The $0/month stack for paid browser extensions.

// Entitlement derives from the signed license, never a stored flag.
export async function isPro(): Promise<boolean> {
  return (await getEntitlementStatus()).tier !== 'free';
}
export async function hasFeature(feature: string): Promise<boolean> {
  const { tier } = await getEntitlementStatus();
  return featuresForTier(tier).has(feature);
}

// verify.ts — offline ES256 check with the embedded PUBLIC key
const pubKey = await crypto.subtle.importKey('jwk', LICENSE_PUBLIC_JWK,
  { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
return crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' },
  pubKey, signature, data);

const claims = await verifyLicenseKey(body.key, env.LICENSE_PRIVATE_JWK);
if (!claims) return json({ error: 'invalid_key' }, 400, cors);

// 'unknown' = couldn't confirm; never lock a payer out over our outage.
const status = await licenseStatus(claims.sub, env);
if (status === 'cancelled' || status === 'expired') {
  return json({ error: 'subscription_inactive', status }, 403, cors);
}
const seats = await readSeats(claims.sub, env);
const known = seats.installs.some((i) => i.id === installId);
if (!known && seats.installs.length >= MAX_SEATS) {
  return json({ error: 'seat_limit',
    seats: { used: seats.installs.length, max: MAX_SEATS } }, 409, cors);
}
const ttl = now + ENTITLEMENT_TTL_SECONDS;
const token = await signEntitlement(claims, installId, ttl, env);

// The extension creates the Paddle transaction server-side (Worker
// /checkout) and opens this page with ?txn=<id>&env=<sandbox|production>
// This page only renders Paddle's overlay for that transaction.
var config = window.SITE_CONFIG || {};
var PINNED_TOKENS = config.paddleTokens || {};
var TXN_PATTERN = /^txn_[a-z0-9]{1,64}$/;

var params = new URLSearchParams(window.location.search);
var txnId = params.get('txn');
var env = params.get('env') || 'production';
var token = Object.prototype.hasOwnProperty.call(PINNED_TOKENS, env)
  ? PINNED_TOKENS[env] : '';

---
name: setup
description: Take a fresh clone of the kit to a working paid extension —
  rebrand, signing keypair, Paddle sandbox, Worker deploy, GitHub Pages,
  and a verified trial → purchase → activate loop.
---
# Setup
Ask the user for the product facts once: name, description, company,
support email, site origin, seats per license, trial days.
Never paste a secret into a tracked file — `wrangler secret put` only.

## 1. Rebrand · 2. Keypair · 3. Paddle sandbox
## 4. Worker · 5. Site + domain · 6. Prove the loop

# Rebrand the kit from the sample "Acme Extension" to your product.
npm run init                          # interactive
npm run init -- --from answers.json   # non-interactive (agents, CI)
npm run validate:config && npm test   # manifests, Worker, site agree

# release.yml — push tag v1.2.3 → store zips + GitHub release
on: { push: { tags: ['v*'] } }
steps:
  - run: npm run validate:config
  - run: npm run lint && npm run typecheck && npm test
  - name: Build with production payment config
    run: npm run build && npm run check:manifest && npm run package