your-ai-workflow-firebase-os 2.0.0 → 2.0.2

package/dist/components/ViewingAs.d.ts

@@ -57,10 +57,17 @@ export declare function useViewingAs({ on, everyone }: {
     everyone?: boolean;
 }): ViewingAs;
 /**
- * The switch with its word beside it, for a toolbar that wants one line.
+ * The switch with its word BESIDE it, for a toolbar that wants one line.
+ *
+ * The word is drawn here and not by the select, which stacks its label above
+ * the trigger the way a form field does: in a toolbar that made the bar two
+ * rows tall, so "Viewing" floated over the row while the eye, the switch and
+ * every button beside it centred against the taller box. One line, one
+ * baseline — the eye, the word, the switch.
  *
  * The eye is the same glyph the console uses for looking at something without
- * changing it, and the word goes on a phone the way every other button's does.
+ * changing it, and it stays on a phone while the word goes, the way every
+ * other row up here is icons on a phone and words on a screen.
  */
 export declare function ViewingAsBar({ viewing }: {
     viewing: ViewingAs;

package/dist/components/media/Attachments.d.ts

@@ -0,0 +1,15 @@
+export interface AttachmentsProps {
+    /** The answer as it sits on the entry — one link, or several. */
+    value: unknown;
+    /** The file to show large. The screen keeps the viewer. */
+    onOpen: (file: {
+        src: string;
+        name: string;
+    }) => void;
+    /** The tile's size, where a screen wants them smaller than the Inbox's. */
+    className?: string;
+}
+export declare function Attachments({ value, onOpen, className }: AttachmentsProps): import("react/jsx-runtime").JSX.Element;
+export declare namespace Attachments {
+    var displayName: string;
+}

package/dist/lib/pageDesignLines.d.ts

@@ -102,7 +102,7 @@ export declare const PIECES_LINE = "And the hard parts are the app\u2019s own pi
  * that keeps many things — and names no piece: rule 6 and rule 31 do, and
  * `whole-records` is the build's half.
  */
-export declare const WORKING_VIEW_LINE = "If this page keeps many things \u2014 orders, requests, clients \u2014 show them the way a professional tool does, so a dozen can be seen at once without my asking for it: each one a compact card or a single row saying only what tells it apart \u2014 its number or name, who it is for, its stage as a small label, when, how much, who has it \u2014 and pressing one opens the whole of it in the app\u2019s own pop-up, where everything done to it is: its stage, its notes, handing it over. Where things move through stages, the people who work on them see a board of those stages; somebody who only follows their own sees theirs as a short list. Never every one drawn open, one big box under another. Inside the opened one, keep it tidy and even: a clear grid, each label above its value, the same spacing throughout, and boxes and buttons that sit side by side the same height. Do not add a gallery to a page I did not ask it for.";
+export declare const WORKING_VIEW_LINE = "If this page keeps many things \u2014 orders, requests, clients \u2014 show them the way a professional tool does, so a dozen can be seen at once without my asking for it: each one a compact card or a single row saying only what tells it apart \u2014 its number or name, who it is for, its stage as a small label, when, how much, who has it \u2014 and pressing one opens the whole of it in the app\u2019s own pop-up, where everything done to it is: its stage, its notes, handing it over. Where things move through stages, the people who work on them see a board of those stages; somebody who only follows their own sees theirs as a short list. Never every one drawn open, one big box under another. Inside the opened one, keep it tidy and even: the pop-up is its one frame, so its parts are set apart by space or a thin rule and never each in a bordered box of its own, nothing boxed inside a box; a clear grid, each label in small print above its value at the page\u2019s ordinary size, one spacing throughout, boxes and buttons that sit side by side the same height, and what can be done to it \u2014 its stage, who holds it, a note \u2014 together in one place at the end rather than scattered through it; nothing on it pulses, and every word on it is mine or the entry\u2019s, never a made-up place, carrier or name standing in for one that is missing. Do not add a gallery to a page I did not ask it for.";
 export declare const finishLine: (website: boolean) => string;
 /**
  * A change sentence's first rule: what the owner's words are about is the

package/dist/lib/payments.d.ts

@@ -164,13 +164,34 @@ export declare function openBillingPortal(): Promise<string | null>;
  * that URL. Only `paid: true` from here means money moved.
  */
 export declare function confirmPayment(sessionId: string): Promise<PaymentConfirmation>;
-/** Forget the cached /payments/status answer — the Payments switch, and tests. */
+export interface PaymentsStatus {
+    configured: boolean;
+    mode: 'live' | 'test' | null;
+}
+/** How often a watching screen asks again while the key is still not in. */
+export declare const STATUS_WATCH_MS = 5000;
+/**
+ * Forget the cached /payments/status answer and ask again — the Payments
+ * switch, and tests. Anything on screen holding the old answer is told.
+ */
 export declare function resetPaymentsStatus(): void;
+/**
+ * An answer the status route gave SOMEWHERE ELSE — the polled chips on the
+ * Setup, Payments and Go live screens (lib/serviceStatus.ts). The screen that
+ * tells the owner their key is in is the screen that tells the app, so walking
+ * from there to the Pages screen finds the Payments section already there.
+ */
+export declare function notePaymentsStatus(data: any): void;
 /**
  * Whether the owner has connected Stripe. A page uses this to avoid drawing a
  * Pay button that cannot work on an app whose owner is still mid-setup.
+ *
+ * `watch` is for the screens an owner sets payments up FROM — they ask again
+ * every few seconds until the key is in, so a section appears where the owner
+ * is standing rather than after a reload. It stops itself the moment the
+ * answer turns true, so an app that is set up polls nothing.
  */
-export declare function usePaymentsEnabled(): {
+export declare function usePaymentsEnabled(watch?: boolean): {
     loading: boolean;
     configured: boolean;
     mode: 'live' | 'test' | null;

package/dist/lib/people.d.ts

@@ -6,6 +6,15 @@ export interface Person {
     name: string;
     /** Their picture, or '' — most installs keep none on the profile. */
     photo: string;
+    /**
+     * Their address, or '' — beside the name in a picker, so two people who
+     * share a name are told apart and a name that IS an address is not the
+     * only thing known about them. Only the team and admins ever list people,
+     * so it reaches nobody a profile does not already reach.
+     */
+    email: string;
+    /** The number they signed in with, or ''. */
+    phone: string;
     /** The word they are marked with, which is the word that was asked for. */
     role: string;
 }

package/dist/lib/recordsKey.d.ts

@@ -28,3 +28,27 @@ export declare function pageRecordsCollection(config: any, prefix: string, id?:
  * no preset draws no record list of its own).
  */
 export declare function recordsKeyInUse(config: any, id: string, isPublic: boolean): string;
+/**
+ * The word a page of SENT entries names its collection after: its tab name
+ * as the sentence has always folded it — lower case, one `_` between words,
+ * none at either end — behind the key the page keeps once it has been
+ * renamed or moved, so a rename never sends the road to an empty list.
+ */
+export declare const casePageName: (config: any) => string;
+/**
+ * The ONE collection a page whose entries are sent keeps them in —
+ * `case_orders_entries` for a page called Orders.
+ *
+ * Three things have to agree on it to the letter, and until 2026-09-24 only
+ * two did. The page's sentence hands the assistant this name
+ * (`useCases('case_orders_entries')`), and the arrival road writes a shop's
+ * orders into it (lib/arrivalRoads.ts). But the page templates handed the
+ * content file its `actions` — `records`, `saveRecord`, `updateRecord`,
+ * `deleteRecord`, `collection` — bound to `case_<name>_records`, the shape
+ * every other page has, and nothing else ever read or wrote that name. So
+ * `actions.updateRecord(order.id, …)` on an order that had arrived answered
+ * "No document to update: …/case_orders_records/<id>": the order sat one
+ * collection over under the same id, and the first anybody heard of it was
+ * the owner pressing Assign. Named here, once, and read by all three.
+ */
+export declare const caseEntriesCollection: (config: any, prefix?: string) => string;

package/dist/lib/rowPress.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Was that click a PRESS on the row, or the tail of a text selection?
+ *
+ * The admin lists — Pages, Forms — are cards that open when you click them
+ * and shut when you click them again, and the handler sits on the whole
+ * card, so the open settings are inside the very element that folds them.
+ * Everything drawn in there stops the click from reaching it, which works
+ * for an ordinary click and not at all for a SELECTION: dragging across a
+ * hint, a sentence or a label starts on one element and ends on another, so
+ * the browser fires the click on the nearest thing that holds them both —
+ * the card — above every guard inside it. The owner's words, 2026-09-24:
+ * "if you select text inside a page settings anywhere it folds page
+ * settings which is super annoying".
+ *
+ * So the card asks this instead. A press is a press: down and up in the same
+ * spot, with no text left selected. A drag is not, wherever it landed, and
+ * neither is a click that ends with words highlighted — a double-click on a
+ * word, a triple-click on a line, a drag across a paragraph.
+ *
+ * Clicking to CLOSE a row still works after a selection: the mouse going
+ * down clears it, so by the time the click lands there is nothing selected.
+ */
+/** How far the mouse may travel between down and up and still be a press. */
+export declare const PRESS_SLOP = 4;
+export interface PressPoint {
+    x: number;
+    y: number;
+}
+/**
+ * `from` is where the mouse went down on the card, or null when the click
+ * came from somewhere that never pressed it — a keyboard, or a test.
+ */
+export declare const isRowPress: (at: {
+    clientX: number;
+    clientY: number;
+}, from: PressPoint | null) => boolean;

package/dist/lib/steps.d.ts

@@ -16,6 +16,13 @@ export interface StepsState<T extends string = string> {
     goTo: (id: T) => void;
     /** Back to the first step with the question taken off the address — for when the thing is sent. */
     reset: () => void;
+    /**
+     * A file somewhere in the app is still going up, so the step is held: every
+     * way off it does nothing but say so. For a page that wants its own button
+     * to show it — `<Button disabled={flow.waiting}>` — rather than let somebody
+     * press a button that will not move.
+     */
+    waiting: boolean;
     /** Everything `<StepBar>` needs: `<StepBar {...flow.bar} />`. */
     bar: {
         steps: StepInfo<T>[];

package/dist/lib/transactions.d.ts

@@ -118,6 +118,12 @@ export declare function splitCollected(collected: [string, unknown][]): {
 };
 /** A metadata value is always a string; one that holds JSON is read as what it holds. */
 export declare function readValue(value: unknown): unknown;
+/**
+ * A key that holds a PICTURE rather than something to read. Anywhere an
+ * entry's own keys are printed — a receipt line, a sent list in the Inbox —
+ * this one is either drawn or left out, never said as an address.
+ */
+export declare const isPictureKey: (key: string) => boolean;
 /**
  * One thing bought, as a line: "2 × Blazer — Noir Black, M · £240". The
  * page named the keys itself, so each part is found by the names pages
@@ -125,10 +131,14 @@ export declare function readValue(value: unknown): unknown;
  * follows as "label: value".
  */
 export declare function itemLine(item: Record<string, unknown>, currency?: string | null): string;
-/** The same thing with its price apart — the words for the left of a receipt line, the sum for the right. */
+/**
+ * The same thing with its price apart — the words for the left of a receipt
+ * line, the sum for the right, and the picture for the line to draw.
+ */
 export declare function itemParts(item: Record<string, unknown>, currency?: string | null): {
     words: string;
     price: string;
+    picture: string;
 };
 /**
  * A collected value as the lines it reads as. A list of things bought is
@@ -142,6 +152,8 @@ export interface ReceiptLine {
     right: string;
     /** A thing bought; a number that made up the amount or a choice (delivery, a discount, the plan, the seats); the total. */
     kind: 'item' | 'extra' | 'total';
+    /** The thing's own picture, where the page put one on the line — drawn beside its words, never printed as an address. */
+    picture?: string;
 }
 /**
  * What was bought, as the lines of a receipt: each thing on a line of its

package/dist/lib/uploadQueue.d.ts

@@ -102,6 +102,12 @@ export declare class UploadQueue<T = unknown> {
     private pump;
     private run;
 }
+/** How many files are going up that walking away from would stop. */
+export declare const uploadsStoppedByLeaving: () => number;
+/** Hear when that number changes. Hands back the way to stop hearing. */
+export declare function watchUploads(heard: () => void): () => void;
+/** The same number, for a component — it redraws as each file lands. */
+export declare const useUploadsStoppedByLeaving: () => number;
 /** The list in numbers — what a button or a status line says. */
 export declare function uploadSummary(items: UploadItem[]): {
     total: number;

package/dist/pages/PagesAdmin.d.ts

@@ -72,13 +72,6 @@ export declare const audienceRoleOptions: (roles?: CustomRole[]) => {
     value: string;
     label: string;
 }[];
-/**
- * The collection a page of sent entries keeps them in — the name its sentence
- * hands the assistant (`useCases('case_orders_entries')`), and so the name the
- * app lets a linked page's entries into (arrivalRoads). ONE place, because the
- * two have to agree to the letter.
- */
-export declare const caseEntriesCollection: (config: any, prefix?: string) => string;
 export declare const audienceLines: (config: any) => string[];
 /** Which groups a piece of the owner's words names, each counted once. */
 export declare const groupsNamed: (text: string, roles?: CustomRole[]) => string[];
@@ -584,6 +577,7 @@ export declare const pageAddress: (page: {
 /** What the owner still has to fill in before the sentence is worth pasting. */
 export declare const promptBlocker: (page: {
     path: string;
+    id?: string;
 }, config: any, linkTargets?: WiringPageRow[]) => string;
 /**
  * One thing the owner has handed over for the page — a picture, a video, a
@@ -1496,6 +1490,54 @@ export declare const arrivalsTo: (config: any) => ArrivalsTo | "";
  * that is not the receiving end of a road.
  */
 export declare const arrivalSources: (config: any, targets: WiringPageRow[]) => WiringPageRow[];
+/**
+ * The pages anybody can open that are linked to THIS page and make entries,
+ * when this page is one person's own records (`user_`) — where nothing can
+ * ever land.
+ *
+ * The app carries what a visitor makes onto a page whose entries are SENT
+ * (`case_`, arrivalRoads) and onto no other kind: a `user_` record is read by
+ * the one uid on it, so an order could carry the buyer OR the person it is
+ * handed to, never both, and a guest's order nobody at all. There is no road
+ * into `user_`, and there cannot be one.
+ *
+ * The owner's Orders rehearsal of 2026-09-24 was this. Members had to see
+ * their own orders, so she answered "Only the person who added it" — the
+ * reading of an order that anybody would make — and the sentence told the
+ * assistant the shop and the page had "nothing to share". Every assistant
+ * given it built the same page: actions.records on a collection nothing ever
+ * writes, empty for the buyer, the team and the admins, and not a fault
+ * anywhere, because nothing was refused. Regenerated with the context
+ * cleared it came back the same, which is how she knew it was not Gemini.
+ *
+ * So the row says it where she is standing, and the sentence waits: a page
+ * that can never work is not one to hand over. Looked for from both ends,
+ * like arrivalSources, because a link is kept on one of its two rows.
+ */
+export declare const deadRoadSources: (config: any, targets: WiringPageRow[]) => WiringPageRow[];
+/**
+ * The same road seen from the page that MAKES the entries: the pages of one
+ * person's own records this page links to, when this page is one anybody can
+ * open and makes something. Empty for a page that makes nothing.
+ */
+export declare const deadRoadEnds: (config: any, targets: WiringPageRow[]) => WiringPageRow[];
+/**
+ * The line under "Who sees what somebody adds here?" on a page nothing can
+ * land on — in place of the answer's own hint, because the answer is wrong
+ * for this page and saying what it does would only confirm it.
+ */
+export declare const deadRoadHint: (config: any, targets: WiringPageRow[]) => string;
+/**
+ * The same, under the link on the row that MAKES the entries — the other
+ * page's setting is not on this row, so the line says where it is.
+ */
+export declare const deadRoadEndWords: (target: WiringPageRow) => string;
+/**
+ * What holds a sentence back on either end of a road with nowhere to end.
+ * A page that can never show what it is for is not one to hand over: the
+ * assistant would build it faithfully, empty, and nothing would say why.
+ */
+export declare const roadBlocker: (config: any, targets: WiringPageRow[]) => string;
 /**
  * What "only the person it is handed to" asks of the page that draws the
  * entries. The app keeps a new one from the team by itself; without a way to

package/dist/renderer.cjs.js

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-CiTBaPhY.cjs`);const e=require(`./ContactPopup-MalER7E7.cjs`);exports.ContactPopup=e.t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-CiTBaPhY.cjs`);const e=require(`./ContactPopup-IwBm-eqz.cjs`);exports.ContactPopup=e.t;

package/dist/renderer.es.js

@@ -1,2 +1,2 @@
-import { t as e } from "./ContactPopup-Du_AVUgk.js";
+import { t as e } from "./ContactPopup-Dsg2ntq3.js";
 export { e as ContactPopup };

package/dist/server.cjs.js

@@ -1,4 +1,4 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunk-CiTBaPhY.cjs`),t=require(`./verifiedAccount-D3OeaOBo.cjs`),n=require(`./aiModels-BIhoTNH0.cjs`),r=require(`./validate-L8QWFfBP.cjs`);let i=require(`node:fs`);i=e.a(i,1);let a=require(`express`);a=e.a(a,1);let o=require(`node:crypto`),s=require(`stripe`);s=e.a(s,1);var c=`https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com`,l=60;function u(e,t,n,r=Math.floor(Date.now()/1e3)){return n?e.alg===`RS256`?e.kid?t.aud===n?t.iss===`https://securetoken.google.com/${n}`?t.sub?t.sub.length>128?`Token subject is not a valid uid.`:typeof t.exp!=`number`||t.exp<=r?`Token has expired.`:typeof t.iat!=`number`||t.iat>r+l?`Token was issued in the future.`:null:`Token has no subject.`:`Token has the wrong issuer.`:`Token was issued for a different Firebase project.`:`Token has no key id.`:`Token is not signed with RS256.`:`The server does not know its Firebase project id.`}function d(e){return Buffer.from(e.replace(/-/g,`+`).replace(/_/g,`/`),`base64`)}function f(e){let t=String(e||``).split(`.`);if(t.length!==3)return null;try{return{header:JSON.parse(d(t[0]).toString(`utf8`)),claims:JSON.parse(d(t[1]).toString(`utf8`)),signed:`${t[0]}.${t[1]}`,signature:d(t[2])}}catch{return null}}var p=null;async function m(){if(p&&p.expiresAt>Date.now())return p.keys;let e=await fetch(c);if(!e.ok)throw Error(`Could not fetch Google signing keys (${e.status}).`);let t=await e.json(),n=/max-age=(\d+)/.exec(e.headers.get(`cache-control`)||``);return p={keys:t,expiresAt:Date.now()+(n?Number(n[1]):3600)*1e3},t}async function h(e,t){let n=f(e);if(!n)throw Error(`That is not a valid sign-in token.`);let r=u(n.header,n.claims,t);if(r)throw Error(r);let i=(await m())[n.header.kid];if(!i)throw Error(`Token was signed with a key Google no longer publishes.`);let a=(0,o.createVerify)(`RSA-SHA256`);if(a.update(n.signed),a.end(),!a.verify(i,n.signature))throw Error(`Token signature does not check out.`);return{uid:n.claims.sub,email:n.claims.email||null,emailVerified:!!n.claims.email_verified,signInProvider:n.claims.firebase?.sign_in_provider||null}}function g(){return(process.env.VITE_FIREBASE_PROJECT_ID||process.env.FIREBASE_PROJECT_ID||``).trim()}var _=`https://firestore.googleapis.com/v1`;function v(e){return e==null?null:`stringValue`in e?e.stringValue:`integerValue`in e?Number(e.integerValue):`doubleValue`in e?e.doubleValue:`booleanValue`in e?e.booleanValue:`timestampValue`in e?e.timestampValue:`nullValue`in e?null:`mapValue`in e?y(e.mapValue?.fields||{}):`arrayValue`in e?(e.arrayValue?.values||[]).map(v):null}function y(e){let t={};for(let[n,r]of Object.entries(e||{}))t[n]=v(r);return t}function ee(e,t){let n=`${e}/${t}`.split(`/`);if(n.length%2!=0)return`That is not a document path.`;for(let e of n)if(!e||e===`.`||e===`..`||!/^[A-Za-z0-9_.@~+-]+$/.test(e))return`That is not a document path.`;return null}async function b(e,t,n,r){let i=ee(t,n);if(i)throw Error(i);let a=`${_}/projects/${e}/databases/(default)/documents/${t}/${n}`,o=await fetch(a,{headers:r?{Authorization:`Bearer ${r}`}:{}});if(o.status===404)return null;if(o.status===403)throw Error(`You do not have permission to read that record.`);if(!o.ok)throw Error(`Firestore refused the read (${o.status}).`);return y((await o.json()).fields||{})}async function te(e,t,n){if(!/^[A-Za-z0-9_.@~+-]+$/.test(t)||t===`.`||t===`..`)throw Error(`That is not a collection.`);let r=`${_}/projects/${e}/databases/(default)/documents/${t}?pageSize=300`,i=await fetch(r,{headers:n?{Authorization:`Bearer ${n}`}:{}});if(i.status===403)throw Error(`You do not have permission to read those records.`);if(!i.ok)throw Error(`Firestore refused the read (${i.status}).`);return((await i.json()).documents||[]).map(e=>({id:String(e.name||``).split(`/`).pop()||``,data:y(e.fields||{})}))}var ne=[`email`,`Email`,`emailAddress`,`email_address`,`userEmail`,`contactEmail`,`submitterEmail`];function re(e){for(let t of ne){let n=e[t];if(typeof n==`string`&&n.includes(`@`))return n.trim()}return null}var ie=4320*60*1e3,ae=new Set([`user`,`users`,`free`,`guest`,`guests`,`internal`,`admin`,`admins`,`public`,`owner`,`team`,`member`,`members`,`none`,`role`,`roles`]),oe=e=>typeof e==`string`&&/^[a-z][a-z0-9]{1,23}$/.test(e)&&!ae.has(e),se=e=>(0,o.createHmac)(`sha256`,e).update(`your-ai-firebase plan roles v1`).digest(`hex`),ce=(e,t,n,r)=>(0,o.createHash)(`sha256`).update(`${e}:${t}:${n}:${r}`).digest(`hex`);function le(e){let t=new Map;for(let n of e){let e=Array.isArray(n?.plans)?n.plans:[];for(let n of e){let e=String(n?.roleId||``);if(oe(e))for(let r of[n?.monthly,n?.yearly])for(let n of[r?.priceId,r?.livePriceId]){let r=String(n||``).trim();r&&t.set(r,e)}}}return t}var ue=e=>le(e).size>0;function de(e,t,n){let r=null;for(let i of e){if(!i.active||!i.priceId)continue;let e=t.get(i.priceId);if(!e)continue;let a=typeof i.currentPeriodEnd==`number`?i.currentPeriodEnd*1e3:n,o=Math.round(Math.max(a,n)+ie);(!r||o>r.until)&&(r={role:e,until:o})}return r}var fe=`https://api.resend.com/emails`;function pe(){return(process.env.RESEND_API_KEY||``).trim()}function x(){return(process.env.EMAIL_FROM||``).trim()||`onboarding@resend.dev`}function me(){return(process.env.EMAIL_REPLY_TO||``).trim()||void 0}function S(){return(process.env.VITE_ADMIN_EMAILS||process.env.ADMIN_EMAILS||``).split(/[,\s]+/).map(e=>e.trim().toLowerCase()).filter(e=>e.includes(`@`))}var he={appName:``,logoUrl:``,appUrl:``,accent:`#7c3aed`,foreground:`#1e1b4b`,buttonText:``,buttonGradient:[],panelBg:``,panelBorder:``};function C(e,t){let n=String(e??``).trim();return/^#(?:[0-9a-f]{3}|[0-9a-f]{6}|[0-9a-f]{8})$/i.test(n)?n:t}function ge(e){let t=String(e??``).trim();return t.length>2e3||/[\s"'<>]/.test(t)?``:/^https?:\/\/[^/]+/i.test(t)?t:``}function _e(e){return String(e??``).replace(/[\r\n\t<>]/g,` `).replace(/\s+/g,` `).trim().slice(0,60)}function ve(e){let t=e&&typeof e==`object`?e:{},n=Array.isArray(t.buttonGradient)?t.buttonGradient.map(e=>C(e,``)).filter(Boolean).slice(0,2):[];return{appName:_e(t.appName),logoUrl:ge(t.logoUrl),appUrl:ge(t.appUrl),accent:C(t.accent,he.accent),foreground:C(t.foreground,he.foreground),buttonText:C(t.buttonText,``),buttonGradient:n,panelBg:C(t.panelBg,``),panelBorder:C(t.panelBorder,``)}}function ye(e){let t=e.replace(`#`,``);if(t.length===3&&(t=t.split(``).map(e=>e+e).join(``)),t.length<6)return null;let n=parseInt(t.slice(0,6),16);return Number.isNaN(n)?null:[n>>16&255,n>>8&255,n&255]}function be(e,t,n=[255,255,255]){let r=ye(e);return r?`#`+r.map((e,r)=>Math.round(e+(n[r]-e)*t)).map(e=>e.toString(16).padStart(2,`0`)).join(``):e}function xe(e){let t=ye(e);return t?(.299*t[0]+.587*t[1]+.114*t[2])/255:1}function Se(e,t=`#1f2937`,n=`#ffffff`){return xe(e)>.6?t:n}function Ce(e){let t=e.accent,n=xe(e.foreground)>.55?he.foreground:e.foreground,r=e.buttonGradient[0]||be(t,.22,[0,0,0]),i=e.buttonGradient[1]||(e.buttonGradient[0]?e.buttonGradient[0]:t),a=e.panelBg||be(t,.94);return{accent:t,text:n,muted:`#6b7280`,faint:`#9ca3af`,g0:r,g1:i,btnFg:e.buttonText||Se(r),panelBg:a,panelBorder:e.panelBorder||(e.panelBg?be(e.panelBg,.12,[0,0,0]):be(t,.84)),hr:be(t,.88)}}var w={test:{audience:`admins`,look:`notification`,kicker:`Test`,subject:`Test email from {{appName}}`,title:`{{appName}} can send email`,opener:`{{appName}} can send email`,body:`This is a test. If you are reading it, the connection works and every email your app sends will look like this one.
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunk-CiTBaPhY.cjs`),t=require(`./verifiedAccount-D3OeaOBo.cjs`),n=require(`./aiModels-BIhoTNH0.cjs`),r=require(`./validate-e48WXJdP.cjs`);let i=require(`node:fs`);i=e.a(i,1);let a=require(`express`);a=e.a(a,1);let o=require(`node:crypto`),s=require(`stripe`);s=e.a(s,1);var c=`https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com`,l=60;function u(e,t,n,r=Math.floor(Date.now()/1e3)){return n?e.alg===`RS256`?e.kid?t.aud===n?t.iss===`https://securetoken.google.com/${n}`?t.sub?t.sub.length>128?`Token subject is not a valid uid.`:typeof t.exp!=`number`||t.exp<=r?`Token has expired.`:typeof t.iat!=`number`||t.iat>r+l?`Token was issued in the future.`:null:`Token has no subject.`:`Token has the wrong issuer.`:`Token was issued for a different Firebase project.`:`Token has no key id.`:`Token is not signed with RS256.`:`The server does not know its Firebase project id.`}function d(e){return Buffer.from(e.replace(/-/g,`+`).replace(/_/g,`/`),`base64`)}function f(e){let t=String(e||``).split(`.`);if(t.length!==3)return null;try{return{header:JSON.parse(d(t[0]).toString(`utf8`)),claims:JSON.parse(d(t[1]).toString(`utf8`)),signed:`${t[0]}.${t[1]}`,signature:d(t[2])}}catch{return null}}var p=null;async function m(){if(p&&p.expiresAt>Date.now())return p.keys;let e=await fetch(c);if(!e.ok)throw Error(`Could not fetch Google signing keys (${e.status}).`);let t=await e.json(),n=/max-age=(\d+)/.exec(e.headers.get(`cache-control`)||``);return p={keys:t,expiresAt:Date.now()+(n?Number(n[1]):3600)*1e3},t}async function h(e,t){let n=f(e);if(!n)throw Error(`That is not a valid sign-in token.`);let r=u(n.header,n.claims,t);if(r)throw Error(r);let i=(await m())[n.header.kid];if(!i)throw Error(`Token was signed with a key Google no longer publishes.`);let a=(0,o.createVerify)(`RSA-SHA256`);if(a.update(n.signed),a.end(),!a.verify(i,n.signature))throw Error(`Token signature does not check out.`);return{uid:n.claims.sub,email:n.claims.email||null,emailVerified:!!n.claims.email_verified,signInProvider:n.claims.firebase?.sign_in_provider||null}}function g(){return(process.env.VITE_FIREBASE_PROJECT_ID||process.env.FIREBASE_PROJECT_ID||``).trim()}var _=`https://firestore.googleapis.com/v1`;function v(e){return e==null?null:`stringValue`in e?e.stringValue:`integerValue`in e?Number(e.integerValue):`doubleValue`in e?e.doubleValue:`booleanValue`in e?e.booleanValue:`timestampValue`in e?e.timestampValue:`nullValue`in e?null:`mapValue`in e?y(e.mapValue?.fields||{}):`arrayValue`in e?(e.arrayValue?.values||[]).map(v):null}function y(e){let t={};for(let[n,r]of Object.entries(e||{}))t[n]=v(r);return t}function ee(e,t){let n=`${e}/${t}`.split(`/`);if(n.length%2!=0)return`That is not a document path.`;for(let e of n)if(!e||e===`.`||e===`..`||!/^[A-Za-z0-9_.@~+-]+$/.test(e))return`That is not a document path.`;return null}async function b(e,t,n,r){let i=ee(t,n);if(i)throw Error(i);let a=`${_}/projects/${e}/databases/(default)/documents/${t}/${n}`,o=await fetch(a,{headers:r?{Authorization:`Bearer ${r}`}:{}});if(o.status===404)return null;if(o.status===403)throw Error(`You do not have permission to read that record.`);if(!o.ok)throw Error(`Firestore refused the read (${o.status}).`);return y((await o.json()).fields||{})}async function te(e,t,n){if(!/^[A-Za-z0-9_.@~+-]+$/.test(t)||t===`.`||t===`..`)throw Error(`That is not a collection.`);let r=`${_}/projects/${e}/databases/(default)/documents/${t}?pageSize=300`,i=await fetch(r,{headers:n?{Authorization:`Bearer ${n}`}:{}});if(i.status===403)throw Error(`You do not have permission to read those records.`);if(!i.ok)throw Error(`Firestore refused the read (${i.status}).`);return((await i.json()).documents||[]).map(e=>({id:String(e.name||``).split(`/`).pop()||``,data:y(e.fields||{})}))}var ne=[`email`,`Email`,`emailAddress`,`email_address`,`userEmail`,`contactEmail`,`submitterEmail`];function re(e){for(let t of ne){let n=e[t];if(typeof n==`string`&&n.includes(`@`))return n.trim()}return null}var ie=4320*60*1e3,ae=new Set([`user`,`users`,`free`,`guest`,`guests`,`internal`,`admin`,`admins`,`public`,`owner`,`team`,`member`,`members`,`none`,`role`,`roles`]),oe=e=>typeof e==`string`&&/^[a-z][a-z0-9]{1,23}$/.test(e)&&!ae.has(e),se=e=>(0,o.createHmac)(`sha256`,e).update(`your-ai-firebase plan roles v1`).digest(`hex`),ce=(e,t,n,r)=>(0,o.createHash)(`sha256`).update(`${e}:${t}:${n}:${r}`).digest(`hex`);function le(e){let t=new Map;for(let n of e){let e=Array.isArray(n?.plans)?n.plans:[];for(let n of e){let e=String(n?.roleId||``);if(oe(e))for(let r of[n?.monthly,n?.yearly])for(let n of[r?.priceId,r?.livePriceId]){let r=String(n||``).trim();r&&t.set(r,e)}}}return t}var ue=e=>le(e).size>0;function de(e,t,n){let r=null;for(let i of e){if(!i.active||!i.priceId)continue;let e=t.get(i.priceId);if(!e)continue;let a=typeof i.currentPeriodEnd==`number`?i.currentPeriodEnd*1e3:n,o=Math.round(Math.max(a,n)+ie);(!r||o>r.until)&&(r={role:e,until:o})}return r}var fe=`https://api.resend.com/emails`;function pe(){return(process.env.RESEND_API_KEY||``).trim()}function x(){return(process.env.EMAIL_FROM||``).trim()||`onboarding@resend.dev`}function me(){return(process.env.EMAIL_REPLY_TO||``).trim()||void 0}function S(){return(process.env.VITE_ADMIN_EMAILS||process.env.ADMIN_EMAILS||``).split(/[,\s]+/).map(e=>e.trim().toLowerCase()).filter(e=>e.includes(`@`))}var he={appName:``,logoUrl:``,appUrl:``,accent:`#7c3aed`,foreground:`#1e1b4b`,buttonText:``,buttonGradient:[],panelBg:``,panelBorder:``};function C(e,t){let n=String(e??``).trim();return/^#(?:[0-9a-f]{3}|[0-9a-f]{6}|[0-9a-f]{8})$/i.test(n)?n:t}function ge(e){let t=String(e??``).trim();return t.length>2e3||/[\s"'<>]/.test(t)?``:/^https?:\/\/[^/]+/i.test(t)?t:``}function _e(e){return String(e??``).replace(/[\r\n\t<>]/g,` `).replace(/\s+/g,` `).trim().slice(0,60)}function ve(e){let t=e&&typeof e==`object`?e:{},n=Array.isArray(t.buttonGradient)?t.buttonGradient.map(e=>C(e,``)).filter(Boolean).slice(0,2):[];return{appName:_e(t.appName),logoUrl:ge(t.logoUrl),appUrl:ge(t.appUrl),accent:C(t.accent,he.accent),foreground:C(t.foreground,he.foreground),buttonText:C(t.buttonText,``),buttonGradient:n,panelBg:C(t.panelBg,``),panelBorder:C(t.panelBorder,``)}}function ye(e){let t=e.replace(`#`,``);if(t.length===3&&(t=t.split(``).map(e=>e+e).join(``)),t.length<6)return null;let n=parseInt(t.slice(0,6),16);return Number.isNaN(n)?null:[n>>16&255,n>>8&255,n&255]}function be(e,t,n=[255,255,255]){let r=ye(e);return r?`#`+r.map((e,r)=>Math.round(e+(n[r]-e)*t)).map(e=>e.toString(16).padStart(2,`0`)).join(``):e}function xe(e){let t=ye(e);return t?(.299*t[0]+.587*t[1]+.114*t[2])/255:1}function Se(e,t=`#1f2937`,n=`#ffffff`){return xe(e)>.6?t:n}function Ce(e){let t=e.accent,n=xe(e.foreground)>.55?he.foreground:e.foreground,r=e.buttonGradient[0]||be(t,.22,[0,0,0]),i=e.buttonGradient[1]||(e.buttonGradient[0]?e.buttonGradient[0]:t),a=e.panelBg||be(t,.94);return{accent:t,text:n,muted:`#6b7280`,faint:`#9ca3af`,g0:r,g1:i,btnFg:e.buttonText||Se(r),panelBg:a,panelBorder:e.panelBorder||(e.panelBg?be(e.panelBg,.12,[0,0,0]):be(t,.84)),hr:be(t,.88)}}var w={test:{audience:`admins`,look:`notification`,kicker:`Test`,subject:`Test email from {{appName}}`,title:`{{appName}} can send email`,opener:`{{appName}} can send email`,body:`This is a test. If you are reading it, the connection works and every email your app sends will look like this one.
 
 Sent {{now}}.`,button:{label:`Open the app`},description:`Proves the connection works. Goes to the admin addresses.`},new_submission:{audience:`admins`,look:`notification`,kicker:`New form entry`,subject:`New {{formName}} submission`,title:`Someone filled in {{formName}}`,opener:`Someone filled in {{formName}}`,body:`{{summary}}`,facts:[[`Name`,`{{name}}`],[`Email`,`{{email}}`]],button:{label:`Open the inbox`,path:`/inbox`},description:`Lets you know someone filled in a form.`},submission_received:{audience:`record`,look:`text`,kicker:`Received`,subject:`We got your message`,title:`We got your message`,greeting:`Hi {{name}},`,body:`Thanks for getting in touch — we have your message and will come back to you shortly.
 

package/dist/server.es.js

@@ -1,6 +1,6 @@
 import { S as e, c as t, h as n, t as r, u as i, w as a } from "./verifiedAccount-C1iCxopN.js";
 import { a as o, c as s, i as c, l, m as u, n as d, o as f, r as p, s as m, t as h, u as g } from "./aiModels-BHlEfuRJ.js";
-import { _, a as v, i as ee, p as te } from "./validate-C_iJKXDU.js";
+import { _, a as v, i as ee, p as te } from "./validate-DzSJWuyL.js";
 import * as ne from "node:fs";
 import y from "express";
 import { createHash as re, createHmac as ie, createVerify as ae } from "node:crypto";

package/dist/{validate-C_iJKXDU.js → validate-DzSJWuyL.js}

@@ -308,13 +308,13 @@ var D = (e) => E(y(e)), O = /\b(?:useAiChat|askAi|useAiEnabled|useAiModels)\b|ge
 	"raw-html": "breaks",
 	"own-money": "breaks",
 	"dead-click": "breaks",
-	"glyph-icon": "breaks",
-	"own-spinner": "breaks",
-	"tiny-text": "breaks",
+	"glyph-icon": "looks",
+	"own-spinner": "looks",
+	"tiny-text": "looks",
 	"vague-button": "breaks",
 	"extra-press": "breaks",
-	"icon-in-heading": "breaks",
-	"decorated-empty": "breaks",
+	"icon-in-heading": "looks",
+	"decorated-empty": "looks",
 	"item-key": "breaks",
 	"whole-records": "breaks"
 };
@@ -1014,7 +1014,7 @@ function _r(e) {
 			if (J ? c("own-basket", zr.test(i) ? Vr(t, J, /<Checkout\b/.test(i)) : Hr(t, J)) : Y ? c("own-checkout", Lr(t, Y)) : Ur(i) && c("own-purchase", Wr(t)), !J && !Y) for (let n of Wa(i, e)) n.why === "flag" ? c("order-flag", io(n.config, t)) : n.why === "asks" ? c("order-asks", Ga(n.config, t)) : c("buyer-form", ao(n.config, t));
 			let Ae = Kr(i);
 			Ae && c("own-return", qr(t, Ae));
-			for (let n of Ja(i, e)) n.why === "typed" ? c("no-road-in", no(n.target, t, n.formId)) : c("own-road", ro(n, t));
+			for (let n of Ja(t, i, e)) n.why === "typed" ? c("no-road-in", no(n.target, t, n.formId)) : c("own-road", ro(n, t));
 			let Fe = Qi(i);
 			Fe.length && c("swallowed-write", aa(t, Fe));
 			let Ie = ra(i);
@@ -1440,38 +1440,59 @@ var wa = (e, t) => `${e}: ${P(t)} — the page works out WHO MADE a record for i
 		}));
 	}
 	return r;
-}, Ga = (e, t) => `${e}: this is the order ${t} sends back beside its <PayButton>, and an order asks the buyer NOTHING (fields: []) — who is paying is their ACCOUNT. Put <BuyerDetails onReady={setBuyer} phone address /> from 'your-ai-workflow-firebase-os' before the form, take every name, email, phone and address question out of the form, spread { ...buyer.metadata } into the button's metadata, and carry buyer.name, buyer.email, buyer.phone and buyer.address in the form's extra with the items. Asked through the form, the buyer has no account: their order can never be shown back to them, and a page built on these entries — an Orders page each buyer sees their own on — has nobody to send it to (contract rule 9).`, Ka = /(?:\bto|\bhref|\borderPath)=\{?\s*['"`]\/([A-Za-z0-9_-]+)[?'"`]|\bnavigate\(\s*['"`]\/([A-Za-z0-9_-]+)[?'"`]/g, $ = (e) => e.toLowerCase().replace(/[^a-z0-9]+/g, ""), qa = /\baddDoc\s*\(\s*collection\s*\(\s*db\s*,\s*['"`]case_|\bsetDoc\s*\(\s*doc\s*\(\s*collection\s*\(\s*db\s*,\s*['"`]case_/, Ja = (e, t) => {
-	let n = (t) => [...e.matchAll(RegExp(`<${t}\\b`, "g"))].map((t) => {
-		let n = t.index ?? 0, r = e.indexOf("/>", n);
-		return e.slice(n, r === -1 ? n + 800 : r + 2);
-	}), r = [...n("Basket"), ...n("Checkout")].find((e) => /\bformId=/.test(e)), i = (r ?? n("ContactPopup").find((e) => /\bextra=/.test(e)))?.match(/formId=\{?\s*['"`]([^'"`]+)['"`]/)?.[1];
-	if (!i) return [];
-	let a = [], o = /* @__PURE__ */ new Set();
-	for (let n of e.matchAll(Ka)) {
-		let e = $(n[1] || n[2] || "");
-		if (!e || o.has(e)) continue;
-		o.add(e);
-		let s = t.find((t) => R(t.file) && $(I(t.file).replace(/Content\.tsx$/, "")) === e);
-		if (!s) continue;
-		let c = z(s.source), l = /\b(?:usePublished|publish)\s*\(/.test(c), u = c.match(/\buseCases(?:<[^>]*>)?\s*\(\s*['"`](case_[A-Za-z0-9_]+)['"`]/)?.[1] ?? `case_${I(s.file).replace(/Content\.tsx$/, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase()}_entries`, d = {
-			target: s.file,
-			formId: i,
-			paid: !!r,
-			reads: u
+}, Ga = (e, t) => `${e}: this is the order ${t} sends back beside its <PayButton>, and an order asks the buyer NOTHING (fields: []) — who is paying is their ACCOUNT. Put <BuyerDetails onReady={setBuyer} phone address /> from 'your-ai-workflow-firebase-os' before the form, take every name, email, phone and address question out of the form, spread { ...buyer.metadata } into the button's metadata, and carry buyer.name, buyer.email, buyer.phone and buyer.address in the form's extra with the items. Asked through the form, the buyer has no account: their order can never be shown back to them, and a page built on these entries — an Orders page each buyer sees their own on — has nobody to send it to (contract rule 9).`, Ka = /(?:\bto|\bhref|\borderPath)=\{?\s*['"`]\/([A-Za-z0-9_-]+)[?'"`]|\bnavigate\(\s*['"`]\/([A-Za-z0-9_-]+)[?'"`]/g, $ = (e) => e.toLowerCase().replace(/[^a-z0-9]+/g, ""), qa = /\baddDoc\s*\(\s*collection\s*\(\s*db\s*,\s*['"`]case_|\bsetDoc\s*\(\s*doc\s*\(\s*collection\s*\(\s*db\s*,\s*['"`]case_/, Ja = (e, t, n) => {
+	let r = (e) => [...t.matchAll(RegExp(`<${e}\\b`, "g"))].map((e) => {
+		let n = e.index ?? 0, r = t.indexOf("/>", n);
+		return t.slice(n, r === -1 ? n + 800 : r + 2);
+	}), i = [...r("Basket"), ...r("Checkout")].find((e) => /\bformId=/.test(e)), a = (i ?? r("ContactPopup").find((e) => /\bextra=/.test(e)))?.match(/formId=\{?\s*['"`]([^'"`]+)['"`]/)?.[1];
+	if (!a) return [];
+	let o = [], s = /* @__PURE__ */ new Set(), c = [];
+	for (let e of t.matchAll(Ka)) {
+		let t = $(e[1] || e[2] || "");
+		if (!t || s.has(t)) continue;
+		s.add(t);
+		let r = n.find((e) => R(e.file) && $(I(e.file).replace(/Content\.tsx$/, "")) === t);
+		r && c.push(r);
+	}
+	let l = (e) => {
+		let t = z(e.source), n = t.match(/\buseCases(?:<[^>]*>)?\s*\(\s*['"`](case_[A-Za-z0-9_]+)['"`]/)?.[1] ?? `case_${I(e.file).replace(/Content\.tsx$/, "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase()}_entries`;
+		return {
+			theirs: t,
+			gap: {
+				target: e.file,
+				formId: a,
+				paid: !!i,
+				reads: n
+			}
 		};
-		!l && /\buseCases\s*\(/.test(c) && qa.test(c) && a.push({
-			...d,
+	}, u = (e) => {
+		let t = e.match(da)?.[1], n = RegExp(`['"\`]${a.replace(/[^A-Za-z0-9_-]/g, "")}['"\`]`).test(e);
+		return t && n && !/\bappliedEntries\b/.test(e) ? t : void 0;
+	};
+	for (let e of c) {
+		let { theirs: t, gap: n } = l(e);
+		!/\b(?:usePublished|publish)\s*\(/.test(t) && /\buseCases\s*\(/.test(t) && qa.test(t) && o.push({
+			...n,
 			why: "typed",
 			inbox: ""
 		});
-		let f = c.match(da)?.[1], p = RegExp(`['"\`]${i.replace(/[^A-Za-z0-9_-]/g, "")}['"\`]`).test(c);
-		f && p && !/\bappliedEntries\b/.test(c) && a.push({
-			...d,
+		let r = u(t);
+		r && o.push({
+			...n,
+			why: "fetched",
+			inbox: r
+		});
+	}
+	for (let t of n) {
+		if (t.file === e || !R(t.file) || c.includes(t)) continue;
+		let { theirs: n, gap: r } = l(t), i = u(n);
+		i && o.push({
+			...r,
 			why: "fetched",
-			inbox: f
+			inbox: i
 		});
 	}
-	return a;
+	return o;
 }, Ya = (e) => {
 	let t = [], n = /* @__PURE__ */ new Set(), r = (e, r, i) => {
 		let a = `${$(e)}|${r}`;