Repository navigation
Credit codes and invites: days of the x402 pass - #34
Merged
Merged
Conversation
A credit code (@profullstack/redeem-credits 0.2.0) grants pass_days; an invite (@profullstack/affiliates 0.3.0) gives both sides 7 days of the pass when a new account is made from the emailed link. Both go through the existing pass path: a $0 crawl_sales row owned by the account, idempotent on its ref. While it runs, accessFor serves the account as a pass on the session, its API keys, the CLI and MCP, and /settings shows the signed cp_ bearer token for it. - /settings: "Have a code?" + pass panel; admin mint/revoke panel - /account/invites (3 per account, from 7 days old), /i/<code> landing, invite carried on login_tokens.invite_code so another browser counts - bonus withheld for same mailbox (+tag, gmail dots), throwaway domains, same network as the invite's creation, inviter cap 10/30 days - ?ref= affiliate links: first-touch attribution of new accounts - API /api/v1/credits/redeem, /pass, /invites, /admin/credits; MCP redeem_code, list_invites, create_invite; CLI 0.2.0 redeem, pass, invites - scripts/credit-codes.js for minting on the box - migration 0003 (package DDL + crawl_sales.user_id/source, invite tables) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fleet rollout of
@profullstack/redeem-credits0.2.0 +@profullstack/affiliates0.3.0 (ROLLOUT batch 5).What a code grants: unit
pass_days. Through the existing pass path: a $0crawl_salesrow owned by the account (newuser_id/sourcecolumns), refgrant:code:<id>:<user>(unique, so a retried grant is one term), stacked after any running term. While it runs,accessForserves the account aspasson the session, every API key, the CLI and MCP;/settingsshows the signedcp_bearer token for the same term (minted with the gateway's secret, checked withgateway.verifyPass).crawlSalesSummarycounts sold passes only.Invites: 3 per account, 30-day expiry, from accounts at least 7 days old. Accepted only when spending the emailed link creates the account (proves the mailbox); the code rides on
login_tokens.invite_codeas well as ther4k_invitecookie. Both sides get 7 pass days, decided once per side ininvite_bonuses; withheld for same mailbox (+tag, Gmail dots), throwaway domains, same network as the invite's creation (salted IP hash), or an inviter at 10 bonuses in 30 days. One accepted invite per account (affiliates 0.3 unique index).Affiliate links:
/?ref=<code>setsreferral_code; first-touch attribution of new accounts. r4ck had no referral programme, so nothing counts twice. No commission is paid (nothing to pay it from yet).Surfaces:
/settings(Have a code?, pass panel, admin mint/revoke),/account/invites(+/invitesredirect),/i/<code>(in OPEN_PATHS, noindex), API/api/v1/credits/redeem,/api/v1/pass,/api/v1/invites,/api/v1/admin/credits; MCPredeem_code,list_invites,create_invite; CLI 0.2.0redeem,pass,invites;scripts/credit-codes.js. Links are built from the request host.Migration 0003 runs on boot. It holds the packages' own DDL plus the r4ck columns and tables. I dry-ran it against prod in a rolled-back transaction. Backup:
~/backups/r4ck/pre-0003-20261026T183357Z.dump.Supabase check: not applicable. r4ck runs on plain Postgres with no PostgREST or public key, and every write goes through server routes.
Tests:
test/credits.test.js(8, real Postgres). Full suite 99 pass, 1 fail. The failure issyncTicktiming out at 5 s, and it fails the same way on main.🤖 Generated with Claude Code