[ralyodio]

Credit code redemptions and invite/affiliate links (fleet rollout, batch 1).

What a code grants: @profullstack/redeem-credits unit usd_cents = store credit toward rented numbers ($5/mo). Redeem on Settings ("Have a code?"), POST /api/v1/redeem, CLI smshub-cli redeem, MCP redeem_code.

How credit pays for a rental: payment method CREDIT (chain field on POST /api/v1/numbers/orders and /numbers/{id}/renew; "Pay with store credit" / "Renew with credit" on /numbers; rent --credit). createOrder checks the balance (402 if short, no order opened), inserts the normal number_orders row with chain CREDIT, spends the credit (credit_append_if_version CAS, so parallel orders cannot overdraw), then runs the same pending -> paid claim + provision() the CoinPay webhook runs (extracted as claimAndProvision). A renewal extends phone_numbers.expires_at exactly like a paid renewal. If provisioning gives up for good (status failed), the credit is granted back (refund:order:<id>). The whole order must be covered by credit (no split payments).

Invites: @profullstack/affiliates, 3 per account at /invites (API GET/POST /api/v1/invites, CLI invites [new], MCP list_invites / create_invite). /i/<code> sets a 7-day cookie and lands on /register, which says what the invite gives and also stores the code in signup metadata. On /auth/callback a new account (under 7 days old) with a confirmed email and a signup profile (smshub's signup checks) spends the invite, and both people get $2.50 of credit, so two accepted invites pay for a month. Unconfirmed, profile-less, old accounts and self-invites spend nothing.

?ref=: first touch on new accounts via refFromRequest = the existing referral_code cookie set by trackReferralCode; codes from the old referral_codes table come back external and are not recorded, so a sign-up is never counted twice.

DB: 017_redeem_credits.sql, 018_affiliates.sql copied from the packages (RLS on, no policies, service_role only); applied by hand on dev2 before merge, after a pg_dump -n public backup.

Minting: scripts/mint-credit-code.mjs --usd 10 --label "for Kim" with the app env.

Tests: src/lib/__tests__/rewards.test.ts (codes, quota, invite accepted once with both sides credited, checks, cookie vs metadata, ref first touch + external), src/lib/managed-numbers/__tests__/credit-orders.test.ts (402 when short, credit order provisions with no CoinPay call, renewal, refund on final failure). 317 pass; typecheck clean; next build passes.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 6

Severity	Rule	Location
HIGH	sh-unquoted-expansion-destructive	public/install.sh:67
HIGH	sh-remote-script-execution	public/install.sh:89
MEDIUM	sh-remote-script-execution	public/install.sh:133
MEDIUM	js-open-redirect	src/app/numbers/page.tsx:180
MEDIUM	js-open-redirect	src/components/inbox-client.tsx:35
MEDIUM	js-unescaped-html-sink	src/components/pit-footer.tsx:17
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:24
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:46
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:60
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:78
LOW	secret-generic-credential	supabase/config.toml:287
LOW	secret-generic-credential	supabase/config.toml:319

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​affiliates@​0.2.0
	@​profullstack/​redeem-credits@​0.2.0

View full report