Comprehensive admin + user dashboards (production-ready)

lib/billing/paypal.ts

@@ -1,8 +1,18 @@
 import type { PlanKey } from "./plans";
 
-const base = () => process.env.PAYPAL_API_BASE ?? "https://api-m.sandbox.paypal.com";
+const SANDBOX_BASE = "https://api-m.sandbox.paypal.com";
+const base = () => process.env.PAYPAL_API_BASE ?? SANDBOX_BASE;
 const appUrl = () => process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000";
 
+// Loudly warn (but don't throw — never break deploys) if PayPal is pointed at the
+// sandbox while running in production. The sandbox default is fine for dev.
+if (process.env.NODE_ENV === "production" && base().includes("sandbox.paypal.com")) {
+  console.warn(
+    "[paypal] WARNING: running against the PayPal SANDBOX in production. " +
+      "Set PAYPAL_API_BASE=https://api-m.paypal.com for live billing."
+  );
+}
+
 function creds(): { id: string; secret: string } {
   const id = process.env.PAYPAL_CLIENT_ID;
   const secret = process.env.PAYPAL_CLIENT_SECRET;