chore(sync): promote upstream v1.1.1, RevenueCat billing, and OpenAI-compatible support to main

.env.example

@@ -247,6 +247,8 @@ OPENAI_IMAGE_MODEL="chatgpt-image-latest"
 OPENAI_OAUTH_CLIENT_ID="sample_openai_oauth_client_id"
 # OpenAI App domain verification challenge string (optional)
 OPENAI_APP_CHALLANGE="sample_openai_app_challenge_token"
+# EvoLink API key for Seedance AI video generation (https://evolink.ai)
+EVOLINK_API_KEY="sample_evolink_api_key"
 # Tavily AI Search API Key for real-time web grounding in agent workflows (optional)
 TAVILY_API_KEY="tvly-sample_tavily_api_key"
 # Fal.ai API Key for image and video rendering generation (optional)
@@ -406,7 +408,7 @@ MIGRATE_PROVIDERS="tiktok:tiktok-business"
 NX_ADD_PLUGINS="false"
 
 # ==============================================================================
-# 14. Stripe Billing & Subscription Plans
+# 14. Stripe & In-App Purchase Billing (RevenueCat / Stripe)
 # ==============================================================================
 # Platform fee percentage (0.05 = 5%)
 FEE_AMOUNT="0.05"
@@ -420,6 +422,12 @@ STRIPE_SIGNING_KEY="whsec_sample_stripe_webhook_signing_secret"
 STRIPE_SIGNING_KEY_CONNECT="whsec_sample_stripe_connect_signing_secret"
 # Stripe coupon / promotional discount ID
 STRIPE_DISCOUNT_ID="sample_stripe_coupon_discount_id"
+# RevenueCat Secret Key (App Store & Google Play subscriptions)
+REVENUECAT_SECRET_KEY="sample_revenuecat_secret_key"
+# RevenueCat Webhook Authorization Header Secret
+REVENUECAT_WEBHOOK_SECRET="sample_revenuecat_webhook_secret"
+# Reject sandbox in-app purchases in production mode (true/false)
+IN_APP_PURCHASE_REJECT_SANDBOX="false"
 
 # ==============================================================================
 # 15. Telemetry, Observability & Analytics

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,7 @@
 # What kind of change does this PR introduce?
 
 <!-- [ ] Bug fix | [ ] Feature | [ ] Architecture & Docs | [ ] Refactor | [ ] CI/CD -->
+<!-- Name the change type, scope/component, and summary of changes. -->
 
 # Why was this change needed?
 
@@ -18,13 +19,18 @@
 
 <!--
 Write the steps here, replacing this whole comment. Leaving it as is, or writing
-"N/A" / "TBD" / an empty checkbox, counts as no QA at all.
+"N/A" / "TBD" / a bare empty checkbox as the whole section, counts as no QA at all.
+
+Write real steps a reviewer can follow without asking you anything: setup, action,
+expected result. Keep them as numbered checkboxes so a reviewer can tick them off -
+the numbering is what the review board extracts, the checkbox is for the reviewer.
+Steps inside a fenced code block are ignored, so keep them as plain lines.
 
 Example of what it should look like:
 
-1. Link a webhook endpoint pointing at http://localhost:9999 (nothing listening)
-2. Approve an application to trigger a delivery
-3. Delivery should show 4 attempts, roughly 1m / 5m / 30m apart, then stop
+1. [ ] Link a webhook endpoint pointing at http://localhost:9999 (nothing listening)
+2. [ ] Approve an application to trigger a delivery
+3. [ ] Delivery should show 4 attempts, roughly 1m / 5m / 30m apart, then stop
 -->
 
 # Checklist:

CLAUDE.md

@@ -64,8 +64,9 @@ const useCommunity = () => {
 - Whenever you generate a PR, PR description, or similar, **always** follow the PR Template (.github/PULL_REQUEST_TEMPLATE.md)
 - Every PR description **must** contain a `# QA` section with real, numbered steps a reviewer can follow to verify the change (setup, action, expected result), written so they can be run without asking the author anything. This is not optional and applies to humans and agents alike, including one-line fixes. The section is extracted verbatim and shown on the review board, so:
   - Use the exact heading `# QA` (`# Testing`, `# Test plan`, `# How to test`, `# How to verify`, `# Verification`, `# Steps to test` and `# Manual testing` are also recognised, but prefer `# QA`). The whole heading must match, so something like `## Testing philosophy` is not picked up.
-  - Never leave the template placeholder in place, and never write `N/A`, `TBD`, `todo`, `none` or an empty checkbox there - those all count as no QA at all and the board will show the PR as missing testing notes.
-  - Steps inside a fenced code block are ignored, so keep them as plain numbered lines.
+  - Never leave the template placeholder in place, and never write `N/A`, `TBD`, `todo`, `none` or a bare empty checkbox as the whole section - those all count as no QA at all and the board will show the PR as missing testing notes.
+  - Steps inside a fenced code block are ignored, so keep them as plain numbered lines. Write each step as a numbered checkbox (`1. [ ] step`) so a reviewer can tick it off while working through it - the numbering is what the board extracts, the checkbox is for the reviewer.
+- Every PR description **must** answer `# What kind of change does this PR introduce?` with actual detail, not just a category. `Bug fix.` / `Feature.` on its own is not acceptable. State the type, the area it touches (backend, frontend, orchestrator, a specific provider or screen), and in one to three sentences what concretely changed and where - the key function, endpoint, file or field - plus what deliberately stayed the same. A reader should understand the change from this section alone, without opening the diff.
 - Avoid as much as possible creating new files with pure logic of algorithms, it's usually wrong
 - When you write code, make sure that what you add looks like something similar somewhere else in the code, don't make weird patterns
 - When you finished running, run another agents that matches the new code with the existing system code, to see that it looks similar and is not a weird pattern.

apps/backend/src/api/api.module.ts

@@ -3,8 +3,11 @@ import { AuthController } from '@gitroom/backend/api/routes/auth.controller';
 import { AuthService } from '@gitroom/backend/services/auth/auth.service';
 import { UsersController } from '@gitroom/backend/api/routes/users.controller';
 import { AuthMiddleware } from '@gitroom/backend/services/auth/auth.middleware';
-import { StripeController } from '@gitroom/backend/api/routes/stripe.controller';
 import { StripeService } from '@gitroom/nestjs-libraries/services/stripe.service';
+import { PaymentController } from '@gitroom/backend/api/routes/payment.controller';
+import { PaymentService } from '@gitroom/nestjs-libraries/services/payment/payment.service';
+import { PaymentProviderManager } from '@gitroom/nestjs-libraries/services/payment/payment.provider.manager';
+import { RevenueCatProvider } from '@gitroom/nestjs-libraries/services/payment/providers/revenuecat.provider';
 import { AnalyticsController } from '@gitroom/backend/api/routes/analytics.controller';
 import { PoliciesGuard } from '@gitroom/backend/services/auth/permissions/permissions.guard';
 import { PermissionsService } from '@gitroom/backend/services/auth/permissions/permissions.service';
@@ -48,6 +51,7 @@ import { AppleProvider } from '@gitroom/backend/services/auth/providers/apple.pr
 import { FarcasterProvider } from '@gitroom/backend/services/auth/providers/farcaster.provider';
 import { WalletProvider } from '@gitroom/backend/services/auth/providers/wallet.provider';
 import { OauthProvider } from '@gitroom/backend/services/auth/providers/oauth.provider';
+import { StripeController } from '@gitroom/backend/api/routes/stripe.controller';
 
 const authenticatedController = [
   UsersController,
@@ -76,6 +80,7 @@ const authenticatedController = [
     ? [RootController, OAuthController]
     : [
         RootController,
+        PaymentController,
         StripeController,
         AuthController,
         PublicController,
@@ -88,6 +93,9 @@ const authenticatedController = [
   providers: [
     AuthService,
     StripeService,
+    PaymentService,
+    PaymentProviderManager,
+    RevenueCatProvider,
     OpenaiService,
     ExtractContentService,
     AuthMiddleware,

apps/backend/src/api/routes/billing.controller.ts

@@ -1,6 +1,13 @@
-import { Body, Controller, Get, HttpException, Param, Post, Req } from '@nestjs/common';
+import {
+  Body,
+  Controller,
+  Get,
+  HttpException,
+  Param,
+  Post,
+  Req,
+} from '@nestjs/common';
 import { SubscriptionService } from '@gitroom/nestjs-libraries/database/prisma/subscriptions/subscription.service';
-import { StripeService } from '@gitroom/nestjs-libraries/services/stripe.service';
 import { GetOrgFromRequest } from '@gitroom/nestjs-libraries/user/org.from.request';
 import { Organization, User } from '@prisma/client';
 import { BillingSubscribeDto } from '@gitroom/nestjs-libraries/dtos/billing/billing.subscribe.dto';
@@ -11,17 +18,25 @@ import { NotificationService } from '@gitroom/nestjs-libraries/database/prisma/n
 import { Request } from 'express';
 import { AuthService } from '@gitroom/helpers/auth/auth.service';
 import { UsersService } from '@gitroom/nestjs-libraries/database/prisma/users/users.service';
+import { PaymentService } from '@gitroom/nestjs-libraries/services/payment/payment.service';
+import { BillingSyncDto } from '@gitroom/nestjs-libraries/dtos/billing/billing.sync.dto';
 
 @ApiTags('Billing')
 @Controller('/billing')
 export class BillingController {
   constructor(
     private _subscriptionService: SubscriptionService,
-    private _stripeService: StripeService,
     private _notificationService: NotificationService,
-    private _usersService: UsersService
+    private _usersService: UsersService,
+    private _paymentService: PaymentService
   ) {}
 
+  // Billing routes are the web platform; the org's own provider (or the web
+  // default when it has none) handles the action.
+  private provider(org: Organization) {
+    return this._paymentService.getProviderForOrganization(org.id, 'web');
+  }
+
   private async assertNoOtherSubscribedAccount(user: User) {
     const other = await this._usersService.getUserWithActiveSubscriptionByEmail(
       user.email,
@@ -36,28 +51,29 @@ export class BillingController {
     @Param('id') body: string
   ) {
     return {
-      status: await this._stripeService.checkSubscription(org.id, body),
+      status: await (await this.provider(org)).checkSubscription(org.id, body),
     };
   }
 
   @Get('/check-discount')
   async checkDiscount(@GetOrgFromRequest() org: Organization) {
     return {
-      offerCoupon: !(await this._stripeService.checkDiscount(org.paymentId))
+      offerCoupon: !(await (await this.provider(org)).checkDiscount(org))
         ? false
         : AuthService.signJWT({ discount: true }),
     };
   }
 
   @Post('/apply-discount')
   async applyDiscount(@GetOrgFromRequest() org: Organization) {
-    await this._stripeService.applyDiscount(org.paymentId);
+    await (await this.provider(org)).applyDiscount(org);
   }
 
   @Post('/finish-trial')
   async finishTrial(@GetOrgFromRequest() org: Organization) {
+    const provider = await this.provider(org);
     try {
-      await this._stripeService.finishTrial(org.paymentId);
+      await provider.finishTrial(org);
     } catch (err) {}
     return {
       finish: true,
@@ -83,7 +99,7 @@ export class BillingController {
     }
 
     const uniqueId = req?.cookies?.track;
-    return this._stripeService.embedded(
+    return (await this.provider(org)).embedded(
       uniqueId,
       org.id,
       user.id,
@@ -104,7 +120,7 @@ export class BillingController {
     }
 
     const uniqueId = req?.cookies?.track;
-    return this._stripeService.subscribe(
+    return (await this.provider(org)).subscribe(
       uniqueId,
       org.id,
       user.id,
@@ -113,20 +129,38 @@ export class BillingController {
     );
   }
 
+  @Post('/sync')
+  async sync(
+    @GetOrgFromRequest() org: Organization,
+    @GetUserFromRequest() user: User,
+    @Body() body: BillingSyncDto
+  ) {
+    if (await this.assertNoOtherSubscribedAccount(user)) {
+      return { blocked: true };
+    }
+    await this._paymentService.assertCanUseProvider(org.id, body.provider);
+
+    try {
+      return await this._paymentService.syncSubscription(body.provider, org.id);
+    } catch (e) {
+      if (e instanceof HttpException) {
+        throw e;
+      }
+      throw new HttpException((e as Error)?.message || 'Sync failed', 400);
+    }
+  }
+
   @Get('/portal')
   async modifyPayment(@GetOrgFromRequest() org: Organization) {
-    const customer = await this._stripeService.getCustomerByOrganizationId(
-      org.id
-    );
-    const { url } = await this._stripeService.createBillingPortalLink(customer);
+    const { url } = await (await this.provider(org)).portalLink(org.id);
     return {
       portal: url,
     };
   }
 
   @Get('/')
   getCurrentBilling(@GetOrgFromRequest() org: Organization) {
-    return this._subscriptionService.getSubscriptionByOrganizationId(org.id);
+    return this._paymentService.getSubscription(org.id);
   }
 
   @Post('/cancel')
@@ -142,15 +176,15 @@ export class BillingController {
       user.email
     );
 
-    return this._stripeService.setToCancel(org.id);
+    return (await this.provider(org)).setToCancel(org.id);
   }
 
   @Post('/prorate')
-  prorate(
+  async prorate(
     @GetOrgFromRequest() org: Organization,
     @Body() body: BillingSubscribeDto
   ) {
-    return this._stripeService.prorate(org.id, body);
+    return (await this.provider(org)).prorate(org.id, body);
   }
 
   @Get('/charges')
@@ -162,7 +196,7 @@ export class BillingController {
       throw new HttpException('Unauthorized', 400);
     }
 
-    return this._stripeService.getCharges(org.id);
+    return (await this.provider(org)).getCharges(org.id);
   }
 
   @Post('/refund-charges')
@@ -175,7 +209,7 @@ export class BillingController {
       throw new HttpException('Unauthorized', 400);
     }
 
-    return this._stripeService.refundCharges(org.id, body.chargeIds);
+    return (await this.provider(org)).refundCharges(org.id, body.chargeIds);
   }
 
   @Post('/cancel-subscription')
@@ -187,7 +221,7 @@ export class BillingController {
       throw new HttpException('Unauthorized', 400);
     }
 
-    return this._stripeService.cancelSubscription(org.id);
+    return (await this.provider(org)).cancelSubscription(org.id);
   }
 
   @Get('/coupon-info')
@@ -199,7 +233,7 @@ export class BillingController {
       throw new HttpException('Unauthorized', 400);
     }
 
-    return this._stripeService.getCouponInfo(org.id);
+    return (await this.provider(org)).getCouponInfo(org.id);
   }
 
   @Post('/apply-coupon')
@@ -212,7 +246,7 @@ export class BillingController {
       throw new HttpException('Unauthorized', 400);
     }
 
-    return this._stripeService.applyCoupon(org.id, body);
+    return (await this.provider(org)).applyCoupon(org.id, body);
   }
 
   @Post('/cancel-coupon')
@@ -224,20 +258,20 @@ export class BillingController {
       throw new HttpException('Unauthorized', 400);
     }
 
-    return this._stripeService.cancelCoupon(org.id);
+    return (await this.provider(org)).cancelCoupon(org.id);
   }
 
   @Get('/chatbase-refund/preview')
-  chatbaseRefundPreview(@GetOrgFromRequest() org: Organization) {
-    return this._stripeService.chatbaseRefundPreview(org.id);
+  async chatbaseRefundPreview(@GetOrgFromRequest() org: Organization) {
+    return (await this.provider(org)).chatbaseRefundPreview(org.id);
   }
 
   @Post('/chatbase-refund')
   async chatbaseRefund(
     @GetUserFromRequest() user: User,
     @GetOrgFromRequest() org: Organization
   ) {
-    const refund = await this._stripeService.chatbaseRefund(org.id);
+    const refund = await (await this.provider(org)).chatbaseRefund(org.id);
 
     if (refund.refunded) {
       await this._notificationService.sendEmail(
@@ -264,8 +298,8 @@ export class BillingController {
     await this._subscriptionService.addSubscription(
       org.id,
       user.id,
-      body.subscription
+      body.subscription,
+      this._paymentService.getDefaultProviderName('web')
     );
   }
-
 }

apps/backend/src/api/routes/payment.controller.ts

@@ -0,0 +1,36 @@
+import {
+  Controller,
+  HttpException,
+  Param,
+  Post,
+  RawBodyRequest,
+  Req,
+} from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { PaymentService } from '@gitroom/nestjs-libraries/services/payment/payment.service';
+
+@ApiTags('Payment')
+@Controller('/payment')
+export class PaymentController {
+  constructor(private readonly _paymentService: PaymentService) {}
+
+  @Post('/:provider')
+  async webhook(
+    @Param('provider') provider: string,
+    @Req() req: RawBodyRequest<Request>
+  ) {
+    try {
+      return await this._paymentService.webhook(
+        provider,
+        req.rawBody,
+        // @ts-ignore
+        req.headers
+      );
+    } catch (e) {
+      if (e instanceof HttpException) {
+        throw e;
+      }
+      throw new HttpException(e, 500);
+    }
+  }
+}