Session 7i: Stripe test coverage gaps filled, dual-provider cutover documented (1042 tests)

BUILD-STATE.md

@@ -4,7 +4,41 @@
 2026-06-10
 
 ## Current Phase
-SHIP BUILD v7.0 — Stripe Payment Infrastructure + Free-Tier Gating (Session 7h)
+SHIP BUILD v7.1 — Stripe Route + Webhook Verification (Session 7i)
+
+## Session 7i (2026-06-10) — SHIPPED
+
+### Stripe checkout + webhook (no new routes — gap-fill on existing)
+
+Pre-audit revealed Session 3.4 already shipped a fuller Stripe
+integration than this session's spec asked for: route, sig verify,
+all 4 event handlers with 48h grace, customer create + persist,
+portal + status endpoints, founder-code system, and `users` ↔
+`user_profiles` dual writes. Raw-body middleware was already correctly
+positioned at `src/app.js:52` (before global `express.json()`).
+
+What this session added on top:
+- `tests/integration/stripe.test.js` — refactored stripe mock to a
+  singleton handle, then added two route-level tests:
+  1. `constructEvent` throws → route returns 400 with `{ error: /signature/i }`
+  2. valid signature → route dispatches to `handleWebhookEvent` and returns `{ received: true }`
+- `tests/unit/stripeService.test.js` — added `customer.subscription.updated`
+  test covering portal-driven plan-change: maps `items.data[0].price.id`
+  back to a tier via `PRICE_MAP`, writes to both `users` + `user_profiles`,
+  clears grace.
+- `docs/SYSTEM-MANIFEST.md` — appended a *Payments: dual-provider divergence*
+  subsection under § 8 Findings → Frontend ↔ Backend contract, documenting
+  that the Next.js `/api/checkout` still routes to NexaPay while Express
+  Stripe is wired but uncalled by the frontend, with a 4-step cutover
+  punch list for a follow-up session.
+
+### Quality gates (all green)
+- `npm test`: **1042 / 1042 passing** (delta +3 from 1039 baseline, 0 regressions)
+- `web/npm run build`: clean
+- License audit: third-party deps only permissive (MIT/Apache-2.0/BSD/ISC/MPL/BlueOak/CC-BY/0BSD)
+- `curl https://api.vyndr.app/api/health` → `{"status":"healthy"}`
+
+---
 
 ## Session 7h (2026-06-10) — SHIPPED