fix: harden billing, revenue, analytics, and investigations

[izadoesdev]

Summary

This keeps the verified fixes from #565 on current staging without restoring the superseded deterministic insights engine.

• make Autumn webhook processing replay-safe and stop new replay claims during graceful shutdown
• normalize Stripe and Paddle revenue data and scope diagnostics correctly
• retain late, sparse Stripe refunds in website and profile totals without cross-organization leakage
• fix identity, funnel, link, uptime, profile, and revenue-view accuracy
• preserve cents and treat refund-only periods as real revenue activity
• harden public inputs, callback URLs, request IDs, error boundaries, and process shutdown
• preserve explicit production URLs for self-hosted deployments
• keep Slack payloads within provider limits and preserve concurrent insight schedule edits
• remove stale env schemas, helpers, runtime knobs, and server-side OpenAI Ads forwarding
• verify ClickHouse schema indexes while leaving retired web-vitals objects unmanaged
• polish investigations list, detail, settings, and home-preview layouts across desktop and mobile

Deliberately excluded

The old deterministic investigation pipeline, legacy evals, evidence reader, queue rename, rollout flags, model/depth rails, and large dispatch-lease machinery from #565 remain excluded. The unsafe worker-attempt fence also remains excluded.

Deployment

• Before an API/main-connected deployment, run bun run db:push. It adds the Autumn webhook inbox, usage-alert organization ownership/index, and links organization index.
• Merging into staging is safe before that schema push: the staging-connected Basket and Slack Agent services do not use those new PostgreSQL objects.
• Configure Stripe to send the documented invoice, payment-failure, cancellation, and refund events.
• Production Insights uses AI_GATEWAY_API_KEY; Axiom uses AXIOM_TOKEN.
• This PR does not drop live ClickHouse objects.

Verification

Current head cfda4b040:

• full local Turbo test run: 26/26 tasks passed
• focused Autumn replay/webhook tests: 22/22 passed
• Redis package tests: 105/105 passed
• production IP-salt startup guard reproduced
• current-head GitHub Actions passed lint, types, tests, Dashboard Playwright, API/Basket/Insights health checks, and CodeQL
• CodeQL reported zero new alerts; Socket checks passed
• Vercel dashboard/status previews completed successfully
• investigations feed and detail views were visually checked at desktop and 390px mobile widths with no horizontal overflow
• all five Greptile threads are resolved; Greptile's last substantive review covered through d4e8eeee, before the final investigations UI commit

Accepted follow-up

One in-flight Autumn replay can still hit the API's 10-second hard shutdown deadline before status persistence. Stable provider idempotency prevents duplicate alert emails, but a killed claim can remain leased until retry. New replay claims stop immediately during shutdown.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview, Comment	Jul 22, 2026 6:28am
databuddy-status	Ready	Preview, Comment	Jul 22, 2026 6:28am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
documentation	Skipped		Jul 22, 2026 6:28am

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2ea59bec-0596-4fca-8594-41e13f7a0754

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/salvage-pr565-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
api (preview)	Ready	Visit Preview	Inspect	Jul 22, 2026 6:27am

[izadoesdev]

@greptile-apps review

[greptile-apps]

Greptile Summary

This PR hardens billing, revenue reporting, analytics, and investigation workflows. The main changes are:

• Replay-safe Autumn webhook processing and coordinated shutdown.
• Normalized Stripe and Paddle revenue and refund data.
• More accurate identity, funnel, link, uptime, and profile results.
• Safer public inputs, callback URLs, request IDs, and error handling.
• Updated environment schemas, deployment workflows, and provider integrations.

Confidence Score: 5/5

This looks safe to merge.

• Production Basket startup rejects a missing IP hashing salt.
• Browser authentication configuration did not show a remaining wrong-origin path.
• Replay shutdown stops new work and waits for active maintenance.
• No separate blocking issue remains in the updated areas.

Important Files Changed

Filename	Overview
apps/basket/src/index.ts	Updates production startup validation for Basket secrets.
packages/auth/src/client/auth-client.ts	Updates browser authentication client configuration.
apps/api/src/billing/autumn-webhook-replay.ts	Adds replay maintenance coordination and waits for active work during shutdown.
apps/api/src/bootstrap/shutdown.ts	Coordinates replay shutdown before shared API resources close.

_{Reviews (3): Last reviewed commit: "fix(api): stop replay claims during shut..." | Re-trigger Greptile}

[izadoesdev]

@greptile-apps review

[izadoesdev]

@greptile-apps review

[izadoesdev]

Validated the reported findings against the supported deployment topology and addressed the real shutdown issue with focused regression coverage.