The upstream already serves a per-user AI image generation history (last 20 successful generations: id, prompt, url, aspect_ratio, cost, created), but no proxy route exposes it, so no client can show it. That matters for recovery: a generation can complete and be billed server-side while the client saw a timeout or an error, and today the delivered image is not visible anywhere in the UI.
Add POST /private-api/ai-images: validate the signed code and pipe users/{username}/ai-images for the VALIDATED username only. Prompts are private to their author, so the username must come from the validated code, never from the request body (same principle as AiGenerateImage/AiTranscribe billing).
The upstream already serves a per-user AI image generation history (last 20 successful generations: id, prompt, url, aspect_ratio, cost, created), but no proxy route exposes it, so no client can show it. That matters for recovery: a generation can complete and be billed server-side while the client saw a timeout or an error, and today the delivered image is not visible anywhere in the UI.
Add
POST /private-api/ai-images: validate the signed code and pipeusers/{username}/ai-imagesfor the VALIDATED username only. Prompts are private to their author, so the username must come from the validated code, never from the request body (same principle asAiGenerateImage/AiTranscribebilling).