Day 22 — Stripe live, password reset, v1 feature-complete

The week I stopped building features and started preparing for actual humans to use this.

Stripe came in. PaymentIntents for invoice payments, webhook reconciliation (payment_intent.succeeded → mark invoice paid), Stripe Elements on the client billing page, and a per-barn enable/disable flag for managers who'd rather collect outside Stripe. The flow now: barn generates invoices on the 1st, client opens StableSync on their phone, taps Pay, done. No more "did you get my Venmo?" texts.

Auth hardening. This was the unglamorous but essential week. A real password reset flow with signed email tokens. A first-login forced password change — when a manager invites a client or trainer, the temp password is single-use, and the middleware redirects them to /change-password until they set their own. Graceful session expiry on both web (apiFetch redirects to login on 401/403) and mobile (token refresh + sign-out). All the boring stuff that production software has to do.

Database performance audit. Walked every hot path looking for N+1 queries. The good news: between Drizzle's prepared queries and disciplined use of Promise.all(), there were no real issues. Added two indexes for the cron jobs (horse_vaccines.dueAt and notifications.(sentAt, type+lessonSlotId)) and called it done.

CI pipeline. GitHub Actions running pnpm test + pnpm type-check on every PR. A deploy workflow ready to push to Vercel. A deployment guide written.

The header in my todo list at the start of the week said "v0.1.0 — what's left." At the end of the week it said "tag it." I'm going to wait one more cycle on the tag — there's still the marketing site to build and a brand rename I've been putting off — but the product itself is done for v1. Three weeks in.

It feels different to ship features that have to work for somebody other than me.