fix: harden billing, revenue, analytics, and investigations

[izadoesdev]

Summary

This keeps the verified fixes from #565 on current staging without restoring the superseded deterministic insights engine.

• make Autumn webhook processing replay-safe and stop new replay claims during graceful shutdown
• normalize Stripe and Paddle revenue data and scope diagnostics correctly
• retain late, sparse Stripe refunds in website and profile totals without cross-organization leakage
• fix identity, funnel, link, uptime, profile, and revenue-view accuracy
• preserve cents and treat refund-only periods as real revenue activity
• harden public inputs, callback URLs, request IDs, error boundaries, and process shutdown
• preserve explicit production URLs for self-hosted deployments
• keep Slack payloads within provider limits and preserve concurrent insight schedule edits
• remove stale env schemas, helpers, runtime knobs, and server-side OpenAI Ads forwarding
• verify ClickHouse schema indexes while leaving retired web-vitals objects unmanaged

Deliberately excluded

The old deterministic investigation pipeline, legacy evals, evidence reader, queue rename, rollout flags, model/depth rails, and large dispatch-lease machinery from #565 remain excluded. The unsafe worker-attempt fence also remains excluded.

Deployment

• Before an API/main-connected deployment, run bun run db:push. It adds the Autumn webhook inbox, usage-alert organization ownership/index, and links organization index.
• Merging into staging is safe before that schema push: the staging-connected Basket and Slack Agent services do not use those new PostgreSQL objects.
• Configure Stripe to send the documented invoice, payment-failure, cancellation, and refund events.
• Production Insights uses AI_GATEWAY_API_KEY; Axiom uses AXIOM_TOKEN.
• This PR does not drop live ClickHouse objects.

Verification

Exact head d4e8eeee9:

• bun run lint: 1,513 files clean
• bun run check-types: 35/35 tasks
• focused Autumn replay/webhook tests: 22/22 passed
• AI query tests: 3,736 passed, 28 skipped, 0 failed
• focused dashboard revenue tests: 12/12 passed
• isolated ClickHouse revenue integration: 27/27 passed
• sparse late-refund regression verified across overview and profile queries
• production read-only revenue query: about 2.1 seconds, matching the previous PR head while retaining refund correctness
• exact-head GitHub Actions passed full tests, Dashboard Playwright, API/Basket/Insights health checks, and CodeQL
• Greptile reviewed all 210 changed files and added no finding on the final head
• Socket security checks passed; the affected Vercel status deployment completed successfully

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
databuddy-status	Ready	Preview, Comment	Jul 21, 2026 4:36pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
dashboard	Skipped		Jul 21, 2026 4:36pm
documentation	Skipped		Jul 21, 2026 4:36pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 62bdbf72-ff20-4e1b-9c37-48357cb04b5e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/salvage-pr565-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
api (preview)	Ready	Visit Preview	Inspect	Jul 21, 2026 4:37pm

[izadoesdev]

@greptile-apps review

[greptile-apps]

Greptile Summary

This PR hardens billing, revenue reporting, analytics, and investigation workflows. The main changes are:

• Replay-safe Autumn webhook processing and coordinated shutdown.
• Normalized Stripe and Paddle revenue and refund data.
• More accurate identity, funnel, link, uptime, and profile results.
• Safer public inputs, callback URLs, request IDs, and error handling.
• Updated environment schemas, deployment workflows, and provider integrations.

Confidence Score: 5/5

This looks safe to merge.

• Production Basket startup rejects a missing IP hashing salt.
• Browser authentication configuration did not show a remaining wrong-origin path.
• Replay shutdown stops new work and waits for active maintenance.
• No separate blocking issue remains in the updated areas.

Important Files Changed

Filename	Overview
apps/basket/src/index.ts	Updates production startup validation for Basket secrets.
packages/auth/src/client/auth-client.ts	Updates browser authentication client configuration.
apps/api/src/billing/autumn-webhook-replay.ts	Adds replay maintenance coordination and waits for active work during shutdown.
apps/api/src/bootstrap/shutdown.ts	Coordinates replay shutdown before shared API resources close.

_{Reviews (3): Last reviewed commit: "fix(api): stop replay claims during shut..." | Re-trigger Greptile}

[izadoesdev]

@greptile-apps review

[izadoesdev]

@greptile-apps review

[izadoesdev]

Validated the reported findings against the supported deployment topology and addressed the real shutdown issue with focused regression coverage.