feat(release): v7.7.0 — V1 Plugin Pro paid tier + recovery + GDPR

[saurabhjain1592]

v7.7.0 — V1 launch release

First public release of the paid Pro tier and credential recovery for AxonFlow Community SaaS, alongside the unified license matrix from ADR-050. Self-hosted Enterprise deployments are unaffected; existing Self-Hosted license tokens continue to validate via the missing-aud fallback documented in ADR-050.

Note: companion plugin and SDK changes (the new X-Axonflow-Client header read path, scope-aware license validation) are present on enterprise main but the corresponding plugin and SDK releases will follow on their own cadence. Clients without the new header continue to work and receive a one-time upgrade hint.

Added — paid Pro tier

• POST /api/v1/billing/stripe-webhook receives Stripe webhook deliveries for the V1 SaaS Plugin Pro tier. Subscribes to checkout.session.completed (issues the license) and charge.refunded (revokes on full refund). Defended by Stripe-Signature HMAC + IP allowlist (Stripe's published webhook CIDRs, env-overridable) + per-source rate limit. Idempotent over stripe_session_id — Stripe at-least-once delivery returns the original token byte-identically on retry, never a new one.

• License token validation on every governed request. validateCommunitySaasAuth now reads X-License-Token, validates the Ed25519 signature, checks the token's audience claim against the SaaS Plugin accept list, verifies the tenant binding, and looks up the active row in plugin_user_licenses. Free tier (no header) passes through unmodified; Pro / Premium tier promotes the request when both token and row are valid. Per-request DB lookup keeps revocation effective within ~60s of a chargeback or dispute.

• Per-tenant daily request quota and audit retention follow the resolved tier from the license token: Free 200/day with 3-day rolling retention; Pro 1,000/day with 30-day retention; Premium 5,000/day with 90-day retention (reserved, not yet sold). Fires on both admin routes (apiAuthMiddleware) and plugin/SDK governed routes.

• Auto-revoke on full refund. A charge.refunded event whose amount_refunded == amount and whose latest refund status == "succeeded" triggers a revoked_at UPDATE on the matching license row, looked up by stripe_payment_intent_id. Partial refunds are an explicit no-op. Replays / already-revoked rows take an idempotent no-op path.

Added — free-tier credential recovery

• POST /api/v1/recover and POST /api/v1/recover/verify allow Community SaaS tenants who opted in at sign-up time to self-recover a lost secret via emailed magic link. Capped at 3 active tenants per email; per-IP rate limit prevents enumeration probes. Tokens stored as HMAC-SHA256 with optional server pepper; single-use; 1-hour TTL.

Added — GDPR right-to-erasure

• POST /api/v1/tenant/{id}/delete-{request,confirm} — two-step email-verified tenant deletion. delete-request accepts the email-on-file and emails a single-use 1-hour confirmation token; delete-confirm consumes the token and atomically scrubs the tenant from community_saas_registrations, plugin_user_licenses, audit_logs, community_saas_daily_usage, and usage_events. Stripe customer archive runs best-effort post-commit (DB-side erasure completes regardless of Stripe reachability). New tenant_deletion_log table is the immutable audit trail of completed erasures — survives the deletion of the tenant's own audit_logs, which is precisely what GDPR Article 30 requires. Anti-enumeration: delete-request always returns 202 with the same generic message regardless of whether the (tenant_id, email) pair matches.

Added — license matrix (ADR-050)

• -aud flag on the keygen CLI for self-hosted operators. Issuers can now generate licenses with an explicit aud claim from the canonical set: axonflow.self_hosted.full (default — no behavior change), axonflow.self_hosted.plugin and axonflow.self_hosted.sdk (both forward-looking, not yet sold). Cross-quadrant aud values (axonflow.saas.*) are rejected at issuance.

Changed

• SaaS Plugin tier names unified to Pro / Premium. The plugin_user_licenses.entitlements JSONB scaffolding shipped in v7.6.1 has been superseded by the unified tier ladder. Migration 080 drops the column and renames any pre-existing 'plugin-claimed' rows to 'Pro' and 'plugin-subscription' rows to 'Premium'. No production tokens existed for the v7.6.1 design — the row writer was inert scaffolding without a downstream reader.

Bug fixes

• csaas register/recovery rate limit now trusts the LAST X-Forwarded-For entry (the AWS ALB-appended client IP) instead of the first, which is client-spoofable. Real per-IP rate limiting now actually fires on real attacker IPs behind the ALB.

• AWS Secrets-Manager-derived secret env vars are trimmed to prevent silent fail-closed on trailing newlines. The Resend API rejects Authorization headers with embedded newlines, which previously caused every paid-tier license email to fail without any obvious cause.

• tierRank fails closed on unknown tier strings. Defense in depth against a corrupt or future-version row evaluating to a permissive tier.

Migrations

• 080 — drops the dormant entitlements JSONB column from v7.6.1 (idempotent, replay safe)
• 081 — promotes usage_metering schema from migrations/enterprise/ to migrations/core/ so community-saas runs it (idempotent IF NOT EXISTS — replay safe on existing SaaS prod where the original migration 104 already applied)
• 082 — tenant_deletion_log audit table for GDPR Article 30
• 083 — stripe_payment_intent_id on plugin_user_licenses (nullable + partial-indexed) for charge.refunded reverse lookup

[saurabhjain1592]

Closing — sync filter let through files that should have been excluded. Reopening will follow once filter excludes are corrected.