zapcooking
diff --git a/‎src/lib/cookbookPricing.ts‎
Lines changed: 35 additions & 0 deletions b/‎src/lib/cookbookPricing.ts‎
Lines changed: 35 additions & 0 deletions
diff --git a/‎src/lib/cookbookPromo.server.ts‎
Lines changed: 60 additions & 9 deletions b/‎src/lib/cookbookPromo.server.ts‎
Lines changed: 60 additions & 9 deletions
diff --git a/‎src/lib/cookbookPromoStore.server.ts‎
Lines changed: 4 additions & 1 deletion b/‎src/lib/cookbookPromoStore.server.ts‎
Lines changed: 4 additions & 1 deletion
diff --git a/‎src/lib/promoEngine.server.ts‎
Lines changed: 39 additions & 0 deletions b/‎src/lib/promoEngine.server.ts‎
Lines changed: 39 additions & 0 deletions
@@ -5,6 +5,35 @@
 
 export const COOKBOOK_EXPORT_SATS = 2100;
 
+/**
+ * Surfaces a promo code can apply to. The engine is scope-aware so a
+ * single KV-backed code list can serve every checkout without one
+ * surface's codes leaking into another.
+ *
+ * `'all'` is a convenience meaning "the general-purpose surfaces" —
+ * deliberately **cookbook + membership only**. It does NOT cover
+ * `'genesis'` (a lifetime founder discount must be opted into with an
+ * explicit `'genesis'` code) and does NOT cover `'sponsor'` (not yet a
+ * live surface). See `scopeAllows`.
+ */
+export type PromoScope = 'cookbook' | 'membership' | 'sponsor' | 'genesis' | 'all';
+
+/** Surfaces that a `scope: 'all'` code is valid for. */
+export const ALL_SCOPE_COVERS: readonly PromoScope[] = ['cookbook', 'membership'];
+
+/**
+ * Pure scope-match check. A code's stored scope (default `'all'` for
+ * legacy entries) is valid for `requested` when it matches exactly, or
+ * when it's `'all'` and `requested` is one of the general surfaces.
+ * Client- and server-safe (no I/O).
+ */
+export function scopeAllows(entryScope: PromoScope | undefined, requested: PromoScope): boolean {
+	const scope: PromoScope = entryScope ?? 'all';
+	if (scope === requested) return true;
+	if (scope === 'all') return ALL_SCOPE_COVERS.includes(requested);
+	return false;
+}
+
 export interface PromoApplied {
 	code: string; // canonicalized (uppercase)
 	originalSats: number;
@@ -18,6 +47,12 @@ export interface PromoApplied {
  * Apply a promo to a base price.
  * Pure / sync / no I/O — safe on both client and server.
  *
+ * Unit-agnostic: `baseSats` is just "the base amount" — cookbook passes
+ * sats, membership/genesis pass USD **cents** (so the integer rounding
+ * below stays exact). `flatOff` shares whatever unit the caller uses.
+ * Membership/genesis codes are percent-only (see `applyPromo`), so the
+ * sats-flavoured `flatOff` label branch never fires for them.
+ *
  * Server **must** still validate the code via `getPromoConfig` before
  * trusting it, since this helper is happy to apply any percentage.
  */
 
@@ -20,7 +20,12 @@
  */
 
 import { env } from '$env/dynamic/private';
-import { applyPromoMath, type PromoApplied } from '$lib/cookbookPricing';
+import {
+	applyPromoMath,
+	scopeAllows,
+	type PromoApplied,
+	type PromoScope
+} from '$lib/cookbookPricing';
 import {
 	loadPromoConfig,
 	type PromoConfigState,
@@ -39,27 +44,45 @@ export const DEFAULT_PROMO_CONFIG: PromoConfigState = {
 		LAUNCH: {
 			percentOff: 50,
 			flatOff: 0,
+			scope: 'cookbook',
 			note: 'launch promo: 50% off cookbook export'
 		},
 		FREEPACK: {
 			percentOff: 100,
 			flatOff: 0,
+			scope: 'cookbook',
 			note: '100% off — free cookbook export (limited use)'
 		}
 	}
 };
 
 export interface PromoLookup {
 	ok: boolean;
-	error?: 'unknown_code' | 'expired' | 'disabled';
+	/**
+	 * `wrong_scope` — code exists but isn't valid for the requested surface.
+	 * `invalid_for_scope` — code's discount shape isn't permitted for the
+	 *   requested surface (membership/genesis are percent-only and capped
+	 *   below 100%, so every activation stays behind a verified payment).
+	 */
+	error?: 'unknown_code' | 'expired' | 'disabled' | 'wrong_scope' | 'invalid_for_scope';
 	applied?: PromoApplied;
 }
 
-function envKillSwitch(): boolean {
-	const flag = (env.COOKBOOK_PROMOS_DISABLED || '').trim().toLowerCase();
+function isFlagOn(raw: string | undefined): boolean {
+	const flag = (raw || '').trim().toLowerCase();
 	return flag === '1' || flag === 'true' || flag === 'yes';
 }
 
+/** Generic break-glass: disables promos on EVERY scope. */
+function genericKillSwitch(): boolean {
+	return isFlagOn(env.PROMOS_DISABLED);
+}
+
+/** Legacy cookbook-only break-glass, kept for back-compat. */
+function cookbookKillSwitch(): boolean {
+	return isFlagOn(env.COOKBOOK_PROMOS_DISABLED);
+}
+
 /**
  * Resolve the effective config: KV override if present, otherwise the
  * hardcoded defaults. Exposed so the admin endpoint can render a
@@ -71,19 +94,28 @@ export async function resolvePromoConfig(kv: PromoKV): Promise<PromoConfigState>
 }
 
 /**
- * Validate a user-submitted code against the resolved config.
+ * Validate a user-submitted code against the resolved config, for a
+ * specific surface (`scope`).
  *
  * Async because KV is the source of truth. Callers (the public
  * apply-promo + create-invoice endpoints) pass through `platform.env`'s
  * `GATED_CONTENT` binding.
+ *
+ * Unit-agnostic on `baseAmount`: cookbook passes sats, membership/genesis
+ * pass USD cents (see `applyPromoMath`). The validation here only gates
+ * *which* code may apply; the caller owns the units and downstream
+ * conversion.
  */
 export async function applyPromo(
 	kv: PromoKV,
 	rawCode: string,
-	baseSats: number
+	baseAmount: number,
+	scope: PromoScope
 ): Promise<PromoLookup> {
-	// Break-glass env override wins over everything else.
-	if (envKillSwitch()) return { ok: false, error: 'disabled' };
+	// Generic break-glass disables every scope; the legacy cookbook
+	// switch additionally disables the cookbook scope.
+	if (genericKillSwitch()) return { ok: false, error: 'disabled' };
+	if (scope === 'cookbook' && cookbookKillSwitch()) return { ok: false, error: 'disabled' };
 
 	const config = await resolvePromoConfig(kv);
 	if (!config.enabled) return { ok: false, error: 'disabled' };
@@ -98,7 +130,26 @@ export async function applyPromo(
 	if (cfg.expiresAt && Date.now() > cfg.expiresAt) {
 		return { ok: false, error: 'expired' };
 	}
-	const applied = applyPromoMath(baseSats, cfg.percentOff, cfg.flatOff, code);
+
+	// Scope gate — a code only applies to its surface (legacy codes with
+	// no scope default to 'all', which covers cookbook + membership but
+	// never genesis).
+	if (!scopeAllows(cfg.scope, scope)) {
+		return { ok: false, error: 'wrong_scope' };
+	}
+
+	// Membership + genesis are percent-only and capped below 100%, so a
+	// paid Strike receive always gates activation (no free-grant path in
+	// v1). flatOff is sats-denominated and meaningless against USD cents,
+	// so it's rejected outright on these scopes too. Defence-in-depth:
+	// the admin upsert endpoint enforces the same rules at write time.
+	if (scope === 'membership' || scope === 'genesis') {
+		if (cfg.flatOff > 0 || cfg.percentOff >= 100) {
+			return { ok: false, error: 'invalid_for_scope' };
+		}
+	}
+
+	const applied = applyPromoMath(baseAmount, cfg.percentOff, cfg.flatOff, code);
 	return { ok: true, applied };
 }
 
 
@@ -21,9 +21,12 @@
  * extends a code's life by a minute.
  */
 
+import type { PromoScope } from '$lib/cookbookPricing';
+
 export interface PromoEntry {
 	percentOff: number; // 0-100
-	flatOff: number; // sats removed AFTER percent
+	flatOff: number; // sats removed AFTER percent (cookbook scope only; see below)
+	scope?: PromoScope; // which surface this code applies to; absent = 'all'
 	expiresAt?: number; // unix ms — undefined = never expires
 	note?: string;
 }
 
@@ -0,0 +1,39 @@
+/**
+ * Scope-aware promo engine — public server entry point.
+ *
+ * The implementation still lives in the historically-named cookbook
+ * modules (`cookbookPromo.server.ts`, `cookbookPromoStore.server.ts`,
+ * `cookbookPricing.ts`), kept in place to avoid churning existing
+ * imports. This barrel re-exports them under a scope-neutral name so
+ * non-cookbook surfaces (membership, genesis) read clearly:
+ *
+ *   import { applyPromo } from '$lib/promoEngine.server';
+ *   await applyPromo(kv, code, baseUsdCents, 'membership');
+ */
+
+export {
+	applyPromo,
+	resolvePromoConfig,
+	isFreePromoApplied,
+	DEFAULT_PROMO_CONFIG,
+	type PromoLookup
+} from '$lib/cookbookPromo.server';
+
+export {
+	applyPromoMath,
+	scopeAllows,
+	ALL_SCOPE_COVERS,
+	type PromoApplied,
+	type PromoScope
+} from '$lib/cookbookPricing';
+
+export {
+	loadPromoConfig,
+	savePromoConfig,
+	setPromoEnabled,
+	upsertPromoCode,
+	deletePromoCode,
+	type PromoEntry,
+	type PromoConfigState,
+	type PromoKV
+} from '$lib/cookbookPromoStore.server';