tesseract.js (self-hosted WASM, Apache-2.0) + pure per-book layout
parsers (DK/FD/MGM/Caesars) with per-field confidence and needs_review
honesty — the reader never guesses. POST /api/slips/parse (auth, free
1/day paid 10/day, 4MB cap) + Next proxy. Gated /slip page: upload or
paste, manual-correct UI, per-leg grades through the normal engine
(refusals render honestly), add-all to Parlay Lab, share card. Vision
model upgrade logged post-revenue. 2574 -> 2608 tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add NFL keys to oddsNormalizer.MARKET_MAP (defensive; same silent-zero
class as the Session 30 MLB bug) + NFL surface test
- npm audit fix: ws/qs + Supabase transitives, 7 vulns -> 0 (semver-safe)
- Audit findings documented in BUILD-STATE: grades cache has no writer,
NFL/NHL not wired end-to-end, rate limiting only on /analyze, tests
mutate a tracked jsonl, leaked GitHub PAT in origin remote (rotate)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Subscription billing:
- POST /api/stripe/checkout — creates Stripe Checkout session
- POST /api/stripe/webhook — handles lifecycle events (raw body)
- POST /api/stripe/portal — customer self-service management
- GET /api/stripe/status — current subscription info
Founder code system:
- Validates codes against env var list with expiry date
- Routes to founder Stripe Price IDs (locked rate for life)
- 4 price objects: analyst, analyst-founder, desk, desk-founder
Webhook events handled:
- checkout.session.completed → tier update + founder status
- customer.subscription.deleted → revert to free tier
- invoice.payment_failed → logged
Lazy Stripe init (no API key required at import time).
Raw body middleware for webhook signature verification.
16 new tests, 237 total (210 Node.js + 27 Python), all passing.
Phase 3 Web MVP COMPLETE. All roadmap features shipped.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
builtbykev