Consent Checkout for civilian spaceflight.
A payment primitive where the payer, beneficiary, and audience are three different people—with consent enforced in the product, not a disclaimer.

Watch the demo · Architecture · Run locally · Demo runbook · Contribute

_{Hero image: NASA, ISS058-E-005282.}

Space tourism will create a new category of purchase: one person pays for another person’s once-in-a-lifetime experience. Existing checkout systems collapse the important identities into one account. That is wrong for a parent sponsoring a daughter’s flight, an employer funding an astronaut experience, or a partner gifting a mission.

LaunchDay creates a Consent Checkout:

The result is a believable new payment behavior—not a themed checkout page. Stripe settles payment; Auth0 proves the human; LaunchDay enforces the relationship between them.

The 90-second judge flow

1. Open the Mission Control demo—no accounts or credentials required.
2. Choose Unlock Family Mission Room and select Sponsor Maya.
3. Continue to Stripe; demo mode activates the same entitlement locally.
4. Invite a guest, then revoke them. The passenger retains ownership; payment remains valid.
5. Generate First Orbit, a private visual memory with optional ElevenLabs narration.

The product always works in demo mode, then turns on the live providers when credentials are added.

The core invariant: completing checkout funds an entitlement; it never grants an audience permission.

flowchart LR
  sponsor["Sponsor"] --> checkout["Stripe Checkout"]
  passenger["Passenger"] --> auth["Auth0\nidentity"]
  guest["Named guest"] --> auth
  checkout --> webhook["Verified webhook"] --> entitlement["Mission entitlement\nbeneficiary ≠ payer"]
  auth --> policy["LaunchDay policy engine"]
  entitlement --> policy
  policy --> room["Private Mission Room"]
  room --> blob["Private Vercel Blob"]
  room --> neon["Neon / Drizzle"]
  blob --> story["First Orbit\nOpenRouter + ElevenLabs"]

Read the detailed security and data-flow rationale in ARCHITECTURE.md.

• Beneficiary-bound payment: a verified checkout.session.completed webhook activates the passenger’s entitlement—not the payer’s access.
• Auth0 identity boundary: passenger owner actions require a verified Auth0 identity; guests are matched to explicit identity-specific invitations.
• Revocable family access: guests have expiry-aware grants and can lose access instantly without affecting the payment.
• Private media by default: direct upload tokens are created only for the mission owner; reads go through an authorization proxy before the private Blob is streamed.
• First Orbit: private images become a structured, cinematic story. OpenRouter and ElevenLabs are optional; a clearly marked local fallback keeps the demo dependable.
• Neon-ready persistence: Drizzle stores the mission policy and entitlement in Neon when configured, with a safe in-memory demo fallback for judges.

1. Payment is not consent. Paying is a funding event, never an audience grant.
2. The passenger is sovereign. The beneficiary owns audience decisions and can revoke them.
3. Private by default. Media and narration are shared only after an identity and policy check.
4. Trust must be demoable. Every enforcement point has a visible, understandable product consequence.

git clone https://github.com/vnmoorthy/launchday.git
cd launchday
npm install
npm run dev

Open http://localhost:3000. The out-of-the-box experience is intentionally credential-free.

Copy .env.example to .env.local, set NEXT_PUBLIC_DEMO_MODE=false, and never commit that file.

Set these URLs in the Auth0 application dashboard for both local and deployed domains:

Allowed Callback URL: https://YOUR_DOMAIN/auth/callback
Allowed Logout URL: https://YOUR_DOMAIN
Allowed Web Origin: https://YOUR_DOMAIN

LaunchDay uses Auth0 Next.js SDK v4 and mounts auth routes at /auth/* through src/proxy.ts.

Use a test-mode secret key while developing. Forward events locally with:

stripe listen --forward-to localhost:3000/api/stripe/webhook

Copy the returned whsec_... value into .env.local. Only the signature-verified webhook activates a live paid entitlement.

npm run db:push

npm run lint
npm run build

Continuous integration runs both checks on every pull request.

src/app/api/checkout       Stripe Checkout with beneficiary metadata
src/app/api/stripe/webhook Verified payment activation
src/lib/authorization      Owner and guest policy enforcement
src/app/api/upload         Direct, private Blob upload authorization
src/app/api/media          Private-media authorization proxy
src/app/api/story          Schema-bound visual story generation
src/app/api/narration      Authorized narration streaming
src/db                     Neon + Drizzle persistence

LaunchDay is a private orientation and memory layer. It is not medical, flight-safety, fitness, or flight-clearance software. Read SECURITY.md before deploying a live experience.

• Separate payer, beneficiary, and audience in the checkout model
• Auth0-backed ownership and explicit guest grants
• Stripe webhook entitlement activation
• Private media and story experience
• Auth0 Organizations for commercial operators and concierge teams
• Stripe Connect for operator-sponsored mission packages
• Passenger consent receipts and auditable audience-policy events
• Multi-mission family archive

Great projects are built in public. Read CONTRIBUTING.md, open an issue with a crisp use case, and keep the core principle intact: funding is never permission.

Released under the MIT License.