snapapi: session 22 — customer portal, 129 tests, staging deployed

projects/snapapi/memory/sessions.md

@@ -1,5 +1,47 @@
 # SnapAPI Session Log
 
+## Session 22 — 2026-02-25 08:00 UTC (Customer Portal + Test Coverage Expansion)
+
+**Goal:** Close key recovery gap (Investor Test #4), expand test coverage.
+
+### What Was Done
+
+1. **Stripe Customer Portal + Key Recovery (staging):**
+   - POST /v1/billing/portal — creates Stripe billing portal session for subscription management
+   - GET /v1/billing/recover — secure masked key lookup (no info leak on unknown emails)
+   - /recovery.html — user-facing key recovery form with dark theme
+   - "Lost your API key?" link added to landing page
+   - New keys.ts functions: getKeyByEmail(), getCustomerIdByEmail()
+   - 10 new billing tests (TDD: tests written first, then implementation)
+   - Commit: c324366
+
+2. **Comprehensive route-level tests (test-only, no prod code changes):**
+   - health.test.ts, playground.test.ts, screenshot.test.ts, watermark.test.ts
+   - Tests cover input validation, error handling, auth, rate limiting, SSRF blocking
+   - Commit: a20828b
+
+3. **Build fix:** Excluded test files from tsc build (commit b2688c0)
+
+4. **Staging deployment:** Built image, transferred to workers, deployed with commit-hash tag.
+   - Fixed k3s-mgr deploy key setup (was missing SSH config)
+   - Learned: must use commit-hash image tags (deployment uses IfNotPresent + specific tags, not :latest)
+
+5. **Test suite: 129 tests passing, 0 failures** (up from 61)
+
+### Investor Test — Session 22
+1. Trust? **Yes** — core flows work, playground demos well
+2. Data loss on crash? **No** — all in PostgreSQL
+3. Free tier abuse? **Low** — playground IP-limited + watermarked + URL length limit
+4. Key recovery? **YES on staging** ✅ (was "Not yet" — now have /recover + /portal endpoints)
+5. Website features work? **Yes** on production; staging has additional features pending deploy
+
+### Staging vs Production Gap
+Staging (v0.5.1) has 6+ features not in production (v0.4.3):
+- GET endpoint, response caching, customer portal, key recovery, bug fixes (FAQ, privacy, browser restart, URL limit)
+- Awaiting investor approval for production tag
+
+---
+
 ## Session 21 — 2026-02-24 16:23 UTC (TDD: Lazy Stripe + Auth/Keys Tests)
 
 **Goal:** Fix test suite (billing.ts crash) and add missing unit tests.