backend-manager 5.11.6 → 5.12.0

package/docs/ai-library.md

@@ -96,7 +96,9 @@ URL citations live in the returned `output` (message content) as `annotations` o
 
 `provider: 'test'` is the AI analog of the `test` payment processor: a first-class provider that suites drive with directives in the LAST user message, so consumer routes exercise their full loop (Firestore writes, usage, locks, tool execution) against the real emulator with zero paid API calls. It **refuses to run outside development/testing**.
 
-Directives form a sequence consumed across loop turns (call N executes directive N-1, indexed by assistant turns after the last user turn). Directive values must not contain `]]` internally (a trailing JSON `]` is fine):
+Directives form a sequence consumed across loop turns (call N executes directive N-1, indexed by assistant turns after the last user turn). Directive values must not contain `]]` internally (a trailing JSON `]` is fine).
+
+The directive source is resolved in order: the last `messages[]` user turn → `message.content` → **`message.settings` values** (flattened raw). That last fallback makes path-based routes (`message: { path, settings }` — the idiomatic BEM prompt-template style) scriptable as-is: embed the directive in whatever request field gets interpolated into the template (e.g. a chat's `message`, a quiz's `topic`).
 
 | Directive | Behavior |
 |---|---|

package/docs/usage-rate-limiting.md

@@ -27,6 +27,8 @@ For anonymous-to-owner billing, call `setUser()` BEFORE `validate()` — validat
 
 Limits are always specified as **monthly** values in product config (e.g., `limits.requests = 100` means 100/month).
 
+**Negative limits are unlimited.** `limits.requests = -1` means the metric is never rate-limited for that product — `validate()` always resolves and no daily caps apply. A limit of `0` (or a metric missing from `limits`) always rejects.
+
 By default, limits are enforced with **daily caps** to prevent users from burning their entire monthly quota in a single day. Two checks are applied:
 
 1. **Flat daily cap**: `ceil(monthlyLimit / daysInMonth)` — max uses per day

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.11.6",
+  "version": "5.12.0",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "files": [

package/src/cli/commands/serve.js

@@ -207,14 +207,61 @@ class ServeCommand extends BaseCommand {
     const certFile = certFiles.find((f) => !f.includes('-key.pem'));
 
     if (keyFile && certFile) {
-      this.log(chalk.gray('  Using existing mkcert certificates from .temp/certs/'));
-      return { key: keyFile, cert: certFile };
+      const problem = this._checkCertProblem(certFile);
+
+      if (!problem) {
+        this.log(chalk.gray('  Using existing mkcert certificates from .temp/certs/'));
+        return { key: keyFile, cert: certFile };
+      }
+
+      // Stale certs (expired, or issued by a DIFFERENT machine's mkcert CA — e.g.
+      // .temp copied over from another Mac) make browsers reject the proxy outright,
+      // so the only thing that responds is the internal plain-HTTP firebase port.
+      // Wipe and regenerate against THIS machine's trusted CA.
+      this.log(chalk.yellow(`  Existing certificates are not usable (${problem}) — regenerating...`));
+      jetpack.remove(certsDir);
+      jetpack.dir(certsDir);
     }
 
     // Try to generate with mkcert
     return this._generateMkcertCerts(certsDir);
   }
 
+  // Returns a reason string when the existing cert must be regenerated, or null
+  // when it's usable: unexpired AND signed by this machine's trusted mkcert root CA.
+  _checkCertProblem(certFile) {
+    const { X509Certificate } = require('crypto');
+    const { execSync } = require('child_process');
+
+    let cert;
+    try {
+      cert = new X509Certificate(fs.readFileSync(certFile));
+    } catch (e) {
+      return 'unreadable certificate';
+    }
+
+    if (new Date(cert.validTo) <= new Date()) {
+      return `expired ${cert.validTo}`;
+    }
+
+    // Verify the signature chains to the CURRENT mkcert root CA. If mkcert (or its
+    // root) isn't available we can't verify — keep the existing certs rather than
+    // breaking the no-mkcert fallback path.
+    try {
+      const caRoot = execSync('mkcert -CAROOT', { encoding: 'utf8' }).trim();
+      const ca = new X509Certificate(fs.readFileSync(path.join(caRoot, 'rootCA.pem')));
+
+      if (!cert.verify(ca.publicKey)) {
+        const issuerCN = cert.issuer.split('\n').find((line) => line.startsWith('CN=')) || cert.issuer;
+        return `issued by a different CA (${issuerCN})`;
+      }
+    } catch (e) {
+      return null;
+    }
+
+    return null;
+  }
+
   async _generateMkcertCerts(certsDir) {
     try {
       await powertools.execute('which mkcert', { log: false });

package/src/manager/helpers/usage.js

@@ -170,6 +170,13 @@ Usage.prototype.validate = function (name, options) {
       return _reject();
     }
 
+    // Negative limits are unlimited (product config convention: -1)
+    if (allowed < 0) {
+      self.log(`Usage.validate(): Unlimited limit (${allowed}) for ${name}`);
+
+      return resolve(true);
+    }
+
     // Check if they have a white list key
     const hasWhitelistKey = self.options.whitelistKeys.some((key) => key && key === self?.user?.api?.privateKey);
     if (hasWhitelistKey) {
@@ -367,9 +374,9 @@ Usage.prototype.getDailyAllowance = function (name) {
     return null;
   }
 
-  // Get the monthly limit
+  // Get the monthly limit (negative limits are unlimited — no daily cap)
   const monthlyLimit = self.getLimit(name);
-  if (!monthlyLimit) {
+  if (!monthlyLimit || monthlyLimit < 0) {
     return null;
   }
 

package/src/manager/libraries/ai/providers/test.js

@@ -55,7 +55,12 @@ TestProvider.prototype.request = async function (options) {
 
   const messages = Array.isArray(options.messages) ? options.messages : [];
   const lastUserMessage = [...messages].reverse().find((m) => m.role === 'user' && typeof m.content === 'string');
-  const scriptSource = lastUserMessage?.content || stringifyLoose(options.message?.content) || '';
+  // Path-based messages ({ path, settings }) are rendered inside the real
+  // providers, so directives arrive via the settings values — read them too.
+  const scriptSource = lastUserMessage?.content
+    || stringifyLoose(options.message?.content)
+    || stringifyLoose(options.message?.settings)
+    || '';
 
   const { steps, cleanText } = parseScript(scriptSource);
 
@@ -230,6 +235,15 @@ function stringifyLoose(content) {
     return content.map((c) => c?.text || '').join('\n');
   }
 
+  // Plain objects (e.g. prompt-template settings) flatten to their raw values
+  // so directives embedded in them stay parseable (JSON.stringify would escape
+  // the quotes inside a directive's JSON payload)
+  if (content && typeof content === 'object') {
+    return Object.values(content)
+      .map((value) => (typeof value === 'string' ? value : `${value}`))
+      .join('\n');
+  }
+
   return content ? String(content) : '';
 }