RxSubscription migration

Billing is selected with BILLING_PROVIDER=rxsubscription, configured locally and in Vercel Production on 2026-10-22. The user explicitly requested a fresh start: do not import legacy subscriptions, customers, invoices, or session usage. Existing Stripe entitlements do not carry over. Local development uses a sandbox key; production uses its own secret key. Configuration takes effect in production when the updated application is deployed.

Configuration

Server-only environment variables:

BILLING_PROVIDER=rxsubscription
RXSUBSCRIPTION_BASE_URL=https://subscription.rxlab.app
RXSUBSCRIPTION_SECRET_KEY=<application secret key>
RXSUBSCRIPTION_PLUS_PLAN_ID=8efd0160-848f-448f-968f-ec2129566829
RXSUBSCRIPTION_AI_USAGE_ITEM=ai_sessions
RXSUBSCRIPTION_NOTIFICATION_USAGE_ITEM=notification_emails
RXSUBSCRIPTION_STORAGE_USAGE_ITEM=release_storage_bytes

The application is GitHub Autopilot / Flowcy, client_e1a643ad5d474aad9430d90d0b7a8f52, matching the current OIDC client. Users are identified by the existing RxLab OIDC subject, never email. Do not put the secret key in a NEXT_PUBLIC variable. Invalid provider values, missing credentials/meters, malformed responses and upstream failures stop billing operations; no local fallback is made after selecting RxSubscription.

Live configuration performed 2026-10-22

Created through Chrome and verified in the usage table:

The workspace agent created these plans; the current active configuration is:

Both use group default, no trial, and usage-limit entitlements rather than balance grants. Free has automatic enrollment configured. The plan table visibly confirmed all four allowances. Both plans are active, verified in Chrome and the live sandbox catalog on 2026-10-22. Sandbox and production credentials are stored separately.

The current RxSubscription catalog sets Plus at USD 10/month. Landing-page pricing now matches. No users were subscribed or charged during verification.

Behavior

• Subscription display reads active RxSubscription plans, including complimentary grants of the configured Plus plan. Usage display and AI preflight read /api/v1/usage, preserving null as unlimited.
• All seven workflow session creation paths and dependency CI repairs atomically consume one ai_sessions unit before running AI. Workflow step IDs and dependency repair repository/PR/head identity provide retry keys. Admitted sessions count even when later AI execution fails, matching the prior session accounting. Denials never run AI. A process failure after admission but before local session insertion can leave a metered attempt with no local session; retrying the same step does not consume again.
• Checkout and portal use /api/v1/checkout. Plan checkout returns checkoutUrl (normalized to the UI's url); the portal returns url. Billing actions navigate to dedicated hosted pages; Sonner overlays report loading/failure.
• Payment history reads /api/v1/invoices. The upstream page size/cursor is retained rather than truncating invoices and skipping records.
• Email usage and limits are authoritative in RxSubscription. Each pending notification reserves one unit using its stable operation key; failed sends release that original unit. Failed refunds retain the operation key and retry on the next usage read/send and in the cleanup cron. Delivery history remains local.
• Release-file usage and limits are authoritative in RxSubscription under release_storage_bytes (default 5 GiB, never resets, block overage). Bytes are reserved before an upload URL is issued. Confirmation requires the actual size to match the reservation; deletion, repository/release removal, and cleanup release the original operation exactly once. Pending uploads reserve capacity until deleted or cleaned up. File metadata remains local.

Fresh-start cutover

The user explicitly waived historical plan and usage migration. Enable the configured provider and deploy the integration without importing old billing records. Keep the old database records untouched. Existing external Stripe subscriptions are not automatically cancelled by this switch.

No historical usage is imported. New usage for all configured meters is tracked by RxSubscription. Local rows retain operation keys only for reliable retries and resource metadata.

Local verification

The local mock is derived from rxtech-lab/rx-subscription-service's app/api/v1/{entitlements,usage,checkout,invoices} and lib/subscription/usage.ts, inspected on 2026-10-22. The published mock lookup was unavailable because the Postman CLI was signed out. This is an authored simulation, not live API verification.

postman simulation run postman/simulations/rxsubscription.sim.yaml --port 4918 --output ndjson
# In a second terminal:
RXSUBSCRIPTION_SIMULATION_URL=http://127.0.0.1:4918/billing bun run test:run lib/services/rxsubscription.integration.test.ts

The integration tests run the real client and services over HTTP with an in-memory local database. They cover usage, concurrency/denial, idempotent retries, unlimited limits, paid/complimentary plans, checkout/portal, invoices, upstream outages, missing meters and notification failure release. The simulation suite skips unless its local URL is explicitly supplied.

Project, document, and scan usage (2026-10-23)

Created and read back using the RxSubscription MCP for the Flowcy application:

These keys are shared application constants; limits and reset policies are owned by RxSubscription. No extra environment variables are required. Failed admitted scans and scans finding no updates count. CI security audits are not charged a second CI-update unit. Installation ownership determines scan billing; a notification recipient does not.

Apply migration 0041_modern_slayback.sql before deploying this code. The allocation table stores operation identities and owners, not local quotas. Projects and documents reserve before creation, release after deletion, and retain failed releases for retry. Project removal also releases contained documents. Notion pruning and explicit purge follow the same release path. The existing release-files cleanup cron reconciles absent resources with allocations older than one hour, including interrupted creations; live resources are retained. This retry step runs even when object storage is not configured. Keep that cron scheduled.

Existing projects/documents are not backfilled. Updating an existing document does not consume a unit. New documents inside an existing project are counted. The mock HTTP lifecycle tests cover creation, version updates, deletion/cascade, failed creation, abandoned allocation recovery, independent meters and denial. Live catalog configuration is verified; production metering has not been deployed or exercised.