Payment Launch Pack

Run npm run payment:launch-pack after changing price, hosted AI cap, support, domain, billing backend, Stripe setup, Customer Portal, webhook, or secret-store state.

Safe Command Sequence

Payment Launch Actions

Required Webhook Events

Live Payment Rule

Keep checkout disabled until business/legal identity, support inbox roundtrip, public domain, policy/legal review, Customer Portal, webhook endpoint, backend URL, secret store, test-mode checkout, entitlement activation, release trust, and deployability preflight are all green.

Never store raw Stripe, webhook, license, or command-center secrets in repo files, dashboard state, Markdown, CSV, screenshots, or chat.

Payment Launch Pack JSON

{
  "schemaVersion": 1,
  "generatedAt": "2026-07-18T13:47:02.811Z",
  "status": "PAYMENT_LAUNCH_WAITING_ON_HANDOFFS",
  "label": "Payment Launch Waiting On Handoffs",
  "offer": {
    "productName": "NyrA Swarm Little Buddy Pro",
    "supportEmail": "support@support.porterlabz.com",
    "monthlyPriceCents": "2500",
    "modeledMonthlyPriceCents": 2500,
    "priceStatus": "Approved value saved",
    "hostedAiCap": "300 hosted AI messages/month until measured usage proves more headroom",
    "hostedAiCapStatus": "Approved cap saved",
    "trialPolicy": "No trial for first paid launch",
    "trialPolicyStatus": "Saved",
    "byokTiming": "BYOK later, not first paid launch",
    "byokTimingStatus": "Saved"
  },
  "billingRehearsal": {
    "label": "Hosted test billing passed; live launch remains gated by legal, support, release trust, physical-phone proof, and the guarded live-mode preflight.",
    "mode": "test",
    "backendBaseUrl": "https://billing.porterlabz.com",
    "webhookEndpointUrl": "https://billing.porterlabz.com/api/billing/webhook",
    "customerPortalConfigured": "Yes",
    "supportInboxConfirmed": "Yes"
  },
  "cloudBilling": {
    "label": "Cloudflare Worker, D1 billing storage, device pairing, and recovery runtime configuration are deployed and health verified; email recovery stays fail-closed until sender-domain onboarding and a real delivery roundtrip pass, and paid launch remains gated by guarded live-mode preflight, legal review.",
    "workerUrl": "https://billing.porterlabz.com",
    "d1DatabaseId": "148a0520-51bb-4f31-895b-02a99efd31b4",
    "secretStatus": "Deployed Worker secret configuration verified"
  },
  "releaseCandidate": {
    "status": "INTERNAL_ALPHA_ONLY",
    "label": "Internal Alpha Only",
    "paidBetaAllowed": false
  },
  "requiredWebhookEvents": [
    "checkout.session.completed",
    "invoice.paid",
    "invoice.payment_failed",
    "customer.subscription.updated",
    "customer.subscription.deleted"
  ],
  "recommendedWebhookEvents": [
    "entitlements.active_entitlement_summary.updated"
  ],
  "actions": [
    {
      "id": "legal-review",
      "source": "deployability-blockers",
      "phase": "1. Legal And Stripe Identity",
      "priority": "P0",
      "owner": "User",
      "status": "Waiting on user",
      "label": "Attorney/accountant review approved for paid beta",
      "detail": "attorneyReviewStatus=Not approved",
      "action": "Mark attorney/accountant review approved only after paid-beta policies, tax, refund, privacy, and support language are cleared.",
      "evidenceNeeded": "Save billingRehearsal.attorneyReviewStatus and upload evidence to legal-review when available.",
      "dashboardPage": "pages/billing-rehearsal.html",
      "dashboardField": "billingRehearsal.attorneyReviewStatus",
      "uploadSlot": "legal-review",
      "verificationCommand": "npm run test:policy-readiness && npm run billing:live-preflight -- --mode test --allow-blocked",
      "noGoRule": "Do not mark this ready until the saved dashboard state or uploaded evidence proves it."
    },
    {
      "id": "billing-live-mode",
      "source": "deployability-blockers",
      "phase": "8. Live Payment Gate",
      "priority": "P0",
      "owner": "User + Codex",
      "status": "User + Codex gated",
      "label": "Billing rehearsal mode set to live for final money preflight",
      "detail": "billingRehearsal.mode=test",
      "action": "Keep rehearsal mode in test until test checkout, portal, webhook, support, legal, domain, secrets, and release gates pass.",
      "evidenceNeeded": "Save billingRehearsal.mode and upload evidence to stripe-screenshots when available.",
      "dashboardPage": "pages/billing-rehearsal.html",
      "dashboardField": "billingRehearsal.mode",
      "uploadSlot": "stripe-screenshots",
      "verificationCommand": "npm run billing:live-preflight -- --mode live",
      "noGoRule": "Do not mark this ready until the saved dashboard state or uploaded evidence proves it."
    },
    {
      "id": "secret-STRIPE_SECRET_KEY",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "STRIPE_SECRET_KEY",
      "detail": "Stripe Checkout, Customer Portal, subscription lookups, and billing API requests.",
      "action": "Cloudflare billing Worker secret and temporary billing rehearsal shell; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: STRIPE_SECRET_KEY",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-STRIPE_WEBHOOK_SECRET",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "STRIPE_WEBHOOK_SECRET",
      "detail": "Stripe webhook signature verification for subscription and entitlement events.",
      "action": "Cloudflare billing Worker secret and temporary billing rehearsal shell; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: STRIPE_WEBHOOK_SECRET",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_STRIPE_PRICE_PRO_MONTHLY",
      "source": "secret-store-pack",
      "phase": "3. Stripe Product And Price",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_STRIPE_PRICE_PRO_MONTHLY",
      "detail": "Checkout Session creation for the monthly Pro subscription price.",
      "action": "Cloudflare billing Worker secret and temporary billing rehearsal shell; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: NYRA_STRIPE_PRICE_PRO_MONTHLY",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_BILLING_SUCCESS_URL",
      "source": "secret-store-pack",
      "phase": "6. Support And Domain",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_BILLING_SUCCESS_URL",
      "detail": "Checkout success redirect after Stripe payment.",
      "action": "Cloudflare billing Worker secret or hosted backend environment variable; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: NYRA_BILLING_SUCCESS_URL",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_BILLING_CANCEL_URL",
      "source": "secret-store-pack",
      "phase": "6. Support And Domain",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_BILLING_CANCEL_URL",
      "detail": "Checkout cancellation redirect back to the launch or app flow.",
      "action": "Cloudflare billing Worker secret or hosted backend environment variable; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: NYRA_BILLING_CANCEL_URL",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_BILLING_RETURN_URL",
      "source": "secret-store-pack",
      "phase": "6. Support And Domain",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_BILLING_RETURN_URL",
      "detail": "Customer Portal return redirect after subscription management.",
      "action": "Cloudflare billing Worker secret or hosted backend environment variable; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: NYRA_BILLING_RETURN_URL",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_LICENSE_API_TOKEN",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_LICENSE_API_TOKEN",
      "detail": "Private license status API access and customer-safe device activation.",
      "action": "Cloudflare billing Worker secret and desktop activation configuration; verify with npm run cloud:billing:check && npm run test:cloud-billing-worker.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: NYRA_LICENSE_API_TOKEN",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:billing:check && npm run test:cloud-billing-worker",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_LICENSE_SIGNING_SECRET",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_LICENSE_SIGNING_SECRET",
      "detail": "HMAC signing of device-scoped license access tokens accepted by billing and mobile bridge APIs.",
      "action": "Cloudflare billing Worker and mobile bridge Worker secret; verify with npm run cloud:billing:check && npm run test:cloud-billing-worker && npm run cloud:mobile-bridge:check.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-billing.html",
      "dashboardField": "deployment secret store: NYRA_LICENSE_SIGNING_SECRET",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:billing:check && npm run test:cloud-billing-worker && npm run cloud:mobile-bridge:check",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_MOBILE_BRIDGE_TOKEN",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_MOBILE_BRIDGE_TOKEN",
      "detail": "Private mobile bridge API authentication until paid customer auth replaces the bundled alpha-token path.",
      "action": "Cloudflare mobile bridge Worker secret and temporary bridge test shell; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-mobile-bridge.html",
      "dashboardField": "deployment secret store: NYRA_MOBILE_BRIDGE_TOKEN",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_OPENAI_API_KEY",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_OPENAI_API_KEY",
      "detail": "Hosted OpenAI model routing through the mobile bridge.",
      "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-mobile-bridge.html",
      "dashboardField": "deployment secret store: NYRA_OPENAI_API_KEY",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_ANTHROPIC_API_KEY",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_ANTHROPIC_API_KEY",
      "detail": "Hosted Anthropic model routing through the mobile bridge.",
      "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-mobile-bridge.html",
      "dashboardField": "deployment secret store: NYRA_ANTHROPIC_API_KEY",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_GEMINI_API_KEY",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_GEMINI_API_KEY",
      "detail": "Hosted Gemini model routing through the mobile bridge.",
      "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-mobile-bridge.html",
      "dashboardField": "deployment secret store: NYRA_GEMINI_API_KEY",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_GROK_API_KEY",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_GROK_API_KEY",
      "detail": "Hosted Grok model routing through the mobile bridge.",
      "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-mobile-bridge.html",
      "dashboardField": "deployment secret store: NYRA_GROK_API_KEY",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    },
    {
      "id": "secret-NYRA_ANDROID_DOWNLOAD_TICKET_SECRET",
      "source": "secret-store-pack",
      "phase": "7. Secret Store And Rehearsal",
      "priority": "P0",
      "owner": "User",
      "status": "Secret-store only",
      "label": "NYRA_ANDROID_DOWNLOAD_TICKET_SECRET",
      "detail": "Short-lived Android APK download tickets for customer update installs without a bundled shared bridge token.",
      "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
      "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
      "dashboardPage": "pages/cloud-mobile-bridge.html",
      "dashboardField": "deployment secret store: NYRA_ANDROID_DOWNLOAD_TICKET_SECRET",
      "uploadSlot": "cloud-handoff",
      "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
      "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
    }
  ],
  "phases": [
    {
      "phase": "1. Legal And Stripe Identity",
      "actions": [
        {
          "id": "legal-review",
          "source": "deployability-blockers",
          "phase": "1. Legal And Stripe Identity",
          "priority": "P0",
          "owner": "User",
          "status": "Waiting on user",
          "label": "Attorney/accountant review approved for paid beta",
          "detail": "attorneyReviewStatus=Not approved",
          "action": "Mark attorney/accountant review approved only after paid-beta policies, tax, refund, privacy, and support language are cleared.",
          "evidenceNeeded": "Save billingRehearsal.attorneyReviewStatus and upload evidence to legal-review when available.",
          "dashboardPage": "pages/billing-rehearsal.html",
          "dashboardField": "billingRehearsal.attorneyReviewStatus",
          "uploadSlot": "legal-review",
          "verificationCommand": "npm run test:policy-readiness && npm run billing:live-preflight -- --mode test --allow-blocked",
          "noGoRule": "Do not mark this ready until the saved dashboard state or uploaded evidence proves it."
        }
      ]
    },
    {
      "phase": "8. Live Payment Gate",
      "actions": [
        {
          "id": "billing-live-mode",
          "source": "deployability-blockers",
          "phase": "8. Live Payment Gate",
          "priority": "P0",
          "owner": "User + Codex",
          "status": "User + Codex gated",
          "label": "Billing rehearsal mode set to live for final money preflight",
          "detail": "billingRehearsal.mode=test",
          "action": "Keep rehearsal mode in test until test checkout, portal, webhook, support, legal, domain, secrets, and release gates pass.",
          "evidenceNeeded": "Save billingRehearsal.mode and upload evidence to stripe-screenshots when available.",
          "dashboardPage": "pages/billing-rehearsal.html",
          "dashboardField": "billingRehearsal.mode",
          "uploadSlot": "stripe-screenshots",
          "verificationCommand": "npm run billing:live-preflight -- --mode live",
          "noGoRule": "Do not mark this ready until the saved dashboard state or uploaded evidence proves it."
        }
      ]
    },
    {
      "phase": "7. Secret Store And Rehearsal",
      "actions": [
        {
          "id": "secret-STRIPE_SECRET_KEY",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "STRIPE_SECRET_KEY",
          "detail": "Stripe Checkout, Customer Portal, subscription lookups, and billing API requests.",
          "action": "Cloudflare billing Worker secret and temporary billing rehearsal shell; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: STRIPE_SECRET_KEY",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-STRIPE_WEBHOOK_SECRET",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "STRIPE_WEBHOOK_SECRET",
          "detail": "Stripe webhook signature verification for subscription and entitlement events.",
          "action": "Cloudflare billing Worker secret and temporary billing rehearsal shell; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: STRIPE_WEBHOOK_SECRET",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_LICENSE_API_TOKEN",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_LICENSE_API_TOKEN",
          "detail": "Private license status API access and customer-safe device activation.",
          "action": "Cloudflare billing Worker secret and desktop activation configuration; verify with npm run cloud:billing:check && npm run test:cloud-billing-worker.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: NYRA_LICENSE_API_TOKEN",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:billing:check && npm run test:cloud-billing-worker",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_LICENSE_SIGNING_SECRET",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_LICENSE_SIGNING_SECRET",
          "detail": "HMAC signing of device-scoped license access tokens accepted by billing and mobile bridge APIs.",
          "action": "Cloudflare billing Worker and mobile bridge Worker secret; verify with npm run cloud:billing:check && npm run test:cloud-billing-worker && npm run cloud:mobile-bridge:check.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: NYRA_LICENSE_SIGNING_SECRET",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:billing:check && npm run test:cloud-billing-worker && npm run cloud:mobile-bridge:check",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_MOBILE_BRIDGE_TOKEN",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_MOBILE_BRIDGE_TOKEN",
          "detail": "Private mobile bridge API authentication until paid customer auth replaces the bundled alpha-token path.",
          "action": "Cloudflare mobile bridge Worker secret and temporary bridge test shell; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-mobile-bridge.html",
          "dashboardField": "deployment secret store: NYRA_MOBILE_BRIDGE_TOKEN",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_OPENAI_API_KEY",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_OPENAI_API_KEY",
          "detail": "Hosted OpenAI model routing through the mobile bridge.",
          "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-mobile-bridge.html",
          "dashboardField": "deployment secret store: NYRA_OPENAI_API_KEY",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_ANTHROPIC_API_KEY",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_ANTHROPIC_API_KEY",
          "detail": "Hosted Anthropic model routing through the mobile bridge.",
          "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-mobile-bridge.html",
          "dashboardField": "deployment secret store: NYRA_ANTHROPIC_API_KEY",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_GEMINI_API_KEY",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_GEMINI_API_KEY",
          "detail": "Hosted Gemini model routing through the mobile bridge.",
          "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-mobile-bridge.html",
          "dashboardField": "deployment secret store: NYRA_GEMINI_API_KEY",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_GROK_API_KEY",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_GROK_API_KEY",
          "detail": "Hosted Grok model routing through the mobile bridge.",
          "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-mobile-bridge.html",
          "dashboardField": "deployment secret store: NYRA_GROK_API_KEY",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_ANDROID_DOWNLOAD_TICKET_SECRET",
          "source": "secret-store-pack",
          "phase": "7. Secret Store And Rehearsal",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_ANDROID_DOWNLOAD_TICKET_SECRET",
          "detail": "Short-lived Android APK download tickets for customer update installs without a bundled shared bridge token.",
          "action": "Cloudflare mobile bridge Worker secret; verify with npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-mobile-bridge.html",
          "dashboardField": "deployment secret store: NYRA_ANDROID_DOWNLOAD_TICKET_SECRET",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run cloud:mobile-bridge:check && npm run test:mobile-bridge-security",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        }
      ]
    },
    {
      "phase": "3. Stripe Product And Price",
      "actions": [
        {
          "id": "secret-NYRA_STRIPE_PRICE_PRO_MONTHLY",
          "source": "secret-store-pack",
          "phase": "3. Stripe Product And Price",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_STRIPE_PRICE_PRO_MONTHLY",
          "detail": "Checkout Session creation for the monthly Pro subscription price.",
          "action": "Cloudflare billing Worker secret and temporary billing rehearsal shell; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: NYRA_STRIPE_PRICE_PRO_MONTHLY",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        }
      ]
    },
    {
      "phase": "6. Support And Domain",
      "actions": [
        {
          "id": "secret-NYRA_BILLING_SUCCESS_URL",
          "source": "secret-store-pack",
          "phase": "6. Support And Domain",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_BILLING_SUCCESS_URL",
          "detail": "Checkout success redirect after Stripe payment.",
          "action": "Cloudflare billing Worker secret or hosted backend environment variable; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: NYRA_BILLING_SUCCESS_URL",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_BILLING_CANCEL_URL",
          "source": "secret-store-pack",
          "phase": "6. Support And Domain",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_BILLING_CANCEL_URL",
          "detail": "Checkout cancellation redirect back to the launch or app flow.",
          "action": "Cloudflare billing Worker secret or hosted backend environment variable; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: NYRA_BILLING_CANCEL_URL",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        },
        {
          "id": "secret-NYRA_BILLING_RETURN_URL",
          "source": "secret-store-pack",
          "phase": "6. Support And Domain",
          "priority": "P0",
          "owner": "User",
          "status": "Secret-store only",
          "label": "NYRA_BILLING_RETURN_URL",
          "detail": "Customer Portal return redirect after subscription management.",
          "action": "Cloudflare billing Worker secret or hosted backend environment variable; verify with npm run billing:live-preflight -- --mode test --allow-blocked.",
          "evidenceNeeded": "Set via Wrangler secret, deployment secret manager, or temporary shell only. Generated docs may show placeholders only.",
          "dashboardPage": "pages/cloud-billing.html",
          "dashboardField": "deployment secret store: NYRA_BILLING_RETURN_URL",
          "uploadSlot": "cloud-handoff",
          "verificationCommand": "npm run billing:live-preflight -- --mode test --allow-blocked",
          "noGoRule": "Never paste raw secret values into dashboard fields, Markdown files, CSV files, screenshots, source code, repo state, or chat."
        }
      ]
    }
  ],
  "paymentCommands": [
    {
      "id": "refresh-pricing-model",
      "phase": "2. Offer And Price",
      "owner": "Codex",
      "command": "npm run pricing:model && npm run test:pricing-model",
      "purpose": "Refresh pricing, Stripe fee estimate, provider reserve, and hosted AI cap before the user approves the SKU.",
      "noGoRule": "Do not create a Stripe Price until the user-approved monthly price and hosted AI cap are saved."
    },
    {
      "id": "stripe-plan-no-secret",
      "phase": "3. Stripe Product And Price",
      "owner": "Codex",
      "command": "npm run billing:stripe-plan",
      "purpose": "Preview the Stripe product, price readiness, Customer Portal dependency, and dashboard fields without requiring STRIPE_SECRET_KEY or creating Stripe resources.",
      "noGoRule": "Planning output only. Never paste Stripe secret keys, webhook secrets, or live credentials into dashboard fields, generated files, screenshots, or chat."
    },
    {
      "id": "stripe-setup-dry-run",
      "phase": "3. Stripe Product And Price",
      "owner": "Codex",
      "command": "npm run billing:stripe-plan -- --price-cents 2500 --support-email support@support.porterlabz.com --name \"NyrA Swarm Little Buddy Pro\"",
      "purpose": "Preview the exact Stripe product/price payload from the command center values without creating live Stripe resources.",
      "noGoRule": "Plan only until the price, support email, product name, and Customer Portal setup path are approved."
    },
    {
      "id": "stripe-setup-test-execute",
      "phase": "3. Stripe Product And Price",
      "owner": "User + Codex",
      "command": "npm run billing:stripe-setup -- --price-cents 2500 --support-email support@support.porterlabz.com --name \"NyrA Swarm Little Buddy Pro\" --execute",
      "purpose": "Create or reuse the Stripe product and monthly Price in test mode after STRIPE_SECRET_KEY is set in a temporary shell.",
      "noGoRule": "Use a test key first. Live Stripe creation waits for legal, support, tax, domain, and launch approvals."
    },
    {
      "id": "set-billing-worker-secrets",
      "phase": "7. Secret Store And Rehearsal",
      "owner": "User + Codex",
      "command": "npm run secret:pack",
      "purpose": "Use the Secret Store Setup Pack for Stripe, webhook, billing URL, license, and entitlement secret placement.",
      "noGoRule": "Do not copy raw secret values into generated docs, command-center state, or chat."
    },
    {
      "id": "verify-billing-worker",
      "phase": "5. Billing Backend",
      "owner": "Codex",
      "command": "npm run cloud:billing:check && npm run test:cloud-billing-worker",
      "purpose": "Verify billing Worker routes, D1 schema, webhook signature handling, portal route, checkout route, and license status route.",
      "noGoRule": "Do not connect checkout to public launch until billing Worker/backend checks and hosted rehearsal pass."
    },
    {
      "id": "sync-billing-worker-config",
      "phase": "5. Billing Backend",
      "owner": "Codex",
      "command": "npm run cloud:billing:config:sync && npm run test:cloud-billing-config-sync",
      "purpose": "Apply non-secret Cloud Billing dashboard handoffs to the production billing Worker config.",
      "noGoRule": "This step must not write Stripe keys, webhook secrets, license secrets, Customer Portal secrets, or customer data to repo files."
    },
    {
      "id": "test-mode-preflight",
      "phase": "7. Secret Store And Rehearsal",
      "owner": "User + Codex",
      "command": "npm run billing:live-preflight -- --mode test --allow-blocked",
      "purpose": "Show remaining test-mode payment blockers without failing the whole dashboard build.",
      "noGoRule": "Do not proceed to hosted checkout rehearsal until blockers are understood and intentionally accepted for test mode."
    },
    {
      "id": "hosted-test-rehearsal",
      "phase": "7. Secret Store And Rehearsal",
      "owner": "User + Codex",
      "command": "npm run billing:live-rehearsal -- --mode test",
      "purpose": "After backend deployment, verify hosted /health and optionally create a Stripe test Checkout Session.",
      "noGoRule": "Create a test Checkout Session only when NYRA_BILLING_REHEARSAL_EXECUTE=true is set intentionally for that run."
    },
    {
      "id": "live-mode-final-gate",
      "phase": "8. Live Payment Gate",
      "owner": "User + Codex",
      "command": "npm run billing:live-preflight -- --mode live",
      "purpose": "Final guarded live-mode check before any public paid checkout path is enabled.",
      "noGoRule": "Live mode also requires NYRA_ALLOW_LIVE_BILLING_REHEARSAL=true immediately before the run and all paid-beta gates closed."
    }
  ],
  "counts": {
    "totalActions": 16,
    "userActions": 16,
    "secretActions": 14,
    "paymentCommands": 10,
    "p0Actions": 16
  },
  "outputs": {
    "json": "docs/launch_command_center/payment-launch-pack.json",
    "csv": "docs/launch_command_center/payment-launch-pack.csv",
    "report": "docs/launch_command_center/PAYMENT_LAUNCH_PACK.md",
    "dashboard": "docs/launch_command_center/pages/payment-launch-pack.html"
  }
}