BookifAI — Session Handoff (2026-07-10)

Fable Mode audit methodology + market research + money-path audit

> This is a briefing, not an instruction set. Nothing here auto-executes. Sondra decides > what to act on. No code on the live app was touched this session — only research + audit docs.

---

0. Where we are in one paragraph

BookifAI is LIVE (bookifai.app, real Stripe). This session did NOT touch the app code — it did three things: (1) built and wired a permanent "Fable Mode" money-path audit methodology into the safety system; (2) ran the market research BookifAI never got (it was a PushTen template sold as-is), which reframed the whole product; (3) ran an adversarial money-path audit that found a real paywall hole. The plan was reordered: money-path fixes come BEFORE the nav/UX polish. No fixes are applied yet — clean pickup point.

---

1. What was BUILT this session (the only files changed)

The "Fable Mode audit" is now a self-firing part of the safety net:

• reference/fable-mode-money-path-audit.md — NEW. The living money-path checklist +

dated Findings Log (seeded with today's BookifAI + P2P findings). Designed to GROW: every new hole any audit finds gets appended here.

• .claude/commands/app-safety-check.md — added Phase 2d (money-path deep audit runs for

any app OR website that takes money) + a MONEY-PATH line in the verdict block.

• reference/vibe-coding-safety-net.md — added Section E pointing to the checklist.
• ~/.claude/skills/fable-mode/SKILL.md — added a Notes pointer to the checklist.
• Memory: reference_fable_mode_money_path_audit.md + MEMORY.md index line.
• PROJECTS/Bookify AI Studio/knowledge/bookifai-market-research-report-2026-07-10.html —

NEW. The market-research + pricing report (opened in Edge).

• Companion (from an earlier scout): knowledge/market-research-competitors-pricing-2026.html.

Standing rule now in force: any app/site that touches money gets the money-path audit BEFORE nav polish, and re-run after any payment/credit/entitlement change. It's automatic in /app-safety-check.

---

2. Money-path audit — FINDINGS (the important part)

Adversarial audit of BookifAI's webhook, edge functions, RLS, and billing/download path. Ranked most-severe first. Nothing fixed yet.

🔴 #1 HIGH — Client-side paywall: the $29 book can be taken for free

The paid deliverable (PDF / Word / KDP print pack + publishing kit) is generated entirely in the browser (src/lib/book-export.ts, src/lib/kdp-print.ts). The paid flag only decides which buttons render (src/components/create-book/ExportOptions.tsx). A free user can flip the entitlement state in DevTools or call the export function from the console → full product, $0, never touching the DB (so the solid server rules never fire). The server function that WOULD enforce it (supabase/functions/export-ebook/index.ts, checks entitlement==='paid') is dead code — never called (grep export-ebook src/ = nothing).

• Blast-radius limiter: page illustrations ARE server-locked for free users (meter_image

returns free_page_locked), so a bypassed free export is text + up to 3 cover attempts, not a fully-illustrated book. Real, but not the whole product.

• Fix (the biggest piece of work in the plan): move the compiled-artifact generation

server-side, behind the existing entitlement==='paid' check. A client gate can never secure a file whose source data is already in the browser. NOT a drop-in: export-ebook today is text-only (no illustrations, no KDP bleed) — the jsPDF/kdp-print illustrated assembly must be reproduced server-side (or the server issues a short-lived signed authorization the generator requires).

🟠 #2 MEDIUM — No refund/chargeback clawback

stripe-webhook/index.ts handles ONLY checkout.session.completed. No charge.refunded / charge.dispute.created handler, no revoke_purchase RPC. Buyer can pay → download → refund → keep the unlock + unused credits. Fix: add a refund branch + a service-role revoke_purchase RPC that reverses the grant (you already store stripe_session_id/stripe_event_id in purchases, so reverse-lookup is cheap).

🟠 #3 MEDIUM — AI-bill drain on unmetered text endpoints

No ANONYMOUS drain (all AI fns require a signed-in user) and images ARE metered. BUT several text endpoints run paid Claude-Sonnet calls on auth alone, with no per-call meter and no rate limit: generate-title, generate-toc (per-call ceiling only), generate-chapter legacy edit path ("stays free and unmetered"), and ALL ideation-chat actions. One free signup + a loop → runs up her OpenRouter/Anthropic bill. Fix: wrap them in the daily-quota guard she already wrote for research (claim_research_quota pattern), or require an active book slot; at minimum rate-limit per account/day.

✅ VERIFIED SAFE (checked in code, not trusted from old notes — the prior work was real)

• Stripe webhook — signature-verified (constructEventAsync, 400 on bad sig) + idempotent

(unique stripe_event_id + apply_purchase on-conflict-do-nothing guard). SOLID.

• RLS / credit tampering — every entitlement table (profiles, book_meters, purchases)

is read-only to the client; all writes via service-role SECURITY DEFINER fns. update profiles set credits=9999 is blocked. SOLID.

• Metering integrity — server-side atomic SELECT ... FOR UPDATE, proper reserve-then-refund.

SOLID.

• Minor hygiene (not money): projects/chapters UPDATE policies lack WITH CHECK (could

reassign user_id) — no paid access gained, but worth adding for hygiene.

Fix priority: #1 server-side export (highest) → #2 refund handler → #3 rate-limit text endpoints. Then re-verify adversarially + /app-safety-check.

---

3. Market research — the strategic reframe

Full report: knowledge/bookifai-market-research-report-2026-07-10.html (in Edge). Three scouts (competitors/pricing, audience demand via Reddit+forums, buyer willingness-to-pay).

Headline: BookifAI is priced for the wrong buyer. There are TWO different customers:

• Buyer A — KDP entrepreneur: wants a cheap tool, price-sensitive ($/book ROI). Illustration

+ KDP formatting are real value (replaces a $2,500–6,000 illustrator). Price band: $29–49/mo or $99–249 one-time.

• Buyer B — coach/consultant (book = lead magnet): wants an authority asset, price-INsensitive,

displacing a $15k–100k ghostwriter. Could pay $297–997/book or a premium annual tier. A LOW price actively hurts credibility here. This buyer is basically Sondra's existing Amplif-AI audience — and nobody in the market is capturing them with AI software (all priced $15–50/mo, compared to ChatGPT). Open lane.

Which job people want: NOT "one sentence → finished book." Both buyers lean toward "shape the material I already have." The "already have a draft" crowd is the fundable one — specific, already-funded pain (KDP formatting rejection, AI won't edit their own chapter, illustration inconsistency), lower stigma. The "always wanted to write a book" crowd is bigger but flakier, cheaper, and takes the most stigma → best as a free/cheap on-ramp, not the paid core.

Guardrail: position as editor/formatter, never ghostwriter. Self-publishing community cheers AI-as-editor, mocks AI-as-author. Editing stays opt-in. Meter on IMAGES (existing model), not on writing.

White space confirmed: nobody bundles import + AI-edit + illustrations + KDP-ready. Adult-book illustration is wide open (all rivals are children's-only). Illustration consistency is the unsolved pain — BookifAI already cracked cover-as-reference consistency = a differentiator.

Honesty flag: the ONE unverified assumption is whether Buyer B pays four figures for software specifically (vs a human ghostwriter). Validate with a few real conversations / /roast before locking premium pricing.

---

4. "Import your existing book" feature — viability

Verdict: highly viable + cheap — the expensive 90% already exists and is book-type-general (AI edit = ReviewPolish; illustrations = per-chapter; KDP export). The DB field uploaded_content already exists AND is already fed into generate-chapter. Missing = only the front door: a paste/upload screen + Word .docx reading (mammoth.js — small, free; ASK before installing) + chapter chunking (the one fiddly part). PDF import = harder, defer. Decision: it earns its own PRD + Fable prompt, built for the RIGHT buyer/positioning — write it AFTER the app is made solid, NOT before. Slot as "Phase 3.5."

---

5. THE PLAN (reordered this session)

• Phase 0 — money-path fixes (NEW, now first): ② refund handler + ③ rate-limit text endpoints

(both quick — do first), then ① move book generation server-side (the big build). Re-verify + /app-safety-check.

• Phase 1 — shell/nav (root-cause fix): BookifAI has NO shared layout — every page re-builds

its own sidebar, so Sign Out exists on the Dashboard page ONLY, Support isn't in the nav, Buy Credits is buried in "Account," and the "tiny home page" = landing locked to max-w-6xl. Build ONE shared shell (like P2P's Shell.jsx) with: Dashboard · My Books · Templates · Buy Credits · KDP Resources · Account · Help & Support · Sign Out · (hidden Admin for her email). Widen the landing page. ~7 files. Fixes 4 complaints at once.

• Phase 2 — surface security: CORS pin (~9 functions off * → bookifai.app; the shared

_shared/constants.ts + export-ebook's own copy) · install DOMPurify + sanitize the markdown→HTML of AI chapter content (book-export.ts, ChapterEditor.tsx) · flip the Supabase breached-password toggle (settings, not code). [DOMPurify also closes the localStorage-token concern — same battle. Skip a localStorage rewrite; no real gain.]

• Phase 3 — parity builds: Admin dashboard (email-gated, mirror P2P's admin edge fn +

Admin.jsx) · first-run onboarding + post-purchase guidance · add Children's/Fiction template cards (Templates page only has 6 non-fiction) · clarify "any book" on sales page.

• Phase 3.5 — Import Your Book: PRD + Fable prompt, then build.
• Phase 4 — Google consent branding (settings; consent shows raw supabase.co URL) →

/app-safety-check before calling it shipped.

P2P quality bar reference (studied this session): shared Shell.jsx (sidebar w/ credits box + buy-more in 2 places, Sign Out in footer) · StarGate.jsx un-skippable first-run → drops user into first action · post-purchase confirmation folded into Account w/ auto-refresh · admin edge fn gated to srverva@gmail.com (server-side ADMIN_EMAILS) · Support.jsx in nav · CreditGuide.jsx single source of truth for cost chips · ErrorBoundary · route fallback (no 404s).

---

6. OPEN DECISIONS (all Sondra's calls)

1. Start Phase 0? (money-path fixes on the live app — begin with refund + rate-limit, then

server-side export). Not yet greenlit to edit code.

2. Two-product strategy — cheap tool (Buyer A) + premium "Authority Book Engine" (Buyer B).

Product #2 is PARKED by her call ("finish the app I have first"). /roast the premium pricing ONLY when she's ready to pursue #2 — NOT now.

3. Import-Your-Book PRD + Fable prompt — write it as part of this work, or keep flagged? (She

leaned: make the app solid first.)

4. mammoth.js for Word import — needs her OK before install (Phase 3.5).
5. Agent Opus credits expire TODAY (2026-07-10) — the dachshund render backlog is a competing

priority she chose to set aside for BookifAI; flagged, her call.

---

7. Next-session pickup checklist

1. Re-open this handoff + the money-path findings (§2). Confirm nothing changed on bookifai.app.
2. If she greenlights Phase 0: start with #2 refund handler + #3 rate-limits (quick, safe), then

#1 server-side export (design decision: reproduce KDP assembly server-side vs signed-auth token). Test each with the verify-loop (real card round-trip where safe), then re-audit.

3. 10-sec regression check already PASSED this session: cover + chapter-3 images still display

after the earlier storage-security fix.

4. Every money change → re-run the money-path audit (reference/fable-mode-money-path-audit.md)

+ /app-safety-check. Append any new hole to that checklist.

---

8. Key files

• App: PROJECTS/Bookify AI Studio/app/ (React+Vite+TS, Supabase umnlokuehteqwrheoyai,

Cloudflare Pages bookifai, repo AmplifAI-Your-Business/amplifai-bookifai).

• Paywall hole: app/src/components/create-book/ExportOptions.tsx, app/src/lib/book-export.ts,

app/src/lib/kdp-print.ts, app/supabase/functions/export-ebook/index.ts (correct but unused).

• Webhook/refund: app/supabase/functions/stripe-webhook/index.ts,

app/supabase/migrations/20260710000100_catchup_schema_drift_and_hardening.sql (apply_purchase; add revoke_purchase sibling).

• Unmetered text: app/supabase/functions/{ideation-chat,generate-title,generate-toc,generate-chapter}/index.ts.
• CORS: app/supabase/functions/_shared/constants.ts (line 17 *) + export-ebook/index.ts (own copy).
• Research: PROJECTS/Bookify AI Studio/knowledge/*.html.
• Audit methodology: reference/fable-mode-money-path-audit.md.