Each component is Zod-validated at every trust boundary, server-only enforced, fully tested — and reviewed against the standard before it shipped.
canonical/auth
Email/password auth for Next.js App Router. Enumeration-resistant sign-in, shape-leak-resistant forgot password, httpOnly cookie sessions.
await signIn({ email, password })
// → AuthResult<AuthUser>
20 tests
canonical/billing
Stripe subscriptions with idempotent webhook processing, price pre-flight validation, fail-safe status reads. server-only throughout.
await getSubscriptionStatus(userId)
// → BillingUser | 'none' on error
20 tests
canonical/ai · callAI
Single entry point for all AI calls. Routes standard / priority / flagship modes. Writes audit row on every invocation — success and failure both.
const r = await callAI({
prompt, feature: 'tag', userId
})
28 tests
canonical/ai · callAIStream
Streaming counterpart. Audit row bound to the API stream lifecycle — not consumer iteration. Client disconnects cannot lose the log.
const h = callAIStream({
prompt, feature, mode: 'flagship'
})
14 tests
canonical/events
Server-side product analytics. Contractually non-throwing — drops on failure, never breaks the request path. JSONB properties, Neon-native.
void logEvent({
event_name: 'user_signed_up', userId
})
10 tests
canonical/access
Access-code gating. Codes stored as SHA-256 hashes — a DB leak exposes nothing redeemable. Race-safe redemption on the Neon HTTP driver.
await redeemAccessCode({
code, userId
}) // → ok | error reason
16 tests
canonical/tiers
Tier / plan gating with fail-safe defaults. On any ambiguity → free tier. Never grants access on doubt. Composes with billing and access codes.
await requireCapability(tier, 'ai_calls')
// throws CapabilityError if not entitled
15 tests
canonical/email
Transactional email via Resend. Workers-compatible. Anonymization Principle — recipient and template stored as SHA-256 hashes. No PII in the send log.
await sendTransactionalEmail({
to, template: 'welcome', subject, html
})
12 tests
canonical/rate-limit
Fixed-window rate limiter. Fail-open by default — never blocks on infra failure. failClosed opt-in for auth/billing paths. Single race-safe UPSERT.
await consumeRateLimit({
key: userId, limit: 100, windowMs: 60_000
})
11 tests
canonical/billing · one-time
One-time purchase billing. WinterCG-portable webhook handler. Insert-first idempotency. SubtleCrypto signature verification. Ownership from session metadata only.
await createOneTimeCheckoutSession({
userId, priceId, successUrl
})
12 tests