- subscription.renewed is now sent for the first paid period too;
data.period.first_period tells it apart (README, EventType, test payload).
- Billing portal links need no login, are single use and valid for about
15 minutes: create them on click and redirect right away (README,
createBillingPortalLinkForUser(), appBillingPortalUrl()).
Document the items (subscription, period, net amount, discount), invoice
and metadata of orders read with the app's token, add
AppOrders::invoicePdf() for the invoice PDF and the opt-in
subscription.renewed event type with its period data.
Webhook::constructEvent() checks the Anikeen-Signature header (HMAC-SHA256
of "t.body" with the endpoint's secret, 5-minute tolerance) and returns
the event, like Stripe's helper.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Maurice Preuß
