[builtbyrishabh]

Implements the remediation plan in #28 (findings in #27). All changes verified with pnpm verify:launch (typecheck, lint, format, 33 tests, production build).

Signup credits (the main user-facing bug)

• 1A — CLERK_WEBHOOK_SIGNING_SECRET added to the env contract; a prod deploy missing it now fails the build instead of silently 400-ing every Clerk webhook.
• 1B — Clerk webhook returns 200 for ignored event types (was falling through to a 500) and logs via console.error.
• 1C — ensureSignupGrant() self-healing fallback: grants the signup bonus on first balance load if the webhook never landed it. Idempotent via the unique source_id constraint + deterministic signup:<userId> id, treating Postgres 23505 as success. Both paths share SIGNUP_BONUS_CREDITS.

Payments

• 4 — ?session_id={CHECKOUT_SESSION_ID} appended to success_url; /payment/success rewritten to verify the session with Stripe (+ ownership check), show a processing state while the webhook lands, and redirect invalid/foreign sessions to /billing.

Observability

• 3 — both silent Stripe webhook catch blocks now log with event.id/event.type.
• 5 — tRPC per-call timing log gated to dev.

Housekeeping

• 2 — (local .env only, not in this diff) Inngest key typo fixed.
• 7a — removed duplicate cdn.animeroom.space image pattern.
• 7b — gitignored the standalone launch-readiness-field-guide/ repo.
• 7c — verified no change needed (extra .env keys are unused).

Still requires dashboards (out of scope for this PR)

• Vercel prod: set CLERK_WEBHOOK_SIGNING_SECRET with the prod Clerk secret; check for the INNGEST_SIGNIN typo.
• Clerk: review user.created webhook delivery log.
• 6 — Supabase: refresh DATABASE_URL (pooler reports "tenant not found" locally).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
anime-room	Ready	Preview, Comment	Jul 18, 2026 3:58am

[coderabbitai]

Warning

Review limit reached

@D33ADLOCK, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Free

Run ID: d1107acd-5e2f-4f2f-87fc-3000845237bf

📥 Commits

Reviewing files that changed from the base of the PR and between bc3370a and 7e9ce28.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

📝 Walkthrough

Walkthrough

The changes add idempotent signup-credit initialization, strengthen Clerk and Stripe webhook handling, validate payment sessions before rendering success states, require the Clerk webhook secret in environment validation, and adjust runtime logging and repository configuration.

Changes

Payments and signup credits

Layer / File(s)	Summary
Signup credit initialization src/env.js, src/env.schema.js, src/env.schema.test.ts, src/server/credits/creditHelper.ts	Adds required Clerk webhook-secret validation and an idempotent, concurrency-safe signup credit grant.
Signup credit delivery src/app/api/webhooks/clerk/route.ts, src/server/api/routers/credit.ts	Uses deterministic signup grant metadata, acknowledges non-creation events, and applies the grant fallback before balance lookup.
Stripe payment verification src/server/api/routers/payment.ts, src/app/payment/success/page.tsx, src/app/api/webhooks/stripe/route.ts	Passes the Checkout session ID through the success URL, verifies session ownership and payment state, and logs webhook failures with context.
Runtime and repository support src/server/api/trpc.ts, next.config.js, .gitignore	Limits timing logs to development, adjusts remote pattern formatting, and ignores the tooling directory.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant paymentRouter.startPayment
  participant Stripe
  participant PaymentSuccessPage
  participant auth
  Client->>paymentRouter.startPayment: Start checkout
  paymentRouter.startPayment->>Stripe: Create checkout session with success_url
  Stripe-->>Client: Redirect with session_id
  Client->>PaymentSuccessPage: Request success page
  PaymentSuccessPage->>auth: Authenticate user
  PaymentSuccessPage->>Stripe: Retrieve and verify session
  Stripe-->>PaymentSuccessPage: Return payment status and ownership metadata
  PaymentSuccessPage-->>Client: Render payment state or redirect to billing

Loading

Poem

I’m a bunny with credits, ten carrots to spare,
Stripe checks the session with careful bunny care.
Webhooks now whisper when troubles appear,
Paid or processing, the path is clear.
Hop, hop—secure payments bloom!

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}