# Stripe Pin Desk

> A scan of one Stripe integration file - and its package manifest, if given - against a target Stripe API version,
> following the upgrade skill from stripe/ai. Paste the file (Node.js / TypeScript, Python, Ruby, PHP, Java, Go, .NET,
> a curl script or an HTML page with Stripe.js); the browser masks comments per language, finds the API version pins in the file
> and sorts it by kind - client configuration, per-request override, Stripe-Version header, webhook endpoint,
> strongly-typed override, Stripe.js option or script, a version constant - and compares it with the target by date
> and release name. It bumps stale pins, adds an explicit version where a client is created without one, adds the
> Stripe-Version header to curl tests, moves an older Stripe.js release and widens short Stripe id columns - never a
> pin moved to an older version or a stable pin to a preview. It lists what needs a decision: typed-SDK overrides,
> webhook endpoints that move by replacement with both signing secrets during cutover, the breaking major releases
> between a pin and the target, unfamiliar event types and the SDK packages. Metered runs write the review and the
> whole file on the target. Built on the SkillSafe skill @stripe/upgrade-stripe, from stripe/ai (MIT). An independent
> tool, not made by or affiliated with Stripe.

https://stripe-pin-desk.skillsafe.ai/

## What is free
- The scan: every pin (line, kind, where, value, what the page did) and every finding with an id (P1, P2, ...), an area, a severity (blocker, major, minor), the line, where it sits, what the page saw, the fix, and whether the page already changed it.
- The skill's upgrade rules marked from the scan, and the upgrade steps in the skill's order.
- The upgraded file, findings and pins as CSV, everything as JSON.
- Without a target, the page uses the skill's bundled fallback (2026-10-28.endive, a snapshot from 2026-11-03) and marks it unverified.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (review or rewrite), `unit`, `code`, `manifest` (may be empty), `carry` (rewrite only: the review's decisions) and `facts` (the page's scan).
- `review` replies with `summary`, `target` (the version and its source), `findings`, `cleared`, `extra` (up to five issues a scan cannot see, on real lines), `plan`, `tests` (curl calls with the Stripe-Version header and the key from STRIPE_SECRET_KEY) and `caveats`.
- `rewrite` replies with `summary`, `code` (the whole file on the target), `changes`, `kept` and `caveats`.
The page holds every reply to its scan: each id accounted for exactly once, the target stated, every API test sending the target, no key in any field, and the upgraded file re-scanned against the same target - a pin left behind, a version neither pasted nor the target, or a newer pin moved down is flagged.

## Links
- API tutorial: https://stripe-pin-desk.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@stripe/upgrade-stripe