# Step Away v2.14 PayPal Transaction Unlock

Commercial shape:
- Poker-deck demo: one case.
- Official deck purchase: full app access.
- Future packs: one-off purchases, not monthly.

Unlock logic:
- Buyer purchases the official deck through PayPal.
- PayPal transaction/capture/order ID is recorded in `data/paypal-transactions.json`.
- Buyer enters their PayPal transaction ID in the app.
- The app checks the hosted database file through `api.php`.
- Valid completed purchases unlock the full app.

Profile rule:
- One purchase supports 3 active profiles by default.
- If a fourth profile uses the same transaction ID, access moves from the oldest profile to the new profile.
- Transaction-level stats are kept with the purchase, so legitimate device/profile migration remains possible.

Manual import:
- Use `api.php?endpoint=paypal-manual-import` with environment variable `STEPAWAY_ADMIN_IMPORT_KEY`.
- Or import rows into `data/paypal-transactions.json`.

PayPal wiring:
- `paypal_webhook.php` is included as a safe disabled scaffold.
- Paste PayPal credentials into `data/paypal-config.json` and set `enabled:true` only after the webhook verification section is completed.
