chore: sync upstream dubinc/dub main into main-staging

.agents/skills/jobs-define-job/SKILL.md

@@ -0,0 +1,130 @@
+---
+name: jobs-define-job
+description: Add or migrate background jobs with defineJob, register them in jobLoaders, and dispatch via job.dispatch/dispatchBatch instead of qstash.publishJSON to a cron URL. Use when adding a QStash worker, converting a POST /api/cron route into a job, or when the user mentions defineJob, job handlers, /api/jobs/process, or background jobs.
+---
+
+# Background jobs: use defineJob
+
+Payload-driven QStash work goes through `defineJob`. Do **not** add a new HTTP route under `/api/jobs` — every job is executed by the existing [`apps/web/app/api/jobs/process/[jobName]/route.ts`](apps/web/app/api/jobs/process/[jobName]/route.ts).
+
+Keep using `withCron` for Vercel GET schedules and for cron scanners that have no job envelope. See the `cron-use-with-cron` skill for those.
+
+## File layout
+
+```
+apps/web/lib/jobs/
+├── index.ts                 # defineJob — do not edit unless changing the framework
+├── registry.ts              # jobLoaders — register every new job here
+├── send-jobs.ts             # envelope + QStash request builder
+└── handlers/
+    └── {name}-job.ts        # one file per job
+```
+
+## 1. Create the handler
+
+Add `apps/web/lib/jobs/handlers/{name}-job.ts`. The `name` must be kebab-case and end in `-job` (enforced by `jobNameSchema`: `/^[a-z][a-z0-9]*(-[a-z0-9]+)*-job$/`).
+
+```ts
+import * as z from "zod/v4";
+import { defineJob } from "../index";
+
+const inputSchema = z.object({
+  programId: z.string(),
+  partnerId: z.string(),
+});
+
+export const unbanPartnerJob = defineJob({
+  name: "unban-partner-job",
+  schema: inputSchema,
+  defaults: {
+    retries: 3, // optional; QStash retries on 5xx
+    // queue: "unban-partner", // optional; named QStash queue
+    // flowControl: { key: "unban-partner", parallelism: 20 },
+  },
+  async handle(input) {
+    // skip (permanent / not found) → return (process route returns 2xx, QStash does not retry)
+    // transient failure → throw (process route returns 500, QStash retries)
+  },
+});
+```
+
+Export the const as camelCase `{name}Job` matching the kebab `name`.
+
+Reference handlers:
+
+- Simple skip/work: `unban-partner-job.ts`, `create-tremendous-campaign-job.ts`
+- Self-pagination: `folder-deleted-job.ts`, `domain-deleted-job.ts`, `partner-search-sync-job.ts`
+- `defaults.flowControl`: `partner-search-sync-job.ts`
+
+## 2. Register it
+
+Add a **static** `import()` in [`apps/web/lib/jobs/registry.ts`](apps/web/lib/jobs/registry.ts) `jobLoaders`. The object key must equal `defineJob({ name })`. Webpack code-splits each handler.
+
+```ts
+"unban-partner-job": () =>
+  import("./handlers/unban-partner-job").then((m) => m.unbanPartnerJob),
+```
+
+Do not register by editing the process route. `loadJob` throws if `job.name !==` the registry key.
+
+## 3. Dispatch from call sites
+
+Import the handler (not `qstash`) and call `dispatch` / `dispatchBatch`:
+
+```ts
+import { unbanPartnerJob } from "@/lib/jobs/handlers/unban-partner-job";
+
+await unbanPartnerJob.dispatch(
+  { workspaceId, programId, partnerId },
+  { label: partnerId },
+);
+
+await folderDeletedJob.dispatchBatch(
+  folderIds.map((folderId) => ({ folderId })),
+  ({ folderId }) => ({ label: folderId }),
+);
+```
+
+Per-dispatch options merge over `defaults`: `delay`, `notBefore`, `deduplicationId`, `retries`, `queue`, `flowControl`, `label`.
+
+Failed QStash publish is persisted to the jobs outbox automatically — do not catch-and-swallow unless even the outbox persist failing must not fail the source mutation (see `queue-partner-search-sync.ts`).
+
+Self-pagination: call `theJob.dispatch(nextPayload, { delay: 1 })` from `handle` (see `folder-deleted-job`, `partner-search-sync-job`).
+
+Do not call `job.execute` from app code. That is only for the process route (and cron drain shims below).
+
+## 4. Convert an existing cron worker
+
+1. Move the `withCron` body into `handle`. Replace `logAndRespond("skip…")` with `console.info` / `console.error` + `return`.
+2. Register + switch every `qstash.publishJSON` / `enqueueJSON` / `enqueueBatchJobs` targeting that cron URL to `job.dispatch` / `dispatchBatch`.
+3. Keep a thin POST shim at the old `/api/cron/...` URL that parses the **old** body (not the job envelope) and calls `job.execute(payload)`. That drains in-flight QStash messages. Do not add a shim for brand-new jobs.
+4. Delete cron-only helpers that moved with the handler.
+
+## Handle semantics
+
+| Outcome | What to do | HTTP from process route | QStash |
+| --- | --- | --- | --- |
+| Work done | `return` | 200 | stop |
+| Skip (not found, already done, env not configured) | `console.*` + `return` | 200 | stop |
+| Bad payload | throw `ZodError` (schema.parse) | 200 | stop (non-retryable) |
+| Transient failure | `throw` | 500 | retry |
+
+Unknown job names and invalid envelopes also return 2xx so QStash does not retry forever.
+
+## Do not use defineJob for
+
+- Vercel GET crons in `apps/web/vercel.json`
+- Scanners that only fan out work (the worker they enqueue can be a job)
+- Importers that republish continuation state to the same URL
+- `/api/cron/queue/retry` (job replay infrastructure)
+- Path-param identity (`/api/cron/links/[linkId]/…`) unless the id moves into the payload
+- Outbound webhook forwarding and postbacks
+
+## Do not
+
+- Add a new `/api/jobs/...` route or a new `/api/cron/...` POST worker for payload-driven work.
+- Call `qstash.publishJSON` / `enqueueJSON` / `enqueueBatchJobs` with `/api/jobs/process/...` — use `dispatch`.
+- Register jobs with a dynamic `import()` that webpack cannot statically analyze, or a key that differs from `defineJob({ name })`.
+- Name a job without the `-job` suffix.
+- Use `job.execute` at dispatch call sites.
+- Run `pnpm build` after adding a job.

.agents/skills/playwright-api-tests/SKILL.md

@@ -54,10 +54,6 @@ import { expect } from "@playwright/test";
 import { randomName } from "../../utils";
 import { test, type ApiClient } from "../fixtures";
 
-test.describe.configure({
-  mode: "parallel",
-});
-
 async function createThing(
   api: ApiClient,
   overrides: Record<string, unknown> = {},
@@ -98,7 +94,7 @@ test("POST /things", async ({ api }) => {
 | Rule                                            | Detail                                                                                                        |
 | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
 | Import `test` from `../fixtures`                | Provides `api`, `workspace`, and `program`                                                                    |
-| `test.describe.configure({ mode: "parallel" })` | At top of every API spec file                                                                                 |
+| Serial only when tests share state              | API project is `fullyParallel: true`. Do not add `mode: "parallel"`. Use `test.describe.configure({ mode: "serial" })` only when tests in a file/describe share state (e.g. domains, seeded pagination) |
 | Cleanup in `finally`                            | Create → assert → always delete created rows                                                                  |
 | Unique names/ids                                | Use `randomName` / `randomCustomer` / `randomPartnerEmail` from `../../utils` — never fixed colliding names   |
 | Assert status + body                            | Prefer `toStrictEqual` / `toEqual` on full shapes; use `expect.any(String)` for ids/timestamps                |

.gitignore

@@ -50,4 +50,5 @@ packages/stripe-app/.build/*
 playwright-report/
 **/playwright/.auth/
 test-results/
-blob-report/
+blob-report/
+.pnpm-store

apps/web/.env.example

@@ -5,8 +5,12 @@
 # Generate secrets with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
 NEXTAUTH_SECRET=
 NEXTAUTH_URL=http://localhost:8888 # (only needed for localhost)
-# Secret for Vercel cron jobs (https://vercel.com/docs/cron-jobs/manage-cron-jobs#securing-cron-jobs)
+
+# Secret for Vercel cron jobs + sync-embeddings
 CRON_SECRET=
+# Shared with the LoopWork demo. Mints geo-accurate clicks via POST /api/demo/click
+# and backdated commissions via POST /api/demo/commission
+DEMO_CLICK_SECRET=
 # Encryption key (AES-256-GCM) for encrypting sensitive data in the database
 ENCRYPTION_KEY=
 # Email unsubscribe token secret (optional, falls back to NEXTAUTH_SECRET)
@@ -23,6 +27,10 @@ PLANETSCALE_DATABASE_URL="http://root:unused@localhost:3900/planetscale"
 UPSTASH_REDIS_REST_URL=
 UPSTASH_REDIS_REST_TOKEN=
 
+# Full-text partner search. Unset falls back to the database search path.
+TURBOPUFFER_API_KEY=
+PARTNER_SEARCH_READ_ENABLED=
+
 # Upstash QStash – required for queues and background jobs
 # Get your QStash Token here: https://upstash.com/docs/qstash/overall/getstarted
 QSTASH_URL="https://qstash-us-east-1.upstash.io"
@@ -108,6 +116,9 @@ STORAGE_BASE_URL=
 STORAGE_PUBLIC_BUCKET=
 STORAGE_PRIVATE_BUCKET=
 
+# Shared secret for Cloudflare Workers that call Next.js webhooks
+CLOUDFLARE_WORKER_WEBHOOK_SECRET=
+
 # Used for internal monitoring & paging
 # You can remove this by removing `DUB_SLACK_HOOK_CRON` and `DUB_SLACK_HOOK_LINKS` from the codebase
 DUB_SLACK_HOOK_CRON=
@@ -121,6 +132,7 @@ DUB_SLACK_ASSISTANT_BOT_TOKEN=
 NEXT_PUBLIC_NGROK_URL=
 
 # For AI features
+AI_GATEWAY_API_KEY=
 ANTHROPIC_API_KEY=
 
 # Axiom – used for logging and monitoring
@@ -195,4 +207,9 @@ E2E_PARTNER_PASSWORD=
 
 # Veriff (Identity Verification)
 VERIFF_API_KEY=
-VERIFF_SHARED_SECRET=
+VERIFF_SHARED_SECRET=
+
+# Domain Connect (auto-configure DNS for custom domains)
+# Generate key: openssl genrsa -out private.pem 2048
+# Get public key: openssl rsa -in private.pem -pubout -outform DER | base64 | tr -d '\n'
+DOMAIN_CONNECT_PRIVATE_KEY=

apps/web/app/(ee)/admin.dub.co/(dashboard)/commissions/page.tsx

@@ -43,6 +43,19 @@ function CommissionsPageClient() {
   const { queryParams, getQueryString, searchParamsObj } = useRouterStuff();
   const { interval, start, end, programId } = searchParamsObj;
 
+  const { data: { programs: allPrograms } = {} } = useSWR<AdminCommissionsData>(
+    `/api/admin/commissions${getQueryString(
+      {
+        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      },
+      { exclude: ["programId"] },
+    )}`,
+    fetcher,
+    {
+      keepPreviousData: true,
+    },
+  );
+
   const { data: { programs, timeseries } = {}, isLoading } =
     useSWR<AdminCommissionsData>(
       `/api/admin/commissions${getQueryString({
@@ -62,7 +75,7 @@ function CommissionsPageClient() {
         icon: GridIcon,
         label: "Program",
         options:
-          programs?.map((program) => ({
+          allPrograms?.map((program) => ({
             value: program.id,
             label: program.name,
             icon: (
@@ -72,6 +85,7 @@ function CommissionsPageClient() {
                 className="size-4 rounded-full"
               />
             ),
+            right: currencyFormatter(program.commissions),
           })) ?? null,
       },
     ],
@@ -279,8 +293,8 @@ function CommissionsPageClient() {
   });
 
   return (
-    <div className="mx-auto grid w-full max-w-screen-xl gap-5 p-3 lg:px-10">
-      <div className="flex flex-col gap-3 md:flex-row md:items-center">
+    <div className="mx-auto grid w-full min-w-0 max-w-screen-xl gap-3 overflow-x-hidden p-3 lg:px-10">
+      <div className="flex min-w-0 flex-col gap-3 md:flex-row md:items-center">
         <Filter.Select
           className="w-full md:w-fit"
           filters={filters}
@@ -294,18 +308,16 @@ function CommissionsPageClient() {
         />
       </div>
       {activeFilters.length > 0 && (
-        <div>
-          <Filter.List
-            filters={filters}
-            activeFilters={activeFilters}
-            onSelect={onSelect}
-            onRemove={onRemove}
-            onRemoveAll={onRemoveAll}
-          />
-        </div>
+        <Filter.List
+          filters={filters}
+          activeFilters={activeFilters}
+          onSelect={onSelect}
+          onRemove={onRemove}
+          onRemoveAll={onRemoveAll}
+        />
       )}
-      <div className="flex flex-col divide-y divide-neutral-200 rounded-lg border border-neutral-200 bg-white">
-        <div className="scrollbar-hide grid w-full grid-cols-2 divide-x overflow-y-hidden sm:grid-cols-3">
+      <div className="flex min-w-0 flex-col divide-y divide-neutral-200 overflow-hidden rounded-lg border border-neutral-200 bg-white">
+        <div className="scrollbar-hide grid w-full grid-cols-1 divide-y overflow-hidden sm:grid-cols-2 sm:divide-x sm:divide-y-0">
           {tabs.map(({ id, label, colorClassName, disabled }) => {
             return (
               <button
@@ -317,7 +329,7 @@ function CommissionsPageClient() {
                   });
                 }}
                 className={cn(
-                  "border-box relative block h-full w-full flex-none px-4 py-3 sm:px-8 sm:py-6",
+                  "border-box relative block h-full min-w-0 w-full flex-none overflow-hidden px-4 py-3 sm:px-8 sm:py-6",
                   "ring-inset ring-neutral-500 focus-visible:ring-1 sm:first:rounded-tl-xl",
                   disabled
                     ? "cursor-not-allowed"
@@ -334,17 +346,17 @@ function CommissionsPageClient() {
                 <div className="flex items-center gap-2.5 text-sm text-neutral-600">
                   <div
                     className={cn(
-                      "h-2 w-2 rounded-sm bg-current shadow-[inset_0_0_0_1px_#00000019]",
+                      "h-2 w-2 shrink-0 rounded-sm bg-current shadow-[inset_0_0_0_1px_#00000019]",
                       colorClassName,
                     )}
                   />
                   <span>{label}</span>
                 </div>
-                <div className="mt-1 flex h-12 items-center">
+                <div className="mt-1 flex h-12 min-w-0 items-center">
                   {(totals[id] || totals[id] === 0) && !isLoading ? (
                     <NumberFlow
                       value={(totals[id] ?? 0) / 100}
-                      className="text-xl font-medium sm:text-3xl"
+                      className="truncate text-xl font-medium sm:text-3xl"
                       format={{
                         style: "currency",
                         currency: "USD",
@@ -360,8 +372,8 @@ function CommissionsPageClient() {
             );
           })}
         </div>
-        <div className="p-5 sm:p-10">
-          <div className="flex h-96 w-full items-center justify-center">
+        <div className="min-w-0 overflow-hidden p-5 sm:p-10">
+          <div className="flex h-96 w-full min-w-0 items-center justify-center">
             {chartData ? (
               chartData.length > 0 ? (
                 <TimeSeriesChart
@@ -419,7 +431,12 @@ function CommissionsPageClient() {
                   />
                   <YAxis
                     showGridLines
-                    tickFormat={(value) => currencyFormatter(value)}
+                    tickFormat={(value) =>
+                      currencyFormatter(value, {
+                        notation: "compact",
+                        maximumFractionDigits: 1,
+                      })
+                    }
                   />
                 </TimeSeriesChart>
               ) : (
@@ -433,7 +450,7 @@ function CommissionsPageClient() {
           </div>
         </div>
       </div>
-      <div className="w-full">
+      <div className="w-full min-w-0 overflow-x-auto">
         <Table {...tableProps} table={table} />
       </div>
     </div>