your-ai-workflow-firebase-os 1.3.0 → 1.4.0

package/dist/server/index.d.ts

@@ -12,6 +12,8 @@ export interface ApiRoutesOptions {
 }
 export interface AuthedRequest extends Request {
     user?: VerifiedUser;
+    /** The caller's own ID token — Firestore reads are made as them, never as us. */
+    idToken?: string;
 }
 export declare function apiRoutes(options?: ApiRoutesOptions): Router;
 export { projectId, verifyIdToken } from './auth';
@@ -19,3 +21,6 @@ export { runSelfTest, selfTestAllowed } from './selftest';
 export { checkoutProblem, grantsAccess, returnUrls, stripeMode, MAX_ADHOC_AMOUNT, MIN_ADHOC_AMOUNT, } from './stripeClient';
 export type { CheckoutRequest } from './stripeClient';
 export type { Check, SelfTestResult } from './selftest';
+export { TEMPLATES, renderTemplate, escapeHtml, fill, adminEmails } from './email';
+export type { EmailTemplate, RenderedEmail } from './email';
+export { readDocument, emailOnRecord, pathProblem, fromFields } from './firestore';

package/dist/server.cjs.js

@@ -1 +1,25 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunk-DYteiM-1.cjs`);let t=require(`express`);t=e.i(t,1);let n=require(`node:crypto`),r=require(`stripe`);r=e.i(r,1);var i=`https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com`,a=60;function o(e,t,n,r=Math.floor(Date.now()/1e3)){return n?e.alg===`RS256`?e.kid?t.aud===n?t.iss===`https://securetoken.google.com/${n}`?t.sub?t.sub.length>128?`Token subject is not a valid uid.`:typeof t.exp!=`number`||t.exp<=r?`Token has expired.`:typeof t.iat!=`number`||t.iat>r+a?`Token was issued in the future.`:null:`Token has no subject.`:`Token has the wrong issuer.`:`Token was issued for a different Firebase project.`:`Token has no key id.`:`Token is not signed with RS256.`:`The server does not know its Firebase project id.`}function s(e){return Buffer.from(e.replace(/-/g,`+`).replace(/_/g,`/`),`base64`)}function c(e){let t=String(e||``).split(`.`);if(t.length!==3)return null;try{return{header:JSON.parse(s(t[0]).toString(`utf8`)),claims:JSON.parse(s(t[1]).toString(`utf8`)),signed:`${t[0]}.${t[1]}`,signature:s(t[2])}}catch{return null}}var l=null;async function u(){if(l&&l.expiresAt>Date.now())return l.keys;let e=await fetch(i);if(!e.ok)throw Error(`Could not fetch Google signing keys (${e.status}).`);let t=await e.json(),n=/max-age=(\d+)/.exec(e.headers.get(`cache-control`)||``);return l={keys:t,expiresAt:Date.now()+(n?Number(n[1]):3600)*1e3},t}async function d(e,t){let r=c(e);if(!r)throw Error(`That is not a valid sign-in token.`);let i=o(r.header,r.claims,t);if(i)throw Error(i);let a=(await u())[r.header.kid];if(!a)throw Error(`Token was signed with a key Google no longer publishes.`);let s=(0,n.createVerify)(`RSA-SHA256`);if(s.update(r.signed),s.end(),!s.verify(a,r.signature))throw Error(`Token signature does not check out.`);return{uid:r.claims.sub,email:r.claims.email||null,emailVerified:!!r.claims.email_verified}}function f(){return(process.env.VITE_FIREBASE_PROJECT_ID||process.env.FIREBASE_PROJECT_ID||``).trim()}var p=null;function m(){return(process.env.STRIPE_SECRET_KEY||``).trim()}function h(){let e=m();return e?e.startsWith(`sk_live_`)?`live`:`test`:null}function g(){let e=m();if(!e)throw Error(`STRIPE_SECRET_KEY is not set.`);return p||=new r.default(e),p}var _=Number(process.env.STRIPE_MAX_ADHOC_AMOUNT||1e4),v=.5;function y(e){let{priceId:t,amount:n,mode:r=`payment`,quantity:i=1}=e||{};if(!t&&n===void 0)return`This button does not say what is being sold.`;if(t&&n!==void 0)return`A payment has either a Stripe price or an amount, not both.`;if(r!==`payment`&&r!==`subscription`)return`A payment is either one-time or a subscription.`;if(!Number.isInteger(i)||i<1||i>999)return`Quantity must be a whole number between 1 and 999.`;if(n!==void 0){if(r===`subscription`)return`A subscription needs a price created in Stripe — a typed amount cannot recur.`;if(typeof n!=`number`||!Number.isFinite(n))return`That amount is not a number.`;if(n<.5)return`The smallest amount that can be charged is ${v}.`;if(n>_)return`That amount is above the ${_} limit for typed prices. Use a price created in Stripe.`;if(!e.productName||!String(e.productName).trim())return`A typed amount needs a name for what is being bought.`}return t&&!/^price_[A-Za-z0-9]+$/.test(t)?`That does not look like a Stripe price id.`:null}function b(e){return Math.round(e*100)}function x(e,t,n){let r=String(e||``).replace(/\/+$/,``),i=(e,t)=>{let n=String(e||t);return n.startsWith(`/`)?n:`/${n}`};return{success:`${r}${i(t,`/payment-complete`)}?session_id={CHECKOUT_SESSION_ID}`,cancel:`${r}${i(n,`/payment-cancelled`)}`}}function S(e){return e===`active`||e===`trialing`||e===`past_due`}var C=e=>!!(process.env[e]||``).trim();function w(e){let t=(process.env.SELFTEST_TOKEN||``).trim();return t?String(e||``)===t:!0}async function T(){let e=[{name:`Server`,status:`pass`,detail:`The backend is running and reachable.`}],t=f();if(!t)e.push({name:`Firebase project`,status:`fail`,detail:`VITE_FIREBASE_PROJECT_ID is not set, so the server cannot tell who is signed in.`});else{e.push({name:`Firebase project`,status:`pass`,detail:`Signing in against ${t}.`});try{let t=await u();e.push({name:`Sign-in verification`,status:`pass`,detail:`Google's signing keys are reachable (${Object.keys(t).length} in rotation).`})}catch(t){e.push({name:`Sign-in verification`,status:`fail`,detail:`Could not reach Google's signing keys: ${t.message}`})}}if(!m())e.push({name:`Stripe`,status:`warn`,detail:`STRIPE_SECRET_KEY is not set. Payments are switched off until it is.`});else{let t=h();try{let n=await g().accounts.retrieve();e.push({name:`Stripe`,status:`pass`,detail:`Connected in ${t} mode to ${n.business_profile?.name||n.id}.`}),t===`live`&&e.push({name:`Live mode`,status:`warn`,detail:`This app is charging real cards. Every payment made here is real money.`})}catch(t){e.push({name:`Stripe`,status:`fail`,detail:`The key is set but Stripe refused it: ${t.message}`})}e.push(C(`STRIPE_WEBHOOK_SECRET`)?{name:`Stripe webhook`,status:`pass`,detail:`Signed webhooks will be accepted.`}:{name:`Stripe webhook`,status:`warn`,detail:`STRIPE_WEBHOOK_SECRET is not set. Payments still confirm when the payer returns; refunds and cancellations made in the Stripe dashboard will not reach the app until it is.`})}return e.push(C(`RESEND_API_KEY`)?{name:`Email`,status:`pass`,detail:`RESEND_API_KEY is set.`}:{name:`Email`,status:`warn`,detail:`RESEND_API_KEY is not set. The app will not send its own email.`}),{ok:!e.some(e=>e.status===`fail`),service:`your-ai-workflow-firebase-os`,checks:e}}var E=(e,t,n,r={})=>e.status(t).json({success:!1,error:n,...r});function D(e,t){let n=t instanceof Error?t.message:`Something went wrong on the server.`,r=n.includes(`STRIPE_SECRET_KEY`)||n.includes(`project id`);return E(e,r?503:500,n,r?{requiresSetup:!0}:{})}async function O(e,t,n){let r=String(e.headers.authorization||``),i=r.startsWith(`Bearer `)?r.slice(7):``;if(!i)return E(t,401,`Please sign in first.`);try{e.user=await d(i,f()),n()}catch(e){return E(t,401,e.message)}}async function k(e,t){return!t.email||!t.emailVerified?null:(await e.customers.list({email:t.email,limit:1})).data[0]||null}async function A(e,t){let n=await k(e,t);return n?(n.metadata?.uid!==t.uid&&await e.customers.update(n.id,{metadata:{...n.metadata,uid:t.uid}}),n):e.customers.create({email:t.email||void 0,metadata:{uid:t.uid}})}function j(e){return e?.current_period_end??e?.items?.data?.[0]?.current_period_end??null}function M(e){let t=e.items?.data?.[0],n=t?.price;return{id:e.id,status:e.status,active:S(e.status),priceId:n?.id||null,productName:typeof n?.product==`object`&&n.product?.name||null,amount:n?.unit_amount==null?null:n.unit_amount/100,currency:n?.currency||null,interval:n?.recurring?.interval||null,quantity:t?.quantity??1,currentPeriodEnd:j(e),cancelAtPeriodEnd:!!e.cancel_at_period_end}}function N(e){return{id:e.id,amount:e.amount/100,currency:e.currency,created:e.created,description:e.description||null,paid:e.paid&&e.status===`succeeded`,refunded:e.refunded,amountRefunded:e.amount_refunded/100,fullyRefunded:e.refunded&&e.amount_refunded>=e.amount}}var P=new Set;function F(e){return P.has(e)?!0:(P.add(e),P.size>500&&P.delete(P.values().next().value),!1)}function I(e={}){let n=t.default.Router();return n.post(`/payments/webhook`,t.default.raw({type:`application/json`}),async(t,n)=>{let r=(process.env.STRIPE_WEBHOOK_SECRET||``).trim(),i=t.headers[`stripe-signature`];if(!r)return E(n,503,`STRIPE_WEBHOOK_SECRET is not set.`);if(!i)return E(n,400,`Missing stripe-signature header.`);let a;try{a=g().webhooks.constructEvent(t.body,i,r)}catch(e){return E(n,400,`Webhook signature check failed: ${e.message}`)}if(F(a.id))return n.json({received:!0,duplicate:!0});try{await e.onStripeEvent?.(a)}catch(e){return P.delete(a.id),E(n,503,`Handler failed: ${e.message}`)}return n.json({received:!0})}),n.use(t.default.json()),n.get(`/_selftest`,async(e,t)=>{if(!w(e.query.token))return E(t,403,`This check needs its token.`);try{let e=await T();return t.status(e.ok?200:500).json(e)}catch(e){return D(t,e)}}),n.get(`/payments/status`,(e,t)=>{let n=h();t.json({configured:!!m(),mode:n,webhookConfigured:!!(process.env.STRIPE_WEBHOOK_SECRET||``).trim(),message:n?`Stripe is connected in ${n} mode.`:`Add STRIPE_SECRET_KEY to start taking payments.`})}),n.post(`/payments/checkout`,async(e,t)=>{let n=e.body||{},r=y(n);if(r)return E(t,400,r);let i=n.origin||e.headers.origin;if(!i)return E(t,400,`The page did not say where to send the payer back to.`);try{let r=g(),a=null,o=String(e.headers.authorization||``);if(o.startsWith(`Bearer `))try{a=await d(o.slice(7),f())}catch{a=null}let s=a?await A(r,a):null,c=x(String(i),n.successPath,n.cancelPath),l=n.priceId?{price:n.priceId,quantity:n.quantity||1}:{quantity:n.quantity||1,price_data:{currency:n.currency||`usd`,product_data:{name:String(n.productName)},unit_amount:b(Number(n.amount))}},u=await r.checkout.sessions.create({mode:n.mode||`payment`,line_items:[l],success_url:c.success,cancel_url:c.cancel,customer:s?.id,allow_promotion_codes:!0,metadata:{...n.metadata||{},...a?{uid:a.uid}:{}}});return t.json({success:!0,sessionId:u.id,url:u.url})}catch(e){return D(t,e)}}),n.get(`/payments/session/:id`,async(e,t)=>{try{let n=await g().checkout.sessions.retrieve(String(e.params.id));return t.json({success:!0,paid:n.payment_status===`paid`,paymentStatus:n.payment_status,mode:n.mode,amountTotal:n.amount_total==null?null:n.amount_total/100,currency:n.currency,customerEmail:n.customer_details?.email||null,customerName:n.customer_details?.name||null,metadata:n.metadata||{}})}catch(e){return(e instanceof Error?e.message:`Unknown error`).includes(`STRIPE_SECRET_KEY`)?D(t,e):E(t,404,`That payment could not be found.`)}}),n.get(`/payments/me`,O,async(e,t)=>{try{let n=g(),r=await k(n,e.user);if(!r)return t.json({success:!0,customerId:null,active:!1,subscriptions:[],payments:[]});let[i,a]=await Promise.all([n.subscriptions.list({customer:r.id,status:`all`,limit:10,expand:[`data.items.data.price.product`]}),n.charges.list({customer:r.id,limit:20})]),o=i.data.map(M),s=a.data.map(N);return t.json({success:!0,customerId:r.id,email:r.email,active:o.some(e=>e.active)||s.some(e=>e.paid&&!e.fullyRefunded),subscriptions:o,payments:s})}catch(e){return D(t,e)}}),n.post(`/payments/portal`,O,async(e,t)=>{try{let n=g(),r=await k(n,e.user);if(!r)return E(t,404,`There is nothing to manage on this account yet.`);let i=e.body?.origin||e.headers.origin;if(!i)return E(t,400,`The page did not say where to send them back to.`);let a=await n.billingPortal.sessions.create({customer:r.id,return_url:String(i).replace(/\/+$/,``)});return t.json({success:!0,url:a.url})}catch(e){return D(t,e)}}),n}exports.MAX_ADHOC_AMOUNT=_,exports.MIN_ADHOC_AMOUNT=v,exports.apiRoutes=I,exports.checkoutProblem=y,exports.grantsAccess=S,exports.projectId=f,exports.returnUrls=x,exports.runSelfTest=T,exports.selfTestAllowed=w,exports.stripeMode=h,exports.verifyIdToken=d;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunk-DYteiM-1.cjs`);let t=require(`express`);t=e.i(t,1);let n=require(`node:crypto`),r=require(`stripe`);r=e.i(r,1);var i=`https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com`,a=60;function o(e,t,n,r=Math.floor(Date.now()/1e3)){return n?e.alg===`RS256`?e.kid?t.aud===n?t.iss===`https://securetoken.google.com/${n}`?t.sub?t.sub.length>128?`Token subject is not a valid uid.`:typeof t.exp!=`number`||t.exp<=r?`Token has expired.`:typeof t.iat!=`number`||t.iat>r+a?`Token was issued in the future.`:null:`Token has no subject.`:`Token has the wrong issuer.`:`Token was issued for a different Firebase project.`:`Token has no key id.`:`Token is not signed with RS256.`:`The server does not know its Firebase project id.`}function s(e){return Buffer.from(e.replace(/-/g,`+`).replace(/_/g,`/`),`base64`)}function c(e){let t=String(e||``).split(`.`);if(t.length!==3)return null;try{return{header:JSON.parse(s(t[0]).toString(`utf8`)),claims:JSON.parse(s(t[1]).toString(`utf8`)),signed:`${t[0]}.${t[1]}`,signature:s(t[2])}}catch{return null}}var l=null;async function u(){if(l&&l.expiresAt>Date.now())return l.keys;let e=await fetch(i);if(!e.ok)throw Error(`Could not fetch Google signing keys (${e.status}).`);let t=await e.json(),n=/max-age=(\d+)/.exec(e.headers.get(`cache-control`)||``);return l={keys:t,expiresAt:Date.now()+(n?Number(n[1]):3600)*1e3},t}async function d(e,t){let r=c(e);if(!r)throw Error(`That is not a valid sign-in token.`);let i=o(r.header,r.claims,t);if(i)throw Error(i);let a=(await u())[r.header.kid];if(!a)throw Error(`Token was signed with a key Google no longer publishes.`);let s=(0,n.createVerify)(`RSA-SHA256`);if(s.update(r.signed),s.end(),!s.verify(a,r.signature))throw Error(`Token signature does not check out.`);return{uid:r.claims.sub,email:r.claims.email||null,emailVerified:!!r.claims.email_verified}}function f(){return(process.env.VITE_FIREBASE_PROJECT_ID||process.env.FIREBASE_PROJECT_ID||``).trim()}var p=`https://firestore.googleapis.com/v1`;function m(e){return e==null?null:`stringValue`in e?e.stringValue:`integerValue`in e?Number(e.integerValue):`doubleValue`in e?e.doubleValue:`booleanValue`in e?e.booleanValue:`timestampValue`in e?e.timestampValue:`nullValue`in e?null:`mapValue`in e?h(e.mapValue?.fields||{}):`arrayValue`in e?(e.arrayValue?.values||[]).map(m):null}function h(e){let t={};for(let[n,r]of Object.entries(e||{}))t[n]=m(r);return t}function g(e,t){let n=`${e}/${t}`.split(`/`);if(n.length%2!=0)return`That is not a document path.`;for(let e of n)if(!e||e===`.`||e===`..`||!/^[A-Za-z0-9_.@~+-]+$/.test(e))return`That is not a document path.`;return null}async function _(e,t,n,r){let i=g(t,n);if(i)throw Error(i);let a=`${p}/projects/${e}/databases/(default)/documents/${t}/${n}`,o=await fetch(a,{headers:r?{Authorization:`Bearer ${r}`}:{}});if(o.status===404)return null;if(o.status===403)throw Error(`You do not have permission to read that record.`);if(!o.ok)throw Error(`Firestore refused the read (${o.status}).`);return h((await o.json()).fields||{})}var ee=[`email`,`Email`,`emailAddress`,`email_address`,`userEmail`,`contactEmail`];function v(e){for(let t of ee){let n=e[t];if(typeof n==`string`&&n.includes(`@`))return n.trim()}return null}var te=`https://api.resend.com/emails`;function y(){return(process.env.RESEND_API_KEY||``).trim()}function b(){return(process.env.EMAIL_FROM||``).trim()||`onboarding@resend.dev`}function x(){return(process.env.EMAIL_REPLY_TO||``).trim()||void 0}function S(){return(process.env.VITE_ADMIN_EMAILS||process.env.ADMIN_EMAILS||``).split(/[,\s]+/).map(e=>e.trim().toLowerCase()).filter(e=>e.includes(`@`))}var C={test:{audience:`admins`,subject:`Test email from {{appName}}`,body:`This is a test.
+
+If you are reading it, {{appName}} can send email.
+
+Sent {{now}}.`,description:`Proves the connection works. Goes to the admin addresses.`},new_submission:{audience:`admins`,subject:`New {{formName}} submission`,body:`Someone filled in {{formName}} on {{appName}}.
+
+From: {{name}} ({{email}})
+
+{{summary}}
+
+Open the app to see the full entry.`,description:`Tells the owner a form was filled in.`},submission_received:{audience:`record`,subject:`We got your message`,body:`Hi {{name}},
+
+Thanks for getting in touch — we have your message and will come back to you shortly.
+
+— {{appName}}`,description:`Confirms to the sender that their form arrived.`},order_confirmed:{audience:`record`,subject:`Your order is confirmed`,body:`Hi {{name}},
+
+Thank you — your payment of {{amount}} went through and your order is confirmed.
+
+{{details}}
+
+— {{appName}}`,description:`Sent to the buyer after a successful payment.`},new_sale:{audience:`admins`,subject:`You made a sale — {{amount}}`,body:`{{name}} ({{email}}) just paid {{amount}} on {{appName}}.
+
+{{details}}`,description:`Tells the owner money came in.`}};function w(e){return e?Object.prototype.hasOwnProperty.call(C,e)?null:`There is no email template called "${e}". Available: ${Object.keys(C).join(`, `)}.`:`No template was named.`}function T(e){return String(e).replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#39;`)}function E(e,t,n){return String(e).replace(/\{\{\s*([A-Za-z0-9_]+)\s*\}\}/g,(e,r)=>{let i=t[r];return i==null?``:n?T(String(i)):String(i)})}function D(e,t){let n=E(e.body,t,!1);return{subject:E(e.subject,t,!1).slice(0,200),text:n,html:`<div style="font-family:system-ui,-apple-system,Segoe UI,sans-serif;font-size:15px;line-height:1.6;color:#1e293b">`+E(e.body,t,!0).split(`
+
+`).map(e=>`<p>${e.replace(/\n/g,`<br>`)}</p>`).join(``)+`</div>`}}async function O(e,t){let n=y();if(!n)return{id:null,error:`RESEND_API_KEY is not set.`};if(!e.length)return{id:null,error:`There is nobody to send this to.`};let r=await fetch(te,{method:`POST`,headers:{Authorization:`Bearer ${n}`,"Content-Type":`application/json`},body:JSON.stringify({from:b(),to:e,reply_to:x(),subject:t.subject,html:t.html,text:t.text})}),i=await r.json().catch(()=>({}));return r.ok?{id:i?.id||null,error:null}:{id:null,error:i?.message||`Resend refused the send (${r.status}).`}}var k=null;function A(){return(process.env.STRIPE_SECRET_KEY||``).trim()}function j(){let e=A();return e?e.startsWith(`sk_live_`)?`live`:`test`:null}function M(){let e=A();if(!e)throw Error(`STRIPE_SECRET_KEY is not set.`);return k||=new r.default(e),k}var N=Number(process.env.STRIPE_MAX_ADHOC_AMOUNT||1e4),P=.5;function F(e){let{priceId:t,amount:n,mode:r=`payment`,quantity:i=1}=e||{};if(!t&&n===void 0)return`This button does not say what is being sold.`;if(t&&n!==void 0)return`A payment has either a Stripe price or an amount, not both.`;if(r!==`payment`&&r!==`subscription`)return`A payment is either one-time or a subscription.`;if(!Number.isInteger(i)||i<1||i>999)return`Quantity must be a whole number between 1 and 999.`;if(n!==void 0){if(r===`subscription`)return`A subscription needs a price created in Stripe — a typed amount cannot recur.`;if(typeof n!=`number`||!Number.isFinite(n))return`That amount is not a number.`;if(n<.5)return`The smallest amount that can be charged is ${P}.`;if(n>N)return`That amount is above the ${N} limit for typed prices. Use a price created in Stripe.`;if(!e.productName||!String(e.productName).trim())return`A typed amount needs a name for what is being bought.`}return t&&!/^price_[A-Za-z0-9]+$/.test(t)?`That does not look like a Stripe price id.`:null}function I(e){return Math.round(e*100)}function L(e,t,n){let r=String(e||``).replace(/\/+$/,``),i=(e,t)=>{let n=String(e||t);return n.startsWith(`/`)?n:`/${n}`};return{success:`${r}${i(t,`/payment-complete`)}?session_id={CHECKOUT_SESSION_ID}`,cancel:`${r}${i(n,`/payment-cancelled`)}`}}function R(e){return e===`active`||e===`trialing`||e===`past_due`}var z=e=>!!(process.env[e]||``).trim();function B(e){let t=(process.env.SELFTEST_TOKEN||``).trim();return t?String(e||``)===t:!0}async function V(){let e=[{name:`Server`,status:`pass`,detail:`The backend is running and reachable.`}],t=f();if(!t)e.push({name:`Firebase project`,status:`fail`,detail:`VITE_FIREBASE_PROJECT_ID is not set, so the server cannot tell who is signed in.`});else{e.push({name:`Firebase project`,status:`pass`,detail:`Signing in against ${t}.`});try{let t=await u();e.push({name:`Sign-in verification`,status:`pass`,detail:`Google's signing keys are reachable (${Object.keys(t).length} in rotation).`})}catch(t){e.push({name:`Sign-in verification`,status:`fail`,detail:`Could not reach Google's signing keys: ${t.message}`})}}if(!A())e.push({name:`Stripe`,status:`warn`,detail:`STRIPE_SECRET_KEY is not set. Payments are switched off until it is.`});else{let t=j();try{let n=await M().accounts.retrieve();e.push({name:`Stripe`,status:`pass`,detail:`Connected in ${t} mode to ${n.business_profile?.name||n.id}.`}),t===`live`&&e.push({name:`Live mode`,status:`warn`,detail:`This app is charging real cards. Every payment made here is real money.`})}catch(t){e.push({name:`Stripe`,status:`fail`,detail:`The key is set but Stripe refused it: ${t.message}`})}e.push(z(`STRIPE_WEBHOOK_SECRET`)?{name:`Stripe webhook`,status:`pass`,detail:`Signed webhooks will be accepted.`}:{name:`Stripe webhook`,status:`warn`,detail:`STRIPE_WEBHOOK_SECRET is not set. Payments still confirm when the payer returns; refunds and cancellations made in the Stripe dashboard will not reach the app until it is.`})}return e.push(z(`RESEND_API_KEY`)?{name:`Email`,status:`pass`,detail:`RESEND_API_KEY is set.`}:{name:`Email`,status:`warn`,detail:`RESEND_API_KEY is not set. The app will not send its own email.`}),{ok:!e.some(e=>e.status===`fail`),service:`your-ai-workflow-firebase-os`,checks:e}}var H=(e,t,n,r={})=>e.status(t).json({success:!1,error:n,...r});function U(e,t){let n=t instanceof Error?t.message:`Something went wrong on the server.`,r=n.includes(`STRIPE_SECRET_KEY`)||n.includes(`project id`);return H(e,r?503:500,n,r?{requiresSetup:!0}:{})}async function W(e,t,n){let r=String(e.headers.authorization||``),i=r.startsWith(`Bearer `)?r.slice(7):``;if(!i)return H(t,401,`Please sign in first.`);try{e.user=await d(i,f()),e.idToken=i,n()}catch(e){return H(t,401,e.message)}}async function G(e,t){return!t.email||!t.emailVerified?null:(await e.customers.list({email:t.email,limit:1})).data[0]||null}async function K(e,t){let n=await G(e,t);return n?(n.metadata?.uid!==t.uid&&await e.customers.update(n.id,{metadata:{...n.metadata,uid:t.uid}}),n):e.customers.create({email:t.email||void 0,metadata:{uid:t.uid}})}function q(e){return e?.current_period_end??e?.items?.data?.[0]?.current_period_end??null}function J(e){let t=e.items?.data?.[0],n=t?.price;return{id:e.id,status:e.status,active:R(e.status),priceId:n?.id||null,productName:typeof n?.product==`object`&&n.product?.name||null,amount:n?.unit_amount==null?null:n.unit_amount/100,currency:n?.currency||null,interval:n?.recurring?.interval||null,quantity:t?.quantity??1,currentPeriodEnd:q(e),cancelAtPeriodEnd:!!e.cancel_at_period_end}}function ne(e){return{id:e.id,amount:e.amount/100,currency:e.currency,created:e.created,description:e.description||null,paid:e.paid&&e.status===`succeeded`,refunded:e.refunded,amountRefunded:e.amount_refunded/100,fullyRefunded:e.refunded&&e.amount_refunded>=e.amount}}var re=600*1e3,ie=Number(process.env.EMAIL_RATE_PER_CALLER||20),ae=Number(process.env.EMAIL_RATE_PER_HOUR||200),Y=new Map,X=[];function Z(e){let t=Date.now();for(;X.length&&t-X[0]>3600*1e3;)X.shift();if(X.length>=ae)return`This app has sent its hourly limit of email. Try again shortly.`;let n=(Y.get(e)||[]).filter(e=>t-e<re);return n.length>=ie?(Y.set(e,n),`Too many messages from here just now. Try again in a few minutes.`):(n.push(t),Y.set(e,n),X.push(t),Y.size>5e3&&Y.clear(),null)}var Q=e=>String(e.ip||e.socket?.remoteAddress||`unknown`),$=new Set;function oe(e){return $.has(e)?!0:($.add(e),$.size>500&&$.delete($.values().next().value),!1)}function se(e={}){let n=t.default.Router();return n.post(`/payments/webhook`,t.default.raw({type:`application/json`}),async(t,n)=>{let r=(process.env.STRIPE_WEBHOOK_SECRET||``).trim(),i=t.headers[`stripe-signature`];if(!r)return H(n,503,`STRIPE_WEBHOOK_SECRET is not set.`);if(!i)return H(n,400,`Missing stripe-signature header.`);let a;try{a=M().webhooks.constructEvent(t.body,i,r)}catch(e){return H(n,400,`Webhook signature check failed: ${e.message}`)}if(oe(a.id))return n.json({received:!0,duplicate:!0});try{await e.onStripeEvent?.(a)}catch(e){return $.delete(a.id),H(n,503,`Handler failed: ${e.message}`)}return n.json({received:!0})}),n.use(t.default.json()),n.get(`/_selftest`,async(e,t)=>{if(!B(e.query.token))return H(t,403,`This check needs its token.`);try{let e=await V();return t.status(e.ok?200:500).json(e)}catch(e){return U(t,e)}}),n.get(`/_selftest/checkout`,async(e,t)=>{if(!B(e.query.token))return H(t,403,`This check needs its token.`);if(j()!==`test`)return H(t,403,`The test checkout only runs against a test key (sk_test_).`);try{let n=e.headers.origin||`${e.protocol}://${e.get(`host`)}`,r=L(String(n),`/api/_selftest/paid`,`/api/_selftest/cancelled`),i=await M().checkout.sessions.create({mode:`payment`,line_items:[{quantity:1,price_data:{currency:`usd`,product_data:{name:`Self-test payment`},unit_amount:100}}],success_url:r.success,cancel_url:r.cancel,metadata:{selftest:`true`}});return t.redirect(303,i.url)}catch(e){return U(t,e)}}),n.get(`/_selftest/paid`,async(e,t)=>{let n=String(e.query.session_id||``);if(!n)return H(t,400,`No session id came back.`);try{let e=await M().checkout.sessions.retrieve(n),r=e.payment_status===`paid`;return t.status(r?200:402).json({ok:r,message:r?`The whole loop works: checkout created, card charged, payment confirmed by the server.`:`Stripe says this payment is ${e.payment_status}.`,amount:e.amount_total==null?null:e.amount_total/100,currency:e.currency,email:e.customer_details?.email||null})}catch(e){return U(t,e)}}),n.get(`/_selftest/cancelled`,(e,t)=>t.json({ok:!0,message:`Payment cancelled — nothing was charged.`})),n.get(`/_selftest/email`,async(e,t)=>{if(!B(e.query.token))return H(t,403,`This check needs its token.`);if(!y())return H(t,503,`RESEND_API_KEY is not set.`);let n=S();if(!n.length)return H(t,503,`VITE_ADMIN_EMAILS is empty, so there is no admin address to send to.`);let r=await O(n,D(C.test,{appName:process.env.APP_NAME||`your app`,now:new Date().toISOString()}));return t.status(r.error?502:200).json({ok:!r.error,sentTo:n,from:b(),id:r.id,error:r.error,message:r.error?`Resend refused the send.`:`Sent. If it does not arrive within a minute, check spam — an unverified domain often lands there.`})}),n.get(`/email/status`,(e,t)=>{t.json({configured:!!y(),from:b(),adminCount:S().length,templates:Object.entries(C).map(([e,t])=>({id:e,audience:t.audience,description:t.description}))})}),n.post(`/email/notify`,async(e,t)=>{let n=Z(Q(e));if(n)return H(t,429,n);let{template:r,data:i}=e.body||{},a=w(String(r||``));if(a)return H(t,400,a);let o=C[String(r)];if(o.audience!==`admins`)return H(t,400,`The "${r}" template is written to a customer, not to you.`);let s=S();if(!s.length)return H(t,503,`There is no admin address to send to.`);let c=await O(s,D(o,{appName:process.env.APP_NAME||`your app`,...i||{}}));return t.status(c.error?502:200).json({success:!c.error,id:c.id,error:c.error})}),n.post(`/email/send`,async(e,t)=>{let n=Z(Q(e));if(n)return H(t,429,n);let{template:r,collection:i,docId:a,data:o}=e.body||{},s=w(String(r||``));if(s)return H(t,400,s);if(!i||!a)return H(t,400,`Name the record this email is about.`);let c=C[String(r)];if(c.audience!==`record`)return H(t,400,`The "${r}" template is written to you, not to a customer. Use /email/notify.`);try{let n=String(e.headers.authorization||``),r=n.startsWith(`Bearer `)?n.slice(7):void 0,s=await _(f(),String(i),String(a),r);if(!s)return H(t,404,`That record does not exist.`);let l=v(s);if(!l)return H(t,422,`That record has no email address on it.`);let u=D(c,{appName:process.env.APP_NAME||`your app`,...s,...o||{}}),d=await O([l],u);return t.status(d.error?502:200).json({success:!d.error,id:d.id,error:d.error})}catch(e){return H(t,400,e.message)}}),n.get(`/payments/status`,(e,t)=>{let n=j();t.json({configured:!!A(),mode:n,webhookConfigured:!!(process.env.STRIPE_WEBHOOK_SECRET||``).trim(),message:n?`Stripe is connected in ${n} mode.`:`Add STRIPE_SECRET_KEY to start taking payments.`})}),n.post(`/payments/checkout`,async(e,t)=>{let n=e.body||{},r=F(n);if(r)return H(t,400,r);let i=n.origin||e.headers.origin;if(!i)return H(t,400,`The page did not say where to send the payer back to.`);try{let r=M(),a=null,o=String(e.headers.authorization||``);if(o.startsWith(`Bearer `))try{a=await d(o.slice(7),f())}catch{a=null}let s=a?await K(r,a):null,c=L(String(i),n.successPath,n.cancelPath),l=n.priceId?{price:n.priceId,quantity:n.quantity||1}:{quantity:n.quantity||1,price_data:{currency:n.currency||`usd`,product_data:{name:String(n.productName)},unit_amount:I(Number(n.amount))}},u=await r.checkout.sessions.create({mode:n.mode||`payment`,line_items:[l],success_url:c.success,cancel_url:c.cancel,customer:s?.id,allow_promotion_codes:!0,metadata:{...n.metadata||{},...a?{uid:a.uid}:{}}});return t.json({success:!0,sessionId:u.id,url:u.url})}catch(e){return U(t,e)}}),n.get(`/payments/session/:id`,async(e,t)=>{try{let n=await M().checkout.sessions.retrieve(String(e.params.id));return t.json({success:!0,paid:n.payment_status===`paid`,paymentStatus:n.payment_status,mode:n.mode,amountTotal:n.amount_total==null?null:n.amount_total/100,currency:n.currency,customerEmail:n.customer_details?.email||null,customerName:n.customer_details?.name||null,metadata:n.metadata||{}})}catch(e){return(e instanceof Error?e.message:`Unknown error`).includes(`STRIPE_SECRET_KEY`)?U(t,e):H(t,404,`That payment could not be found.`)}}),n.get(`/payments/me`,W,async(e,t)=>{try{let n=M(),r=await G(n,e.user);if(!r)return t.json({success:!0,customerId:null,active:!1,subscriptions:[],payments:[]});let[i,a]=await Promise.all([n.subscriptions.list({customer:r.id,status:`all`,limit:10,expand:[`data.items.data.price.product`]}),n.charges.list({customer:r.id,limit:20})]),o=i.data.map(J),s=a.data.map(ne);return t.json({success:!0,customerId:r.id,email:r.email,active:o.some(e=>e.active)||s.some(e=>e.paid&&!e.fullyRefunded),subscriptions:o,payments:s})}catch(e){return U(t,e)}}),n.post(`/payments/portal`,W,async(e,t)=>{try{let n=M(),r=await G(n,e.user);if(!r)return H(t,404,`There is nothing to manage on this account yet.`);let i=e.body?.origin||e.headers.origin;if(!i)return H(t,400,`The page did not say where to send them back to.`);let a=await n.billingPortal.sessions.create({customer:r.id,return_url:String(i).replace(/\/+$/,``)});return t.json({success:!0,url:a.url})}catch(e){return U(t,e)}}),n}exports.MAX_ADHOC_AMOUNT=N,exports.MIN_ADHOC_AMOUNT=P,exports.TEMPLATES=C,exports.adminEmails=S,exports.apiRoutes=se,exports.checkoutProblem=F,exports.emailOnRecord=v,exports.escapeHtml=T,exports.fill=E,exports.fromFields=h,exports.grantsAccess=R,exports.pathProblem=g,exports.projectId=f,exports.readDocument=_,exports.renderTemplate=D,exports.returnUrls=L,exports.runSelfTest=V,exports.selfTestAllowed=B,exports.stripeMode=j,exports.verifyIdToken=d;

package/dist/server.es.js

@@ -53,22 +53,163 @@ function d() {
 	return (process.env.VITE_FIREBASE_PROJECT_ID || process.env.FIREBASE_PROJECT_ID || "").trim();
 }
 //#endregion
+//#region src/server/firestore.ts
+var f = "https://firestore.googleapis.com/v1";
+function p(e) {
+	return e == null ? null : "stringValue" in e ? e.stringValue : "integerValue" in e ? Number(e.integerValue) : "doubleValue" in e ? e.doubleValue : "booleanValue" in e ? e.booleanValue : "timestampValue" in e ? e.timestampValue : "nullValue" in e ? null : "mapValue" in e ? m(e.mapValue?.fields || {}) : "arrayValue" in e ? (e.arrayValue?.values || []).map(p) : null;
+}
+function m(e) {
+	let t = {};
+	for (let [n, r] of Object.entries(e || {})) t[n] = p(r);
+	return t;
+}
+function h(e, t) {
+	let n = `${e}/${t}`.split("/");
+	if (n.length % 2 != 0) return "That is not a document path.";
+	for (let e of n) if (!e || e === "." || e === ".." || !/^[A-Za-z0-9_.@~+-]+$/.test(e)) return "That is not a document path.";
+	return null;
+}
+async function g(e, t, n, r) {
+	let i = h(t, n);
+	if (i) throw Error(i);
+	let a = `${f}/projects/${e}/databases/(default)/documents/${t}/${n}`, o = await fetch(a, { headers: r ? { Authorization: `Bearer ${r}` } : {} });
+	if (o.status === 404) return null;
+	if (o.status === 403) throw Error("You do not have permission to read that record.");
+	if (!o.ok) throw Error(`Firestore refused the read (${o.status}).`);
+	return m((await o.json()).fields || {});
+}
+var ee = [
+	"email",
+	"Email",
+	"emailAddress",
+	"email_address",
+	"userEmail",
+	"contactEmail"
+];
+function _(e) {
+	for (let t of ee) {
+		let n = e[t];
+		if (typeof n == "string" && n.includes("@")) return n.trim();
+	}
+	return null;
+}
+//#endregion
+//#region src/server/email.ts
+var te = "https://api.resend.com/emails";
+function v() {
+	return (process.env.RESEND_API_KEY || "").trim();
+}
+function y() {
+	return (process.env.EMAIL_FROM || "").trim() || "onboarding@resend.dev";
+}
+function b() {
+	return (process.env.EMAIL_REPLY_TO || "").trim() || void 0;
+}
+function x() {
+	return (process.env.VITE_ADMIN_EMAILS || process.env.ADMIN_EMAILS || "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter((e) => e.includes("@"));
+}
+var S = {
+	test: {
+		audience: "admins",
+		subject: "Test email from {{appName}}",
+		body: "This is a test.\n\nIf you are reading it, {{appName}} can send email.\n\nSent {{now}}.",
+		description: "Proves the connection works. Goes to the admin addresses."
+	},
+	new_submission: {
+		audience: "admins",
+		subject: "New {{formName}} submission",
+		body: "Someone filled in {{formName}} on {{appName}}.\n\nFrom: {{name}} ({{email}})\n\n{{summary}}\n\nOpen the app to see the full entry.",
+		description: "Tells the owner a form was filled in."
+	},
+	submission_received: {
+		audience: "record",
+		subject: "We got your message",
+		body: "Hi {{name}},\n\nThanks for getting in touch — we have your message and will come back to you shortly.\n\n— {{appName}}",
+		description: "Confirms to the sender that their form arrived."
+	},
+	order_confirmed: {
+		audience: "record",
+		subject: "Your order is confirmed",
+		body: "Hi {{name}},\n\nThank you — your payment of {{amount}} went through and your order is confirmed.\n\n{{details}}\n\n— {{appName}}",
+		description: "Sent to the buyer after a successful payment."
+	},
+	new_sale: {
+		audience: "admins",
+		subject: "You made a sale — {{amount}}",
+		body: "{{name}} ({{email}}) just paid {{amount}} on {{appName}}.\n\n{{details}}",
+		description: "Tells the owner money came in."
+	}
+};
+function C(e) {
+	return e ? Object.prototype.hasOwnProperty.call(S, e) ? null : `There is no email template called "${e}". Available: ${Object.keys(S).join(", ")}.` : "No template was named.";
+}
+function w(e) {
+	return String(e).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function T(e, t, n) {
+	return String(e).replace(/\{\{\s*([A-Za-z0-9_]+)\s*\}\}/g, (e, r) => {
+		let i = t[r];
+		return i == null ? "" : n ? w(String(i)) : String(i);
+	});
+}
+function E(e, t) {
+	let n = T(e.body, t, !1);
+	return {
+		subject: T(e.subject, t, !1).slice(0, 200),
+		text: n,
+		html: "<div style=\"font-family:system-ui,-apple-system,Segoe UI,sans-serif;font-size:15px;line-height:1.6;color:#1e293b\">" + T(e.body, t, !0).split("\n\n").map((e) => `<p>${e.replace(/\n/g, "<br>")}</p>`).join("") + "</div>"
+	};
+}
+async function D(e, t) {
+	let n = v();
+	if (!n) return {
+		id: null,
+		error: "RESEND_API_KEY is not set."
+	};
+	if (!e.length) return {
+		id: null,
+		error: "There is nobody to send this to."
+	};
+	let r = await fetch(te, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${n}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			from: y(),
+			to: e,
+			reply_to: b(),
+			subject: t.subject,
+			html: t.html,
+			text: t.text
+		})
+	}), i = await r.json().catch(() => ({}));
+	return r.ok ? {
+		id: i?.id || null,
+		error: null
+	} : {
+		id: null,
+		error: i?.message || `Resend refused the send (${r.status}).`
+	};
+}
+//#endregion
 //#region src/server/stripeClient.ts
-var f = null;
-function p() {
+var O = null;
+function k() {
 	return (process.env.STRIPE_SECRET_KEY || "").trim();
 }
-function m() {
-	let e = p();
+function A() {
+	let e = k();
 	return e ? e.startsWith("sk_live_") ? "live" : "test" : null;
 }
-function h() {
-	let e = p();
+function j() {
+	let e = k();
 	if (!e) throw Error("STRIPE_SECRET_KEY is not set.");
-	return f ||= new n(e), f;
+	return O ||= new n(e), O;
 }
-var g = Number(process.env.STRIPE_MAX_ADHOC_AMOUNT || 1e4), _ = .5;
-function v(e) {
+var M = Number(process.env.STRIPE_MAX_ADHOC_AMOUNT || 1e4), N = .5;
+function P(e) {
 	let { priceId: t, amount: n, mode: r = "payment", quantity: i = 1 } = e || {};
 	if (!t && n === void 0) return "This button does not say what is being sold.";
 	if (t && n !== void 0) return "A payment has either a Stripe price or an amount, not both.";
@@ -77,16 +218,16 @@ function v(e) {
 	if (n !== void 0) {
 		if (r === "subscription") return "A subscription needs a price created in Stripe — a typed amount cannot recur.";
 		if (typeof n != "number" || !Number.isFinite(n)) return "That amount is not a number.";
-		if (n < .5) return `The smallest amount that can be charged is ${_}.`;
-		if (n > g) return `That amount is above the ${g} limit for typed prices. Use a price created in Stripe.`;
+		if (n < .5) return `The smallest amount that can be charged is ${N}.`;
+		if (n > M) return `That amount is above the ${M} limit for typed prices. Use a price created in Stripe.`;
 		if (!e.productName || !String(e.productName).trim()) return "A typed amount needs a name for what is being bought.";
 	}
 	return t && !/^price_[A-Za-z0-9]+$/.test(t) ? "That does not look like a Stripe price id." : null;
 }
-function y(e) {
+function F(e) {
 	return Math.round(e * 100);
 }
-function b(e, t, n) {
+function I(e, t, n) {
 	let r = String(e || "").replace(/\/+$/, ""), i = (e, t) => {
 		let n = String(e || t);
 		return n.startsWith("/") ? n : `/${n}`;
@@ -96,17 +237,17 @@ function b(e, t, n) {
 		cancel: `${r}${i(n, "/payment-cancelled")}`
 	};
 }
-function x(e) {
+function L(e) {
 	return e === "active" || e === "trialing" || e === "past_due";
 }
 //#endregion
 //#region src/server/selftest.ts
-var S = (e) => !!(process.env[e] || "").trim();
-function C(e) {
+var R = (e) => !!(process.env[e] || "").trim();
+function z(e) {
 	let t = (process.env.SELFTEST_TOKEN || "").trim();
 	return t ? String(e || "") === t : !0;
 }
-async function w() {
+async function B() {
 	let e = [{
 		name: "Server",
 		status: "pass",
@@ -138,15 +279,15 @@ async function w() {
 			});
 		}
 	}
-	if (!p()) e.push({
+	if (!k()) e.push({
 		name: "Stripe",
 		status: "warn",
 		detail: "STRIPE_SECRET_KEY is not set. Payments are switched off until it is."
 	});
 	else {
-		let t = m();
+		let t = A();
 		try {
-			let n = await h().accounts.retrieve();
+			let n = await j().accounts.retrieve();
 			e.push({
 				name: "Stripe",
 				status: "pass",
@@ -163,7 +304,7 @@ async function w() {
 				detail: `The key is set but Stripe refused it: ${t.message}`
 			});
 		}
-		e.push(S("STRIPE_WEBHOOK_SECRET") ? {
+		e.push(R("STRIPE_WEBHOOK_SECRET") ? {
 			name: "Stripe webhook",
 			status: "pass",
 			detail: "Signed webhooks will be accepted."
@@ -173,7 +314,7 @@ async function w() {
 			detail: "STRIPE_WEBHOOK_SECRET is not set. Payments still confirm when the payer returns; refunds and cancellations made in the Stripe dashboard will not reach the app until it is."
 		});
 	}
-	return e.push(S("RESEND_API_KEY") ? {
+	return e.push(R("RESEND_API_KEY") ? {
 		name: "Email",
 		status: "pass",
 		detail: "RESEND_API_KEY is set."
@@ -189,32 +330,32 @@ async function w() {
 }
 //#endregion
 //#region src/server/index.ts
-var T = (e, t, n, r = {}) => e.status(t).json({
+var V = (e, t, n, r = {}) => e.status(t).json({
 	success: !1,
 	error: n,
 	...r
 });
-function E(e, t) {
+function H(e, t) {
 	let n = t instanceof Error ? t.message : "Something went wrong on the server.", r = n.includes("STRIPE_SECRET_KEY") || n.includes("project id");
-	return T(e, r ? 503 : 500, n, r ? { requiresSetup: !0 } : {});
+	return V(e, r ? 503 : 500, n, r ? { requiresSetup: !0 } : {});
 }
-async function D(e, t, n) {
+async function U(e, t, n) {
 	let r = String(e.headers.authorization || ""), i = r.startsWith("Bearer ") ? r.slice(7) : "";
-	if (!i) return T(t, 401, "Please sign in first.");
+	if (!i) return V(t, 401, "Please sign in first.");
 	try {
-		e.user = await u(i, d()), n();
+		e.user = await u(i, d()), e.idToken = i, n();
 	} catch (e) {
-		return T(t, 401, e.message);
+		return V(t, 401, e.message);
 	}
 }
-async function O(e, t) {
+async function W(e, t) {
 	return !t.email || !t.emailVerified ? null : (await e.customers.list({
 		email: t.email,
 		limit: 1
 	})).data[0] || null;
 }
-async function k(e, t) {
-	let n = await O(e, t);
+async function G(e, t) {
+	let n = await W(e, t);
 	return n ? (n.metadata?.uid !== t.uid && await e.customers.update(n.id, { metadata: {
 		...n.metadata,
 		uid: t.uid
@@ -223,26 +364,26 @@ async function k(e, t) {
 		metadata: { uid: t.uid }
 	});
 }
-function A(e) {
+function K(e) {
 	return e?.current_period_end ?? e?.items?.data?.[0]?.current_period_end ?? null;
 }
-function j(e) {
+function q(e) {
 	let t = e.items?.data?.[0], n = t?.price;
 	return {
 		id: e.id,
 		status: e.status,
-		active: x(e.status),
+		active: L(e.status),
 		priceId: n?.id || null,
 		productName: typeof n?.product == "object" && n.product?.name || null,
 		amount: n?.unit_amount == null ? null : n.unit_amount / 100,
 		currency: n?.currency || null,
 		interval: n?.recurring?.interval || null,
 		quantity: t?.quantity ?? 1,
-		currentPeriodEnd: A(e),
+		currentPeriodEnd: K(e),
 		cancelAtPeriodEnd: !!e.cancel_at_period_end
 	};
 }
-function M(e) {
+function J(e) {
 	return {
 		id: e.id,
 		amount: e.amount / 100,
@@ -255,61 +396,181 @@ function M(e) {
 		fullyRefunded: e.refunded && e.amount_refunded >= e.amount
 	};
 }
-var N = /* @__PURE__ */ new Set();
-function P(e) {
-	return N.has(e) ? !0 : (N.add(e), N.size > 500 && N.delete(N.values().next().value), !1);
+var ne = 600 * 1e3, re = Number(process.env.EMAIL_RATE_PER_CALLER || 20), ie = Number(process.env.EMAIL_RATE_PER_HOUR || 200), Y = /* @__PURE__ */ new Map(), X = [];
+function Z(e) {
+	let t = Date.now();
+	for (; X.length && t - X[0] > 3600 * 1e3;) X.shift();
+	if (X.length >= ie) return "This app has sent its hourly limit of email. Try again shortly.";
+	let n = (Y.get(e) || []).filter((e) => t - e < ne);
+	return n.length >= re ? (Y.set(e, n), "Too many messages from here just now. Try again in a few minutes.") : (n.push(t), Y.set(e, n), X.push(t), Y.size > 5e3 && Y.clear(), null);
+}
+var Q = (e) => String(e.ip || e.socket?.remoteAddress || "unknown"), $ = /* @__PURE__ */ new Set();
+function ae(e) {
+	return $.has(e) ? !0 : ($.add(e), $.size > 500 && $.delete($.values().next().value), !1);
 }
-function F(t = {}) {
+function oe(t = {}) {
 	let n = e.Router();
 	return n.post("/payments/webhook", e.raw({ type: "application/json" }), async (e, n) => {
 		let r = (process.env.STRIPE_WEBHOOK_SECRET || "").trim(), i = e.headers["stripe-signature"];
-		if (!r) return T(n, 503, "STRIPE_WEBHOOK_SECRET is not set.");
-		if (!i) return T(n, 400, "Missing stripe-signature header.");
+		if (!r) return V(n, 503, "STRIPE_WEBHOOK_SECRET is not set.");
+		if (!i) return V(n, 400, "Missing stripe-signature header.");
 		let a;
 		try {
-			a = h().webhooks.constructEvent(e.body, i, r);
+			a = j().webhooks.constructEvent(e.body, i, r);
 		} catch (e) {
-			return T(n, 400, `Webhook signature check failed: ${e.message}`);
+			return V(n, 400, `Webhook signature check failed: ${e.message}`);
 		}
-		if (P(a.id)) return n.json({
+		if (ae(a.id)) return n.json({
 			received: !0,
 			duplicate: !0
 		});
 		try {
 			await t.onStripeEvent?.(a);
 		} catch (e) {
-			return N.delete(a.id), T(n, 503, `Handler failed: ${e.message}`);
+			return $.delete(a.id), V(n, 503, `Handler failed: ${e.message}`);
 		}
 		return n.json({ received: !0 });
 	}), n.use(e.json()), n.get("/_selftest", async (e, t) => {
-		if (!C(e.query.token)) return T(t, 403, "This check needs its token.");
+		if (!z(e.query.token)) return V(t, 403, "This check needs its token.");
 		try {
-			let e = await w();
+			let e = await B();
 			return t.status(e.ok ? 200 : 500).json(e);
 		} catch (e) {
-			return E(t, e);
+			return H(t, e);
+		}
+	}), n.get("/_selftest/checkout", async (e, t) => {
+		if (!z(e.query.token)) return V(t, 403, "This check needs its token.");
+		if (A() !== "test") return V(t, 403, "The test checkout only runs against a test key (sk_test_).");
+		try {
+			let n = e.headers.origin || `${e.protocol}://${e.get("host")}`, r = I(String(n), "/api/_selftest/paid", "/api/_selftest/cancelled"), i = await j().checkout.sessions.create({
+				mode: "payment",
+				line_items: [{
+					quantity: 1,
+					price_data: {
+						currency: "usd",
+						product_data: { name: "Self-test payment" },
+						unit_amount: 100
+					}
+				}],
+				success_url: r.success,
+				cancel_url: r.cancel,
+				metadata: { selftest: "true" }
+			});
+			return t.redirect(303, i.url);
+		} catch (e) {
+			return H(t, e);
+		}
+	}), n.get("/_selftest/paid", async (e, t) => {
+		let n = String(e.query.session_id || "");
+		if (!n) return V(t, 400, "No session id came back.");
+		try {
+			let e = await j().checkout.sessions.retrieve(n), r = e.payment_status === "paid";
+			return t.status(r ? 200 : 402).json({
+				ok: r,
+				message: r ? "The whole loop works: checkout created, card charged, payment confirmed by the server." : `Stripe says this payment is ${e.payment_status}.`,
+				amount: e.amount_total == null ? null : e.amount_total / 100,
+				currency: e.currency,
+				email: e.customer_details?.email || null
+			});
+		} catch (e) {
+			return H(t, e);
+		}
+	}), n.get("/_selftest/cancelled", (e, t) => t.json({
+		ok: !0,
+		message: "Payment cancelled — nothing was charged."
+	})), n.get("/_selftest/email", async (e, t) => {
+		if (!z(e.query.token)) return V(t, 403, "This check needs its token.");
+		if (!v()) return V(t, 503, "RESEND_API_KEY is not set.");
+		let n = x();
+		if (!n.length) return V(t, 503, "VITE_ADMIN_EMAILS is empty, so there is no admin address to send to.");
+		let r = await D(n, E(S.test, {
+			appName: process.env.APP_NAME || "your app",
+			now: (/* @__PURE__ */ new Date()).toISOString()
+		}));
+		return t.status(r.error ? 502 : 200).json({
+			ok: !r.error,
+			sentTo: n,
+			from: y(),
+			id: r.id,
+			error: r.error,
+			message: r.error ? "Resend refused the send." : "Sent. If it does not arrive within a minute, check spam — an unverified domain often lands there."
+		});
+	}), n.get("/email/status", (e, t) => {
+		t.json({
+			configured: !!v(),
+			from: y(),
+			adminCount: x().length,
+			templates: Object.entries(S).map(([e, t]) => ({
+				id: e,
+				audience: t.audience,
+				description: t.description
+			}))
+		});
+	}), n.post("/email/notify", async (e, t) => {
+		let n = Z(Q(e));
+		if (n) return V(t, 429, n);
+		let { template: r, data: i } = e.body || {}, a = C(String(r || ""));
+		if (a) return V(t, 400, a);
+		let o = S[String(r)];
+		if (o.audience !== "admins") return V(t, 400, `The "${r}" template is written to a customer, not to you.`);
+		let s = x();
+		if (!s.length) return V(t, 503, "There is no admin address to send to.");
+		let c = await D(s, E(o, {
+			appName: process.env.APP_NAME || "your app",
+			...i || {}
+		}));
+		return t.status(c.error ? 502 : 200).json({
+			success: !c.error,
+			id: c.id,
+			error: c.error
+		});
+	}), n.post("/email/send", async (e, t) => {
+		let n = Z(Q(e));
+		if (n) return V(t, 429, n);
+		let { template: r, collection: i, docId: a, data: o } = e.body || {}, s = C(String(r || ""));
+		if (s) return V(t, 400, s);
+		if (!i || !a) return V(t, 400, "Name the record this email is about.");
+		let c = S[String(r)];
+		if (c.audience !== "record") return V(t, 400, `The "${r}" template is written to you, not to a customer. Use /email/notify.`);
+		try {
+			let n = String(e.headers.authorization || ""), r = n.startsWith("Bearer ") ? n.slice(7) : void 0, s = await g(d(), String(i), String(a), r);
+			if (!s) return V(t, 404, "That record does not exist.");
+			let l = _(s);
+			if (!l) return V(t, 422, "That record has no email address on it.");
+			let u = E(c, {
+				appName: process.env.APP_NAME || "your app",
+				...s,
+				...o || {}
+			}), f = await D([l], u);
+			return t.status(f.error ? 502 : 200).json({
+				success: !f.error,
+				id: f.id,
+				error: f.error
+			});
+		} catch (e) {
+			return V(t, 400, e.message);
 		}
 	}), n.get("/payments/status", (e, t) => {
-		let n = m();
+		let n = A();
 		t.json({
-			configured: !!p(),
+			configured: !!k(),
 			mode: n,
 			webhookConfigured: !!(process.env.STRIPE_WEBHOOK_SECRET || "").trim(),
 			message: n ? `Stripe is connected in ${n} mode.` : "Add STRIPE_SECRET_KEY to start taking payments."
 		});
 	}), n.post("/payments/checkout", async (e, t) => {
-		let n = e.body || {}, r = v(n);
-		if (r) return T(t, 400, r);
+		let n = e.body || {}, r = P(n);
+		if (r) return V(t, 400, r);
 		let i = n.origin || e.headers.origin;
-		if (!i) return T(t, 400, "The page did not say where to send the payer back to.");
+		if (!i) return V(t, 400, "The page did not say where to send the payer back to.");
 		try {
-			let r = h(), a = null, o = String(e.headers.authorization || "");
+			let r = j(), a = null, o = String(e.headers.authorization || "");
 			if (o.startsWith("Bearer ")) try {
 				a = await u(o.slice(7), d());
 			} catch {
 				a = null;
 			}
-			let s = a ? await k(r, a) : null, c = b(String(i), n.successPath, n.cancelPath), l = n.priceId ? {
+			let s = a ? await G(r, a) : null, c = I(String(i), n.successPath, n.cancelPath), l = n.priceId ? {
 				price: n.priceId,
 				quantity: n.quantity || 1
 			} : {
@@ -317,7 +578,7 @@ function F(t = {}) {
 				price_data: {
 					currency: n.currency || "usd",
 					product_data: { name: String(n.productName) },
-					unit_amount: y(Number(n.amount))
+					unit_amount: F(Number(n.amount))
 				}
 			}, f = await r.checkout.sessions.create({
 				mode: n.mode || "payment",
@@ -337,11 +598,11 @@ function F(t = {}) {
 				url: f.url
 			});
 		} catch (e) {
-			return E(t, e);
+			return H(t, e);
 		}
 	}), n.get("/payments/session/:id", async (e, t) => {
 		try {
-			let n = await h().checkout.sessions.retrieve(String(e.params.id));
+			let n = await j().checkout.sessions.retrieve(String(e.params.id));
 			return t.json({
 				success: !0,
 				paid: n.payment_status === "paid",
@@ -354,11 +615,11 @@ function F(t = {}) {
 				metadata: n.metadata || {}
 			});
 		} catch (e) {
-			return (e instanceof Error ? e.message : "Unknown error").includes("STRIPE_SECRET_KEY") ? E(t, e) : T(t, 404, "That payment could not be found.");
+			return (e instanceof Error ? e.message : "Unknown error").includes("STRIPE_SECRET_KEY") ? H(t, e) : V(t, 404, "That payment could not be found.");
 		}
-	}), n.get("/payments/me", D, async (e, t) => {
+	}), n.get("/payments/me", U, async (e, t) => {
 		try {
-			let n = h(), r = await O(n, e.user);
+			let n = j(), r = await W(n, e.user);
 			if (!r) return t.json({
 				success: !0,
 				customerId: null,
@@ -374,7 +635,7 @@ function F(t = {}) {
 			}), n.charges.list({
 				customer: r.id,
 				limit: 20
-			})]), o = i.data.map(j), s = a.data.map(M);
+			})]), o = i.data.map(q), s = a.data.map(J);
 			return t.json({
 				success: !0,
 				customerId: r.id,
@@ -384,14 +645,14 @@ function F(t = {}) {
 				payments: s
 			});
 		} catch (e) {
-			return E(t, e);
+			return H(t, e);
 		}
-	}), n.post("/payments/portal", D, async (e, t) => {
+	}), n.post("/payments/portal", U, async (e, t) => {
 		try {
-			let n = h(), r = await O(n, e.user);
-			if (!r) return T(t, 404, "There is nothing to manage on this account yet.");
+			let n = j(), r = await W(n, e.user);
+			if (!r) return V(t, 404, "There is nothing to manage on this account yet.");
 			let i = e.body?.origin || e.headers.origin;
-			if (!i) return T(t, 400, "The page did not say where to send them back to.");
+			if (!i) return V(t, 400, "The page did not say where to send them back to.");
 			let a = await n.billingPortal.sessions.create({
 				customer: r.id,
 				return_url: String(i).replace(/\/+$/, "")
@@ -401,9 +662,9 @@ function F(t = {}) {
 				url: a.url
 			});
 		} catch (e) {
-			return E(t, e);
+			return H(t, e);
 		}
 	}), n;
 }
 //#endregion
-export { g as MAX_ADHOC_AMOUNT, _ as MIN_ADHOC_AMOUNT, F as apiRoutes, v as checkoutProblem, x as grantsAccess, d as projectId, b as returnUrls, w as runSelfTest, C as selfTestAllowed, m as stripeMode, u as verifyIdToken };
+export { M as MAX_ADHOC_AMOUNT, N as MIN_ADHOC_AMOUNT, S as TEMPLATES, x as adminEmails, oe as apiRoutes, P as checkoutProblem, _ as emailOnRecord, w as escapeHtml, T as fill, m as fromFields, L as grantsAccess, h as pathProblem, d as projectId, g as readDocument, E as renderTemplate, I as returnUrls, B as runSelfTest, z as selfTestAllowed, A as stripeMode, u as verifyIdToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "your-ai-workflow-firebase-os",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Your AI Firebase — a complete Firebase-powered admin app in one React component.",
   "type": "module",
   "main": "dist/your-ai-workflow-firebase-os.cjs.js",

package/server.template.ts

@@ -9,13 +9,19 @@
  *
  * WHAT TO PUT IN SECRETS
  *   STRIPE_SECRET_KEY          starts sk_test_ while you are trying it out
+ *   RESEND_API_KEY             from resend.com — turns on email
+ *   EMAIL_FROM                 optional; defaults to Resend's shared sender
+ *   EMAIL_REPLY_TO             optional; where replies should land
+ *   APP_NAME                   optional; the name used inside emails
  *   STRIPE_WEBHOOK_SECRET      optional, and only once the app is published
- *   SELFTEST_TOKEN             optional; once set, /api/_selftest asks for it
+ *   SELFTEST_TOKEN             optional; once set, every check below asks for it
  *   VITE_FIREBASE_PROJECT_ID   already there — the server reads the same one
+ *   VITE_ADMIN_EMAILS          already there — who owner notifications go to
  *
- * IS IT WORKING?
- *   Open /api/_selftest in the browser. It answers with a list rather than a
- *   blank page: what is set, what connects, and what is still missing.
+ * IS IT WORKING?  All three open in the browser — no terminal needed.
+ *   /api/_selftest            what is set, what connects, what is missing
+ *   /api/_selftest/checkout   charges $1 on a test card and confirms it
+ *   /api/_selftest/email      sends a test email to the admin addresses
  */
 import express, { Request, Response } from 'express';
 import path from 'path';