Closing the paid layer.

Five gears that have to turn together. Until then it's a side-project with payment glued on. Order matters — start where the user already wants to swipe a card.

Overall progress 0 / 0

1 · WhatsApp managed relay

Start here

Same shape as the new Telegram flow: PATAPIM-hosted bot, zero token setup, instance pairing. Today WhatsApp lives as an embedded browser panel — that's local automation, not a service. Convert it to a real backend.

Pick the backend: WhatsApp Cloud API vs Twilio
Cloud API is cheaper at scale but requires Meta Business verification. Twilio = faster MVP, ~5× cost. Decide based on time-to-launch.
Provision a phone number for the bot
Either a Meta-verified WABA number or a Twilio number. This is the public face of @patapim on WhatsApp.
Build the relay Durable Object on patapim.ai
Mirror TelegramInstance.ts: WS upgrade per install, hibernating socket, paired chat binding, offline queue.
Pairing flow — UX-symmetric to Telegram
"Connect to WhatsApp" button → 6-letter code → user sends code to the bot number → done.
PATAPIM client: whatsappRelay.js + whatsappPairing.js
Refactor of the Telegram pair to be a generic messagingRelay. The diff is mostly in transport URLs and outbound message shape.
Keep embedded panel as Free-tier fallback
"BYO WhatsApp Web session" stays for Free users. Managed relay is a Pro feature, license-gated.
End-to-end test from a real phone
Notification arrives, reply gets injected into the right terminal, multi-terminal routing works.

2 · Email managed relay

Phase 2

Outbound-only at first (Claude pings you when something needs attention). Inbound reply parsing comes later — most people don't reply to bot emails anyway.

Pick the provider: Resend vs Postmark
Resend has better DX and pricing. Postmark has better deliverability reputation. Either works.
Set up DNS: SPF, DKIM, DMARC for patapim.ai
Without these, our notification mails will hit spam. Cloudflare DNS makes this trivial.
Implement /api/notify/email on patapim.ai
Authenticated by license key. Rate-limit per install. Templates for "Claude finished", "Claude needs approval", "build failed".
PATAPIM client: route email notifications through the relay
Replace the current direct-SMTP path. Keep the SMTP option for Free tier "BYO email".
License-gate the managed mode
If license is valid → managed relay. If not → fall back to user-configured SMTP.

3 · License + payment, end-to-end

Phase 1 polish

Stripe + Cloudflare KV + main-process validation already exists in pieces. Stitch them so a stranger can pay and unlock without you touching a thing.

Stripe checkout → license key issuance
Cloudflare Worker webhook reacts to checkout.session.completed, generates a signed JWT license, stores in LICENSES KV, emails it to the buyer.
Main-process validation (offline-capable, signed JWT)
Public key in the binary. App boots, reads license, verifies signature offline. Periodic phone-home for revocation only.
Define and wire feature gates
Decide exactly which features are paid: managed relays (WA/email), remote mobile auth, multi-seat. Add gate checks at the entry points.
14-day trial without card
First install → trial license auto-issued. Days remaining shown subtly in the UI. Day 13 → upgrade nudge.
Revocation + recovery flows
Lost key → email recovery via Stripe customer ID. Refund → invalidate. License moves between machines (deactivate / activate).

4 · Signed binaries on both platforms

Phase 1

Without signature: SmartScreen scares 80% of installs, Gatekeeper blocks Mac. Windows side is mid-flight (Eggscape identity verified ✓).

Azure Trusted Signing — Certificate Profile linked to Eggscape
Identity is verified. Last step: create cert profile, plumb the new credential into release.bat.
Test fresh-install on a clean Windows VM
SmartScreen should show "Verified publisher: Eggscape Entertainment Inc." with no scary warning.
Apple Developer ID enrollment ($99/yr)
Personal or Eggscape business account? Business is cleaner long-term but adds D-U-N-S verification time.
electron-builder Mac signing + notarization
Configure codeSign + notarize in build. Hardened runtime + entitlements file.
Test fresh-install on a clean Mac
No "unidentified developer" prompt. Stapled notarization ticket so it works offline.
Auto-updater verifies signatures on download
electron-updater already does this when binaries are signed — just confirm and add a smoke test.

5 · Remote mobile in production

Phase 3

patapim.ai/remote already works for the dev. Make it work for a stranger on a hotel WiFi.

License-token auth for the remote endpoint
Today the device-token is generated locally; tie it to a valid license so Free tier doesn't get free remote.
QR pairing onboarding
Phone scans a QR shown in PATAPIM, lands on patapim.ai/remote already authenticated. No login needed.
TURN fallback for hostile NAT (only if needed)
Cloudflare TURN service is cheap; only wire it if real-world testing shows direct connect fails too often.
Rate limiting + abuse logging
Per-instance + per-IP. Anything that looks like brute force or scanning gets banned at the edge.
First-time onboarding flow on the phone
"This is your terminal in your pocket" — short tutorial the first time someone lands on /remote.

6 · Distribution & onboarding polish

Phase 4

Make the buy flow boring and obvious. Today there's a download page; tomorrow there's a funnel.

OS detection on download.astro
Show the right installer first. "Windows installer" badge + signed cert chip ("Eggscape Entertainment Inc.").
Public pricing page wired to Stripe
Free / Pro $6.99 / Studio $29.99. Clicking Pro/Studio → Stripe checkout → license email. Already declared in schema.org.
"1 day left in trial" upgrade nudge
Soft banner inside the app, deep-link to checkout. Don't be obnoxious.
In-app upgrade flow
Click Upgrade → checkout → return to app → license auto-applied (deep-link callback or polling).
Receipts + invoice page
Stripe customer portal works out of the box; just expose it from the app menu.

Order is deliberate. WhatsApp first because (a) the Telegram pattern is fresh, so the relay code is mostly copy-adapt, and (b) WA + email are the "managed services" that turn this from app into product. Without paid services, the license tier has nothing to gate.