PeptidePal v2 — Phase 3 (money spine + premium) COMPLETE + verified (2026-07-07, Opus)

The paid tier. Built + hard-verified the Stripe money spine, server-side free-tier enforcement, the upgrade UI, and two flagship premium features. Still TEST mode.

What shipped

• DB — migrations 0004_phase3_money_spine.sql + 0005_harden_phase3_triggers.sql (applied live):
• is_premium(uid) — expiry-aware effective-premium check (the read-path downgrade).
• apply_subscription(...) — the ONLY writer of premium; atomic upsert-to-state (idempotent). SECURITY DEFINER, revoked from anon/authenticated.
• Server-side free-tier trigger enforce_compound_limit — free = ONE active compound, enforced in the DB (not just UI). enforce_stacks_premium — stacks are premium-only, DB-enforced.
• entitlements.stripe_customer_id, profiles.is_admin, stacks + stack_items tables (owner-only RLS).
• Stripe (TEST mode) — product "PeptidePal Premium" + prices $4.99/mo & $39.99/yr; webhook endpoint registered → secret synced to edge env.
• Edge functions (deployed): create-checkout (JWT-auth'd; 14-day trial; reuses/creates Stripe customer; returns checkout URL — never grants premium) and stripe-webhook (verify_jwt=false; verifies Stripe signature via constructEventAsync; maps event→user; calls apply_subscription; active/trialing→premium, deleted/past→revoke).
• Client: useAuth now loads entitlement + exposes isPremium (expiry-aware, mirrors DB). pages/Upgrade.tsx (paywall: perks, yearly/monthly, 14-day trial, "CSV always free" trust line). lib/checkout.ts. Free-tier gate on Compounds (2nd compound → /upgrade, + server-trigger fallback). components/PremiumLock.tsx. pages/Settings.tsx shows plan + polls entitlement after ?upgrade=success.
• Flagship premium features: pages/HalfLife.tsx + lib/halflife.ts — estimated medication-level curve per compound from the user's own dose events × published half-lives (overridable), Recharts area chart, "personal reference, not medical guidance" label. pages/Stacks.tsx — named protocols grouping compounds. Both premium-gated (UI + DB).
• Routes/menu wired (/upgrade, /halflife, /stacks; More shows a Go-Premium banner for free users).

Verification (done)

• npx tsc -b clean · npm run build clean · dev server serves 200.
• Security advisors: the 4 real function-exposure lints fixed; one known-benign warning remains — pg_net in the public schema (it doesn't support SET SCHEMA; moving it means drop/recreate which would disrupt the live reminder cron — deferred to launch).
• MONEY-SPINE PROOF — 15/15 PASS (forged Stripe-signed events with the real webhook secret + a throwaway user): free user blocked at compound #2 and at stack creation (server triggers); client cannot insert/grant an entitlement (tamper-proof); webhook rejects a bad signature (400); a valid signed event grants premium (plan + customer + future expiry stored); premium then lifts both gates; replayed events → exactly one row (idempotent); an active-but-past-dated subscription is treated as free (expiry read-path downgrade blocks compound #3); subscription.deleted revokes. Test user cascade-deleted; DB confirmed clean (0 rows).

The one thing only Sondra can finish (like BookifAI)

• A real 4242 test-card checkout round-trip from the UI. The spine is proven server-side end-to-end; her actual card click confirms the browser→Stripe→webhook→unlock path on a real session. Sign in → Upgrade → pay with 4242 4242 4242 4242 (any future date/CVC) → Settings should flip to Premium within a few seconds.

Deferred to Phase 3b (flagged, NOT built — each is substantial)

• Insight cards (§5.2 #5) — AI via OpenRouter on her key, premium-gated, per-user daily cap, fail-closed. (Key present; not wired.)
• Clinician share links (§5.1) — revocable, 30-day-expiring, noindex, PII-stripped public read page + issue/revoke edge fn.
• Admin console (§5.1 + §5.4 #3) — grant/revoke premium, allowlist, audit log, multi-select bulk delete on the user list. (profiles.is_admin column already exists.)

Launch gates (Phase 4, unchanged)

Landing page, legal pages, support form, empty-state/microcopy polish, Lighthouse gate, /app-safety-check, then flip Stripe TEST→live (products/webhook/keys), email-confirm ON, and domain cutover to getpeptidepal.com. Cancel Emergent (Sondra's manual step).

Notes

• Stripe is TEST mode throughout (STRIPE_TEST_SECRET_KEY). Edge secrets set: STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_MONTHLY/YEARLY, APP_URL (=localhost:4780 for now — change at deploy).
• types.ts still hand-written (now includes Entitlement/Stack/StackItem); regenerate from live DB at launch.