refactor: adopt @profullstack/stack modules

Replace vendored/drifted referrals, email, supabase, feedback, coinpay and
crawlproof code with @profullstack/stack@^0.1.0 subpath imports.

Author: ralyodio

app/api/admin/email-broadcast/route.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { createClient } from "@/lib/supabase/server";
 import { serviceClient } from "@/lib/supabase/service";
 import { env } from "@/lib/env";
-import { createEmailer } from "@profullstack/emailer";
+import { createEmailer } from "@profullstack/stack/email";
 
 export const runtime = "nodejs";
 

app/api/referrals/route.ts

@@ -1,5 +1,4 @@
-import { NextResponse } from "next/server";
-import { createCode, validateCode, applyReferral } from "@profullstack/referrals";
+import { createReferralsRouteHandler } from "@profullstack/stack/referrals";
 import { referralStore } from "@/lib/referrals";
 import { createClient } from "@/lib/supabase/server";
 
@@ -11,47 +10,4 @@ async function getUserId(): Promise<string | null> {
   return user?.id ?? null;
 }
 
-export async function GET(req: Request) {
-  const { searchParams } = new URL(req.url);
-  const action = searchParams.get("action");
-
-  if (action === "validate") {
-    const code = searchParams.get("ref");
-    if (!code) return NextResponse.json({ error: "Missing ref" }, { status: 400 });
-    const record = await validateCode(code, referralStore);
-    return NextResponse.json({ valid: !!record, code: record ?? null });
-  }
-
-  if (action === "myusages") {
-    const userId = await getUserId();
-    if (!userId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-    const usages = await referralStore.getUsagesByAffiliate(userId);
-    return NextResponse.json({ usages });
-  }
-
-  return NextResponse.json({ error: "Unknown action" }, { status: 400 });
-}
-
-export async function POST(req: Request) {
-  const body = await req.json() as Record<string, unknown>;
-  const action = body["action"];
-
-  if (action === "create") {
-    const userId = await getUserId();
-    if (!userId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-    const code = await createCode(userId, referralStore);
-    return NextResponse.json({ code });
-  }
-
-  if (action === "apply") {
-    const userId = await getUserId();
-    if (!userId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-    const code = typeof body["code"] === "string" ? body["code"] : null;
-    const amount = typeof body["amount"] === "number" ? body["amount"] : null;
-    if (!code || !amount) return NextResponse.json({ error: "Missing code or amount" }, { status: 400 });
-    const usage = await applyReferral({ code, newUserId: userId, amountCents: amount, store: referralStore });
-    return NextResponse.json({ usage });
-  }
-
-  return NextResponse.json({ error: "Unknown action" }, { status: 400 });
-}
+export const { GET, POST } = createReferralsRouteHandler({ store: referralStore, getUserId });

app/layout.tsx

@@ -1,6 +1,7 @@
 import type { Metadata, Viewport } from "next";
 import Script from "next/script";
 import { ReferralProvider } from "@profullstack/referrals/react";
+import { FeedbackWidget } from "@profullstack/stack/feedback";
 import "./globals.css";
 
 export const viewport: Viewport = {
@@ -150,7 +151,7 @@ export default function RootLayout({ children }: { children: React.ReactNode })
           strategy="afterInteractive"
         />
         </ReferralProvider>
-      <script async src="https://feedback.profullstack.com/embed/profullstack-feedback.js" data-property="crawlproof.com"></script>
+        <FeedbackWidget property="crawlproof.com" />
       </body>
     </html>
   );

lib/coinpay.ts

@@ -1,4 +1,4 @@
-import crypto from "node:crypto";
+import { verifyCoinPayWebhook } from "@profullstack/stack/coinpay";
 import { env } from "./env";
 
 // CoinPay HTTP client.
@@ -316,116 +316,20 @@ export async function createCryptoPayout(
   };
 }
 
-// Parse the Stripe-style `t=...,v1=...` header into its parts.
-function parseSignatureHeader(header: string): { t: string; v1: string[] } | null {
-  const t: string[] = [];
-  const v1: string[] = [];
-  for (const part of header.split(",")) {
-    const [k, v] = part.split("=", 2);
-    if (!k || v === undefined) continue;
-    if (k.trim() === "t") t.push(v.trim());
-    else if (k.trim() === "v1") v1.push(v.trim());
-  }
-  if (t.length !== 1 || v1.length === 0) return null;
-  return { t: t[0], v1 };
-}
-
-// Reject signatures older than this window to limit replay attacks.
-const TOLERANCE_SECONDS = 5 * 60;
-
-function hmac(secret: string | Buffer, message: string): string {
-  return crypto.createHmac("sha256", secret).update(message).digest("hex");
-}
-
-// CoinPay's webhook secret is "whsecret_<64 hex chars>" — the hex is a 32-byte
-// key. We don't know which form they HMAC with, so we try them all.
-function secretCandidates(raw: string): Array<[string, string | Buffer]> {
-  const candidates: Array<[string, string | Buffer]> = [];
-  candidates.push(["raw_utf8", raw]);
-  const m = raw.match(/^whsecret_([0-9a-f]+)$/i);
-  if (m) {
-    candidates.push(["hex_string", m[1]]);
-    if (m[1].length % 2 === 0) {
-      try {
-        candidates.push(["hex_decoded", Buffer.from(m[1], "hex")]);
-      } catch {
-        /* skip */
-      }
-    }
-  }
-  return candidates;
-}
-
-function eqTimingSafe(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  return crypto.timingSafeEqual(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
-}
-
-// Build several plausible signing forms and try them all. Stripe uses
-// `${t}.${body}`; if CoinPay diverges we'll cover the common variants
-// (omit timestamp, omit separator, reverse). Whichever wins, the next
-// log line tells us which one to keep.
-function candidateMessages(t: string, body: string): Array<[string, string]> {
-  return [
-    ["t.body", `${t}.${body}`],
-    ["t+body", `${t}${body}`],
-    ["body.t", `${body}.${t}`],
-    ["body", body],
-  ];
-}
-
+// Verification itself lives in @profullstack/stack/coinpay: HMAC-SHA256 over
+// `${t}.${rawBody}` with a 5-minute replay tolerance, constant-time compare,
+// and support for multiple `v1=` parts during secret rotation.
 export function verifyWebhookSignature(
   rawBody: string,
   signatureHeader: string | null,
   options: { now?: number; tolerance?: number } = {},
 ): boolean {
-  if (!env.coinpayWebhookSecret || !signatureHeader) return false;
-  const parsed = parseSignatureHeader(signatureHeader);
-  if (!parsed) {
-    console.warn("[coinpay] verify: unparseable signature header", { header: signatureHeader.slice(0, 60) });
-    return false;
-  }
-
-  const ts = Number.parseInt(parsed.t, 10);
-  if (!Number.isFinite(ts)) return false;
-  const now = options.now ?? Math.floor(Date.now() / 1000);
-  const tolerance = options.tolerance ?? TOLERANCE_SECONDS;
-  if (Math.abs(now - ts) > tolerance) {
-    console.warn("[coinpay] verify: timestamp out of tolerance", { ts, now, drift: now - ts });
-    return false;
-  }
-
-  const variants = candidateMessages(parsed.t, rawBody);
-  const secrets = secretCandidates(env.coinpayWebhookSecret);
-
-  for (const [sLabel, secret] of secrets) {
-    for (const [mLabel, message] of variants) {
-      const expected = hmac(secret, message);
-      if (parsed.v1.some((cand) => eqTimingSafe(cand, expected))) {
-        if (sLabel !== "raw_utf8" || mLabel !== "t.body") {
-          console.warn(
-            `[coinpay] verify OK via secret=${sLabel}, signing=${mLabel}`,
-          );
-        }
-        return true;
-      }
-    }
-  }
-
-  // None matched — log enough to compare with the sender. No secret leak.
-  console.warn("[coinpay] verify FAIL", {
-    bodyLen: rawBody.length,
-    ts: parsed.t,
-    v1_tail: parsed.v1.map((s) => s.slice(-8)),
-    secret_len: env.coinpayWebhookSecret.length,
-    tails: Object.fromEntries(
-      secrets.flatMap(([sLabel, secret]) =>
-        variants.map(([mLabel, message]) => [
-          `${sLabel}:${mLabel}`,
-          hmac(secret, message).slice(-8),
-        ]),
-      ),
-    ),
+  if (!env.coinpayWebhookSecret) return false;
+  return verifyCoinPayWebhook({
+    signature: signatureHeader,
+    rawBody,
+    secret: env.coinpayWebhookSecret,
+    now: options.now,
+    toleranceSeconds: options.tolerance,
   });
-  return false;
 }

lib/email.ts

@@ -1,11 +1,14 @@
-import { Resend } from "resend";
+import { createEmailer, type Emailer } from "@profullstack/stack/email";
 import { env } from "./env";
 
-let cached: Resend | null = null;
+let cached: Emailer | null = null;
 function client() {
   if (cached) return cached;
   if (!env.resendApiKey) return null;
-  cached = new Resend(env.resendApiKey);
+  cached = createEmailer({
+    resendApiKey: env.resendApiKey,
+    defaultFrom: env.resendFrom,
+  });
   return cached;
 }
 
@@ -309,7 +312,7 @@ export async function sendAuditReadyEmail(input: {
 }) {
   const c = client();
   if (!c) return;
-  await c.emails.send({
+  await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: `Your AEO audit for ${input.targetUrl} is ready (${input.score}/100)`,
@@ -337,7 +340,7 @@ export async function sendAuditReportPdfEmail(input: {
       return input.targetUrl;
     }
   })();
-  const res = await c.emails.send({
+  const res = await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: `Your CrawlProof audit for ${host} (${input.score}/100)`,
@@ -349,7 +352,7 @@ export async function sendAuditReportPdfEmail(input: {
     }),
     attachments: [{ filename: `crawlproof-${host}.pdf`, content: input.pdf.toString("base64") }],
   });
-  if (res.error) return { sent: false, error: String(res.error) };
+  if (!res.sent) return { sent: false, error: res.error };
   return { sent: true };
 }
 
@@ -365,7 +368,7 @@ export async function sendDigestEmail(input: {
         `<li><a href="${r.url}">${r.target}</a> — <strong>${r.score}/100</strong></li>`,
     )
     .join("");
-  await c.emails.send({
+  await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: `Your weekly CrawlProof digest`,
@@ -392,7 +395,7 @@ export async function sendMarketingEmail(input: {
       <a href="${unsubUrl}" style="color:#888">Unsubscribe</a>.
     </p>`;
 
-  const res = await c.emails.send({
+  const res = await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: input.subject,
@@ -402,7 +405,7 @@ export async function sendMarketingEmail(input: {
       "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
     },
   });
-  if (res.error) return { sent: false, error: String(res.error) };
+  if (!res.sent) return { sent: false, error: res.error };
   return { sent: true };
 }
 
@@ -425,7 +428,7 @@ export async function sendPurchaseReceiptEmail(input: {
   })}`;
   const filename = `crawlproof-receipt-${input.paymentId.slice(0, 12)}.pdf`;
 
-  const res = await c.emails.send({
+  const res = await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: `Your CrawlProof receipt — ${input.creditsAdded} credit${input.creditsAdded === 1 ? "" : "s"}`,
@@ -439,7 +442,7 @@ export async function sendPurchaseReceiptEmail(input: {
     }),
     attachments: [{ filename, content: input.pdf.toString("base64") }],
   });
-  if (res.error) return { sent: false, error: String(res.error) };
+  if (!res.sent) return { sent: false, error: res.error };
   return { sent: true };
 }
 
@@ -487,7 +490,7 @@ export async function sendPremiumDeckEmail(input: {
   if (!c) return { sent: false, error: "RESEND_API_KEY not set" };
 
   const deckUrl = `${env.siteUrl}/pdfs/CrawlProof_Premium_Deck.pdf`;
-  const res = await c.emails.send({
+  const res = await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: "Your CrawlProof premium deck",
@@ -499,7 +502,7 @@ export async function sendPremiumDeckEmail(input: {
       },
     ],
   });
-  if (res.error) return { sent: false, error: String(res.error) };
+  if (!res.sent) return { sent: false, error: res.error };
   return { sent: true };
 }
 
@@ -537,14 +540,14 @@ export async function sendHireInquiryEmail(input: {
     ${input.message ? `<p style="margin-top:16px"><strong>Message</strong><br/><pre style="white-space:pre-wrap;font-family:inherit;background:#f6f8fa;padding:12px;border-radius:6px">${esc(input.message)}</pre></p>` : ""}
   </body></html>`;
 
-  const res = await c.emails.send({
+  const res = await c.send({
     from: env.resendFrom,
     to: "hello@crawlproof.com",
     replyTo: input.email,
     subject: `Hire-us inquiry: ${input.name} (${input.website})`,
     html,
   });
-  if (res.error) return { sent: false, error: String(res.error) };
+  if (!res.sent) return { sent: false, error: res.error };
   return { sent: true };
 }
 
@@ -595,13 +598,13 @@ export async function sendProjectInviteEmail(input: {
     footerNote: "If you weren't expecting this invitation, you can safely ignore this email.",
   });
 
-  const res = await c.emails.send({
+  const res = await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: `${escapeHtml(input.invitedBy)} invited you to ${escapeHtml(input.projectName)} on CrawlProof`,
     html,
   });
-  if (res.error) return { sent: false, error: String(res.error) };
+  if (!res.sent) return { sent: false, error: res.error };
   return { sent: true };
 }
 
@@ -644,12 +647,12 @@ export async function sendOrgInviteEmail(input: {
     footerNote: "If you weren't expecting this invitation, you can safely ignore this email.",
   });
 
-  const res = await c.emails.send({
+  const res = await c.send({
     from: env.resendFrom,
     to: input.to,
     subject: `${escapeHtml(input.invitedBy)} invited you to ${escapeHtml(input.orgName)} on CrawlProof`,
     html,
   });
-  if (res.error) return { sent: false, error: String(res.error) };
+  if (!res.sent) return { sent: false, error: res.error };
   return { sent: true };
 }