[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Launches the Stripe-backed billing platform using a SKU-first catalog via @trycompai/billing, with admin/customer UIs, entitlement gating, secure webhooks, and add‑ons/trial support. Also refreshes the integrations catalog and adds billing audit logging with more robust webhook processing.

• New Features

  • API: BillingModule with subscriptions, entitlements, credits, invoices, preferences, and webhook at /v1/billing/webhook (raw‑body enabled) with idempotent event store and better error preservation; usage ledger now favors the newest event.
  • Catalog: integrates @trycompai/billing; build includes packages/billing.
  • Admin: billing controller/services for preferences, plan changes, credits, and audit logging; interceptor maps billing actions to org audit events and writes an audit entry when a subscription is set.
  • Background checks: Stripe customer creation, invoice listing, setup sessions, stricter redirect URL validation, included‑usage consumption before charging, and safer invoice rollback on failures.
  • Pentests: create/run gated by entitlements; usage consumption and refunds wired into services and tests.
  • App: Billing settings with plans, add‑ons, trials, invoices, payment method portal, preferences, and usage table; Admin Billing tab added; improved invoices table and copy/links in background check flow.

• Migration

  • Configure Stripe envs and webhook secret; register webhook to /v1/billing/webhook.
  • Set NEXT_PUBLIC_APP_URL/APP_URL (or BETTER_AUTH_URL) to a valid HTTPS origin; only localhost may use HTTP.
  • Ensure deploy builds packages/billing (Dockerfile/buildspec updated).

^{Written for commit 40180c8. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	May 1, 2026 9:34pm
comp-framework-editor (staging)	Ready	Preview, Comment	May 1, 2026 9:34pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		May 1, 2026 9:34pm

[cubic-dev-ai]

10 issues found across 131 files

Confidence score: 2/5

• Several high-confidence billing-path issues are user-impacting (idempotency collisions and stale usage selection), so merge risk is elevated rather than routine.
• The most severe concern is in apps/api/src/billing/billing-customer.ts: a per-org idempotency key combined with variable email can trigger Stripe idempotency errors under concurrent requests.
• There are additional runtime/behavior risks in apps/api/src/billing/billing-entitlements.service.ts (missing @Optional() for DI), apps/api/src/admin-organizations/admin-audit-log.interceptor.ts (overbroad context parsing), and apps/api/src/billing/billing-webhook.service.ts (original errors can be swallowed).
• Pay close attention to apps/api/src/billing/billing-customer.ts, apps/api/src/billing/billing-usage.ts, apps/api/src/billing/billing-webhook.service.ts - these affect billing correctness, Stripe interaction reliability, and error visibility.

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed. cubic prioritises the most important files to review.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/settings/billing/billingPreferencesFormSchema.ts">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/settings/billing/billingPreferencesFormSchema.ts:17">
P2: `getCountryLabel` uppercases input, but the `No country` option is stored as lowercase `none`, so `getCountryLabel('none')` returns `NONE` instead of the expected label.</violation>
</file>

<file name="apps/api/src/billing/billing-usage.ts">

<violation number="1" location="apps/api/src/billing/billing-usage.ts:70">
P2: `Map` construction here can select an older usage event per source instead of the latest one, causing stale billing type/SKU in usage rows.</violation>
</file>

<file name="apps/api/src/billing/billing-entitlements.service.ts">

<violation number="1" location="apps/api/src/billing/billing-entitlements.service.ts:21">
P2: Missing `@Optional()` decorator on the `credits` constructor parameter. NestJS DI ignores TypeScript's `?` — without `@Optional()`, this dependency is treated as required at runtime. The null-checks on `this.credits` elsewhere in the class will be dead code unless the decorator is added.</violation>
</file>

<file name="apps/api/src/admin-organizations/admin-audit-log.interceptor.ts">

<violation number="1" location="apps/api/src/admin-organizations/admin-audit-log.interceptor.ts:160">
P2: This condition is too broad and unintentionally changes `context` audit parsing. It should only apply to `billing`; otherwise `context` entries get `entityId = orgId` and lose correct entity-name resolution.</violation>
</file>

<file name="apps/api/src/billing/billing-webhook.service.ts">

<violation number="1" location="apps/api/src/billing/billing-webhook.service.ts:58">
P2: If `markStripeWebhookFailed` throws (e.g., DB is down), the original processing error is swallowed. Wrap the failure-recording call so the original error is always re-thrown.</violation>
</file>

<file name="apps/api/src/billing/billing-subscription-plans.ts">

<violation number="1" location="apps/api/src/billing/billing-subscription-plans.ts:101">
P2: Idempotency key lacks a temporal or sequence component, so an upgrade→downgrade→upgrade cycle within 24 hours would hit Stripe's cached response and silently skip the second upgrade. Consider including a timestamp, sequence counter, or the current `skuKey` being changed *from* in the key.</violation>
</file>

<file name="apps/api/src/billing/billing-credits.types.ts">

<violation number="1" location="apps/api/src/billing/billing-credits.types.ts:31">
P2: `eventType` is typed as `string` instead of the local `BillingCreditEventType` union, which weakens type safety for credit event payloads.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/BackgroundCheckDetailsForm.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/BackgroundCheckDetailsForm.tsx:110">
P2: Use `next/link` instead of a plain `<a>` for this internal billing route to avoid full page reload navigation.</violation>
</file>

<file name="apps/api/src/billing/billing-customer.ts">

<violation number="1" location="apps/api/src/billing/billing-customer.ts:25">
P1: Using a per-organization idempotency key with a variable `email` field can trigger Stripe idempotency errors on concurrent calls with different `customerEmail` values.</violation>
</file>

<file name="apps/api/src/admin-organizations/admin-billing.service.ts">

<violation number="1" location="apps/api/src/admin-organizations/admin-billing.service.ts:233">
P2: Missing audit log for the checkout-session path. When `'changed' in result` is true (subscription created immediately), the method returns without calling `writeBillingAudit`, so the admin action goes untracked. Consider writing the audit entry before the early return in this branch.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[claudfuen]

🎉 This PR is included in version 3.42.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀