backend-manager 5.11.7 → 5.12.0

package/docs/ai-library.md

@@ -96,7 +96,9 @@ URL citations live in the returned `output` (message content) as `annotations` o
 
 `provider: 'test'` is the AI analog of the `test` payment processor: a first-class provider that suites drive with directives in the LAST user message, so consumer routes exercise their full loop (Firestore writes, usage, locks, tool execution) against the real emulator with zero paid API calls. It **refuses to run outside development/testing**.
 
-Directives form a sequence consumed across loop turns (call N executes directive N-1, indexed by assistant turns after the last user turn). Directive values must not contain `]]` internally (a trailing JSON `]` is fine):
+Directives form a sequence consumed across loop turns (call N executes directive N-1, indexed by assistant turns after the last user turn). Directive values must not contain `]]` internally (a trailing JSON `]` is fine).
+
+The directive source is resolved in order: the last `messages[]` user turn → `message.content` → **`message.settings` values** (flattened raw). That last fallback makes path-based routes (`message: { path, settings }` — the idiomatic BEM prompt-template style) scriptable as-is: embed the directive in whatever request field gets interpolated into the template (e.g. a chat's `message`, a quiz's `topic`).
 
 | Directive | Behavior |
 |---|---|

package/docs/usage-rate-limiting.md

@@ -27,6 +27,8 @@ For anonymous-to-owner billing, call `setUser()` BEFORE `validate()` — validat
 
 Limits are always specified as **monthly** values in product config (e.g., `limits.requests = 100` means 100/month).
 
+**Negative limits are unlimited.** `limits.requests = -1` means the metric is never rate-limited for that product — `validate()` always resolves and no daily caps apply. A limit of `0` (or a metric missing from `limits`) always rejects.
+
 By default, limits are enforced with **daily caps** to prevent users from burning their entire monthly quota in a single day. Two checks are applied:
 
 1. **Flat daily cap**: `ceil(monthlyLimit / daysInMonth)` — max uses per day

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.11.7",
+  "version": "5.12.0",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "files": [

package/src/manager/helpers/usage.js

@@ -170,6 +170,13 @@ Usage.prototype.validate = function (name, options) {
       return _reject();
     }
 
+    // Negative limits are unlimited (product config convention: -1)
+    if (allowed < 0) {
+      self.log(`Usage.validate(): Unlimited limit (${allowed}) for ${name}`);
+
+      return resolve(true);
+    }
+
     // Check if they have a white list key
     const hasWhitelistKey = self.options.whitelistKeys.some((key) => key && key === self?.user?.api?.privateKey);
     if (hasWhitelistKey) {
@@ -367,9 +374,9 @@ Usage.prototype.getDailyAllowance = function (name) {
     return null;
   }
 
-  // Get the monthly limit
+  // Get the monthly limit (negative limits are unlimited — no daily cap)
   const monthlyLimit = self.getLimit(name);
-  if (!monthlyLimit) {
+  if (!monthlyLimit || monthlyLimit < 0) {
     return null;
   }
 

package/src/manager/libraries/ai/providers/test.js

@@ -55,7 +55,12 @@ TestProvider.prototype.request = async function (options) {
 
   const messages = Array.isArray(options.messages) ? options.messages : [];
   const lastUserMessage = [...messages].reverse().find((m) => m.role === 'user' && typeof m.content === 'string');
-  const scriptSource = lastUserMessage?.content || stringifyLoose(options.message?.content) || '';
+  // Path-based messages ({ path, settings }) are rendered inside the real
+  // providers, so directives arrive via the settings values — read them too.
+  const scriptSource = lastUserMessage?.content
+    || stringifyLoose(options.message?.content)
+    || stringifyLoose(options.message?.settings)
+    || '';
 
   const { steps, cleanText } = parseScript(scriptSource);
 
@@ -230,6 +235,15 @@ function stringifyLoose(content) {
     return content.map((c) => c?.text || '').join('\n');
   }
 
+  // Plain objects (e.g. prompt-template settings) flatten to their raw values
+  // so directives embedded in them stay parseable (JSON.stringify would escape
+  // the quotes inside a directive's JSON payload)
+  if (content && typeof content === 'object') {
+    return Object.values(content)
+      .map((value) => (typeof value === 'string' ? value : `${value}`))
+      .join('\n');
+  }
+
   return content ? String(content) : '';
 }
 

package/src/manager/libraries/email/data/disposable-domains.json

@@ -12,8 +12,10 @@
   "000webmail.dyndns.ddnss.de",
   "000webmail.dyndns1.de",
   "000webmail.home-webserver.de",
+  "00jac.com",
   "01022.hk",
   "01130.hk",
+  "020307.xyz",
   "027168.com",
   "045692.xyz",
   "062e.com",
@@ -51,8 +53,10 @@
   "10mail.xyz",
   "10minemail.com",
   "10minmail.de",
+  "10minmail.org",
   "10minut.com.pl",
   "10minut.xyz",
+  "10minute.email",
   "10minutemail.be",
   "10minutemail.cf",
   "10minutemail.co.uk",
@@ -246,6 +250,7 @@
   "55hosting.net",
   "5ghgfhfghfgh.tk",
   "5gramos.com",
+  "5ixmonth.xyz",
   "5july.org",
   "5mail.cf",
   "5mail.ga",
@@ -254,6 +259,7 @@
   "5semail.com",
   "5tb.in",
   "5x25.com",
+  "5xu.vn",
   "5y.loseyourip.com",
   "5yaochu.top",
   "5ymail.com",
@@ -269,6 +275,7 @@
   "681mail.com",
   "689345.xyz",
   "6974.click",
+  "6gdfg.zone.id",
   "6hjgjhgkilkj.tk",
   "6ip.us",
   "6mail.cf",
@@ -417,6 +424,7 @@
   "adroh.com",
   "ads24h.top",
   "adsd.org",
+  "adsensekorea.com",
   "adubiz.info",
   "adult-work.info",
   "adv-dep-eng.jo3.org",
@@ -476,6 +484,7 @@
   "ahk.jp",
   "ahmedkhlef.com",
   "ahvin.com",
+  "ai100999.com",
   "aiaccount.click",
   "aiapes.publicvm.com",
   "aibase.bond",
@@ -634,6 +643,7 @@
   "animesos.com",
   "aniross.com",
   "anit.ro",
+  "ankiclub.space",
   "ann.qzz.io",
   "annd.us",
   "annnekkk.com",
@@ -672,6 +682,7 @@
   "apedesigns.jo3.org",
   "apedesigns.linkpc.net",
   "apes-ai.linkpc.net",
+  "apexnovaser.com",
   "apexone.top",
   "apfelkorps.de",
   "aphlog.com",
@@ -693,12 +704,14 @@
   "arapgege.app",
   "arapps.me",
   "arcadein.com",
+  "arcadium.lat",
   "arcentra.cfd",
   "ardsp.shop",
   "arduino.hk",
   "arenahiveai.com",
   "ares.edu.pl",
   "ariaz.jetzt",
+  "arkoo.site",
   "armyspy.com",
   "aron.us",
   "arroisijewellery.com",
@@ -748,6 +761,7 @@
   "au1688x.us",
   "aubady.com",
   "augmentationtechnology.com",
+  "aumails.us",
   "auralith.cfd",
   "ausgefallen.info",
   "auth2fa.com",
@@ -910,17 +924,20 @@
   "badoop.com",
   "badopsec.lol",
   "badpotato.tk",
+  "baechecker.com",
   "bahlill.cfd",
   "baicai1145.online",
   "baicai1145.shop",
   "baidoxe.com",
   "baileybridge.org",
+  "baipiaodashen.cloud-ip.cc",
   "baiyucraft.sbs",
   "baizoto.shop",
   "bakalos.dpdns.org",
   "balaket.com",
   "balawo.com",
   "banana.linkpc.net",
+  "banancaocap.com",
   "bandtoo.com",
   "bangban.uk",
   "bangdieukhien.net",
@@ -930,6 +947,7 @@
   "bank-opros1.ru",
   "bankinnepal.com",
   "banri.xyz",
+  "bar-ton.store",
   "bareed.ws",
   "barnrestaurant.pro",
   "barooko.com",
@@ -1017,6 +1035,7 @@
   "bgtmail.com",
   "bgx.ro",
   "bgyiacczy.top",
+  "bhana.xyz",
   "bhap.me",
   "bheps.com",
   "bhuxp.org",
@@ -1090,6 +1109,7 @@
   "bocas.tech",
   "boerakemail.com",
   "bofthew.com",
+  "bokgumail.kr",
   "bomnet.net",
   "bonobo.email",
   "boofx.com",
@@ -1168,6 +1188,7 @@
   "buccalmassage.ru",
   "budaya-tionghoa.com",
   "budayationghoa.com",
+  "buddyfly.top",
   "buffemail.com",
   "bugfoo.com",
   "bugmenever.com",
@@ -1262,11 +1283,13 @@
   "capcud.shop",
   "capcut.digital",
   "capcut.sbs",
+  "capcut.space",
   "capcut02.shop",
   "capcutku.io",
   "capcutmeflo.shop",
   "capcutpro.click",
   "capcutpro.dev",
+  "capcvt.es",
   "capitalistdilemma.com",
   "caprasolver.xyz",
   "captus.cyou",
@@ -1426,6 +1449,7 @@
   "clearhabitpath.com",
   "clearwatermail.info",
   "click-email.com",
+  "clickcore99.click",
   "clickdeal.co",
   "clipmail.eu",
   "clixser.com",
@@ -1528,6 +1552,7 @@
   "coolimpool.org",
   "cooljump.org",
   "copyhome.win",
+  "coralhost.my",
   "corbyrise.com",
   "coreclip.com",
   "corhash.net",
@@ -1626,6 +1651,7 @@
   "dahewushi.eu.cc",
   "daibond.info",
   "daily-email.com",
+  "dailynove.com",
   "dailynutria.com",
   "daimuedu.com",
   "daintly.com",
@@ -1748,6 +1774,7 @@
   "dev-null.ml",
   "devbike.com",
   "developermail.com",
+  "developtool.app",
   "devh24.online",
   "devnullmail.com",
   "devsonline.studio",
@@ -1755,6 +1782,7 @@
   "deyom.com",
   "dfghjertyh.dynv6.net",
   "dfyuih.eu.cc",
+  "dgdf.cc",
   "dghdfjfd.eu.cc",
   "dh372.top",
   "dharmatel.net",
@@ -1854,7 +1882,9 @@
   "dnses.ro",
   "doanart.com",
   "dob.jp",
+  "docash.app",
   "docbao7.com",
+  "docse.site",
   "dodgeit.com",
   "dodgemail.de",
   "dodgit.com",
@@ -2114,6 +2144,7 @@
   "emailage.ml",
   "emailage.tk",
   "emailaoa.pro",
+  "emailasia1.com",
   "emailate.com",
   "emailawb.pro",
   "emailax.pro",
@@ -2141,6 +2172,7 @@
   "emailinbo.live",
   "emailinfive.com",
   "emailisvalid.com",
+  "emailjps.com",
   "emailkp.com",
   "emaillime.com",
   "emailluu.asia",
@@ -2178,6 +2210,7 @@
   "emailtik.com",
   "emailtmp.com",
   "emailto.de",
+  "emailuae.com",
   "emailure.net",
   "emailvb.pro",
   "emailviet.com",
@@ -2448,6 +2481,7 @@
   "fexpost.com",
   "fextemp.com",
   "fft.edu.do",
+  "fgmail.cyou",
   "fhoau.eu.cc",
   "fhpfhp.fr.nf",
   "fhwui.eu.cc",
@@ -2711,6 +2745,7 @@
   "gcmail.top",
   "gdcrm.store",
   "gddp2018.edu.vn",
+  "gdfgergrer.online",
   "gdmail.top",
   "gdqoe.net",
   "gdxs.cc.cd",
@@ -2843,6 +2878,7 @@
   "gmailxsn.com",
   "gmailxsn.site",
   "gmailxsn.space",
+  "gmailxyz.bond",
   "gmatch.org",
   "gmeenramy.com",
   "gmel.biz.id",
@@ -2866,6 +2902,7 @@
   "goemailgo.com",
   "goeschman.com",
   "gohivezone.com",
+  "gokublue.me",
   "gold.edu.pl",
   "goldenmagpies.com",
   "goldinbox.net",
@@ -3206,6 +3243,7 @@
   "hihi.lol",
   "hikuhu.com",
   "hillaxiant.xyz",
+  "hilmipremindo.com",
   "hilostar.com",
   "hiltonvr.com",
   "him6.com",
@@ -3224,6 +3262,7 @@
   "hoanggiaanh.com",
   "hoanglong.tech",
   "hochsitze.com",
+  "hohohim.com",
   "hola.org",
   "holio.day",
   "holl.ga",
@@ -3349,6 +3388,7 @@
   "icidroit.info",
   "ickletonrelief.co.uk",
   "icloudmail.kr",
+  "icloulb.com",
   "icmans.com",
   "iconmal.com",
   "icousd.com",
@@ -3444,6 +3484,7 @@
   "indomina.cf",
   "indoserver.stream",
   "indosukses.press",
+  "indoxs.bond",
   "ineec.net",
   "inetopenwrt.dpdns.org",
   "infix1.io.vn",
@@ -3631,11 +3672,13 @@
   "jiaxi.work",
   "jibbo01.com",
   "jieluv.com",
+  "jika.gg",
   "jilingling.eu.cc",
   "jincer.com",
   "jingood.dpdns.org",
   "jinkeyun.com",
   "jinva.fr.nf",
+  "jiongguo.top",
   "jiooq.com",
   "jioso.com",
   "jiuji.asia",
@@ -3738,6 +3781,7 @@
   "katputli.world",
   "katztube.com",
   "kavio.my.id",
+  "kawneha.site",
   "kaybooks.top",
   "kayfilms.top",
   "kaygroup.top",
@@ -3799,6 +3843,7 @@
   "kingsq.ga",
   "kingss.de5.net",
   "kino-100.ru",
+  "kintil.buzz",
   "kiois.com",
   "kismail.ru",
   "kisoq.com",
@@ -3809,6 +3854,7 @@
   "kiwkiw.shop",
   "kjkszpjcompany.com",
   "kkdty.dynv6.net",
+  "kkkoouy.cyou",
   "kkmail.be",
   "kkoup.com",
   "kksm.be",
@@ -3918,6 +3964,7 @@
   "lamasticots.com",
   "lambsauce.de",
   "landmail.co",
+  "lanuiopl.bond",
   "laoeq.com",
   "laoia.com",
   "lapakqu.com",
@@ -4118,6 +4165,7 @@
   "luxovira.cfd",
   "luxudata.com",
   "lxbeta.com",
+  "lxydawang.top",
   "lydir.com",
   "lyfestylecreditsolutions.com",
   "lyft.live",
@@ -4380,6 +4428,7 @@
   "mailvip.net",
   "mailw.site",
   "mailx.click",
+  "mailxyz.cyou",
   "mailyan.my.id",
   "mailzi.ru",
   "mailzilla.com",
@@ -4390,6 +4439,7 @@
   "make.cc.cd",
   "makemenaughty.club",
   "makemetheking.com",
+  "makeraura.online",
   "makertrial.com",
   "makoli.sbs",
   "malahov.de",
@@ -4492,6 +4542,7 @@
   "messwiththebestdielikethe.rest",
   "metadownload.org",
   "metaintern.net",
+  "metajaya.biz.id",
   "metalunits.com",
   "metaorbitx.com",
   "mexvat.com",
@@ -4543,6 +4594,7 @@
   "minuteafter.com",
   "minuteinbox.com",
   "mirai.re",
+  "mirasync.tokyo",
   "miros.cloud",
   "missionbulldogs.org",
   "misterpinball.de",
@@ -4574,6 +4626,7 @@
   "mmmggg0123.ccwu.cc",
   "mmmo.us.ci",
   "mmo.us.ci",
+  "mmo365.store",
   "mmyuu.cn",
   "mnode.me",
   "mnvr.site",
@@ -4615,6 +4668,7 @@
   "monomoho.site",
   "monopacket.com",
   "monumentmail.com",
+  "monyal.shop",
   "moolee.net",
   "moonapps.org",
   "moondyal.com",
@@ -4770,6 +4824,7 @@
   "mtshop18.io.vn",
   "muadaingan.com",
   "muareview.com",
+  "muataikhoan.info",
   "muathegame.com",
   "muchomail.com",
   "mucincanon.com",
@@ -4794,6 +4849,7 @@
   "muratec.eu.org",
   "muratreis.icu",
   "musiccode.me",
+  "musicflow.buzz",
   "musiku.studio",
   "mutant.me",
   "mutudev.com",
@@ -4944,6 +5000,7 @@
   "netris.net",
   "netviewer-france.com",
   "netzidiot.de",
+  "nevanata.com",
   "nevermail.de",
   "neverover.life",
   "new-api.cc.cd",
@@ -4958,6 +5015,7 @@
   "newmano.store",
   "newsteadabbeypartnership.org",
   "newyork.io.vn",
+  "nexarshop.store",
   "nexentia.cfd",
   "nexio.sbs",
   "nexorabio.pro.vn",
@@ -5048,6 +5106,7 @@
   "nomorix.cfd",
   "nonchalantresmita.biz",
   "nondon.site",
+  "nondon.store",
   "nongnue.com",
   "nonspam.eu",
   "nonspammer.de",
@@ -5161,6 +5220,7 @@
   "oing.cf",
   "okcdeals.com",
   "okclprojects.com",
+  "okcx.edu.rs",
   "okcxhssgk.top",
   "okhko.com",
   "okiae.com",
@@ -5238,6 +5298,7 @@
   "openmail.pro",
   "opentrash.com",
   "openwrt.qzz.io",
+  "opihhushdjn.cyou",
   "opmmedia.ga",
   "oposite.org",
   "opp24.com",
@@ -5283,6 +5344,7 @@
   "outlawspam.com",
   "outlook.edu.pl",
   "outlookapp.tech",
+  "outlooks.bond",
   "outmail.win",
   "ovbest.com",
   "ovomail.co",
@@ -5485,6 +5547,7 @@
   "poubelle-du.net",
   "poubelle.fr.nf",
   "poutineyourface.com",
+  "powerdea.me",
   "powered.name",
   "powerencry.com",
   "powerscrews.com",
@@ -5492,6 +5555,7 @@
   "pox2.com",
   "pozima.rest",
   "pp-n6.top",
+  "pp-tw.cc",
   "pp7rvv.com",
   "ppdf.cc",
   "ppedu.pp.ua",
@@ -5533,6 +5597,7 @@
   "privacyshield.cc",
   "privatdemail.net",
   "privmail.edu.pl",
+  "privo.edu.pl",
   "privy-mail.com",
   "privy-mail.de",
   "privymail.de",
@@ -5715,6 +5780,7 @@
   "realquickemail.com",
   "realseek.xyz",
   "realtyalerts.ca",
+  "reapsa.com",
   "rebates.stream",
   "receiveee.com",
   "recipeforfailure.com",
@@ -5836,11 +5902,13 @@
   "rtrobinsbequest.org.uk",
   "rtrtr.com",
   "rtskiya.xyz",
+  "rua.pp.ua",
   "rudymail.ml",
   "ruinique.tech",
   "rukiaops.me",
   "rulersonline.com",
   "rumgel.com",
+  "runcubesapps.id",
   "runi.ca",
   "rupayamail.com",
   "ruru.be",
@@ -5856,6 +5924,7 @@
   "rxs9.cn",
   "rygel.infos.st",
   "ryteto.me",
+  "ryuu.codes",
   "ryyr.ru",
   "ryyr.store",
   "s-mail.social",
@@ -5907,6 +5976,7 @@
   "sast.ro",
   "sasukiez.shop",
   "satisfyme.club",
+  "satorix.id",
   "satukosong.com",
   "saturrshop.uk",
   "saungadaid.pro",
@@ -5946,6 +6016,7 @@
   "secure-mail.cc",
   "secured-link.net",
   "securehost.com.es",
+  "sedekah-mudah.com",
   "seduck.com",
   "seedcorn.foundation",
   "seedspeed.site",
@@ -5970,9 +6041,11 @@
   "sendnow.win",
   "sendo.dedyn.io",
   "sendo.giize.com",
+  "sendokai.click",
   "sendos.fr.nf",
   "sendos.infos.st",
   "sendspamhere.com",
+  "sengkuni.dedyn.io",
   "sengkuni.qzz.io",
   "sengkuni.xx.kg",
   "senseless-entertainment.com",
@@ -6013,6 +6086,7 @@
   "shchiba.uk",
   "sheerid.top",
   "sheinup.com",
+  "shengxia.asia",
   "sherazhaider.com",
   "sheryli.com",
   "shhmail.com",
@@ -6345,6 +6419,7 @@
   "starcheck.in",
   "stardust-2.store",
   "starlight-breaker.net",
+  "starlight.store",
   "starmail.net",
   "starnlink.com",
   "starpower.space",
@@ -6359,6 +6434,7 @@
   "steambot.net",
   "steel4work.io.vn",
   "stepsofhope.co.uk",
+  "sterlingpointco.com",
   "stexsy.com",
   "stinkefinger.net",
   "stomatogomail.ru",
@@ -6472,6 +6548,7 @@
   "tagyourself.com",
   "taikhoankiro.pro",
   "taimb.com",
+  "taischaves.com",
   "tako.skin",
   "talemarketing.com",
   "talkinator.com",
@@ -6660,6 +6737,7 @@
   "theaviors.com",
   "thebearshark.com",
   "thebest73.shop",
+  "theboys.cyou",
   "thecarinformation.com",
   "thechildrensfocus.com",
   "thecity.biz",
@@ -6701,6 +6779,7 @@
   "thirifara.com",
   "thisisnotmyrealemail.com",
   "thismail.net",
+  "thispy.top",
   "thisurl.website",
   "thnikka.com",
   "thoas.ru",
@@ -6722,6 +6801,7 @@
   "thulinh.net",
   "thunderbolt.science",
   "thunkinator.org",
+  "thuongxg.com",
   "thurleighchurchestate.church",
   "thxmate.com",
   "tianblog.top",
@@ -6862,6 +6942,7 @@
   "tradermail.info",
   "tradingview.my.id",
   "trainthem2fish.co.uk",
+  "tramynguyen.net",
   "tranceversal.com",
   "trandigabapoe.shop",
   "trangiabao.click",
@@ -6908,6 +6989,7 @@
   "trashymail.net",
   "trasz.com",
   "travelistaworld.com",
+  "travelovelinka.club",
   "travionex.cfd",
   "trayna.com",
   "trbvm.com",
@@ -6916,6 +6998,7 @@
   "treesforderby.org",
   "trend-maker.ru",
   "treso.me",
+  "treterter.shop",
   "trevourus.com",
   "trfu.to",
   "trgfu.com",
@@ -6955,6 +7038,7 @@
   "tualias.com",
   "tuamaeaquelaursa.com",
   "tubeemail.com",
+  "tuku26012023.xyz",
   "tumroc.net",
   "tunthuta.com",
   "tuofs.com",
@@ -7054,6 +7138,7 @@
   "urgentmail.ovh",
   "urhen.com",
   "uroid.com",
+  "us-x.top",
   "us.af",
   "us.to",
   "usa.cc",
@@ -7078,6 +7163,7 @@
   "usus.ddnsfree.com",
   "ususus.dynv6.net",
   "utiket.us",
+  "utkarsh.tech",
   "uu.gl",
   "uu2.ovh",
   "uue.edu.pl",
@@ -7329,6 +7415,7 @@
   "waterpalace.pro",
   "watersoftenersystemcost.com",
   "watrf.com",
+  "watsawang.com",
   "waventra.cfd",
   "waw.indevs.in",
   "wazabi.club",
@@ -7438,6 +7525,7 @@
   "winemaven.info",
   "winocs.com",
   "wins.com.br",
+  "wintersgf.store",
   "wintersmail.site",
   "wir-sind.com",
   "wireconnected.com",
@@ -7489,6 +7577,7 @@
   "wwefd.top",
   "wwej.cc.cd",
   "wwjmp.com",
+  "wwtykkm.bond",
   "wwvec.uno",
   "wwvk.ru",
   "wwvk.store",
@@ -7513,6 +7602,7 @@
   "xagloo.com",
   "xandoria.cfd",
   "xapimail.top",
+  "xazymarcie.space",
   "xbaby69.top",
   "xbrok.com",
   "xcf.pet",
@@ -7540,6 +7630,8 @@
   "xents.com",
   "xepa.ru",
   "xfavaj.com",
+  "xgmail.bond",
+  "xhotmail.cyou",
   "xi2.cc",
   "xiajspof.eu.cc",
   "xiangshan.eu.cc",
@@ -7563,6 +7655,7 @@
   "xmaily.com",
   "xmlab.icu",
   "xmyvgkvw.top",
+  "xn--5nx.cc",
   "xn--9kq967o.com",
   "xn--d-bga.net",
   "xn--ihq4pool8g32cwxiiqcovaa9159jhvah03g.top",
@@ -7608,10 +7701,12 @@
   "yabes.ovh",
   "yahmail.top",
   "yahooproduct.net",
+  "yahoox.cyou",
   "yaloo.fr.nf",
   "yamail.win",
   "yanet.me",
   "yangzhai.xyz",
+  "yangzhong-sfd.cc",
   "yannmail.win",
   "yanxuan.eu.cc",
   "yapped.net",
@@ -7785,6 +7880,7 @@
   "zhorachu.com",
   "zhousj.eu.org",
   "zik.dj",
+  "zikzak.site",
   "zipcad.com",
   "zipcatfish.com",
   "ziping.me",

package/test/helpers/ai-test-provider.js

@@ -198,5 +198,29 @@ module.exports = {
         assert.equal(String(second.content).startsWith('Echo:'), true, 'echo fallback');
       },
     },
+
+    // ─── Path-based messages (BEM prompt-template style) ───
+
+    {
+      name: 'reply-directive-from-path-based-message-settings',
+      async run({ assert }) {
+        // Routes idiomatically pass message: { path, settings } — the real
+        // providers render the template, so directives arrive via settings values
+        const provider = makeProvider();
+        const result = await provider.request({
+          response: 'json',
+          message: {
+            path: '/prompts/user.md',
+            settings: {
+              level: 'college',
+              message: 'What is 2+2? [[reply:{"answer":"4"}]]',
+            },
+          },
+        });
+
+        assert.equal(typeof result.content, 'object', 'parsed object');
+        assert.equal(result.content.answer, '4', 'directive extracted from settings values');
+      },
+    },
   ],
 };

package/test/helpers/usage-limits.js

@@ -0,0 +1,85 @@
+/**
+ * Test: Usage limit semantics (helpers/usage.js)
+ *
+ * Negative product limits (the -1 "unlimited" config convention) must never
+ * rate-limit a user. Regression: the daily-cap math turned -1 into a 0/day cap
+ * that 429'd every request from unlimited-plan users.
+ */
+const PRODUCT_ID = 'unlimited-limits-fixture';
+const TEST_UID = '_test-unlimited-limits-user';
+
+module.exports = {
+  description: 'Usage limits (negative = unlimited)',
+  type: 'suite',
+  timeout: 15000,
+
+  tests: [
+    {
+      name: 'setup-product-and-user',
+      async run({ Manager, firestore, state, assert }) {
+        // Inject a fixture product into the real config (restored in cleanup)
+        Manager.config.payment = Manager.config.payment || {};
+        state.originalProducts = Manager.config.payment.products;
+        Manager.config.payment.products = [
+          ...(state.originalProducts || []),
+          { id: PRODUCT_ID, type: 'subscription', limits: { requests: -1 } },
+        ];
+
+        // Seed a user on that product with existing usage (fixture seeding —
+        // production code must always go through the usage helper)
+        await firestore.set(`users/${TEST_UID}`, {
+          subscription: { product: { id: PRODUCT_ID }, status: 'active' },
+          usage: { requests: { monthly: 12345, daily: 678, total: 99999 } },
+        });
+
+        assert.ok(true, 'Fixture product and user seeded');
+      },
+    },
+    {
+      name: 'negative-limit-has-no-daily-allowance',
+      async run({ Manager, state, assert }) {
+        const usage = Manager.Usage();
+        await usage.init(Manager.Assistant(), { log: false });
+        await usage.setUser(TEST_UID);
+
+        state.usage = usage;
+
+        assert.equal(usage.getLimit('requests'), -1, 'Limit resolves to -1');
+        assert.equal(usage.getDailyAllowance('requests'), null, 'Negative limits have no daily cap');
+      },
+    },
+    {
+      name: 'validate-resolves-for-negative-limit',
+      async run({ state, assert }) {
+        const result = await state.usage.validate('requests').catch((e) => e);
+
+        assert.ok(!(result instanceof Error), 'validate() must resolve for unlimited plans regardless of usage');
+      },
+    },
+    {
+      name: 'zero-limit-still-rejects',
+      async run({ Manager, firestore, assert }) {
+        // Guard the other edge: a missing/0 limit must keep rejecting
+        await firestore.set(`users/${TEST_UID}-zero`, {
+          subscription: { product: { id: 'basic' }, status: 'active' },
+          usage: { unknownmetric: { monthly: 1, daily: 1, total: 1 } },
+        });
+
+        const usage = Manager.Usage();
+        await usage.init(Manager.Assistant(), { log: false });
+        await usage.setUser(`${TEST_UID}-zero`);
+
+        const result = await usage.validate('unknownmetric').catch((e) => e);
+
+        assert.ok(result instanceof Error, 'Metrics without a configured limit must reject');
+      },
+    },
+  ],
+
+  async cleanup({ Manager, state }) {
+    // Restore the real product list
+    if (Manager?.config?.payment) {
+      Manager.config.payment.products = state?.originalProducts;
+    }
+  },
+};