Polar.sh & Lemon Squeezy + Signbee: Automate B2B Contracts for DevTools (2026)

import { NextResponse } from "next/server";
import { validateEvent, WebhookVerificationError } from "@polar-sh/sdk/webhooks";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const headers = Object.fromEntries(req.headers.entries());

  let event;
  try {
    event = validateEvent(rawBody, headers, process.env.POLAR_WEBHOOK_SECRET!);
  } catch (err) {
    if (err instanceof WebhookVerificationError) {
      return NextResponse.json({ error: "Invalid Polar webhook signature" }, { status: 403 });
    }
    throw err;
  }

  // Trigger B2B Enterprise License + DPA when an order or subscription is created
  if (event.type === "order.created" || event.type === "subscription.created") {
    const payload = event.data;
    const productName = payload.product?.name || "Enterprise DevTool Plan";

    // Optional: Only trigger formal e-signature contracts on Team / Enterprise tiers
    const isEnterpriseTier =
      productName.toLowerCase().includes("enterprise") ||
      productName.toLowerCase().includes("team") ||
      (payload.amount && payload.amount >= 9900); // $99+ plans

    if (!isEnterpriseTier) {
      return NextResponse.json({ skipped: "Self-serve indie tier" });
    }

    const customerEmail = payload.customer?.email || payload.user?.email;
    const customerName =
      payload.customer?.name ||
      payload.customFieldData?.legal_entity_name ||
      customerEmail;
    const legalEntity =
      (payload.customFieldData?.legal_entity_name as string) ||
      payload.customer?.billingAddress?.organization ||
      customerName;

    const amountFormatted = ((payload.amount || 0) / 100).toFixed(2);
    const currency = (payload.currency || "usd").toUpperCase();
    const effectiveDate = new Date().toISOString().split("T")[0];

    const markdownAgreement = `# Enterprise Commercial License, SLA & Data Processing Agreement

**Effective Date:** ${effectiveDate}  
**Software Licensor:** HyperScale DevTools Ltd. ("Licensor" & "Data Processor")  
**Customer Legal Entity:** ${legalEntity} ("Customer" & "Data Controller")  
**Merchant of Record Reference:** Polar.sh Order #${payload.id} (${currency} ${amountFormatted})

---

## 1. Relationship with Merchant of Record (Polar.sh)

Customer has purchased a commercial subscription to **${productName}** through Licensor's authorized Merchant of Record, **Polar Software Inc. ("Polar.sh")**. While Polar.sh administers payment collection and statutory tax remittance, this Agreement governs the direct bilateral software license, intellectual property rights, uptime SLA, and data processing obligations between Licensor and Customer.

## 2. Commercial License Grant & Seat Allocation

| Plan Tier | Polar Order ID | Billing Amount | SLA Target | Support Response |
|---|---|---|---|---|
| ${productName} | ${payload.id} | ${currency} ${amountFormatted} | 99.95% Uptime | < 2 Hours (P1 Priority) |

Licensor grants Customer a non-exclusive, worldwide, commercial license to deploy and use the Software across Customer's internal engineering environments during the active subscription term.

## 3. GDPR Article 28 Data Processing Addendum (DPA)

1. **Scope & Processing Instructions:** Licensor shall process Customer Personal Data and repository telemetry solely on documented instructions from Customer in accordance with GDPR Article 28.
2. **Technical & Organizational Security:** Licensor enforces TLS 1.3 encryption in transit, AES-256 encryption at rest, strict tenant isolation, and annual third-party penetration testing.
3. **Authorized Subprocessors:** Customer authorizes Licensor's core infrastructure subprocessors (Amazon Web Services, Cloudflare Inc., and Neon Inc.). Licensor shall provide 30 days prior notice of any subprocessor changes.

## 4. Limitation of Liability & Governing Law

Each party's aggregate cumulative liability arising out of or related to this Agreement shall not exceed the total subscription fees paid by Customer in the twelve (12) months preceding the claim. Governed by the laws of the State of Delaware.`;

    const signbeeRes = await fetch("https://signb.ee/api/v1/send", {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        title: `Enterprise License & DPA — ${legalEntity} (${effectiveDate})`,
        markdown: markdownAgreement,
        sender_name: "Legal & Compliance — HyperScale DevTools Ltd.",
        sender_email: "legal@hyperscaledev.io",
        recipient_name: String(customerName),
        recipient_email: String(customerEmail),
        expires_in_days: 14,
        webhook_url: `${process.env.NEXT_PUBLIC_APP_URL}/api/webhooks/signbee`,
      }),
    });

    const result = await signbeeRes.json();
    return NextResponse.json({ dispatched: true, signbee_document_id: result.document_id });
  }

  return NextResponse.json({ received: true });
}

import { NextResponse } from "next/server";
import crypto from "crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const signatureHeader = req.headers.get("x-signature") || "";
  const secret = process.env.LEMONSQUEEZY_WEBHOOK_SECRET!;

  // 1. Constant-time HMAC-SHA256 verification
  const hmac = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const digestBuffer = Buffer.from(hmac, "utf8");
  const signatureBuffer = Buffer.from(signatureHeader, "utf8");

  if (
    digestBuffer.length !== signatureBuffer.length ||
    !crypto.timingSafeEqual(digestBuffer, signatureBuffer)
  ) {
    return NextResponse.json({ error: "Invalid X-Signature" }, { status: 401 });
  }

  const event = JSON.parse(rawBody);
  const eventName: string = event.meta?.event_name;

  if (eventName === "order_created" || eventName === "subscription_created") {
    const attrs = event.data?.attributes || {};
    const customData = event.meta?.custom_data || {};

    const buyerEmail: string = attrs.user_email;
    const buyerName: string = attrs.user_name || buyerEmail;
    const companyName: string = customData.company_legal_name || buyerName;
    const variantName: string = attrs.variant_name || attrs.product_name || "Enterprise Tier";
    const totalFormatted: string = attrs.total_formatted || "$2,400.00";
    const orderNumber = attrs.order_number || event.data?.id;
    const today = new Date().toISOString().split("T")[0];

    // 2. Dispatch post-checkout B2B Master Subscription Agreement via Signbee
    const response = await fetch("https://signb.ee/api/v1/send", {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        title: `B2B Subscription Agreement & SLA — ${companyName}`,
        markdown: `# B2B Software Subscription Agreement & SLA

**Date:** ${today}  
**Lemon Squeezy Order Reference:** #${orderNumber}  
**Customer:** ${companyName} (${buyerEmail})  
**Plan & Commercial Commitment:** ${variantName} (${totalFormatted})

## 1. Scope of Commercial License
This Agreement supplements the payment transaction processed via Lemon Squeezy LLC (Merchant of Record) and establishes direct commercial SLA, confidentiality, and GDPR data processing obligations between Vendor and **${companyName}**.

## 2. Confidentiality & Security Commitments
Both parties agree to maintain strict confidentiality regarding proprietary API keys, architecture documentation, and benchmark data shared under this subscription.`,
        sender_name: "Operations & Legal — DevStack AI Inc.",
        sender_email: "contracts@devstack.ai",
        recipient_name: buyerName,
        recipient_email: buyerEmail,
        expires_in_days: 10,
      }),
    });

    const data = await response.json();
    return NextResponse.json({ ok: true, document_id: data.document_id });
  }

  return NextResponse.json({ ok: true });
}

import { NextResponse } from "next/server";

export async function POST(req: Request) {
  const payload = await req.json();

  // Signbee fires document.signed as soon as Party B completes the ceremony
  if (payload.event === "document.signed") {
    const {
      document_id,
      recipient_email,
      signed_pdf_url,
      sha256_hash,
      signed_at,
    } = payload.data;

    // 1. Archive the signed PDF URL and cryptographic SHA-256 hash in your database
    console.log(`[Compliance] Verified SHA-256 (${sha256_hash}) for ${recipient_email}`);

    // 2. Unlock enterprise license key or trigger GitHub private repo invite
    await fetch("https://api.polar.sh/v1/customer-portal/license-keys/activate-enterprise", {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${process.env.POLAR_ACCESS_TOKEN}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        customer_email: recipient_email,
        compliance_audit: {
          signbee_document_id: document_id,
          sha256_hash,
          signed_at,
          signed_pdf_url,
        },
      }),
    });

    return NextResponse.json({ provisioned: true });
  }

  return NextResponse.json({ acknowledged: true });
}