backend-manager 5.11.7 → 5.13.0

package/docs/ai-library.md

@@ -96,7 +96,9 @@ URL citations live in the returned `output` (message content) as `annotations` o
 
 `provider: 'test'` is the AI analog of the `test` payment processor: a first-class provider that suites drive with directives in the LAST user message, so consumer routes exercise their full loop (Firestore writes, usage, locks, tool execution) against the real emulator with zero paid API calls. It **refuses to run outside development/testing**.
 
-Directives form a sequence consumed across loop turns (call N executes directive N-1, indexed by assistant turns after the last user turn). Directive values must not contain `]]` internally (a trailing JSON `]` is fine):
+Directives form a sequence consumed across loop turns (call N executes directive N-1, indexed by assistant turns after the last user turn). Directive values must not contain `]]` internally (a trailing JSON `]` is fine).
+
+The directive source is resolved in order: the last `messages[]` user turn → `message.content` → **`message.settings` values** (flattened raw). That last fallback makes path-based routes (`message: { path, settings }` — the idiomatic BEM prompt-template style) scriptable as-is: embed the directive in whatever request field gets interpolated into the template (e.g. a chat's `message`, a quiz's `topic`).
 
 | Directive | Behavior |
 |---|---|

package/docs/email-system.md

@@ -33,7 +33,7 @@ Both transactional and marketing paths share the same preparation layer:
 | `resolveBrand(Manager)` | Clones brand config, sanitizes images (SVG→PNG via CDN naming) |
 | `resolveSender({ sender, from, group }, brand, brandDomain)` | Resolves sender from/display-name/ASM group by category key |
 | `renderContent({ content, html }, utmOptions)` | Markdown→HTML via markdown-it, applies UTM link tagging |
-| `resolveSignoff(signoff)` | Fills personal signoff defaults (headshot, name, URL) when `type: 'personal'` |
+| `resolveSignoff(signoff)` | Defaults `type` to `'team'`; personal signoffs render only with caller-provided details (name/image/url) — no built-in personal defaults |
 | `buildCategories(type, brandId, extra)` | Builds categories array: `['transactional', brandId, ...extra]` |
 | `buildUnsubscribeUrl({ email, groupId, template, websiteUrl })` | HMAC-signed one-click unsubscribe URL |
 | `buildTemplateData({ brand, subject, ... })` | Deep-merges system defaults with caller data into the template data tree |
@@ -96,11 +96,13 @@ await email.send({
   categories: ['account/welcome'],
   data: {
     content: { title: 'Welcome!', message: '# Hello!\n\nMarkdown here.' },
-    signoff: { type: 'personal' },
+    signoff: { type: 'personal', name: 'Jane Doe, CEO', image: 'https://cdn.example.com/headshot.jpg', url: 'https://example.com', urlText: '@janedoe' },
   },
 });
 ```
 
+A `personal` signoff without a `name` falls back to the team rendering — there are no built-in personal defaults.
+
 ### Per-template `data.content` shapes
 
 | Template | `data.content` fields |

package/docs/usage-rate-limiting.md

@@ -27,6 +27,8 @@ For anonymous-to-owner billing, call `setUser()` BEFORE `validate()` — validat
 
 Limits are always specified as **monthly** values in product config (e.g., `limits.requests = 100` means 100/month).
 
+**Negative limits are unlimited.** `limits.requests = -1` means the metric is never rate-limited for that product — `validate()` always resolves and no daily caps apply. A limit of `0` (or a metric missing from `limits`) always rejects.
+
 By default, limits are enforced with **daily caps** to prevent users from burning their entire monthly quota in a single day. Two checks are applied:
 
 1. **Flat daily cap**: `ceil(monthlyLimit / daysInMonth)` — max uses per day

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.11.7",
+  "version": "5.13.0",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "files": [

package/src/manager/functions/core/actions/api/admin/send-email.js

@@ -171,14 +171,6 @@ Module.prototype.defaultize = function () {
     email.dynamicTemplateData.signoff = options?.data?.signoff || {};
     email.dynamicTemplateData.signoff.type = options?.data?.signoff?.type || 'team';
 
-    if (email.dynamicTemplateData.signoff.type === 'personal') {
-      email.dynamicTemplateData.signoff.image = options?.data?.signoff?.image
-        || 'https://cdn.itwcreativeworks.com/assets/ian-wiedenman/images/website/ian-wiedenman-headshot-2021-color-1024x1024.jpg';
-      email.dynamicTemplateData.signoff.name = options?.data?.signoff?.name || 'Ian Wiedenman, CEO';
-      email.dynamicTemplateData.signoff.url = options?.data?.signoff?.url || 'https://ianwiedenman.com';
-      email.dynamicTemplateData.signoff.urlText = options?.data?.signoff?.urlText || '@ianwieds';
-    }
-
     email.dynamicTemplateData.user = Manager.User(options.user).properties;
 
     // Get brand configuration from Manager.config.brand (backend-manager-config.json)

package/src/manager/helpers/usage.js

@@ -170,6 +170,13 @@ Usage.prototype.validate = function (name, options) {
       return _reject();
     }
 
+    // Negative limits are unlimited (product config convention: -1)
+    if (allowed < 0) {
+      self.log(`Usage.validate(): Unlimited limit (${allowed}) for ${name}`);
+
+      return resolve(true);
+    }
+
     // Check if they have a white list key
     const hasWhitelistKey = self.options.whitelistKeys.some((key) => key && key === self?.user?.api?.privateKey);
     if (hasWhitelistKey) {
@@ -367,9 +374,9 @@ Usage.prototype.getDailyAllowance = function (name) {
     return null;
   }
 
-  // Get the monthly limit
+  // Get the monthly limit (negative limits are unlimited — no daily cap)
   const monthlyLimit = self.getLimit(name);
-  if (!monthlyLimit) {
+  if (!monthlyLimit || monthlyLimit < 0) {
     return null;
   }
 

package/src/manager/libraries/ai/providers/test.js

@@ -55,7 +55,12 @@ TestProvider.prototype.request = async function (options) {
 
   const messages = Array.isArray(options.messages) ? options.messages : [];
   const lastUserMessage = [...messages].reverse().find((m) => m.role === 'user' && typeof m.content === 'string');
-  const scriptSource = lastUserMessage?.content || stringifyLoose(options.message?.content) || '';
+  // Path-based messages ({ path, settings }) are rendered inside the real
+  // providers, so directives arrive via the settings values — read them too.
+  const scriptSource = lastUserMessage?.content
+    || stringifyLoose(options.message?.content)
+    || stringifyLoose(options.message?.settings)
+    || '';
 
   const { steps, cleanText } = parseScript(scriptSource);
 
@@ -230,6 +235,15 @@ function stringifyLoose(content) {
     return content.map((c) => c?.text || '').join('\n');
   }
 
+  // Plain objects (e.g. prompt-template settings) flatten to their raw values
+  // so directives embedded in them stay parseable (JSON.stringify would escape
+  // the quotes inside a directive's JSON payload)
+  if (content && typeof content === 'object') {
+    return Object.values(content)
+      .map((value) => (typeof value === 'string' ? value : `${value}`))
+      .join('\n');
+  }
+
   return content ? String(content) : '';
 }