Update app.js

app.js

@@ -20,7 +20,7 @@ const COUPON_URL = `${API_BASE}/etc/coupon`; // POST {code}
 const CHAT_URL = `${API_BASE}/etc/chat`; // POST {message,sessionId,email}
 const REFERRAL_URL = `${API_BASE}/etc/referral`; // POST {referrer,friend_name,friend_email,uuid}
 // WIZZARD=false is written via AGENT_INFO_URL (POST { uuid, key, value })
-const CREDITS_URL = `${API_BASE}/payment/credits`; // POST {key}
+const CREDITS_URL = `${API_BASE}/payment`; // hidden form POST → 302 Stripe redirect
 const CONTRACT_EXTEND_URL = "https://derez.ai"; // ← replace with Stripe payment link
 const CONTRACT_CANCEL_URL = "https://derez.ai"; // ← replace with Stripe cancellation link
 
@@ -880,21 +880,43 @@ function renderKeys(keys) {
     .join("");
 }
 
-async function buyCredits(keyName, btn) {
-  btnLoad(btn, "Processing\u2026");
-  try {
-    const res = await fetch(CREDITS_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ key: keyName }),
-    });
-    if (!res.ok) throw new Error(`Request failed (${res.status})`);
-    toast("Credits purchase initiated!", "success");
-  } catch (err) {
-    toast(err.message, "error");
-  } finally {
-    btnReset(btn);
+function buyCredits(keyName, btn) {
+  btnLoad(btn, "Redirecting\u2026");
+
+  const params = new URLSearchParams(window.location.search);
+  const activeAgent = agents.find((a) => a.UUID === activeUUID);
+  const couponInput = document.getElementById("coupon-input");
+  const coupon = couponApplied && couponInput ? couponInput.value.trim() : "";
+
+  const fields = {
+    product: "prod_Ufj2wCf4rhemT8",
+    agent: activeUUID || "",
+    period: "",
+    location: activeAgent?.server || "",
+    email: currentEmail || "",
+    coupon,
+    utm_source: params.get("utm_source") || "",
+    utm_medium: params.get("utm_medium") || "",
+    utm_campaign: params.get("utm_campaign") || "",
+    utm_term: params.get("utm_term") || "",
+    utm_content: params.get("utm_content") || "",
+  };
+
+  const form = document.createElement("form");
+  form.method = "POST";
+  form.action = CREDITS_URL;
+  form.target = "_self";
+
+  for (const [name, value] of Object.entries(fields)) {
+    const inp = document.createElement("input");
+    inp.type = "hidden";
+    inp.name = name;
+    inp.value = value;
+    form.appendChild(inp);
   }
+
+  document.body.appendChild(form);
+  form.submit();
 }
 
 /* ═══════════════════════════════════════════════════════════════