`build-queue/done/33-stripe-test-checkout.md`

21 lines
# Task 33 — sell_product: Stripe TEST-mode checkout + webhook (engine 1 core)

Read SPEC.md + ~/.claude/skills/abramsego-golive/SKILL.md. Build the checkout rail in TEST mode.
NO live keys, NO real charges — refuse sk_live_ keys.

1. Run /dtd (preset DTD_DIR=/tmp/dtd-$$-$RANDOM) on: "Option A: Stripe Payment Links (near-zero
   code, link per tier). Option B: Stripe Checkout Sessions via /api/checkout (server-created,
   more control). Pick exactly one for AbramsEgo's $19/$49 tiers." Record the verdict in the commit.
2. Implement the winner in server.js, env-driven: STRIPE_SECRET_KEY (must start sk_test_ — if
   absent, endpoints return 503 {error:"stripe not configured"} and the UI shows a "test keys not
   yet installed" note; if it starts sk_live_, REFUSE to boot the money routes and log loudly),
   STRIPE_WEBHOOK_SECRET. `npm i stripe`. Create .env.example documenting the vars (.env stays
   gitignored — verify .gitignore covers it).
3. Add POST /api/stripe/webhook (raw-body signature verify): on checkout.session.completed append
   {ts, engine:"sell_product", amount, source:"stripe:"+session.id} to data/revenue-ledger.jsonl
   (same shape as /api/revenue/record) and trigger the snapshot rebuild.
4. If test keys ARE present in .env, verify end-to-end with Stripe CLI or a signed test event;
   otherwise verify the 503-graceful path + webhook signature rejection with curl.
5. `pm2 restart abramsego`; curl checks; commit `feat(sell): stripe TEST checkout + webhook (dtd: <verdict>)`.
Local only. If no test keys exist yet, that's EXPECTED — build it keys-ready, note it for the memo.