# Paid AI V2 Build Status

Date: 2026-09-15

## Completed

- Paid AI card gate added.
- Paddle.js overlay checkout wired to a configurable one-time price.
- Server-side anonymous session + card-credit balance added.
- Signed Paddle webhook verification added (`Paddle-Signature`, HMAC-SHA256, timestamp tolerance).
- `transaction.completed` price/project validation added.
- Webhook event + transaction idempotency added.
- Successful purchase provisions configurable AI card credits.
- AI image endpoint refuses unpaid generation when `REQUIRE_PAYMENT=1`.
- Credit reservation/refund behavior added around image generation.
- Existing auto-prompt, AI wish, local photo, canvas editing and PNG export preserved.
- Paddle-aware CSP/security headers added.
- Persistent single-instance payment ledger added.

## QA passed

- `npm test`: 7/7 PASS.
- `node --check server.mjs`: PASS.
- `node --check public/app.js`: PASS.
- Frontend JS DOM ID integrity: PASS (34/34 IDs resolved).
- JSON parsing: PASS.
- Local signed-webhook integration test: PASS.
- Credit provisioning test: **0 -> 1** after verified payment webhook.
- Duplicate webhook replay test: **remains 1**, no duplicate credit.
- Paddle price detection/quantity unit tests: PASS.

## Intentionally not live-tested here

- A real Paddle Sandbox checkout requires the user's actual Paddle sandbox client token, product price ID and notification secret.
- A real OpenAI image request requires the user's actual server-side OpenAI API key/billing balance.

The code paths and local signed-webhook provisioning flow are complete; the remaining work is inserting real account credentials and running one Sandbox end-to-end payment/generation test on the deployed domain.