# NEW CHAT HANDOVER - MPC Companion Sales Landing Page

## Governing documents

Keep these attached in the new session and treat them as controlling instructions:

1. `MPC_TRUTH_BIBLE-2026-07-23.docx`
2. `1 Final rule concerning the Truth Bible.docx`

The stability rule is mandatory: do not rewrite working systems for appearance alone. Change code only for measurable reliability, maintainability, security, performance, hosting compatibility, or Truth Bible compliance.

## User operating rule

The user never edits, creates, moves, cuts, fixes, or patches file or script contents. ChatGPT performs every file and code modification. The user may only use cPanel/PayPal interfaces to upload, extract, select settings, enter private credentials, and click controls.

## Product

- Product: First Time Marloth & Kruger International Visitors Companion
- Version: Premium V1.0
- Displayed premium value: US$29
- Selling price: US$14.99
- Delivery: private PDF after confirmed PayPal capture
- Entitlement: one payment creates one time-limited, single-use download
- Second download: blocked and requires a new purchase

## Current domain and hosting state

- Final domain: `https://guide.marlothparkcentral.com`
- Domain has been created in Namecheap cPanel.
- Document root: `/home/marljsei/guide.marlothparkcentral.com`
- SSL is active for the non-www domain.
- `https://guide.marlothparkcentral.com` currently shows an empty directory index with only `cgi-bin`, confirming DNS, HTTPS, and document root access.
- Do not use `www.guide.marlothparkcentral.com` because its certificate is not covered.
- cPanel provides **Setup Node.js App**.
- Existing older apps are stopped on Node.js 20.20.2, but the new guide app must be created separately using Node.js 22.x.

## Critical compatibility finding

The original production ZIP requires Node.js 22 because it imports the built-in `node:sqlite` module. `node:sqlite` was added in Node.js 22.5. The original package must not be deployed under Node.js 20.

A cPanel-ready package has therefore been prepared with:

- root startup file `app.js`
- Node.js requirement `>=22.5.0 <25`
- Docker/Caddy deployment files removed
- cPanel-specific instructions
- protected PDF preserved outside the public folder
- PayPal Orders v2 and verified webhooks preserved
- single-use download logic preserved

## Exact next cPanel action

In **Setup Node.js App**, click **Create Application** and enter:

- Node.js version: newest available **22.x**
- Application mode: **Production**
- Application root: `guide.marlothparkcentral.com`
- Application URL: `https://guide.marlothparkcentral.com`
- Application startup file: `app.js`

Then upload and extract the cPanel-ready ZIP directly into `/home/marljsei/guide.marlothparkcentral.com` so `app.js` and `package.json` are at the folder root.

## Required environment variables

- `NODE_ENV=production`
- `BASE_URL=https://guide.marlothparkcentral.com`
- `TRUST_PROXY=true`
- `PAYPAL_ENV=sandbox` initially
- `PAYPAL_CLIENT_ID=<PayPal Sandbox Client ID>`
- `PAYPAL_CLIENT_SECRET=<PayPal Sandbox Secret>`
- `PAYPAL_WEBHOOK_ID=<Sandbox Webhook ID>`
- `DOWNLOAD_TOKEN_MINUTES=30`
- `SUPPORT_EMAIL=contact@marlothparkcentral.com`
- `SUPPORT_WHATSAPP=+27 79 084 1496`
- `ADMIN_API_KEY=<long private random value>`
- `DB_PATH=/home/marljsei/guide.marlothparkcentral.com/data/orders.sqlite`

Do not manually set `PORT`; cPanel supplies it.

## PayPal webhook

Use:

`https://guide.marlothparkcentral.com/api/paypal/webhook`

Events:

- `PAYMENT.CAPTURE.COMPLETED`
- `PAYMENT.CAPTURE.DENIED`
- `PAYMENT.CAPTURE.REFUNDED`
- `PAYMENT.CAPTURE.REVERSED`

## Release gate

Do not claim Live production readiness until all of these pass:

1. Node app starts under Node.js 22.x.
2. `/health` returns `ok: true`.
3. Landing-page images and PayPal button load over HTTPS.
4. Sandbox create-order and capture succeed.
5. Webhook verification returns HTTP 200 for valid events.
6. First download returns the private PDF.
7. Reusing the token returns HTTP 410.
8. Refund/reversal removes any unused entitlement.
9. One real US$14.99 Live purchase succeeds after switching credentials.
10. Final flyer QR code points only to `https://guide.marlothparkcentral.com`.