: "none" },
    theme: undefined,
  };
}
/** The email, trimmed and lower-cased, or undefined. */
export const emailOf = (raw: unknown): string | undefined => {
  const s = typeof raw === "string" ? raw.trim() : "";
  return s.length <= 254 && ADDRESS.test(s) ? s.toLowerCase() : undefined;
};
/** Every refusal of a name, in one sentence, or undefined when it is free to buy. */
export async function nameRefusal(app: App, name: string, plan: Plan, now: number): Promise<string | undefined> {
  if (!isChildName(name) || name.length > 38) return "Use 1 to 38 lowercase letters, digits and dashes, not starting or ending with a dash";
  if (getUserByName(app.db, name) !== undefined || listChildrenNow(app).some((c) => c.name === name)) return "That name is taken";
  if (nameHeld(app.db, name, now)) return "That name is held for someone else; try another";
  // The door's own plan: reserved words and the rest of the name's rules, with nothing made.
  const dry = await spawnDoor(systemCtx(app), undefined, { name, apps: [], crew: [], plan: plan.key, dryRun: true }, { paid: true });
  if (dry.status >= 400) return String(dry.body["message"] ?? "That name cannot be used").replace(/^name: /, "");
  return undefined;
}
export interface Placed {
  readonly id: string;
  /** Goes in the buyer's HttpOnly cookie; only its hash is kept. */
  readonly ticket: string;
  /** The provider's checkout address. */
  readonly redirect: string;
}
/** Validate, hold the name, make the checkout. Nothing is held if the checkout cannot be made. */
export async function placeOrder(app: App, input: { name: unknown; plan: unknown; email: unknown; address: string }, url: URL, now = Date.now()): Promise<Result<Placed, Refusal>> {
  const plan = typeof input.plan === "string" ? getPlan(app.db, input.plan) : undefined;
  if (plan === undefined || plan.key === FREE || plan.priceUsd <= 0) return err({ field: "plan", message: "Pick one of the paid plans" });
  const email = emailOf(input.email);
  if (email === undefined) return err({ field: "email", message: "Enter the email the link should go to" });
  const name = typeof input.name === "string" ? input.name.trim() : "";
  const provider = checkoutOf(app);
  if (provider === undefined) return err({ field: "form", message: NO_PROVIDER });
  if (pendingCount(app.db, now) >= MAX_PENDING) return err({ field: "form", message: "Many orders are waiting right now; try again in a few minutes" });
  if (pendingFrom(app.db, input.address, now) >= MAX_PENDING_PER_ADDRESS) return err({ field: "form", message: "You have orders waiting already; finish one or try again in half an hour" });
  const refused = await nameRefusal(app, name, plan, now);
  if (refused !== undefined) return err({ field: "name", message: refused });
  const id = newId();
  const ticket = newTicket();
  if (!holdName(app.db, { id, name, plan: plan.key, email, ticket, address: input.address }, now)) return err({ field: "name", message: "That name is held for someone else; try another" });
  const origin = publicOrigin(app.config.url, url.origin);
  const made = await provider.create({
    orderId: id, forge: name, plan: plan.key, planName: plan.name, priceUsd: plan.priceUsd, email,
    successUrl: `${origin}/pricing/done?order=${id}`, cancelUrl: `${origin}/pricing`,
    // The checkout stops being payable before the name's hold lapses.
    expiresAt: Math.floor((now + CHECKOUT_MS) / 1000),
  });
  if (!made.ok) {
    dropPending(app.db, id);
    app.log.warn("a checkout could not be made", { provider: provider.name, says: made.error });
    return err({ field: "form", message: "The payment provider could not be reached; nothing was charged. Try again in a minute" });
  }
  setSession(app.db, id, made.value.id);
  app.bus.append({ kind: "billing.order_placed", payload: { id, forge: name, plan: plan.key } });
  return ok({ id, ticket, redirect: made.value.url });
}
/**
 * The order is paid: make its forge, once. Called by the webhook and by the
 * return page; only the call whose move out of `pending` took effect goes on,
 * and a later call just reads where the order is. Never throws.
 */
export async function settleOrder(app: App, id: string, paid: { customer?: string; subscription?: string } = {}): Promise<Order | undefined> {
  const now = Date.now();
  const o = getOrder(app.db, id);
  if (o === undefined) return undefined;
  if (!move(app.db, id, "pending", "paid", now, { customerId: paid.customer ?? "", subscriptionId: paid.subscription ?? "" })) return o;
  app.bus.append({ kind: "billing.order_paid", payload: { id, forge: o.name, plan: o.plan } });
  return makeForge(app, id, "paid");
}
/** Make the forge of an order standing in `from` (paid, or failed for a retry). */
async function makeForge(app: App, id: string, from: "paid" | "failed" | "spawning"): Promise<Order | undefined> {
  if (!move(app.db, id, from, "spawning", Date.now())) return getOrder(app.db, id);
  const o = getOrder(app.db, id) as Order;
  const fail = (reason: string): Order => {
    move(app.db, id, "spawning", "failed", Date.now(), { reason });
    app.bus.append({ kind: "billing.order_failed", payload: { id, forge: o.name, plan: o.plan, reason } });
    app.log.error("a paid order could not be made into a forge", { id, forge: o.name, reason });
    return getOrder(app.db, id) as Order;
  };
  try {
    const plan = getPlan(app.db, o.plan);
    if (plan === undefined) return fail(`the ${o.plan} plan is no longer offered`);
    const door = await spawnDoor(systemCtx(app), undefined, { name: o.name, apps: [], crew: [], plan: plan.key, dryRun: false }, { paid: true });
    if (door.status >= 400) return fail(String(door.body["message"] ?? "the forge could not be made").slice(0, 300));
    putEntitlement(app.db, {
      forge: o.name, plan: plan.key, status: "active", provider: checkoutOf(app)?.name ?? "none", payer: o.email,
      customerId: o.customerId, subscriptionId: o.subscriptionId, source: checkoutOf(app)?.name ?? "paid",
    }, plan.size, "");
    move(app.db, id, "spawning", "spawned", Date.now());
    app.bus.append({ kind: "billing.order_spawned", payload: { id, forge: o.name, plan: plan.key } });
    return getOrder(app.db, id);
  } catch (error) {
    return fail(`the forge could not be made: ${String(error).slice(0, 200)}`);
  }
}
/** An event from the provider says this session was paid: settle its order, if it is one of ours. */
export async function settleSession(app: App, session: { id?: unknown; metadata?: { order?: unknown } | null; customer?: unknown; subscription?: unknown; payment_status?: unknown }): Promise<Order | undefined> {
  if (session.payment_status !== "paid" && session.payment_status !== "no_payment_required") return undefined;
  const id = typeof session.metadata?.order === "string" ? session.metadata.order : undefined;
  const sid = typeof session.id === "string" ? session.id : "";
  const o = id === undefined ? undefined : getOrder(app.db, id);
  // The session must be the one this order made: a made-up order id on another session settles nothing.
  if (o === undefined || sid === "" || o.sessionId !== sid) return undefined;
  const text = (v: unknown): string => (typeof v === "string" && /^[A-Za-z0-9_]{1,100}$/.test(v) ? v : "");
  return settleOrder(app, o.id, { customer: text(session.customer), subscription: text(session.subscription) });
}
/** The return page's reconcile: a pending order is asked of the provider, and settled if it was paid. */
export async function reconcileOrder(app: App, id: string): Promise<Order | undefined> {
  const o = getOrder(app.db, id);
  if (o === undefined) return undefined;
  if (o.state === "spawning" && Date.now() - o.updatedAt > STALE_MS) return makeForge(app, id, "spawning");
  if (o.state !== "pending" || o.sessionId === "") return o;
  const provider = checkoutOf(app);
  if (provider === undefined) return o;
  const seen = await provider.state(o.sessionId);
  if (!seen.ok || !seen.value.paid) return o;
  return settleOrder(app, id, { customer: seen.value.customer, subscription: seen.value.subscription });
}
export type Delivered =
  | { readonly kind: "link"; readonly claimUrl: string; readonly mailed: boolean }
  | { readonly kind: "shown" }
  | { readonly kind: "claimed" }
  | { readonly kind: "failed" };
const mailOf = (name: string, link: string) => ({
  subject: `Your forge ${name} is ready`,
  text: ["Your forge is ready.", "", "Open this link to take it over. It works once, for a day:", "", link, "", "If you did not buy a forge, ignore this message."].join("\n"),
});
/** Send the link to the order's email when the forge can mail; true when it went. */
async function mailLink(app: App, o: Order, link: string): Promise<boolean> {
  const mailer = mailerOf(app, { id: "order" });
  if (mailer === undefined || !mayMail(app, o.email)) return false;
  const m = mailOf(o.name, link);
  return (await sendCapped(app, mailer, { to: o.email, ...m })) === "sent";
}
/** A spawned order's claim link, for the buyer who holds its ticket: made fresh, shown once, mailed when mail is on. */
export async function deliverLink(app: App, o: Order): Promise<Delivered> {
  if (o.state !== "spawned") return { kind: "failed" };
  if (!markShown(app.db, o.id, Date.now())) return { kind: "shown" };
  const made = await reissueClaimFor(app, o.name);
  if (!made.ok) {
    unmarkShown(app.db, o.id);
    return "reason" in made.error && made.error.reason === "claimed" ? { kind: "claimed" } : { kind: "failed" };
  }
  return { kind: "link", claimUrl: made.value.claimUrl, mailed: await mailLink(app, o, made.value.claimUrl) };
}
/** A buyer who left asks for the link again: it goes to the order's own email and nowhere else. Always the same answer. */
export async function resendLink(app: App, nameIn: unknown, emailIn: unknown, now = Date.now()): Promise<"sent" | "no_mail" | "asked"> {
  if (mailerOf(app, { id: "order" }) === undefined) return "no_mail";
  const name = typeof nameIn === "string" ? nameIn.trim() : "";
  const email = emailOf(emailIn);
  const o = email === undefined || !isChildName(name) ? undefined : spawnedFor(app.db, name, email);
  // One a day per order, and only to the address it was bought with.
  if (o === undefined || (o.resentAt !== null && now - o.resentAt < RESEND_MS)) return "asked";
  const made = await reissueClaimFor(app, o.name);
  if (!made.ok) return "asked";
  markResent(app.db, o.id, now);
  await mailLink(app, o, made.value.claimUrl);
  return "asked";
}
export type RetryError = "not_found" | "not_failed";
/** An admin who is a person retries a failed (or lost) spawn of a paid order. */
export async function retryOrder(app: App, actor: User | undefined, id: unknown): Promise<Result<Order, RetryError>> {
  if (actor?.isAdmin !== true || actor.kind !== "user") return err("not_found");
  const o = typeof id === "string" ? getOrder(app.db, id) : undefined;
  if (o === undefined) return err("not_found");
  const stale = o.state === "spawning" && Date.now() - o.updatedAt > STALE_MS;
  if (o.state !== "failed" && !stale) return err("not_failed");
  app.bus.append({ kind: "billing.order_retried", actorId: actor.id, payload: { id: o.id, forge: o.name } });
  const made = await makeForge(app, o.id, stale ? "spawning" : "failed");
  return ok(made ?? o);
}
/** The ticket a cookie carries fits this order. */
export const mayView = (app: App, id: string, ticket: string): boolean => ticketFits(app.db, id, ticket);
@@ -288,7 +288,7 @@
async function make(
    if (plan.plan !== undefined && chosen === undefined)
      return err({ kind: "invalid", field: "plan", reason: `${plan.plan} is not a plan this forge offers` });
    if (chosen !== undefined && chosen.key !== FREE && deps.gift === true) {
      // A redeemed gift code (`actions/codes.ts`) is what lends this plan: it asks no admin and no payment.
      // A redeemed gift code (`actions/codes.ts`) or a paid order (`actions/order.ts`) is what lends this plan: it asks no admin.
    } else if (chosen !== undefined && chosen.key !== FREE) {
      if (owner === undefined) return err({ kind: "refused", reason: "plan", message: `the ${chosen.name} plan is for a signed-in person; sign in first` });
      if (!owner.isAdmin) return err({ kind: "refused", reason: "plan", message: PAID_PLAN_ADMIN_ONLY(chosen.name) });
@@ -677,6 +677,20 @@
export async function reissueClaim(
  const user = requireUser(actor);
  if (!user.ok) return err({ kind: "unauthorized" });
  if (!user.value.isAdmin) return err({ kind: "forbidden" });
  const made = await reissueClaimFor(app, name);
  if (made.ok) app.bus.append({ kind: "forge.claim_reissued", actorId: user.value.id, payload: { name } });
  return made;
}
/**
 * A new claim link for an unclaimed child, with no actor: the caller has
 * already decided who may have it (an admin above; the buyer of the forge in
 * `actions/order.ts`). The old link stops working.
 */
export async function reissueClaimFor(
  app: App,
  name: string,
): Promise<Result<{ readonly name: string; readonly claimUrl: string }, SpawnError | { readonly kind: "not_found" }>> {
  const ledger = /^[a-z0-9-]{1,39}$/.test(name) ? await readLedger(app, name) : undefined;
  if (!ledger || !ledger.done) return err({ kind: "not_found" });
  const child = createApp({ dataDir: childDirOf(app, ledger.bodyId) });
@@ -686,7 +700,6 @@
export async function reissueClaim(
    if (hasAdmin(child.db))
      return err({ kind: "refused", reason: "claimed", message: `${name} is already claimed; ask its owner to invite you` });
    const token = mintClaim(child.db, spawned.org.id);
    app.bus.append({ kind: "forge.claim_reissued", actorId: user.value.id, payload: { name } });
    return ok({ name, claimUrl: claimLink(liveChildUrl(app, name), token) });
  } finally {
    child.close();
@@ -56,7 +56,7 @@
export function mailConfigured(app: App): boolean {
  return MAIL_SECRETS.every((name) => set.has(name));
}
function mailerOf(app: App, forUser: User): Mailer | undefined {
export function mailerOf(app: App, forUser: { readonly id: string }): Mailer | undefined {
  if (app.config.mailer !== undefined) return app.config.mailer;
  const stored = resolveSecrets(
    app.db,
@@ -0,0 +1,54 @@
/**
 * The checkout seam (#11138): what the sale needs of a payment provider,
 * and nothing else. `create` makes a hosted checkout for one order and
 * returns where to send the buyer; `state` asks whether a session was paid
 * (the return page reconciles with it when the webhook is late). The
 * provider is Stripe when it is connected (`billing/connection.ts`), else
 * `none`: nothing is sold and the pricing page says so. A test swaps in its
 * own with `useCheckout`.
 */
import type { App } from "../app.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { connectionOf, openKey } from "./connection.ts";
import { stripeClient, type CheckoutRequest, type CheckoutSession, type CheckoutState } from "./stripe.ts";
export type { CheckoutRequest, CheckoutSession, CheckoutState };
export interface CheckoutProvider {
  readonly name: string;
  create(req: CheckoutRequest): Promise<Result<CheckoutSession, string>>;
  state(sessionId: string): Promise<Result<CheckoutState, string>>;
}
const swapped = new WeakMap<App, CheckoutProvider>();
/** Use `provider` for this app; for tests. */
export function useCheckout(app: App, provider: CheckoutProvider | undefined): void {
  if (provider === undefined) swapped.delete(app);
  else swapped.set(app, provider);
}
/** The provider this forge sells through now, or undefined when none is connected. */
export function checkoutOf(app: App): CheckoutProvider | undefined {
  const test = swapped.get(app);
  if (test !== undefined) return test;
  if (connectionOf(app.db) === undefined) return undefined;
  const open = openKey(app.db, app.config.dataDir, app.bus, "checkout");
  if (open === undefined) return undefined;
  const client = stripeClient(open.key);
  return {
    name: "stripe",
    async create(req) {
      const r = await client.createCheckout(req);
      return r.ok ? r : err(r.error.message);
    },
    async state(id) {
      const r = await client.getCheckout(id);
      return r.ok ? ok(r.value) : err(r.error.message);
    },
  };
}
/** Where the operator pays back a buyer: the provider's own dashboard. */
export const REFUND_URL = "https://dashboard.stripe.com/payments";
@@ -0,0 +1,160 @@
/**
 * The store of orders (#11138): a visitor's purchase of a forge, from the
 * name being held to the forge being made. Plain rows in, plain rows out;
 * the checkout and the spawn are in `actions/order.ts`.
 *
 * States: `pending` (name held for 30 minutes, nothing paid), `paid`
 * (money taken, forge not yet made), `spawning`, `spawned`, `failed` (paid,
 * the forge could not be made: an admin's alarm). A move is one UPDATE that
 * names the state it leaves, so two deliveries of the same payment cannot
 * both make the forge: only the one whose UPDATE changed a row goes on.
 * The buyer's ticket (a cookie) is kept as its sha256; the claim link is
 * never kept.
 */
import type { Database } from "bun:sqlite";
import { sha256 } from "../kernel/hash.ts";
export type OrderState = "pending" | "paid" | "spawning" | "spawned" | "failed";
/** The hold outlives the checkout (`CHECKOUT_MS`) so a buyer who pays at the last minute still finds the name theirs. */
export const HOLD_MS = 35 * 60_000;
/** How long the provider's checkout stays payable; Stripe's least is 30 minutes. */
export const CHECKOUT_MS = 31 * 60_000;
/** Most orders waiting for payment at once: a name-hoarder cannot hold the whole namespace. */
export const MAX_PENDING = 200;
/** Most orders one client address may have waiting at once: one stranger cannot fill the shared cap. */
export const MAX_PENDING_PER_ADDRESS = 3;
export interface Order {
  readonly id: string;
  readonly name: string;
  readonly plan: string;
  readonly email: string;
  readonly state: OrderState;
  readonly sessionId: string;
  readonly customerId: string;
  readonly subscriptionId: string;
  readonly reason: string;
  readonly createdAt: number;
  readonly holdUntil: number;
  readonly updatedAt: number;
  readonly shownAt: number | null;
  readonly resentAt: number | null;
}
interface Row {
  id: string; name: string; plan: string; email: string; state: OrderState; ticket_hash: string; session_id: string;
  customer_id: string; subscription_id: string; reason: string; created_at: number; hold_until: number; updated_at: number;
  shown_at: number | null; resent_at: number | null;
}
const fromRow = (r: Row): Order => ({
  id: r.id, name: r.name, plan: r.plan, email: r.email, state: r.state, sessionId: r.session_id, customerId: r.customer_id,
  subscriptionId: r.subscription_id, reason: r.reason, createdAt: r.created_at, holdUntil: r.hold_until, updatedAt: r.updated_at,
  shownAt: r.shown_at, resentAt: r.resent_at,
});
export const newId = (): string => `ord_${crypto.randomUUID().replace(/-/g, "")}`;
export const newTicket = (): string => Buffer.from(crypto.getRandomValues(new Uint8Array(24))).toString("hex");
export function getOrder(db: Database, id: string): Order | undefined {
  const r = db.query<Row, [string]>("SELECT * FROM forge_order WHERE id = ?1").get(id);
  return r ? fromRow(r) : undefined;
}
export function bySession(db: Database, sessionId: string): Order | undefined {
  if (sessionId === "") return undefined;
  const r = db.query<Row, [string]>("SELECT * FROM forge_order WHERE session_id = ?1").get(sessionId);
  return r ? fromRow(r) : undefined;
}
/** True when the ticket is the one the order was made with. */
export function ticketFits(db: Database, id: string, ticket: string): boolean {
  const r = db.query<{ ticket_hash: string }, [string]>("SELECT ticket_hash FROM forge_order WHERE id = ?1").get(id);
  return r !== null && ticket !== "" && r.ticket_hash === sha256(ticket);
}
/** Whether an order other than a lapsed pending one holds `name` now. */
export function nameHeld(db: Database, name: string, now: number): boolean {
  return (
    db
      .query<{ n: number }, [string, number]>(
        "SELECT COUNT(*) AS n FROM forge_order WHERE name = ?1 AND (state != 'pending' OR hold_until > ?2)",
      )
      .get(name, now)?.n !== 0
  );
}
/** Orders waiting for payment from one client address (`http/peer.ts` `clientBucket`, never a header). */
export const pendingFrom = (db: Database, address: string, now: number): number =>
  db.query<{ n: number }, [string, number]>("SELECT COUNT(*) AS n FROM forge_order WHERE state = 'pending' AND hold_until > ?2 AND address = ?1").get(address, now)?.n ?? 0;
export const pendingCount = (db: Database, now: number): number =>
  db.query<{ n: number }, [number]>("SELECT COUNT(*) AS n FROM forge_order WHERE state = 'pending' AND hold_until > ?1").get(now)?.n ?? 0;
/** Write a new pending order. The hold is checked and the row written in one transaction. False when the name is held. */
export function holdName(db: Database, o: { id: string; name: string; plan: string; email: string; ticket: string; address: string }, now: number): boolean {
  return db.transaction(() => {
    if (nameHeld(db, o.name, now)) return false;
    db.query(
      `INSERT INTO forge_order (id, name, plan, email, state, ticket_hash, created_at, hold_until, updated_at, address)
       VALUES (?1, ?2, ?3, ?4, 'pending', ?5, ?6, ?7, ?6, ?8)`,
    ).run(o.id, o.name, o.plan, o.email, sha256(o.ticket), now, now + HOLD_MS, o.address);
    return true;
  })();
}
export function setSession(db: Database, id: string, sessionId: string): void {
  db.query("UPDATE forge_order SET session_id = ?2 WHERE id = ?1").run(id, sessionId);
}
/** Drop a pending order whose checkout could not be made: its name is free again. */
export function dropPending(db: Database, id: string): void {
  db.query("DELETE FROM forge_order WHERE id = ?1 AND state = 'pending'").run(id);
}
/** Move `from` to `to`; true only for the caller whose statement changed the row. */
export function move(db: Database, id: string, from: OrderState, to: OrderState, now: number, extra: { reason?: string; customerId?: string; subscriptionId?: string } = {}): boolean {
  return (
    db
      .query(
        `UPDATE forge_order SET state = ?3, updated_at = ?4, reason = ?5,
           customer_id = CASE WHEN ?6 = '' THEN customer_id ELSE ?6 END,
           subscription_id = CASE WHEN ?7 = '' THEN subscription_id ELSE ?7 END
         WHERE id = ?1 AND state = ?2`,
      )
      .run(id, from, to, now, extra.reason ?? "", extra.customerId ?? "", extra.subscriptionId ?? "").changes === 1
  );
}
/** The buyer has been shown the link: true once, for the caller that marks it. */
export function markShown(db: Database, id: string, now: number): boolean {
  return db.query("UPDATE forge_order SET shown_at = ?2 WHERE id = ?1 AND shown_at IS NULL").run(id, now).changes === 1;
}
/** Give the link back: a mint that failed leaves the buyer able to see it on the next visit. */
export function unmarkShown(db: Database, id: string): void {
  db.query("UPDATE forge_order SET shown_at = NULL WHERE id = ?1").run(id);
}
export function markResent(db: Database, id: string, now: number): void {
  db.query("UPDATE forge_order SET resent_at = ?2 WHERE id = ?1").run(id, now);
}
/** The newest spawned order for a name and email, for a re-send. */
export function spawnedFor(db: Database, name: string, email: string): Order | undefined {
  const r = db
    .query<Row, [string, string]>("SELECT * FROM forge_order WHERE name = ?1 AND lower(email) = ?2 AND state = 'spawned' ORDER BY created_at DESC LIMIT 1")
    .get(name, email.toLowerCase());
  return r ? fromRow(r) : undefined;
}
/** Orders an admin must look at: paid and not made. Newest first. */
export function failedOrders(db: Database): Order[] {
  return db.query<Row, []>("SELECT * FROM forge_order WHERE state = 'failed' ORDER BY updated_at DESC LIMIT 50").all().map(fromRow);
}
export function recentOrders(db: Database, limit = 20): Order[] {
  return db.query<Row, [number]>("SELECT * FROM forge_order WHERE state != 'pending' ORDER BY updated_at DESC LIMIT ?1").all(limit).map(fromRow);
}
@@ -63,7 +63,34 @@
export function formBody(data: { [k: string]: Value }): string {
  return parts.join("&");
}
export interface CheckoutRequest {
  readonly orderId: string;
  readonly forge: string;
  readonly plan: string;
  readonly planName: string;
  readonly priceUsd: number;
  readonly email: string;
  readonly successUrl: string;
  readonly cancelUrl: string;
  /** Unix seconds after which the checkout cannot be paid (Stripe: 30 minutes to 24 hours from now). */
  readonly expiresAt?: number;
}
export interface CheckoutSession {
  readonly id: string;
  readonly url: string;
}
/** What the provider says of a session: paid or not, and who is billed. */
export interface CheckoutState {
  readonly paid: boolean;
  readonly customer: string;
  readonly subscription: string;
}
export interface StripeClient {
  createCheckout(req: CheckoutRequest): Promise<Result<CheckoutSession, StripeError>>;
  getCheckout(sessionId: string): Promise<Result<CheckoutState, StripeError>>;
  addWebhook(url: string): Promise<Result<{ id: string; secret: string }, StripeError>>;
  removeWebhook(id: string): Promise<Result<true, StripeError>>;
  /** The subscription as Stripe has it now. */
@@ -112,6 +139,36 @@
export function stripeClient(key: string, fetchFn: typeof fetch = fetch): Stripe
  const missing = (what: string): StripeError => ({ kind: "rejected", status: 502, message: `Stripe's answer had no ${what}.` });
  return {
    async createCheckout(req) {
      const r = await call("POST", "/v1/checkout/sessions", {
        mode: "subscription",
        success_url: req.successUrl,
        cancel_url: req.cancelUrl,
        customer_email: req.email,
        client_reference_id: req.orderId,
        ...(req.expiresAt === undefined ? {} : { expires_at: req.expiresAt }),
        line_items: [{
          quantity: 1,
          price_data: {
            currency: "usd",
            unit_amount: Math.round(req.priceUsd * 100),
            recurring: { interval: "month" },
            product_data: { name: `${req.planName} forge` },
          },
        }],
        metadata: { order: req.orderId, forge: req.forge, plan: req.plan },
      }, req.orderId);
      if (!r.ok) return r;
      const id = str(r.value, "id"), url = str(r.value, "url");
      return id && url ? ok({ id, url }) : err(missing("checkout address"));
    },
    async getCheckout(sessionId) {
      if (!/^cs_[A-Za-z0-9_]{1,200}$/.test(sessionId)) return err({ kind: "rejected", status: 400, message: "That is not a checkout session id." });
      const r = await call("GET", `/v1/checkout/sessions/${sessionId}`);
      if (!r.ok) return r;
      const paid = r.value["payment_status"] === "paid" || r.value["payment_status"] === "no_payment_required";
      return ok({ paid, customer: str(r.value, "customer"), subscription: str(r.value, "subscription") });
    },
    async addWebhook(url) {
      const r = await call("POST", "/v1/webhook_endpoints", { url, enabled_events: [...WEBHOOK_EVENTS] },
        // fresh per attempt: Stripe replays an answer for a repeated key for 24h, and a reconnect must not get a deleted endpoint back
@@ -0,0 +1,1 @@
8f2099c03e05b76718444c78944bd349fb68145cc46e6bc5fde57f091dc11693
@@ -0,0 +1,1 @@
fa5d0fb138f7a201bf62e538c21efe4220855230305b3827fb9a08756b056da1
@@ -0,0 +1,24 @@
// Orders (#11138): a visitor's purchase of a forge. One row from the moment the name is held (pending)
// to the forge being made (spawned) or failing (failed, kept for an admin). The buyer's ticket is kept
// only as a sha256; the claim link is never kept. Additive.
export default `
  CREATE TABLE forge_order (
    id TEXT PRIMARY KEY,
    name TEXT NOT NULL,
    plan TEXT NOT NULL,
    email TEXT NOT NULL,
    state TEXT NOT NULL,
    ticket_hash TEXT NOT NULL,
    session_id TEXT NOT NULL DEFAULT '',
    customer_id TEXT NOT NULL DEFAULT '',
    subscription_id TEXT NOT NULL DEFAULT '',
    reason TEXT NOT NULL DEFAULT '',
    created_at INTEGER NOT NULL,
    hold_until INTEGER NOT NULL,
    updated_at INTEGER NOT NULL,
    shown_at INTEGER,
    resent_at INTEGER
  );
  CREATE INDEX forge_order_name ON forge_order (name);
  CREATE INDEX forge_order_state ON forge_order (state);
  `;
@@ -0,0 +1,6 @@
// Orders (#11138): the client address an order was placed from, so one address cannot hold more than
// its share of pending names. Additive; older rows keep the empty address.
export default `
  ALTER TABLE forge_order ADD COLUMN address TEXT NOT NULL DEFAULT '';
  CREATE INDEX forge_order_address ON forge_order (address, state);
  `;
@@ -0,0 +1,24 @@
/**
 * The "paid, not made" flow alarm (#11138): someone paid for a forge and it
 * could not be made (no room, the name taken in a race). Fires from the
 * moment the order failed until an admin retries it into a forge. Names the
 * oldest, so the one who has waited longest is the one shown.
 */
import type { Database } from "bun:sqlite";
export interface PaidOrderAlarm {
  readonly fired: boolean;
  readonly since?: string;
  readonly says: string;
}
export function alarmPaidOrder(db: Database): PaidOrderAlarm {
  const rows = db
    .query<{ name: string; reason: string; updated_at: number }, []>("SELECT name, reason, updated_at FROM forge_order WHERE state = 'failed' ORDER BY updated_at ASC")
    .all();
  const first = rows[0];
  if (first === undefined) return { fired: false, says: "Every paid order has its forge." };
  const more = rows.length > 1 ? ` (and ${rows.length - 1} more)` : "";
  return { fired: true, since: new Date(first.updated_at).toISOString(), says: `A buyer paid for ${first.name} and it could not be made: ${first.reason}${more}.` };
}
@@ -14,6 +14,7 @@
import { ownRepoPath } from "../kernel/own_repo.ts";
import { bugClockAlarm } from "./bugs.ts";
import { alarmBackup } from "./alarm_backup.ts";
import { alarmFromApp } from "./alarm_from_app.ts";
import { alarmPaidOrder } from "./alarm_paid_order.ts";
import { alarmIdleCrew } from "./alarm_idle_crew.ts";
import { noReleaseAlarm } from "./alarm_no_release.ts";
import { redMainAlarm } from "./alarm_red_main.ts";
@@ -22,7 +23,7 @@
import { alarmSilent } from "./alarm_silent.ts";
import { alarmStuck } from "./alarm_stuck.ts";
export interface FiredAlarm {
  readonly key: "landing_stopped" | "red_main" | "stuck" | "idle_crew" | "no_release" | "bug_clock" | "silent" | "repeat" | "from_app" | "unreachable" | "backup";
  readonly key: "landing_stopped" | "red_main" | "stuck" | "idle_crew" | "no_release" | "bug_clock" | "silent" | "repeat" | "from_app" | "unreachable" | "backup" | "paid_order";
  readonly says: string;
  readonly since: string;
  /** A same-origin path to the item the alarm names. */
@@ -62,6 +63,8 @@
export function firedAlarms(
    if (fromApp.fired) out.push({ key: "from_app", says: fromApp.says, since: fromApp.since!, href: `/${fromApp.repo}/issues/${fromApp.number}` });
    const backup = opts.dataDir === null ? undefined : alarmBackup(opts.dataDir, now);
    if (backup?.fired) out.push({ key: "backup", says: backup.says, since: backup.since!, href: "/flow" });
    const paidOrder = alarmPaidOrder(db);
    if (paidOrder.fired) out.push({ key: "paid_order", says: paidOrder.says, since: paidOrder.since!, href: "/settings/billing" });
    const idle = alarmIdleCrew(db, now, { ceilingUsd: opts.ceilingUsd ?? null });
    if (idle.fired) out.push({ key: "idle_crew", says: idle.says, since: idle.since!, href: "/boards" });
  }
@@ -35,7 +35,6 @@
import { maintenanceDuty, maintenancePage, maintenancePrepare, maintenanceResume
import { maintenanceBudget } from "../web/pages/maintenance_budgets.ts";
import { nightlyOutputPage, resiliencePage } from "../web/pages/resilience.ts";
import { agentStartSet, billingLinksSet, limitsPage, limitsSet, quotasSet, signupSet, inviteMint, inviteRevoke } from "../web/pages/admin-limits.ts";
import { pricingPage } from "../web/pricing.ts";
import { plansSet } from "../web/settings/plans.ts";
import { allFlowsPage } from "../web/pages/flows-all.ts";
import { measureSubmit } from "./measure.ts";
@@ -281,6 +280,7 @@
import { forgeLinkRevoke, forgeLinkSubmit, forgeLinkUndo, forgeRemoveConfirm, fo
  forgeOwnCodeSubmit, forgesPage } from "../web/pages/forges.ts";
import { forgeItSubmit } from "../web/pages/forge-it.ts";
import { funnelSubmit } from "./funnel.ts";
import { pricingDone, pricingOrder, pricingPage, resendPage, resendSubmit } from "../web/pages/pricing.ts";
import { forgeWaitingPage } from "../web/pages/forge-waiting.ts";
import { startForgeSubmit } from "../web/pages/start-forge.ts";
import { newForgePage, newForgeSubmit } from "../web/pages/new-forge.ts";
@@ -858,6 +858,11 @@
export function buildRouter(): Router<Handler> {
  router.add("GET", "/forges/:name/remove", forgeRemoveConfirm);
  router.add("POST", "/forges/:name/remove", forgeRemoveSubmit);
  router.add("GET", "/forges/:name/ready", forgeReady);
  router.add("GET", "/pricing", pricingPage);
  router.add("POST", "/pricing/order", pricingOrder);
  router.add("GET", "/pricing/done", pricingDone);
  router.add("GET", "/pricing/resend", resendPage);
  router.add("POST", "/pricing/resend", resendSubmit);
  router.add("GET", "/forges/:name/waiting", forgeWaitingPage);
  router.add("GET", "/forges/new", newForgePage);
  router.add("POST", "/forges/new", newForgeSubmit);
@@ -1021,7 +1026,6 @@
export function buildRouter(): Router<Handler> {
  router.add("GET", "/live/moving", liveMovingFragment);
  router.add("GET", "/live/chips", liveChipsFragment);
  router.add("GET", "/feed", feedPage);
  router.add("GET", "/pricing", pricingPage);
  // The home's late regions, each drawn alone (#7660).
  for (const name of HOME_REGIONS) router.add("GET", `/live/home/${name}`, (ctx) => liveHomeFragment(ctx, name));
  // Whether a hostname is an app's verified domain — what Caddy's
@@ -18,7 +18,7 @@
import { teamPage, teamSet, teamsPage, teamsStream } from "../web/pages/teams.ts
import { telemetryPage, telemetrySet } from "../web/pages/telemetry.ts";
import { flagsPage, flagsSet } from "../web/pages/flags.ts";
import { appTemplatesPage, appTemplatesSet } from "../web/pages/app_templates.ts";
import { billingPage, billingGrant, billingSetLinks, billingMakeCode, billingRevokeCode, stripeConnect, stripeDisconnect, stripeSecret } from "../web/pages/billing.ts";
import { billingPage, billingGrant, billingSetLinks, billingMakeCode, billingRevokeCode, stripeConnect, stripeDisconnect, stripeSecret, orderRetry } from "../web/pages/billing.ts";
import { economicsPage, economicsSet } from "../web/pages/economics.ts";
import { trustedAdd, trustedPage, trustedRemove, trustedRevert, trustedStop } from "../web/pages/trusted.ts";
import { usagePage } from "../web/pages/usage.ts";
@@ -215,6 +215,7 @@
export function settingsRoutes(router: Router<Handler>, knownPatterns: () => rea
  router.add("POST", "/settings/billing/stripe/connect", stripeConnect);
  router.add("POST", "/settings/billing/stripe/secret", stripeSecret);
  router.add("POST", "/settings/billing/stripe/disconnect", stripeDisconnect);
  router.add("POST", "/settings/billing/orders/retry", orderRetry);
  router.add("POST", "/settings/billing/codes", billingMakeCode);
  router.add("POST", "/settings/billing/codes/revoke", billingRevokeCode);
  router.add("GET", "/settings/flags", flagsPage);
@@ -13,6 +13,7 @@
 */
import type { App } from "../app.ts";
import { settleSession } from "../actions/order.ts";
import { bindCheckout } from "../billing/checkout_completed.ts";
import { openWebhookSecret } from "../billing/connection.ts";
import { syncSubscription } from "../billing/sync.ts";
@@ -119,6 +120,14 @@
export async function stripeHook(ctx: Ctx): Promise<Response> {
    if (stored.changes === 1 && type === "checkout.session.completed") bindCheckout(app, event);
    return stored.changes === 1;
  })();
  // A paid checkout that is one of our orders makes its forge (once, whoever sees the payment first), then binds it to the customer.
  if (fresh && type === "checkout.session.completed") {
    const session = (event as { data?: { object?: unknown } }).data?.object;
    if (session !== null && typeof session === "object") {
      const settled = await settleSession(app, session as Parameters<typeof settleSession>[1]);
      if (settled?.state === "spawned") bindCheckout(app, event);
    }
  }
  if (fresh && (type.startsWith("customer.subscription.") || type.startsWith("invoice."))) {
    try {
      await syncSubscription(app, subscriptionIdOf(event));
@@ -181,12 +181,15 @@
export async function spawnDoor(
  ctx: Ctx,
  user: User | undefined,
  raw: Record<string, unknown>,
  /** `paid`: the plan was bought (`actions/order.ts`), so a paid plan needs no admin and a stranger's rate limits do not apply. */
  opts: { readonly paid?: boolean } = {},
): Promise<Door> {
  const paid = opts.paid === true;
  const anon = user === undefined;
  if (!anon && user.kind !== "user") return spawnWords({ kind: "forbidden" });
  // A plan is free of children but not of work — it reads every catalog
  // app it names — so a stranger's are counted per address and per forge.
  if (anon) {
  if (anon && !paid) {
    const verdict = takeDoor(ctx.app, "plan", ctx.request);
    if (!verdict.allowed)
      return {
@@ -282,8 +285,8 @@
export async function spawnDoor(
  if (raw["plan"] !== undefined && raw["plan"] !== null && raw["plan"] !== "") {
    const chosen = typeof raw["plan"] === "string" ? getPlan(db, raw["plan"]) : undefined;
    if (chosen === undefined) return invalid("plan", `must be one of ${getPlans(db).map((p) => p.key).join(", ")}`);
    if (anon && chosen.key !== FREE && giftIn === undefined) return invalid("plan", `the ${chosen.name} plan is for a signed-in person; sign in first`);
    if (chosen.key !== FREE && user?.isAdmin !== true && giftIn === undefined) return invalid("plan", PAID_PLAN_ADMIN_ONLY(chosen.name));
    if (anon && chosen.key !== FREE && giftIn === undefined && !paid) return invalid("plan", `the ${chosen.name} plan is for a signed-in person; sign in first`);
    if (chosen.key !== FREE && user?.isAdmin !== true && giftIn === undefined && !paid) return invalid("plan", PAID_PLAN_ADMIN_ONLY(chosen.name));
    if (size !== undefined && size !== null && size !== "" && size !== chosen.size)
      return invalid("size", `the ${chosen.name} plan is a ${chosen.size} forge; leave size out or send ${chosen.size}`);
    planKey = chosen.key;
@@ -325,7 +328,7 @@
export async function spawnDoor(
    };
  }
  // A stranger may start only a few children a day; the plan above is free.
  if (anon) {
  if (anon && !paid) {
    const limit = checkAnonSpawn(ctx.app.db, ctx.request);
    if (!limit.allowed)
      return {
@@ -349,7 +352,7 @@
export async function spawnDoor(
  let made: Awaited<ReturnType<typeof spawnForge>>;
  try {
    made = await spawnForge(ctx.app, user, input, source, {
      ...(gift === undefined ? {} : { gift: true }),
      ...(gift === undefined && !paid ? {} : { gift: true }),
      placement: placementFor(ctx.app),
      request: ctx.request,
      url: ctx.url,
@@ -364,9 +367,9 @@
export async function spawnDoor(
    if (gift !== undefined && !settled) unclaimGift(ctx.app, gift);
  }
  if (!made.ok) return spawnWords(made.error);
  if (anon && !made.value.existed) noteAnonSpawn(ctx.app.db, ctx.request);
  if (anon && !paid && !made.value.existed) noteAnonSpawn(ctx.app.db, ctx.request);
  // The visitor who started (or was given) this forge becomes someone, on the host's side (#11265).
  if (!made.value.existed) linkRequestVisitor(ctx.app, ctx.request, made.value.name, gift === undefined ? "started" : "paid");
  if (!made.value.existed && !paid) linkRequestVisitor(ctx.app, ctx.request, made.value.name, gift === undefined ? "started" : "paid");
  // Its apps come up now, so the first visit after a claim finds them awake.
  if (!made.value.existed) {
    void bootHostedChild(ctx.app, made.value.name);
@@ -732,6 +732,7 @@
function footer(ctx: Ctx, own?: Html): Html {
        >`}
    <span class="spacer"></span>
    <a href="/docs">Docs</a>
    <a href="/pricing">Pricing</a>
    <a href="/changelog">Changelog</a>
    <a href="/api">API</a>
    ${ctx.auth.user !== undefined && ctx.auth.user.kind !== "org"
@@ -7,6 +7,9 @@
import { ledBlock } from "./visitors.ts";
import { BILLING_WORDS, STRIPE_WORDS, connectStripe, disconnectStripe, grantPlan, readBilling, saveSigningSecret, type BillingError, type StripeWords } from "../../actions/billing.ts";
import { retryOrder } from "../../actions/order.ts";
import { REFUND_URL } from "../../billing/checkout.ts";
import { failedOrders } from "../../billing/orders.ts";
import { CODE_ERRORS, makeCode, readCodes, revoke, type CodeError } from "../../actions/codes.ts";
import { publicOrigin } from "../../core/public_origin.ts";
import { notePhase, takeSessionTime } from "../../core/route_timing.ts";
@@ -186,7 +189,21 @@
function billingView(ctx: Ctx, shown?: Shown, values: Record<string, string> = {
            ${btn("Connect")}
          </form>`}
    </section>`;
  const body = html`${stripe}<section class="settings-block">
  const failed = failedOrders(ctx.app.db);
  const orders = failed.length === 0 ? null : html`<section class="settings-block" id="orders" data-orders>
      <h2>Paid, not made</h2>
      <p class="muted small">These buyers paid and their forge could not be made. Retry the spawn, or pay them back at the provider.</p>
      <ul class="list setting-list">${failed.map((o) => html`<li class="row">
        <form class="row-fields" method="post" action="${PATH}/orders/retry">
          <input type="hidden" name="id" value="${o.id}" />
          <span class="mono">${o.name}</span>
          <span class="muted small">${o.plan} · ${o.email} · ${o.reason}</span>
          ${btn("Retry")}
          <a href="${REFUND_URL}" rel="noopener noreferrer" target="_blank">Refund at provider</a>
        </form>
      </li>`)}</ul>
    </section>`;
  const body = html`${stripe}${orders}<section class="settings-block">
      <h2>Plans</h2>
      <p class="muted small">Choose the plan each forge is on.</p>
      ${rows.length === 0
@@ -271,3 +288,13 @@
export async function stripeDisconnect(ctx: Ctx): Promise<Response> {
  const r = await disconnectStripe(ctx.app, ctx.auth.user);
  return back(ctx, r.ok ? { ok: true, message: "Stripe is disconnected." } : r);
}
// POST /settings/billing/orders/retry — an admin who is a person retries a paid order whose forge was not made.
export async function orderRetry(ctx: Ctx): Promise<Response> {
  if (!isPerson(ctx)) return notFoundPage(ctx);
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const r = await retryOrder(ctx.app, ctx.auth.user, field(form, "id"));
  if (!r.ok) return r.error === "not_found" ? notFoundPage(ctx) : flashTo(ctx, PATH, { tone: "danger", message: "That order is not waiting for a retry." });
  return flashTo(ctx, PATH, r.value.state === "spawned" ? { message: `${r.value.name} is made.` } : { tone: "danger", message: `${r.value.name} still could not be made: ${r.value.reason}.` });
}
@@ -0,0 +1,202 @@
/**
 * `/pricing` (#11138): the sale. A visitor with no account picks a plan, names
 * the forge, gives an email and pays at the provider's checkout; a minute
 * later `/pricing/done` shows the claim link, once. The free plan goes on to
 * `/forges/new`. With no provider connected the paid plans show their size and
 * say "ask the operator". The rules are in `actions/order.ts`.
 */
import { deliverLink, mayView, NO_PROVIDER, placeOrder, reconcileOrder, resendLink, type Refusal } from "../../actions/order.ts";
import { checkoutOf } from "../../billing/checkout.ts";
import { notePhase, takeSessionTime } from "../../core/route_timing.ts";
import { cookieValue, type Ctx } from "../../http/context.ts";
import { secureFor } from "../../http/cookie_secure.ts";
import { clientBucket } from "../../http/peer.ts";
import { takeDoor } from "../../http/strangers.ts";
import { FREE, getPlans, type Plan } from "../../settings/plans.ts";
import { sizeWords } from "../../settings/billing.ts";
import { childHost } from "../../spawn/door.ts";
import { notFoundPage, pageHead } from "../chrome.ts";
import { field, readForm } from "../form.ts";
import { html, type Html } from "../html.ts";
import { page, redirect } from "../layout.ts";
import { btn, field as formField, row } from "../ui.ts";
import { claimLinkBody } from "./new-forge.ts";
const COOKIE = "forge_order";
const REFRESH_JS = "setTimeout(function(){location.reload()},3000);";
interface Values {
  readonly name: string;
  readonly email: string;
}
const isBuyer = (ctx: Ctx): boolean => ctx.auth.user === undefined || ctx.auth.user.kind === "user";
function plansView(ctx: Ctx, values: Values, errors: Partial<Record<Refusal["field"], string>>): Html {
  const selling = checkoutOf(ctx.app) !== undefined;
  const plans = getPlans(ctx.app.db);
  const rows = plans.map((p: Plan) => {
    const free = p.key === FREE;
    const paid = !free && selling;
    return row({
      title: html`${p.name}`,
      meta: html`${sizeWords(p.size)}. ${p.says}${p.creditUsd > 0 && selling ? html` $${p.creditUsd} of crew credit each month.` : null}`,
      trail: free
        ? html`<span class="muted">Free</span> ${btn("Start free", { name: "plan", value: p.key })}`
        : paid
          ? html`<span>$${p.priceUsd} a month</span> ${btn(`Get ${p.name}`, { name: "plan", value: p.key, variant: "primary" })}`
          : html`<span class="muted">Ask the operator</span>`,
      data: { plan: p.key },
    });
  });
  return html`<div class="narrow-wide" id="pricing" data-pricing>
    ${pageHead("Get your own forge", { sub: selling ? "Pick a plan, name it, pay. Your forge is ready a minute later." : "Pick a size and name it." })}
    ${errors["form"] ? html`<p class="error" role="alert">${errors["form"]}</p>` : null}
    <form method="post" action="/pricing/order" class="stack" id="order">
      ${formField({
        label: "Name",
        name: "name",
        value: values.name,
        required: true,
        hint: `Its address: <name>--${childHost(ctx.app)}.`,
        ...(errors["name"] ? { error: errors["name"] } : {}),
      })}
      ${selling
        ? formField({
            label: "Email",
            name: "email",
            type: "email",
            value: values.email,
            autocomplete: "email",
            hint: "The link to open your forge is shown after payment and sent here.",
            ...(errors["email"] ? { error: errors["email"] } : {}),
          })
        : null}
      <ul class="list setting-list">${rows}</ul>
    </form>
    <p class="muted small">Paid already? <a href="/pricing/done">Open your order</a> · <a href="/pricing/resend">Lost your link?</a></p>
  </div>`;
}
// GET /pricing — public; agents are refused as buyers.
export function pricingPage(ctx: Ctx): Response {
  if (!isBuyer(ctx)) return notFoundPage(ctx);
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  const rendering = performance.now();
  const response = page({ ctx, title: "Get your own forge", body: plansView(ctx, { name: (ctx.url.searchParams.get("name") ?? "").slice(0, 38), email: "" }, {}) });
  notePhase(ctx.request, "render", performance.now() - rendering);
  return response;
}
const cookieFor = (ctx: Ctx, value: string, maxAge: number): string =>
  `${COOKIE}=${value}; Path=/pricing; Max-Age=${maxAge}; SameSite=Lax; HttpOnly${secureFor(ctx.url, ctx.app.config.url) ? "; Secure" : ""}`;
// POST /pricing/order — free goes on to the free path; a paid plan holds the name and goes to checkout.
export async function pricingOrder(ctx: Ctx): Promise<Response> {
  if (!isBuyer(ctx)) return notFoundPage(ctx);
  const form = await readForm(ctx, ctx.auth.user === undefined ? undefined : "admin");
  if (form instanceof Response) return form;
  const values: Values = { name: field(form, "name").trim().slice(0, 60), email: field(form, "email").trim().slice(0, 254) };
  const plan = field(form, "plan");
  if (plan === FREE) return redirect(`/forges/new?name=${encodeURIComponent(values.name.slice(0, 38))}`);
  const verdict = takeDoor(ctx.app, "plan", ctx.request);
  if (!verdict.allowed) return page({ ctx, title: "Get your own forge", body: plansView(ctx, values, { form: `Too many tries from here; try again in ${verdict.retryAfter}s` }) }, 429);
  const placed = await placeOrder(ctx.app, { name: values.name, plan, email: values.email, address: clientBucket(ctx.request) }, ctx.url);
  if (!placed.ok) {
    const status = placed.error.message === NO_PROVIDER ? 409 : 422;
    return page({ ctx, title: "Get your own forge", body: plansView(ctx, values, { [placed.error.field]: `${placed.error.message}.` }) }, status);
  }
  const res = redirect(placed.value.redirect, { cookie: cookieFor(ctx, `${placed.value.id}.${placed.value.ticket}`, 2 * 86_400) });
  res.headers.set("cache-control", "no-store");
  return res;
}
/** The order the cookie names, when the address names the same one. */
function mine(ctx: Ctx): string | undefined {
  const id = ctx.url.searchParams.get("order") ?? "";
  const [cid, ticket] = (cookieValue(ctx.request, COOKIE) ?? "").split(".");
  if (cid !== id || ticket === undefined || !/^ord_[0-9a-f]{32}$/.test(id) || !mayView(ctx.app, id, ticket)) return undefined;
  return id;
}
const waiting = (ctx: Ctx, says: string): Response => {
  const res = page({
    ctx,
    title: "Making your forge",
    scriptJs: REFRESH_JS,
    body: html`<div class="narrow stack" data-order="waiting">${pageHead("Making your forge")}<p role="status">${says}</p><p class="small"><a href="${ctx.url.pathname}${ctx.url.search}">Check now</a></p></div>`,
  });
  res.headers.set("cache-control", "no-store");
  return res;
};
// GET /pricing/done?order= — reconciles the order with the provider, waits for the forge, shows the link once.
export async function pricingDone(ctx: Ctx): Promise<Response> {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  const rendering = performance.now();
  const response = await doneView(ctx);
  notePhase(ctx.request, "render", performance.now() - rendering);
  return response;
}
async function doneView(ctx: Ctx): Promise<Response> {
  if (!isBuyer(ctx)) return notFoundPage(ctx);
  const id = mine(ctx);
  if (id === undefined) return notFoundPage(ctx);
  const o = await reconcileOrder(ctx.app, id);
  if (o === undefined) return notFoundPage(ctx);
  const plain = (title: string, body: Html, status = 200): Response => {
    const res = page({ ctx, title, body: html`<div class="narrow-wide" data-order="${o.state}">${pageHead(title)}<section class="settings-block">${body}</section></div>` }, status);
    res.headers.set("cache-control", "no-store");
    return res;
  };
  if (o.state === "pending") return waiting(ctx, "Waiting for the payment to arrive. This page updates by itself.");
  if (o.state === "paid" || o.state === "spawning") return waiting(ctx, `Paid. Making ${o.name} now; the link to open it appears here.`);
  if (o.state === "failed")
    return plain(`${o.name} is paid but not made yet`, html`<p>Your payment went through, but the forge could not be made just now: ${o.reason}.</p>
      <p>The operator has been told and will make it or pay you back. Keep this page's address: <code class="mono">${o.id}</code>.</p>`, 200);
  const given = await deliverLink(ctx.app, o);
  if (given.kind === "link")
    return plain(`${o.name} is ready`, html`${claimLinkBody(given.claimUrl, false)}${given.mailed ? html`<p class="small mt">It was also sent to ${o.email}.</p>` : null}`);
  if (given.kind === "claimed") return plain(`${o.name} is taken over`, html`<p>The link was used; sign in at <a href="${`https://${o.name}--${childHost(ctx.app)}`}">your forge</a>.</p>`);
  return plain(`${o.name} is ready`, html`<p>The link was shown already, once.</p><p class="mt">${btn("Send it again by email", { href: "/pricing/resend", size: "sm" })}</p>`);
}
function resendView(ctx: Ctx, says: string | undefined, values: Values): Html {
  return html`<div class="narrow stack" data-resend>
    ${pageHead("Lost your link?")}
    ${says === undefined ? null : html`<p role="status">${says}</p>`}
    <form method="post" action="/pricing/resend" class="stack">
      ${formField({ label: "Name of your forge", name: "name", value: values.name, required: true })}
      ${formField({ label: "Email you bought with", name: "email", type: "email", value: values.email, required: true, hint: "A new link goes there, and the old one stops working." })}
      ${btn("Send the link", { variant: "primary" })}
    </form>
  </div>`;
}
// GET /pricing/resend
export function resendPage(ctx: Ctx): Response {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  if (!isBuyer(ctx)) return notFoundPage(ctx);
  const rendering = performance.now();
  const response = page({ ctx, title: "Lost your link?", body: resendView(ctx, undefined, { name: "", email: "" }) });
  notePhase(ctx.request, "render", performance.now() - rendering);
  return response;
}
// POST /pricing/resend — the link goes to the order's own email; the answer is the same whether or not an order matched.
export async function resendSubmit(ctx: Ctx): Promise<Response> {
  if (!isBuyer(ctx)) return notFoundPage(ctx);
  const form = await readForm(ctx, ctx.auth.user === undefined ? undefined : "admin");
  if (form instanceof Response) return form;
  const values: Values = { name: field(form, "name").trim().slice(0, 60), email: field(form, "email").trim().slice(0, 254) };
  const verdict = takeDoor(ctx.app, "plan", ctx.request);
  if (!verdict.allowed) return page({ ctx, title: "Lost your link?", body: resendView(ctx, `Too many tries from here; try again in ${verdict.retryAfter}s.`, values) }, 429);
  const out = await resendLink(ctx.app, values.name, values.email);
  const says = out === "no_mail" ? "This forge cannot send email. Ask the operator for a new link." : "If that order exists, the link is on its way to the email it was bought with.";
  const res = page({ ctx, title: "Lost your link?", body: resendView(ctx, says, { name: "", email: "" }) });
  res.headers.set("cache-control", "no-store");
  return res;
}
@@ -1,29 +0,0 @@
/**
 * GET /pricing: the plans on a page of their own, so a line that says "pick a
 * plan" (the first screen of a forge whose crew has no credit, #11240) has
 * somewhere to point. The words are the home's (`plans_row.ts`); the terminal's
 * door is the palette's "Get your own forge".
 */
import { notePhase, takeSessionTime, timePhase } from "../core/route_timing.ts";
import type { Ctx } from "../http/context.ts";
import { GET_A_FORGE_PATH } from "../billing/plan_words.ts";
import { getDoorSettings } from "../settings/door.ts";
import { publicPlans } from "../settings/plans.ts";
import { freePlanName } from "./funnel_door.ts";
import { html } from "./html.ts";
import { page } from "./layout.ts";
import { plansRow } from "./plans_row.ts";
import { btn } from "./ui.ts";
export function pricingPage(ctx: Ctx): Response {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  const { plans, links } = getDoorSettings(ctx.app.db);
  const body = html`<section id="pricing" class="stack">
    <h1>Plans</h1>
    <p class="muted">Each plan comes with crew credit. Or add your own model key and the crew builds on it.</p>
    ${plansRow(publicPlans(plans), links)}
    <div class="bar" data-plan="${freePlanName(plans)}">${btn("Get a forge", { href: GET_A_FORGE_PATH, variant: "primary" })}</div>
  </section>`;
  return timePhase(ctx.request, "render", () => page({ ctx, title: "Plans", body }));
}
@@ -20,6 +20,7 @@
quietLogs();
/** Top-level routes that are not pages, or are not worth a picture, and why. */
const NOT_A_PAGE: Record<string, string> = {
  "/pricing": "no picture: the cap of 24 looks is spent; the page is covered by test/pricing-order.test.ts",
  "/audit": "no picture: its slot went to /pinned; /audit.csv is its download, covered by test/audit.test.ts",
  "/deploy-to": "a form for a forge admin that fills from its link; covered by test/pinned-page.test.ts",
  "/settings": "a form of fields; its slot went to the open help of /boards and /settings/crew (#11170); covered by test/account-help.test.ts",
@@ -45,7 +46,6 @@
const NOT_A_PAGE: Record<string, string> = {
  "/opensearch.xml": "the browser search description, XML",
  "/sw.js": "the service worker script",
  "/audit.csv": "a CSV download of /audit",
  "/pricing": "no picture: the cap of 24 looks is spent; the page is covered by test/next-steps-card.test.ts",
  "/maintenance": "no picture: the cap of 24 looks is spent; an admin's page, covered by test/maintenance.test.ts",
  "/claim": "answers 404 to an admin: it exists only for a link-holder",
  "/first-admin": "the setup form for a forge with no admin yet",
@@ -0,0 +1,240 @@
/** /pricing (#11138): order -> paid -> spawned -> claim link; duplicate delivery makes one forge; a failed spawn raises the alarm. */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { placeOrder, reconcileOrder, resendLink, retryOrder, settleSession } from "../src/actions/order.ts";
import { useCheckout, type CheckoutProvider } from "../src/billing/checkout.ts";
import { bindCheckout } from "../src/billing/checkout_completed.ts";
import { CHECKOUT_MS, getOrder, HOLD_MS, MAX_PENDING_PER_ADDRESS } from "../src/billing/orders.ts";
import { getStored } from "../src/billing/store.ts";
import { createUser } from "../src/core/users.ts";
import { firedAlarms } from "../src/flow/alarms.ts";
import { alarmPaidOrder } from "../src/flow/alarm_paid_order.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { ok } from "../src/kernel/result.ts";
import { bootHostedChild } from "../src/spawn/host.ts";
import { usePlacement, useProbe } from "../src/spawn/door.ts";
let dir: string;
let app: App;
let servers: Servers;
let base: string;
let admin: { id: string } & Record<string, any>;
let full = false;
let placed = 0;
const paidSessions = new Set<string>();
const made: string[] = [];
const fake: CheckoutProvider = {
  name: "fake",
  async create(req) {
    const id = `cs_fake_${req.orderId.slice(4, 16)}`;
    return ok({ id, url: `https://pay.fake.test/${id}` });
  },
  async state(id) {
    return ok({ paid: paidSessions.has(id), customer: "cus_1", subscription: "sub_1" });
  },
};
beforeAll(async () => {
  dir = await mkdtemp(join(tmpdir(), "forge-pricing-"));
  app = createApp({ dataDir: dir, port: 0, forgeRepo: "alice/forge-code" });
  servers = await serve(app);
  base = servers.url;
  const a = await createUser(app.db, { origin: "seed", trusted: true, username: "alice", email: "[email protected]", password: "a-good-passphrase", adminIfFirst: true });
  if (!a.ok) throw new Error("user");
  admin = a.value as any;
  const code = await createRepo(app, a.value, { name: "forge-code", visibility: "public" });
  if (!code.ok) throw new Error("code repo");
  await commitToBranch(app, a.value, code.value, { message: "v1", files: [{ path: "src/main.ts", content: "console.log('forge')" }] });
  useProbe(app, () => async () => true);
  usePlacement(app, {
    place: async (plan) => (full ? { ok: false, error: { kind: "refused", reason: "capacity", message: "no room" } } as any : ok({ url: `https://${plan.name}.fake.test`, bodyId: `fake-${++placed}` })),
    retire: async () => ok(),
  });
  useCheckout(app, fake);
}, 30_000);
afterAll(async () => {
  for (const n of made) await bootHostedChild(app, n);
  servers.stop();
  app.close();
  await rm(dir, { recursive: true, force: true });
});
const form = (o: Record<string, string>) => ({ method: "POST", redirect: "manual" as const, headers: { "content-type": "application/x-www-form-urlencoded", origin: base }, body: new URLSearchParams(o).toString() });
async function buy(name: string, plan = "small") {
  const res = await fetch(`${base}/pricing/order`, form({ name, plan, email: "[email protected]" }));
  const cookie = (res.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
  const order = app.db.query<{ id: string; session_id: string }, [string]>("SELECT id, session_id FROM forge_order WHERE name = ?1 ORDER BY created_at DESC").get(name);
  return { res, cookie, order };
}
const completed = (o: { id: string; session_id: string }) => ({ id: o.session_id, metadata: { order: o.id }, customer: "cus_1", subscription: "sub_1", payment_status: "paid" });
describe("/pricing", () => {
  test("shows the plans with sizes and prices to a stranger, and a way to the free path", async () => {
    const res = await fetch(`${base}/pricing`);
    expect(res.status).toBe(200);
    const text = await res.text();
    expect(text).toContain("$19 a month");
    expect(text).toContain("Start free");
    expect(res.headers.get("content-security-policy")).toBeTruthy();
  });
  test("the free plan goes to /forges/new", async () => {
    const res = await fetch(`${base}/pricing/order`, form({ name: "gratis", plan: "free", email: "" }));
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toContain("/forges/new");
  });
  test("a bad name, a bad email and a cross-origin post are refused; nothing is held", async () => {
    expect((await fetch(`${base}/pricing/order`, form({ name: "Bad Name", plan: "small", email: "[email protected]" }))).status).toBe(422);
    expect((await fetch(`${base}/pricing/order`, form({ name: "fine", plan: "small", email: "nope" }))).status).toBe(422);
    const evil = form({ name: "fine", plan: "small", email: "[email protected]" });
    evil.headers.origin = "https://evil.test";
    expect((await fetch(`${base}/pricing/order`, evil)).status).toBeGreaterThanOrEqual(400);
    expect(app.db.query("SELECT 1 FROM forge_order").all()).toEqual([]);
  });
  test("order -> webhook paid -> spawned -> the claim link once; a duplicate delivery makes one forge", async () => {
    const { res, cookie, order } = await buy("shop");
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toStartWith("https://pay.fake.test/");
    expect(cookie).toStartWith("forge_order=");
    expect(res.headers.get("set-cookie")).toContain("HttpOnly");
    expect(getOrder(app.db, order!.id)?.state).toBe("pending");
    // The name is held for someone else.
    const other = await fetch(`${base}/pricing/order`, form({ name: "shop", plan: "small", email: "[email protected]" }));
    expect(other.status).toBe(422);
    // Two deliveries at once.
    await Promise.all([settleSession(app, completed(order!)), settleSession(app, completed(order!))]);
    await settleSession(app, completed(order!));
    made.push("shop");
    expect(getOrder(app.db, order!.id)?.state).toBe("spawned");
    expect(placed).toBe(1);
    expect(getStored(app.db, "shop")?.plan).toBe("small");
    const done = await fetch(`${base}/pricing/done?order=${order!.id}`, { headers: { cookie } });
    const text = await done.text();
    expect(text).toContain("shop is ready");
    expect(text).toMatch(/claim|token=|#/i);
    const again = await fetch(`${base}/pricing/done?order=${order!.id}`, { headers: { cookie } });
    expect(await again.text()).toContain("shown already");
    // Someone without the buyer's cookie sees nothing.
    expect((await fetch(`${base}/pricing/done?order=${order!.id}`)).status).toBe(404);
  });
  test("the return page reconciles by session id when no webhook came, once", async () => {
    const { order, cookie } = await buy("lates");
    paidSessions.add(order!.session_id);
    const [a, b] = await Promise.all([reconcileOrder(app, order!.id), reconcileOrder(app, order!.id)]);
    made.push("lates");
    expect([a?.state, b?.state].includes("spawned")).toBe(true);
    expect(getOrder(app.db, order!.id)?.state).toBe("spawned");
    expect(placed).toBe(2);
    const done = await fetch(`${base}/pricing/done?order=${order!.id}`, { headers: { cookie } });
    expect(await done.text()).toContain("lates is ready");
  });
  test("an event for a session that is not the order's settles nothing", async () => {
    const { order } = await buy("forged");
    expect(await settleSession(app, { ...completed(order!), id: "cs_other" })).toBeUndefined();
    expect(getOrder(app.db, order!.id)?.state).toBe("pending");
  });
  test("a paid order whose spawn fails raises the alarm, tells the buyer, and an admin retries it", async () => {
    full = true;
    const { order, cookie } = await buy("nospace");
    await settleSession(app, completed(order!));
    expect(getOrder(app.db, order!.id)?.state).toBe("failed");
    const alarm = alarmPaidOrder(app.db);
    expect(alarm.fired).toBe(true);
    expect(alarm.says).toContain("nospace");
    const done = await fetch(`${base}/pricing/done?order=${order!.id}`, { headers: { cookie } });
    expect(await done.text()).toContain("paid but not made yet");
    expect(firedAlarms(app.db, new Date(), { dataDir: null } as any).some((f) => f.key === "paid_order")).toBe(true);
    // A non-admin cannot retry; an admin can once there is room.
    expect((await retryOrder(app, undefined, order!.id)).ok).toBe(false);
    full = false;
    const retried = await retryOrder(app, admin as any, order!.id);
    made.push("nospace");
    expect(retried.ok && retried.value.state).toBe("spawned");
    expect(alarmPaidOrder(app.db).fired).toBe(false);
  });
  test("with no provider the paid plans say ask the operator and a post builds nothing", async () => {
    useCheckout(app, undefined);
    const text = await (await fetch(`${base}/pricing`)).text();
    expect(text).toContain("Ask the operator");
    expect(text).not.toContain("$19 a month");
    expect((await fetch(`${base}/pricing/order`, form({ name: "nope", plan: "small", email: "[email protected]" }))).status).toBe(409);
    useCheckout(app, fake);
  });
});
describe("/pricing: abuse and lifetimes", () => {
  const url = () => new URL(`${base}/pricing/order`);
  test("one address cannot hold more than its share of names; another address still can", async () => {
    for (let i = 0; i < MAX_PENDING_PER_ADDRESS; i++) {
      const r = await placeOrder(app, { name: `hoard${i}`, plan: "small", email: "[email protected]", address: "203.0.113.7" }, url());
      expect(r.ok).toBe(true);
    }
    const over = await placeOrder(app, { name: "hoardx", plan: "small", email: "[email protected]", address: "203.0.113.7" }, url());
    expect(over.ok).toBe(false);
    expect(app.db.query("SELECT 1 FROM forge_order WHERE name = 'hoardx'").all()).toEqual([]);
    const other = await placeOrder(app, { name: "honest", plan: "small", email: "[email protected]", address: "203.0.113.8" }, url());
    expect(other.ok).toBe(true);
  });
  test("the checkout stops being payable before the name's hold lapses", async () => {
    let seen: number | undefined;
    useCheckout(app, { ...fake, create: async (req) => { seen = req.expiresAt; return fake.create(req); } });
    const now = Date.now();
    const r = await placeOrder(app, { name: "latepay", plan: "small", email: "[email protected]", address: "198.51.100.1" }, url(), now);
    useCheckout(app, fake);
    expect(r.ok).toBe(true);
    expect(seen).toBeDefined();
    // Stripe's least is 30 minutes; the hold is longer than the checkout.
    expect(seen! * 1000 - now).toBeGreaterThanOrEqual(30 * 60_000);
    expect(seen! * 1000).toBeLessThan(now + HOLD_MS);
    expect(CHECKOUT_MS).toBeLessThan(HOLD_MS);
  });
  test("a claim link is mailed again at most once a day per order", async () => {
    const { order } = await buy("mailme");
    await settleSession(app, completed(order!));
    made.push("mailme");
    const sent: unknown[] = [];
    (app.config as any).mailer = async (m: unknown) => { sent.push(m); return { ok: true }; };
    try {
      const now = Date.now();
      await resendLink(app, "mailme", "[email protected]", now);
      await resendLink(app, "mailme", "[email protected]", now + 11 * 60_000);
      await resendLink(app, "mailme", "[email protected]", now + 23 * 3_600_000);
      expect(sent.length).toBe(1);
      await resendLink(app, "mailme", "[email protected]", now + 25 * 3_600_000);
      expect(sent.length).toBe(2);
    } finally {
      delete (app.config as any).mailer;
    }
  });
  test("binding a checkout twice, as the hook does for a spawned order, changes nothing the second time", async () => {
    const { order } = await buy("twice");
    const event = { data: { object: { ...completed(order!), mode: "subscription", metadata: { order: order!.id, forge: "twice", plan: "small" } } } };
    await settleSession(app, event.data.object);
    made.push("twice");
    const before = getStored(app.db, "twice");
    expect(bindCheckout(app, event)).toBe(true);
    const once = getStored(app.db, "twice");
    expect(bindCheckout(app, event)).toBe(true);
    const { updatedAt: _a, ...again } = getStored(app.db, "twice")!;
    const { updatedAt: _b, ...first } = once!;
    expect(again).toEqual(first);
    expect(once?.plan).toBe(before?.plan);
    expect(once?.customerId).toBe("cus_1");
  });
});
		@@ -72,7 +72,7 @@ Children report in; the parent never reaches in. Every ten minutes a spawned chi
72	72
73	73	## Callers
74	74
75		`POST /api/v1/forges {name, apps[], crew[], direction?, keepAccess?, modelKey?, budgetUsd?, size?, template?, dryRun}` (rw token, admin only) and the MCP `spawn` tool share `src/spawn/door.ts`. `size` is `small` (default), `medium` or `large`; anything else is a 422 on `size`. It is recorded in the plan, the ledger, `parent.json` and `GET /api/v1/forges`, but not enforced yet: it limits nothing. `dryRun` is true unless it is `false`: the answer is the plan, what is left behind, and `firstAdmin` (the caller's username, or `null` for an anonymous plan, where whoever claims the child becomes its admin), and nothing is made. `GET /api/v1/forges` lists the ledger's children. The child's org is its name; `crew` names the agents whose briefs travel. Errors: 401 unauthorized, 403 forbidden / cross_origin, 422 invalid, 409 refused / exists, 500 failed — each with one sentence. The MCP lets an `ro` token plan, never make.
	75	`POST /api/v1/forges {name, apps[], crew[], direction?, keepAccess?, modelKey?, budgetUsd?, size?, template?, dryRun}` (rw token; a person who is signed in, and a paid plan only from an admin, a gift code, or a paid order below) and the MCP `spawn` tool share `src/spawn/door.ts`. `size` is `small` (default), `medium` or `large`; anything else is a 422 on `size`. It is recorded in the plan, the ledger, `parent.json` and `GET /api/v1/forges`, but not enforced yet: it limits nothing. `dryRun` is true unless it is `false`: the answer is the plan, what is left behind, and `firstAdmin` (the caller's username, or `null` for an anonymous plan, where whoever claims the child becomes its admin), and nothing is made. `GET /api/v1/forges` lists the ledger's children. The child's org is its name; `crew` names the agents whose briefs travel. Errors: 401 unauthorized, 403 forbidden / cross_origin, 422 invalid, 409 refused / exists, 500 failed — each with one sentence. The MCP lets an `ro` token plan, never make.
76	76
77	77	A spawn may also name a `size`: `small`, `medium` or `large` (`src/spawn/sizes.ts` maps each to CPU, memory and disk). It is recorded in the plan only when given, so a plan without one hashes as it always did, and an unknown size is a 422 on `size`. The New forge page and the terminal form both offer it, small preselected and not sent; the page shows a refusal beside the select, linked with `aria-describedby`. Nothing enforces the limits yet, and the table's numbers are provisional. `GET /api/v1/forges/sizes` (no sign-in, ETag, cached for 5 minutes) and the MCP tool `sizes` give the same answer — each size's CPU, memory and disk, read from that table, and one sentence on what it is for — so a page or an agent offering a size reads it there.
78	78
		@@ -196,3 +196,13 @@ ledger (`spawn/sizes.ts`). Unset means no quota. A spawn that would pass a
196	196	declared limit is a 409 `refused` with one sentence naming it, and the New
197	197	forge page shows that sentence above the form when even a small forge would
198	198	not fit (`spawn/quota.ts`).
	199
	200	## The paid path: `/pricing`
	201
	202	A visitor with no account buys a forge. `GET /pricing` (public) lists the plans from the setting with their size, price and crew credit. A paid plan's button posts the forge's name and an email to `POST /pricing/order`, which checks the name is free (not a user, a child, a reserved word or another order's hold), writes an order (`forge_order`: name, plan, email, state `pending`) that holds the name for 30 minutes, and redirects to the provider's checkout. The buyer's ticket is an HttpOnly cookie scoped to `/pricing`; only its hash is kept.
	203
	204	When the order turns paid (the `checkout.session.completed` webhook, or `/pricing/done` asking the provider for the session, whichever is first) one `UPDATE … WHERE state = 'pending'` wins and goes on: `spawnDoor(..., { paid: true })` makes the forge on that plan, the entitlement is written, the order is `spawned`. A second delivery finds the order moved and changes nothing.
	205
	206	`/pricing/done` waits for the spawn, then mints a fresh claim link and shows it once, as `/forges/new` does; when mail is configured it is also mailed to the order's email. `/pricing/resend` re-sends a new link (the old one stops) to the order's own email only, and answers the same whether or not an order matched.
	207
	208	A paid order whose spawn fails (no capacity, a name taken in a race) becomes `failed`: a `billing.order_failed` event, the `paid_order` flow alarm, and a plain page to the buyer. On Settings → Billing an admin sees "Paid, not made" with Retry and a link to the provider's dashboard to refund. With no provider connected the paid plans show their size and say "ask the operator". Agents are refused as buyers.
		@@ -49,6 +49,9 @@ Machine routes are not pages and have no entry: `/audit.csv`,
49	49
50	50	- `/` — `pages/site.ts` (`home`, studio mode in `studio/home.ts`) · where I am, what needs me · `/front` (same page for anyone), `/board`, `/asks` · colours 3 in `site.ts`, 7 in `studio/home.ts`.
51	51	- `/front` — `studio/home.ts` (`studioDoor`) · the signed-out door, and the site admin's controls over it · `/` for a signed-out reader · colours 7.
	52	- `/pricing` — `pages/pricing.ts` · the plans and what each brings, and the sale: pick a plan and a name, then pay; the page the no-credit line points to · `/pricing/done`, `/settings/billing`, that line, `/` · none seen.
	53	- `/pricing/done` — `pages/pricing.ts` (`pricingDone`) · after payment, the claim link, shown once · `/pricing`, `/pricing/resend` · none seen.
	54	- `/pricing/resend` — `pages/pricing.ts` (`resendPage`) · a lost claim link sent again to the buyer's email · `/pricing` · none seen.
52	55	- `/explore` — `studio/explore.ts` · browse what the forge holds · `/search`, `/apps` · colours 2.
53	56	- `/board` — `pages/board.ts` (1,231 lines) · every app the viewer can see, with a wall mode · `/boards` (saved queries as panels), `/flow`, `/` · colour 1, sizes 6.
54	57	- `/board/returns` — `pages/returns.ts` · what the window's dollars bought · `/settings/subscriptions` spend tables, `/settings/usage` · none seen.
		@@ -94,7 +97,6 @@ Machine routes are not pages and have no entry: `/audit.csv`,
94	97	- `/family` — `pages/family.ts` · parent, this forge and children as a tree · `/forges` (the same children) · colour 1.
95	98	- `/claim` — `pages/claim.ts` · claim a forge that was sent to me · none · colour 1.
96	99	- `/privacy` — `pages/privacy.ts` · what the forge keeps about a visitor, three plain lines, open to anyone · none · none seen.
97		- `/pricing` — `pricing.ts` · the plans and what each brings, the page the no-credit line points to · that line, `/` · none seen.
98	100	- `/first-admin` — `pages/first-admin.ts` · the first person becomes admin · none · none seen.
99	101	- `/fleet/graph` — `pages/fleet-graph.ts` · the fleet as a graph · `/family`, `/forges` · none seen.
100	102	- `/fleet` — `pages/fleet.ts` · the rows a fleet query line selects, as a table · `/fleet/graph` · none seen.
		@@ -24,4 +24,4 @@ The home reads who may sign up, the plans and the buy links in one statement (`s
24	24
25	25	## When the crew has no credit
26	26
27		A forge whose crew has no key and no included credit says so once on its first screen: "The crew cannot build until you add a model key or pick a plan." (`NO_CREDIT_WORDS`, `crewFirstLine` in `src/web/studio/crew_key.ts`; the terminal's first screen says the same line as text, `crewFirstText`, with credit too). The key is a link to `/settings/subscriptions` (admins), the plan a link to `/pricing`, the plans on a page of their own (`src/web/pricing.ts`). With credit the line is the next step: make an app or bring a repository. A tell sent with no credit is kept, and the flash says the crew cannot build yet, with the same two ways forward; that holds for the first screen's own box (`app=forge`, kept as a thought) as for a tell to an app. `/pricing` has no terminal screen: its door there is the palette's Get your own forge.
	27	A forge whose crew has no key and no included credit says so once on its first screen: "The crew cannot build until you add a model key or pick a plan." (`NO_CREDIT_WORDS`, `crewFirstLine` in `src/web/studio/crew_key.ts`; the terminal's first screen says the same line as text, `crewFirstText`, with credit too). The key is a link to `/settings/subscriptions` (admins), the plan a link to `/pricing`, the plans, and the sale, on a page of their own (`src/web/pages/pricing.ts`). With credit the line is the next step: make an app or bring a repository. A tell sent with no credit is kept, and the flash says the crew cannot build yet, with the same two ways forward; that holds for the first screen's own box (`app=forge`, kept as a thought) as for a tell to an app. `/pricing` has no terminal screen: its door there is the palette's Get your own forge.
		@@ -0,0 +1,12 @@
	1	# Buy a forge at /pricing (#11138)
	2
	3	Open `/pricing` with no account. Each plan shows its size, price and crew credit. Type the forge's name and an email, press the paid plan's button, pay at the provider's checkout, and the page you return to (`/pricing/done`) shows the claim link once. Open it to take the forge over.
	4
	5	- Free plan: its button goes to `/forges/new`.
	6	- Closed the tab? `/pricing/resend`: name and email you bought with; a new link is mailed there (needs mail configured) and the old one stops.
	7	- No provider connected: paid plans show their size and say "Ask the operator".
	8	- Operator: connect Stripe under Settings → Billing. A paid order whose forge could not be made shows under "Paid, not made" with Retry and a link to the provider's dashboard to refund; a flow alarm names it.
	9	- Limits: one client address may have 3 orders waiting at once (counted by socket address, never a header); a name is held 35 minutes and the provider's checkout stops being payable at 31, so a late payer never finds the name given away; a claim link is mailed again at most once a day per order.
	10	- Terminal: no screen yet; checkout is browser-only (the provider's hosted page). Tracked in a follow-up issue.
		sentinelcrew 3d ago outdated Name the terminal door here once the `src/tui/` pricing screen exists (finding 1), and the per-address pending cap (finding 2).
	11	- Code: `src/actions/order.ts` (rules), `src/billing/orders.ts` (store), `src/web/pages/pricing.ts` (pages). The paid path is described in `docs/SPAWN.md`.
	12	- Test: `bun test test/pricing-order.test.ts`.
		@@ -0,0 +1,241 @@
	1	/**
	2	* The sale (#11138): a visitor picks a paid plan, a name and an email; the
	3	* name is held for 30 minutes (an order, `billing/orders.ts`) and the buyer
	4	* goes to the provider's checkout. When the order turns paid, by the webhook
	5	* or by the return page asking the provider for the session, whichever
	6	* comes first, the forge is made once through `spawnDoor` on that plan and
	7	* its entitlement written. A paid order whose forge cannot be made is
	8	* `failed`: an event, a flow alarm, and a plain sentence to the buyer; an
	9	* admin retries it or refunds at the provider. Never an agent as buyer.
	10	*
	11	* The claim link is shown once, on the return page, and mailed when the
	12	* forge can send mail. It is never kept: the page makes a fresh one when the
	13	* buyer arrives, and a buyer who left can ask for one by email.
	14	*/
	15
	16	import type { App } from "../app.ts";
	17	import { checkoutOf } from "../billing/checkout.ts";
	18	import { getOrder, holdName, markResent, markShown, move, unmarkShown, pendingFrom, MAX_PENDING_PER_ADDRESS, CHECKOUT_MS, nameHeld, newId, newTicket, dropPending, pendingCount, setSession, spawnedFor, ticketFits, MAX_PENDING, type Order } from "../billing/orders.ts";
	19	import { putEntitlement } from "../billing/store.ts";
	20	import { getUserByName, type User } from "../core/users.ts";
	21	import { publicOrigin } from "../core/public_origin.ts";
	22	import { err, ok, type Result } from "../kernel/result.ts";
	23	import { isChildName } from "../core/proposal_token.ts";
	24	import type { Ctx } from "../http/context.ts";
	25	import { spawnDoor } from "../spawn/door.ts";
	26	import { FREE, getPlan, type Plan } from "../settings/plans.ts";
	27	import { listChildrenNow, reissueClaimFor } from "./spawn.ts";
	28	import { mayMail, sendCapped } from "./mail.ts";
	29	import { mailerOf } from "./verify.ts";
	30
	31	export interface Refusal {
	32	readonly field: "name" \| "email" \| "plan" \| "form";
	33	readonly message: string;
	34	}
	35
	36	const ADDRESS = /^[^\s<>@,;:"\\]{1,64}@[^\s<>@,;:"\\]{1,190}$/;
	37	export const NO_PROVIDER = "Paid plans are not on sale here yet: ask the operator.";
	38	/** A spawn that stays `spawning` this long is taken as lost and may be retried. */
	39	const STALE_MS = 5 * 60_000;
	40	/** A claim link is mailed again at most once a day per order: a stranger cannot make it a mail-bomb. */
	41	const RESEND_MS = 24 * 60 * 60_000;
	42
	43	/** A request-less context the forge itself acts through when no visitor is on the line (a webhook). */
	44	function systemCtx(app: App): Ctx {
	45	const origin = publicOrigin(app.config.url, `http://localhost:${app.config.port}`);
	46	return {
	47	app,
	48	request: new Request(`${origin}/pricing`, { method: "POST" }),
	49	url: new URL(`${origin}/pricing`),
	50	params: {},
	51	auth: { user: undefined, scope: undefined, via: "none" },
	52	theme: undefined,
	53	};
	54	}
	55
	56	/** The email, trimmed and lower-cased, or undefined. */
	57	export const emailOf = (raw: unknown): string \| undefined => {
	58	const s = typeof raw === "string" ? raw.trim() : "";
	59	return s.length <= 254 && ADDRESS.test(s) ? s.toLowerCase() : undefined;
	60	};
	61
	62	/** Every refusal of a name, in one sentence, or undefined when it is free to buy. */
	63	export async function nameRefusal(app: App, name: string, plan: Plan, now: number): Promise<string \| undefined> {
	64	if (!isChildName(name) \|\| name.length > 38) return "Use 1 to 38 lowercase letters, digits and dashes, not starting or ending with a dash";
	65	if (getUserByName(app.db, name) !== undefined \|\| listChildrenNow(app).some((c) => c.name === name)) return "That name is taken";
	66	if (nameHeld(app.db, name, now)) return "That name is held for someone else; try another";
	67	// The door's own plan: reserved words and the rest of the name's rules, with nothing made.
	68	const dry = await spawnDoor(systemCtx(app), undefined, { name, apps: [], crew: [], plan: plan.key, dryRun: true }, { paid: true });
	69	if (dry.status >= 400) return String(dry.body["message"] ?? "That name cannot be used").replace(/^name: /, "");
	70	return undefined;
	71	}
	72
	73	export interface Placed {
	74	readonly id: string;
	75	/** Goes in the buyer's HttpOnly cookie; only its hash is kept. */
	76	readonly ticket: string;
	77	/** The provider's checkout address. */
	78	readonly redirect: string;
	79	}
	80
	81	/** Validate, hold the name, make the checkout. Nothing is held if the checkout cannot be made. */
	82	export async function placeOrder(app: App, input: { name: unknown; plan: unknown; email: unknown; address: string }, url: URL, now = Date.now()): Promise<Result<Placed, Refusal>> {
	83	const plan = typeof input.plan === "string" ? getPlan(app.db, input.plan) : undefined;
	84	if (plan === undefined \|\| plan.key === FREE \|\| plan.priceUsd <= 0) return err({ field: "plan", message: "Pick one of the paid plans" });
	85	const email = emailOf(input.email);
	86	if (email === undefined) return err({ field: "email", message: "Enter the email the link should go to" });
	87	const name = typeof input.name === "string" ? input.name.trim() : "";
	88	const provider = checkoutOf(app);
	89	if (provider === undefined) return err({ field: "form", message: NO_PROVIDER });
	90	if (pendingCount(app.db, now) >= MAX_PENDING) return err({ field: "form", message: "Many orders are waiting right now; try again in a few minutes" });
	91	if (pendingFrom(app.db, input.address, now) >= MAX_PENDING_PER_ADDRESS) return err({ field: "form", message: "You have orders waiting already; finish one or try again in half an hour" });
	92	const refused = await nameRefusal(app, name, plan, now);
	93	if (refused !== undefined) return err({ field: "name", message: refused });
	94	const id = newId();
	95	const ticket = newTicket();
	96	if (!holdName(app.db, { id, name, plan: plan.key, email, ticket, address: input.address }, now)) return err({ field: "name", message: "That name is held for someone else; try another" });
	97	const origin = publicOrigin(app.config.url, url.origin);
	98	const made = await provider.create({
	99	orderId: id, forge: name, plan: plan.key, planName: plan.name, priceUsd: plan.priceUsd, email,
	100	successUrl: `${origin}/pricing/done?order=${id}`, cancelUrl: `${origin}/pricing`,
	101	// The checkout stops being payable before the name's hold lapses.
	102	expiresAt: Math.floor((now + CHECKOUT_MS) / 1000),
	103	});
	104	if (!made.ok) {
	105	dropPending(app.db, id);
	106	app.log.warn("a checkout could not be made", { provider: provider.name, says: made.error });
	107	return err({ field: "form", message: "The payment provider could not be reached; nothing was charged. Try again in a minute" });
	108	}
	109	setSession(app.db, id, made.value.id);
	110	app.bus.append({ kind: "billing.order_placed", payload: { id, forge: name, plan: plan.key } });
	111	return ok({ id, ticket, redirect: made.value.url });
	112	}
	113
	114	/**
	115	* The order is paid: make its forge, once. Called by the webhook and by the
	116	* return page; only the call whose move out of `pending` took effect goes on,
	117	* and a later call just reads where the order is. Never throws.
	118	*/
	119	export async function settleOrder(app: App, id: string, paid: { customer?: string; subscription?: string } = {}): Promise<Order \| undefined> {
	120	const now = Date.now();
	121	const o = getOrder(app.db, id);
	122	if (o === undefined) return undefined;
	123	if (!move(app.db, id, "pending", "paid", now, { customerId: paid.customer ?? "", subscriptionId: paid.subscription ?? "" })) return o;
	124	app.bus.append({ kind: "billing.order_paid", payload: { id, forge: o.name, plan: o.plan } });
	125	return makeForge(app, id, "paid");
	126	}
	127
	128	/** Make the forge of an order standing in `from` (paid, or failed for a retry). */
	129	async function makeForge(app: App, id: string, from: "paid" \| "failed" \| "spawning"): Promise<Order \| undefined> {
	130	if (!move(app.db, id, from, "spawning", Date.now())) return getOrder(app.db, id);
	131	const o = getOrder(app.db, id) as Order;
	132	const fail = (reason: string): Order => {
	133	move(app.db, id, "spawning", "failed", Date.now(), { reason });
	134	app.bus.append({ kind: "billing.order_failed", payload: { id, forge: o.name, plan: o.plan, reason } });
	135	app.log.error("a paid order could not be made into a forge", { id, forge: o.name, reason });
	136	return getOrder(app.db, id) as Order;
	137	};
	138	try {
	139	const plan = getPlan(app.db, o.plan);
	140	if (plan === undefined) return fail(`the ${o.plan} plan is no longer offered`);
	141	const door = await spawnDoor(systemCtx(app), undefined, { name: o.name, apps: [], crew: [], plan: plan.key, dryRun: false }, { paid: true });
	142	if (door.status >= 400) return fail(String(door.body["message"] ?? "the forge could not be made").slice(0, 300));
	143	putEntitlement(app.db, {
	144	forge: o.name, plan: plan.key, status: "active", provider: checkoutOf(app)?.name ?? "none", payer: o.email,
	145	customerId: o.customerId, subscriptionId: o.subscriptionId, source: checkoutOf(app)?.name ?? "paid",
	146	}, plan.size, "");
	147	move(app.db, id, "spawning", "spawned", Date.now());
	148	app.bus.append({ kind: "billing.order_spawned", payload: { id, forge: o.name, plan: plan.key } });
	149	return getOrder(app.db, id);
	150	} catch (error) {
	151	return fail(`the forge could not be made: ${String(error).slice(0, 200)}`);
	152	}
	153	}
	154
	155	/** An event from the provider says this session was paid: settle its order, if it is one of ours. */
	156	export async function settleSession(app: App, session: { id?: unknown; metadata?: { order?: unknown } \| null; customer?: unknown; subscription?: unknown; payment_status?: unknown }): Promise<Order \| undefined> {
	157	if (session.payment_status !== "paid" && session.payment_status !== "no_payment_required") return undefined;
	158	const id = typeof session.metadata?.order === "string" ? session.metadata.order : undefined;
	159	const sid = typeof session.id === "string" ? session.id : "";
	160	const o = id === undefined ? undefined : getOrder(app.db, id);
	161	// The session must be the one this order made: a made-up order id on another session settles nothing.
	162	if (o === undefined \|\| sid === "" \|\| o.sessionId !== sid) return undefined;
	163	const text = (v: unknown): string => (typeof v === "string" && /^[A-Za-z0-9_]{1,100}$/.test(v) ? v : "");
	164	return settleOrder(app, o.id, { customer: text(session.customer), subscription: text(session.subscription) });
	165	}
	166
	167	/** The return page's reconcile: a pending order is asked of the provider, and settled if it was paid. */
	168	export async function reconcileOrder(app: App, id: string): Promise<Order \| undefined> {
	169	const o = getOrder(app.db, id);
	170	if (o === undefined) return undefined;
	171	if (o.state === "spawning" && Date.now() - o.updatedAt > STALE_MS) return makeForge(app, id, "spawning");
	172	if (o.state !== "pending" \|\| o.sessionId === "") return o;
	173	const provider = checkoutOf(app);
	174	if (provider === undefined) return o;
	175	const seen = await provider.state(o.sessionId);
	176	if (!seen.ok \|\| !seen.value.paid) return o;
	177	return settleOrder(app, id, { customer: seen.value.customer, subscription: seen.value.subscription });
	178	}
	179
	180	export type Delivered =
	181	\| { readonly kind: "link"; readonly claimUrl: string; readonly mailed: boolean }
	182	\| { readonly kind: "shown" }
	183	\| { readonly kind: "claimed" }
	184	\| { readonly kind: "failed" };
	185
	186	const mailOf = (name: string, link: string) => ({
	187	subject: `Your forge ${name} is ready`,
	188	text: ["Your forge is ready.", "", "Open this link to take it over. It works once, for a day:", "", link, "", "If you did not buy a forge, ignore this message."].join("\n"),
	189	});
	190
	191	/** Send the link to the order's email when the forge can mail; true when it went. */
	192	async function mailLink(app: App, o: Order, link: string): Promise<boolean> {
	193	const mailer = mailerOf(app, { id: "order" });
	194	if (mailer === undefined \|\| !mayMail(app, o.email)) return false;
	195	const m = mailOf(o.name, link);
	196	return (await sendCapped(app, mailer, { to: o.email, ...m })) === "sent";
	197	}
	198
	199	/** A spawned order's claim link, for the buyer who holds its ticket: made fresh, shown once, mailed when mail is on. */
	200	export async function deliverLink(app: App, o: Order): Promise<Delivered> {
	201	if (o.state !== "spawned") return { kind: "failed" };
	202	if (!markShown(app.db, o.id, Date.now())) return { kind: "shown" };
	203	const made = await reissueClaimFor(app, o.name);
	204	if (!made.ok) {
	205	unmarkShown(app.db, o.id);
	206	return "reason" in made.error && made.error.reason === "claimed" ? { kind: "claimed" } : { kind: "failed" };
	207	}
	208	return { kind: "link", claimUrl: made.value.claimUrl, mailed: await mailLink(app, o, made.value.claimUrl) };
	209	}
	210
	211	/** A buyer who left asks for the link again: it goes to the order's own email and nowhere else. Always the same answer. */
	212	export async function resendLink(app: App, nameIn: unknown, emailIn: unknown, now = Date.now()): Promise<"sent" \| "no_mail" \| "asked"> {
	213	if (mailerOf(app, { id: "order" }) === undefined) return "no_mail";
	214	const name = typeof nameIn === "string" ? nameIn.trim() : "";
	215	const email = emailOf(emailIn);
	216	const o = email === undefined \|\| !isChildName(name) ? undefined : spawnedFor(app.db, name, email);
	217	// One a day per order, and only to the address it was bought with.
	218	if (o === undefined \|\| (o.resentAt !== null && now - o.resentAt < RESEND_MS)) return "asked";
	219	const made = await reissueClaimFor(app, o.name);
	220	if (!made.ok) return "asked";
	221	markResent(app.db, o.id, now);
	222	await mailLink(app, o, made.value.claimUrl);
	223	return "asked";
	224	}
	225
	226	export type RetryError = "not_found" \| "not_failed";
	227
	228	/** An admin who is a person retries a failed (or lost) spawn of a paid order. */
	229	export async function retryOrder(app: App, actor: User \| undefined, id: unknown): Promise<Result<Order, RetryError>> {
	230	if (actor?.isAdmin !== true \|\| actor.kind !== "user") return err("not_found");
	231	const o = typeof id === "string" ? getOrder(app.db, id) : undefined;
	232	if (o === undefined) return err("not_found");
	233	const stale = o.state === "spawning" && Date.now() - o.updatedAt > STALE_MS;
	234	if (o.state !== "failed" && !stale) return err("not_failed");
	235	app.bus.append({ kind: "billing.order_retried", actorId: actor.id, payload: { id: o.id, forge: o.name } });
	236	const made = await makeForge(app, o.id, stale ? "spawning" : "failed");
	237	return ok(made ?? o);
	238	}
	239
	240	/** The ticket a cookie carries fits this order. */
	241	export const mayView = (app: App, id: string, ticket: string): boolean => ticketFits(app.db, id, ticket);
		@@ -288,7 +288,7 @@ async function make(
288	288	if (plan.plan !== undefined && chosen === undefined)
289	289	return err({ kind: "invalid", field: "plan", reason: `${plan.plan} is not a plan this forge offers` });
290	290	if (chosen !== undefined && chosen.key !== FREE && deps.gift === true) {
291		// A redeemed gift code (`actions/codes.ts`) is what lends this plan: it asks no admin and no payment.
	291	// A redeemed gift code (`actions/codes.ts`) or a paid order (`actions/order.ts`) is what lends this plan: it asks no admin.
292	292	} else if (chosen !== undefined && chosen.key !== FREE) {
293	293	if (owner === undefined) return err({ kind: "refused", reason: "plan", message: `the ${chosen.name} plan is for a signed-in person; sign in first` });
294	294	if (!owner.isAdmin) return err({ kind: "refused", reason: "plan", message: PAID_PLAN_ADMIN_ONLY(chosen.name) });
		@@ -677,6 +677,20 @@ export async function reissueClaim(
677	677	const user = requireUser(actor);
678	678	if (!user.ok) return err({ kind: "unauthorized" });
679	679	if (!user.value.isAdmin) return err({ kind: "forbidden" });
	680	const made = await reissueClaimFor(app, name);
	681	if (made.ok) app.bus.append({ kind: "forge.claim_reissued", actorId: user.value.id, payload: { name } });
	682	return made;
	683	}
	684
	685	/**
	686	* A new claim link for an unclaimed child, with no actor: the caller has
	687	* already decided who may have it (an admin above; the buyer of the forge in
	688	* `actions/order.ts`). The old link stops working.
	689	*/
	690	export async function reissueClaimFor(
	691	app: App,
	692	name: string,
	693	): Promise<Result<{ readonly name: string; readonly claimUrl: string }, SpawnError \| { readonly kind: "not_found" }>> {
680	694	const ledger = /^[a-z0-9-]{1,39}$/.test(name) ? await readLedger(app, name) : undefined;
681	695	if (!ledger \|\| !ledger.done) return err({ kind: "not_found" });
682	696	const child = createApp({ dataDir: childDirOf(app, ledger.bodyId) });
		@@ -686,7 +700,6 @@ export async function reissueClaim(
686	700	if (hasAdmin(child.db))
687	701	return err({ kind: "refused", reason: "claimed", message: `${name} is already claimed; ask its owner to invite you` });
688	702	const token = mintClaim(child.db, spawned.org.id);
689		app.bus.append({ kind: "forge.claim_reissued", actorId: user.value.id, payload: { name } });
690	703	return ok({ name, claimUrl: claimLink(liveChildUrl(app, name), token) });
691	704	} finally {
692	705	child.close();
		@@ -56,7 +56,7 @@ export function mailConfigured(app: App): boolean {
56	56	return MAIL_SECRETS.every((name) => set.has(name));
57	57	}
58	58
59		function mailerOf(app: App, forUser: User): Mailer \| undefined {
	59	export function mailerOf(app: App, forUser: { readonly id: string }): Mailer \| undefined {
60	60	if (app.config.mailer !== undefined) return app.config.mailer;
61	61	const stored = resolveSecrets(
62	62	app.db,
		@@ -0,0 +1,54 @@
	1	/**
	2	* The checkout seam (#11138): what the sale needs of a payment provider,
	3	* and nothing else. `create` makes a hosted checkout for one order and
	4	* returns where to send the buyer; `state` asks whether a session was paid
	5	* (the return page reconciles with it when the webhook is late). The
	6	* provider is Stripe when it is connected (`billing/connection.ts`), else
	7	* `none`: nothing is sold and the pricing page says so. A test swaps in its
	8	* own with `useCheckout`.
	9	*/
	10
	11	import type { App } from "../app.ts";
	12	import { err, ok, type Result } from "../kernel/result.ts";
	13	import { connectionOf, openKey } from "./connection.ts";
	14	import { stripeClient, type CheckoutRequest, type CheckoutSession, type CheckoutState } from "./stripe.ts";
	15
	16	export type { CheckoutRequest, CheckoutSession, CheckoutState };
	17
	18	export interface CheckoutProvider {
	19	readonly name: string;
	20	create(req: CheckoutRequest): Promise<Result<CheckoutSession, string>>;
	21	state(sessionId: string): Promise<Result<CheckoutState, string>>;
	22	}
	23
	24	const swapped = new WeakMap<App, CheckoutProvider>();
	25
	26	/** Use `provider` for this app; for tests. */
	27	export function useCheckout(app: App, provider: CheckoutProvider \| undefined): void {
	28	if (provider === undefined) swapped.delete(app);
	29	else swapped.set(app, provider);
	30	}
	31
	32	/** The provider this forge sells through now, or undefined when none is connected. */
	33	export function checkoutOf(app: App): CheckoutProvider \| undefined {
	34	const test = swapped.get(app);
	35	if (test !== undefined) return test;
	36	if (connectionOf(app.db) === undefined) return undefined;
	37	const open = openKey(app.db, app.config.dataDir, app.bus, "checkout");
	38	if (open === undefined) return undefined;
	39	const client = stripeClient(open.key);
	40	return {
	41	name: "stripe",
	42	async create(req) {
	43	const r = await client.createCheckout(req);
	44	return r.ok ? r : err(r.error.message);
	45	},
	46	async state(id) {
	47	const r = await client.getCheckout(id);
	48	return r.ok ? ok(r.value) : err(r.error.message);
	49	},
	50	};
	51	}
	52
	53	/** Where the operator pays back a buyer: the provider's own dashboard. */
	54	export const REFUND_URL = "https://dashboard.stripe.com/payments";
		@@ -0,0 +1,160 @@
	1	/**
	2	* The store of orders (#11138): a visitor's purchase of a forge, from the
	3	* name being held to the forge being made. Plain rows in, plain rows out;
	4	* the checkout and the spawn are in `actions/order.ts`.
	5	*
	6	* States: `pending` (name held for 30 minutes, nothing paid), `paid`
	7	* (money taken, forge not yet made), `spawning`, `spawned`, `failed` (paid,
	8	* the forge could not be made: an admin's alarm). A move is one UPDATE that
	9	* names the state it leaves, so two deliveries of the same payment cannot
	10	* both make the forge: only the one whose UPDATE changed a row goes on.
	11	* The buyer's ticket (a cookie) is kept as its sha256; the claim link is
	12	* never kept.
	13	*/
	14
	15	import type { Database } from "bun:sqlite";
	16	import { sha256 } from "../kernel/hash.ts";
	17
	18	export type OrderState = "pending" \| "paid" \| "spawning" \| "spawned" \| "failed";
	19
	20	/** The hold outlives the checkout (`CHECKOUT_MS`) so a buyer who pays at the last minute still finds the name theirs. */
	21	export const HOLD_MS = 35 * 60_000;
	22	/** How long the provider's checkout stays payable; Stripe's least is 30 minutes. */
	23	export const CHECKOUT_MS = 31 * 60_000;
	24	/** Most orders waiting for payment at once: a name-hoarder cannot hold the whole namespace. */
	25	export const MAX_PENDING = 200;
	26	/** Most orders one client address may have waiting at once: one stranger cannot fill the shared cap. */
	27	export const MAX_PENDING_PER_ADDRESS = 3;
	28
	29	export interface Order {
	30	readonly id: string;
	31	readonly name: string;
	32	readonly plan: string;
	33	readonly email: string;
	34	readonly state: OrderState;
	35	readonly sessionId: string;
	36	readonly customerId: string;
	37	readonly subscriptionId: string;
	38	readonly reason: string;
	39	readonly createdAt: number;
	40	readonly holdUntil: number;
	41	readonly updatedAt: number;
	42	readonly shownAt: number \| null;
	43	readonly resentAt: number \| null;
	44	}
	45
	46	interface Row {
	47	id: string; name: string; plan: string; email: string; state: OrderState; ticket_hash: string; session_id: string;
	48	customer_id: string; subscription_id: string; reason: string; created_at: number; hold_until: number; updated_at: number;
	49	shown_at: number \| null; resent_at: number \| null;
	50	}
	51
	52	const fromRow = (r: Row): Order => ({
	53	id: r.id, name: r.name, plan: r.plan, email: r.email, state: r.state, sessionId: r.session_id, customerId: r.customer_id,
	54	subscriptionId: r.subscription_id, reason: r.reason, createdAt: r.created_at, holdUntil: r.hold_until, updatedAt: r.updated_at,
	55	shownAt: r.shown_at, resentAt: r.resent_at,
	56	});
	57
	58	export const newId = (): string => `ord_${crypto.randomUUID().replace(/-/g, "")}`;
	59	export const newTicket = (): string => Buffer.from(crypto.getRandomValues(new Uint8Array(24))).toString("hex");
	60
	61	export function getOrder(db: Database, id: string): Order \| undefined {
	62	const r = db.query<Row, [string]>("SELECT * FROM forge_order WHERE id = ?1").get(id);
	63	return r ? fromRow(r) : undefined;
	64	}
	65
	66	export function bySession(db: Database, sessionId: string): Order \| undefined {
	67	if (sessionId === "") return undefined;
	68	const r = db.query<Row, [string]>("SELECT * FROM forge_order WHERE session_id = ?1").get(sessionId);
	69	return r ? fromRow(r) : undefined;
	70	}
	71
	72	/** True when the ticket is the one the order was made with. */
	73	export function ticketFits(db: Database, id: string, ticket: string): boolean {
	74	const r = db.query<{ ticket_hash: string }, [string]>("SELECT ticket_hash FROM forge_order WHERE id = ?1").get(id);
	75	return r !== null && ticket !== "" && r.ticket_hash === sha256(ticket);
	76	}
	77
	78	/** Whether an order other than a lapsed pending one holds `name` now. */
	79	export function nameHeld(db: Database, name: string, now: number): boolean {
	80	return (
	81	db
	82	.query<{ n: number }, [string, number]>(
	83	"SELECT COUNT(*) AS n FROM forge_order WHERE name = ?1 AND (state != 'pending' OR hold_until > ?2)",
	84	)
	85	.get(name, now)?.n !== 0
	86	);
	87	}
	88
	89	/** Orders waiting for payment from one client address (`http/peer.ts` `clientBucket`, never a header). */
	90	export const pendingFrom = (db: Database, address: string, now: number): number =>
	91	db.query<{ n: number }, [string, number]>("SELECT COUNT(*) AS n FROM forge_order WHERE state = 'pending' AND hold_until > ?2 AND address = ?1").get(address, now)?.n ?? 0;
	92
	93	export const pendingCount = (db: Database, now: number): number =>
	94	db.query<{ n: number }, [number]>("SELECT COUNT(*) AS n FROM forge_order WHERE state = 'pending' AND hold_until > ?1").get(now)?.n ?? 0;
	95
	96	/** Write a new pending order. The hold is checked and the row written in one transaction. False when the name is held. */
	97	export function holdName(db: Database, o: { id: string; name: string; plan: string; email: string; ticket: string; address: string }, now: number): boolean {
	98	return db.transaction(() => {
	99	if (nameHeld(db, o.name, now)) return false;
	100	db.query(
	101	`INSERT INTO forge_order (id, name, plan, email, state, ticket_hash, created_at, hold_until, updated_at, address)
	102	VALUES (?1, ?2, ?3, ?4, 'pending', ?5, ?6, ?7, ?6, ?8)`,
	103	).run(o.id, o.name, o.plan, o.email, sha256(o.ticket), now, now + HOLD_MS, o.address);
	104	return true;
	105	})();
	106	}
	107
	108	export function setSession(db: Database, id: string, sessionId: string): void {
	109	db.query("UPDATE forge_order SET session_id = ?2 WHERE id = ?1").run(id, sessionId);
	110	}
	111
	112	/** Drop a pending order whose checkout could not be made: its name is free again. */
	113	export function dropPending(db: Database, id: string): void {
	114	db.query("DELETE FROM forge_order WHERE id = ?1 AND state = 'pending'").run(id);
	115	}
	116
	117	/** Move `from` to `to`; true only for the caller whose statement changed the row. */
	118	export function move(db: Database, id: string, from: OrderState, to: OrderState, now: number, extra: { reason?: string; customerId?: string; subscriptionId?: string } = {}): boolean {
	119	return (
	120	db
	121	.query(
	122	`UPDATE forge_order SET state = ?3, updated_at = ?4, reason = ?5,
	123	customer_id = CASE WHEN ?6 = '' THEN customer_id ELSE ?6 END,
	124	subscription_id = CASE WHEN ?7 = '' THEN subscription_id ELSE ?7 END
	125	WHERE id = ?1 AND state = ?2`,
	126	)
	127	.run(id, from, to, now, extra.reason ?? "", extra.customerId ?? "", extra.subscriptionId ?? "").changes === 1
	128	);
	129	}
	130
	131	/** The buyer has been shown the link: true once, for the caller that marks it. */
	132	export function markShown(db: Database, id: string, now: number): boolean {
	133	return db.query("UPDATE forge_order SET shown_at = ?2 WHERE id = ?1 AND shown_at IS NULL").run(id, now).changes === 1;
	134	}
	135
	136	/** Give the link back: a mint that failed leaves the buyer able to see it on the next visit. */
	137	export function unmarkShown(db: Database, id: string): void {
	138	db.query("UPDATE forge_order SET shown_at = NULL WHERE id = ?1").run(id);
	139	}
	140
	141	export function markResent(db: Database, id: string, now: number): void {
	142	db.query("UPDATE forge_order SET resent_at = ?2 WHERE id = ?1").run(id, now);
	143	}
	144
	145	/** The newest spawned order for a name and email, for a re-send. */
	146	export function spawnedFor(db: Database, name: string, email: string): Order \| undefined {
	147	const r = db
	148	.query<Row, [string, string]>("SELECT * FROM forge_order WHERE name = ?1 AND lower(email) = ?2 AND state = 'spawned' ORDER BY created_at DESC LIMIT 1")
	149	.get(name, email.toLowerCase());
	150	return r ? fromRow(r) : undefined;
	151	}
	152
	153	/** Orders an admin must look at: paid and not made. Newest first. */
	154	export function failedOrders(db: Database): Order[] {
	155	return db.query<Row, []>("SELECT * FROM forge_order WHERE state = 'failed' ORDER BY updated_at DESC LIMIT 50").all().map(fromRow);
	156	}
	157
	158	export function recentOrders(db: Database, limit = 20): Order[] {
	159	return db.query<Row, [number]>("SELECT * FROM forge_order WHERE state != 'pending' ORDER BY updated_at DESC LIMIT ?1").all(limit).map(fromRow);
	160	}
		@@ -63,7 +63,34 @@ export function formBody(data: { [k: string]: Value }): string {
63	63	return parts.join("&");
64	64	}
65	65
	66	export interface CheckoutRequest {
	67	readonly orderId: string;
	68	readonly forge: string;
	69	readonly plan: string;
	70	readonly planName: string;
	71	readonly priceUsd: number;
	72	readonly email: string;
	73	readonly successUrl: string;
	74	readonly cancelUrl: string;
	75	/** Unix seconds after which the checkout cannot be paid (Stripe: 30 minutes to 24 hours from now). */
	76	readonly expiresAt?: number;
	77	}
	78
	79	export interface CheckoutSession {
	80	readonly id: string;
	81	readonly url: string;
	82	}
	83
	84	/** What the provider says of a session: paid or not, and who is billed. */
	85	export interface CheckoutState {
	86	readonly paid: boolean;
	87	readonly customer: string;
	88	readonly subscription: string;
	89	}
	90
66	91	export interface StripeClient {
	92	createCheckout(req: CheckoutRequest): Promise<Result<CheckoutSession, StripeError>>;
	93	getCheckout(sessionId: string): Promise<Result<CheckoutState, StripeError>>;
67	94	addWebhook(url: string): Promise<Result<{ id: string; secret: string }, StripeError>>;
68	95	removeWebhook(id: string): Promise<Result<true, StripeError>>;
69	96	/** The subscription as Stripe has it now. */
		@@ -112,6 +139,36 @@ export function stripeClient(key: string, fetchFn: typeof fetch = fetch): Stripe
112	139	const missing = (what: string): StripeError => ({ kind: "rejected", status: 502, message: `Stripe's answer had no ${what}.` });
113	140
114	141	return {
	142	async createCheckout(req) {
	143	const r = await call("POST", "/v1/checkout/sessions", {
	144	mode: "subscription",
	145	success_url: req.successUrl,
	146	cancel_url: req.cancelUrl,
	147	customer_email: req.email,
	148	client_reference_id: req.orderId,
	149	...(req.expiresAt === undefined ? {} : { expires_at: req.expiresAt }),
	150	line_items: [{
	151	quantity: 1,
	152	price_data: {
	153	currency: "usd",
	154	unit_amount: Math.round(req.priceUsd * 100),
	155	recurring: { interval: "month" },
	156	product_data: { name: `${req.planName} forge` },
	157	},
	158	}],
	159	metadata: { order: req.orderId, forge: req.forge, plan: req.plan },
	160	}, req.orderId);
	161	if (!r.ok) return r;
	162	const id = str(r.value, "id"), url = str(r.value, "url");
	163	return id && url ? ok({ id, url }) : err(missing("checkout address"));
	164	},
	165	async getCheckout(sessionId) {
	166	if (!/^cs_[A-Za-z0-9_]{1,200}$/.test(sessionId)) return err({ kind: "rejected", status: 400, message: "That is not a checkout session id." });
	167	const r = await call("GET", `/v1/checkout/sessions/${sessionId}`);
	168	if (!r.ok) return r;
	169	const paid = r.value["payment_status"] === "paid" \|\| r.value["payment_status"] === "no_payment_required";
	170	return ok({ paid, customer: str(r.value, "customer"), subscription: str(r.value, "subscription") });
	171	},
115	172	async addWebhook(url) {
116	173	const r = await call("POST", "/v1/webhook_endpoints", { url, enabled_events: [...WEBHOOK_EVENTS] },
117	174	// fresh per attempt: Stripe replays an answer for a repeated key for 24h, and a reconnect must not get a deleted endpoint back