Letterward AI

A multi-tenant AI content studio that turns a project brief into a generated post, scene plan, image set, and video-ready campaign workflow.

Overview · Screenshots · Features · Workflow · Architecture · Installation · Testing · Contributing

Overview

Letterward AI gives creators, freelancers, and company teams one structured place to move from an idea to reusable campaign assets. A user creates a workspace-scoped project, selects target channels and tone, generates and edits a post, turns that post into scenes, generates image concepts, selects references, and prepares a video output.

The project demonstrates a production-oriented Laravel and React architecture rather than a collection of disconnected AI demos. Authorization, usage limits, asynchronous jobs, provider failures, asset storage, subscription state, and Super Admin controls are modeled as first-class application concerns.

This repository is a portfolio-focused open-source release. Text, image, and video integrations are implemented against OpenAI APIs, while billing is implemented against Stripe. Those workflows require credentials and eligible provider accounts. Without credentials, the application returns explicit unavailable states; it does not fabricate successful provider output.

Screenshots

All committed screenshots use fictional local data and fixed desktop viewports.

Project dashboard	AI content workflow

Authentication	Super Admin dashboard
	Manual capture pending. The Super Admin surface was verified with fictional data and no browser errors, but the automated screenshot engine timed out on the admin layout. Follow the sanitized capture checklist below.

See the screenshot notes for capture and privacy requirements.

Implemented Features

Authentication and account security

• Laravel Fortify registration, login, logout, password confirmation, password reset, and email verification.
• Confirmed two-factor authentication with TOTP recovery codes.
• Passkey/WebAuthn registration and authentication support.
• Dedicated, rate-limited Super Admin authentication separated from company routes.
• Active-user, company-status, subscription, and role middleware boundaries.

Workspace-scoped content studio

• Workspace creation during registration with owner membership and a free-trial subscription snapshot.
• Project creation with target channels, tone, description, status, and current workflow stage.
• Channel-aware post generation and editable generated copy.
• Scene extraction with normalized titles, descriptions, image prompts, captions, and on-screen text.
• Image generation, per-scene regeneration, selection, status tracking, and downloads.
• Video generation requests, provider-status refresh, preview, persistence, and downloads.
• Project archive, restore, and explicit permanent deletion with related-asset cleanup.
• Plan-aware limits for projects, AI credits, generated assets, storage, and video minutes.

External providers and asynchronous work

• OpenAI Responses API integration for text generation.
• OpenAI image generation with base64 or URL result handling.
• OpenAI video creation, status retrieval, and content download with public-reference validation.
• Unique queued jobs for post, image, image-regeneration, and video workloads.
• Persisted processing, completed, and failed states so a refresh does not erase job progress.
• Timeouts, retries, sanitized provider metadata, and user-facing unavailable/error states.

Billing and platform administration

• Database-backed plans, features, regional prices, currencies, and country selection.
• Stripe Checkout and Billing Portal integration.
• Signature-verified, idempotently stored Stripe webhook events.
• Subscription, invoice, and payment synchronization plus manual administration paths.
• Super Admin management for companies, users, channels, plans, regional prices, subscriptions, invoices, payments, Stripe events, and platform settings.
• Encrypted database storage for the OpenAI API key configured by a Super Admin.

Public and engineering surfaces

• Responsive public landing, feature, use-case, pricing, FAQ, privacy, terms, and security pages.
• Light, dark, and system appearance modes with reduced-motion support.
• Workspace policies, route-level authorization, audit logs, AI request logs, secure headers, and request throttling.
• Pest feature and unit tests, PHPStan/Larastan analysis, Pint, ESLint, Prettier, TypeScript checks, and a production Vite build.

Application Workflow

flowchart LR
    A["Register or sign in"] --> B["Create workspace project"]
    B --> C["Generate and edit post"]
    C --> D["Generate scene plan"]
    D --> E["Generate and select images"]
    E --> F["Generate or refresh video"]
    F --> G["Preview and download assets"]

Loading

Each project is owned by a workspace and records its current stage. Controllers authorize the resource, domain services prepare provider inputs, queued jobs perform long-running requests, and database records preserve status and error details for later visits.

Architecture

Browser
  └─ Inertia React pages and typed Wayfinder routes
       └─ Laravel web routes, middleware, requests, and policies
            ├─ Project and billing controllers
            ├─ Domain services and provider contracts
            ├─ Queue jobs and scheduled commands
            └─ Eloquent models
                 ├─ Workspace-scoped MySQL/PostgreSQL/SQLite data
                 └─ Local or S3-compatible Laravel filesystems

• Backend: Laravel controllers remain thin while workspace provisioning, usage accounting, AI generation, asset downloads, pricing, and Stripe synchronization live in domain services.
• Frontend: Inertia v3 renders React 19 pages without a separate REST API. TypeScript props and Wayfinder-generated route helpers keep navigation and form actions aligned with Laravel routes.
• Tenancy: Workspace membership, workspace_id boundaries, middleware, policies, and scoped controller queries isolate company data.
• Authorization: Company users and Super Admins use separate route groups and access checks. Project, post, image, video, plan, user, and workspace actions are policy-protected.
• AI: Provider contracts isolate text, image, and video calls. The configured OpenAI key is encrypted at rest; provider responses and errors are normalized before persistence.
• Queues: Generation jobs implement retry, timeout, uniqueness, and failure-state behavior. The database driver is the local default; production may use a managed Laravel-compatible queue.
• Storage: Generated images and videos use Laravel's public disk; private application data uses the local disk. The repository includes S3-compatible configuration, but production object storage also requires the optional league/flysystem-aws-s3-v3 adapter.
• Billing: Stripe webhook signatures are verified before events are stored. Event IDs provide idempotency, and transactions synchronize subscriptions, invoices, payments, workspace limits, and audit records.
• Quality: Automated tests exercise authentication, workspace access, projects, providers, billing, public pages, platform management, safe seed data, and release-safety invariants.

Tech Stack

Versions below are taken from the committed lockfiles.

Backend	Frontend	Tooling and services
PHP 8.3+	React 19.2	Pest 4
Laravel 13.19	Inertia React 3.6	PHPStan / Larastan 3
Fortify 1.37	TypeScript 5.9	Laravel Pint
Inertia Laravel 3.1	Tailwind CSS 4.3	ESLint 9 and Prettier 3
Wayfinder 0.1	shadcn/ui and Radix UI	Vite 8
Stripe PHP 20.3	Motion and GSAP	GitHub Actions and Dependabot

External services are optional at boot but required for their related workflows: OpenAI for generated content, Stripe for online billing, and SMTP for transactional mail. Durable S3-compatible production media additionally requires Laravel's optional S3 Flysystem adapter.

Engineering Highlights

• End-to-end Laravel, Inertia, React, and TypeScript delivery in one repository.
• Explicit service and provider boundaries for billable external APIs.
• Multi-company authorization enforced in middleware, policies, and queries.
• Long-running media generation modeled as retryable, observable jobs.
• Country-aware prices stored as plan-price rows rather than hardcoded frontend amounts.
• Idempotent payment-event processing with subscription and invoice snapshots.
• Typed backend route integration and reusable studio UI primitives.
• Security-focused redaction, encrypted settings, rate limits, and public-release regression tests.

Prerequisites

• PHP 8.3 or newer with common Laravel extensions: Ctype, cURL, DOM, Fileinfo, Filter, Hash, Mbstring, OpenSSL, PDO, Session, Tokenizer, and XML.
• Composer 2.
• Node.js 22.12 or newer and npm.
• SQLite with pdo_sqlite for the default local setup, or MySQL/PostgreSQL with the matching PDO extension.
• A queue worker for asynchronous generation outside the combined development command.
• Optional OpenAI credentials, Stripe test credentials and CLI, SMTP delivery, and S3-compatible storage with league/flysystem-aws-s3-v3 installed.

Local Installation

Quick setup

git clone https://github.com/vipertecpro/letterwardai.com.git
cd letterwardai.com
composer setup
composer dev

composer setup installs PHP and JavaScript dependencies, copies .env.example, generates an application key, creates the local SQLite file, runs migrations, and builds frontend assets.

Registration creates a fictional-ready empty workspace. The database seeder creates plans, countries, channels, and local-only fictional accounts with random unknown passwords; it does not publish reusable login credentials. Create a known local Super Admin interactively when needed:

php artisan letterward:create-super-admin

Manual setup

composer install
npm install
cp .env.example .env
php artisan key:generate
touch database/database.sqlite
php artisan migrate --seed
php artisan storage:link
npm run build
composer dev

To use MySQL or PostgreSQL, replace the SQLite values in .env before migration.

Caution

php artisan migrate:fresh deletes all tables and data. Use it only with a disposable local or test database.

If the combined development command is not used, run the web/Vite process and queue worker separately. The longest generation jobs currently allow 900 seconds, so the database queue retry window must remain longer:

php artisan queue:work --queue=default --tries=1 --timeout=900

OpenAI

1. Create the first Super Admin.
2. Open /super-admin/settings/ai.
3. Save the API key, base URL, and eligible text, image, and video models.
4. Use a publicly reachable HTTPS media URL for video reference images.

Automated tests fake provider traffic and do not require an OpenAI key.

Stripe test mode

Add Stripe test credentials to .env, then forward test events with the Stripe CLI:

stripe listen --forward-to http://localhost:8000/stripe/webhook

Copy the CLI's signing secret to STRIPE_WEBHOOK_SECRET. Never use live credentials for local development.

Environment Variables

The complete safe template is .env.example. Important groups are:

Category	Variables
Application	APP_NAME, APP_ENV, APP_KEY, APP_DEBUG, APP_URL
Database	DB_CONNECTION, DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME, DB_PASSWORD
Cache and sessions	CACHE_STORE, SESSION_DRIVER, SESSION_SECURE_COOKIE, REDIS_*
Queues	QUEUE_CONNECTION, DB_QUEUE_RETRY_AFTER
Mail	MAIL_MAILER, MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD, MAIL_FROM_*
OpenAI defaults	OPENAI_BASE_URL, OPENAI_TEXT_MODEL, OPENAI_IMAGE_MODEL, OPENAI_VIDEO_MODEL, OPENAI_TEMPERATURE, OPENAI_VIDEO_*
Stripe	STRIPE_PUBLISHABLE_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_CURRENCY
Filesystem	FILESYSTEM_DISK, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION, AWS_BUCKET, AWS_URL, AWS_ENDPOINT
Locale and pricing	DEFAULT_COUNTRY, DEFAULT_CURRENCY, FALLBACK_COUNTRY, FALLBACK_CURRENCY

The OpenAI API key itself is intentionally absent from .env.example; the application stores it encrypted through Super Admin settings.

Testing and Code Quality

Run the complete local CI equivalent:

composer ci:check

Individual commands:

composer test                 # Pest test suite
composer lint:check          # Pint formatting check
composer types:check         # PHPStan / Larastan
php artisan test --compact   # Pest through Artisan
npm run lint:check           # ESLint
npm run format:check         # Prettier
npm run types:check          # TypeScript
npm run build                # Production Vite build

Tests use in-memory SQLite, array-backed cache/session/mail, synchronous queues, and fake HTTP responses. They must never contact real AI or payment services.

Project Structure

Path	Responsibility
app/Actions/Fortify	Registration, password, and profile actions
app/Http/Controllers	Public, company, project, billing, and Super Admin endpoints
app/Jobs/Mvp	Long-running text, image, regeneration, and video jobs
app/Models and app/Policies	Domain data, relationships, casts, and authorization
app/Services	AI providers, project workflow, usage, billing, audit, and workspace services
database/migrations	Workspace, content, generation, billing, and platform schema
resources/js/pages	Inertia React pages for public, auth, app, settings, and Super Admin surfaces
resources/js/components	Shared shadcn/ui, studio, layout, and motion components
routes	Web routes and scheduled commands
tests	Pest unit and feature coverage

Security

Secrets belong in local environment files, an encrypted database setting, or a deployment-platform secret store—never in Git. Uploaded prompts and generated assets may contain sensitive information and must be stored, logged, backed up, and deleted accordingly. Public issues must not contain credentials, customer data, payment details, signed URLs, or private media.

Review SECURITY.md for private vulnerability reporting. Operational guidance is available in the production checklist and backup strategy.

Roadmap

• Add first-class durable object-storage deployment profiles and integration tests.
• Expand browser-level coverage for the complete studio and Super Admin journeys.
• Add provider webhook support where asynchronous media APIs expose reliable callbacks.
• Improve accessibility and visual-regression coverage across responsive layouts.

Roadmap items are planned improvements, not implemented features.

Contributing

Read CONTRIBUTING.md, follow the Code of Conduct, and run composer ci:check before opening a pull request.

License

Letterward AI is released under the MIT License.

Author

Vipul Walia · GitHub