your-ai-workflow-firebase-os 2.0.6 → 2.0.9

package/dist/Setup-BI-XvYAT.cjs

@@ -1,1524 +0,0 @@
-const e=require(`./chunk-CiTBaPhY.cjs`),t=require(`./PageTitle-BZdZKsWY.cjs`),n=require(`./TimeZoneField-CTOzXNgo.cjs`),r=require(`./arrow-right-CGvbxks5.cjs`),i=require(`./SupportBar-oTRCzEzy.cjs`),a=require(`./eye-off-zYG7T389.cjs`),o=require(`./x-Ci8c5p6T.cjs`),s=require(`./shield-check-Bsd5oaif.cjs`);let c=require(`react`);c=e.a(c,1);let l=require(`react/jsx-runtime`);require(`firebase/firestore`);var u=`aistudio`;function d(){return u}function f(){let[e,t]=(0,c.useState)(d);return[e,(0,c.useCallback)(e=>{t(e)},[])]}var p=`Set this project up for Your AI Firebase, and do only what is listed here.
-
-1. If there is no app in this folder yet, create a Vite + React + TypeScript app in it.
-2. Delete the starter demo — the counter, the logos, App.css, the sample markup. None of the template's own content stays.
-3. Run: npm install your-ai-workflow-firebase-os
-   Its install step writes src/App.tsx and src/main.tsx, patches vite.config.ts, and creates src/your-ai-workflow-firebase-os/ with the theme and configs. Never edit App.tsx or main.tsx afterwards — the build rewrites them from the package.
-4. Run npm install once more: the step above adds Tailwind to package.json.
-5. Create .env in the project root — replace it if the install already made one — with exactly these lines and nothing else, every value left empty:
-
-# Firebase Configuration
-VITE_FIREBASE_API_KEY=""
-VITE_FIREBASE_AUTH_DOMAIN=""
-VITE_FIREBASE_PROJECT_ID=""
-VITE_FIREBASE_STORAGE_BUCKET=""
-VITE_FIREBASE_MESSAGING_SENDER_ID=""
-VITE_FIREBASE_APP_ID=""
-STRIPE_SECRET_KEY=""
-STRIPE_WEBHOOK_SECRET=""
-RESEND_API_KEY=""
-APP_NAME=""
-VITE_ADMIN_EMAILS=""
-EMAIL_FROM=""
-
-   Make sure .gitignore lists .env.
-6. Give it the backend the package expects:
-   - npm install express dotenv stripe
-   - npm install -D tsx @types/express
-   - Copy node_modules/your-ai-workflow-firebase-os/server.template.ts to server.ts in the project root, unchanged.
-   - Set the dev script in package.json to: tsx server.ts
-   Do not add routes to server.ts. Every route lives inside the package, so new features arrive with a version bump and this file never changes again.
-7. Start it with npm run dev and tell me the address it prints.
-
-Then stop. Do not build pages, write content files or change the theme — the app opens on its own Setup screen and carries on from there.`,m=`fbos-setup-done`;function h(){try{localStorage.setItem(m,`yes`)}catch{}}var g=`rules_version = '2';
-service cloud.firestore {
-  match /databases/{database}/documents {
-
-    // ── Who is asking ─────────────────────────────────────────────────────
-    function isAuth() { return request.auth != null; }
-
-    // The profile document is the whole access model: it carries \`role\` and
-    // \`inactive\`. Everything below reads it through these two helpers, so the
-    // rules engine fetches it once per request no matter how many checks run.
-    function profileExists() {
-      return exists(/databases/$(database)/documents/user_profiles/$(request.auth.uid));
-    }
-
-    function profile() {
-      return get(/databases/$(database)/documents/user_profiles/$(request.auth.uid)).data;
-    }
-
-    // Turning someone off under /users used to be decoration: \`inactive\` was
-    // protected from being written (see grantsUntouched) but never read, so the
-    // only thing stopping a deactivated person was the Access Denied screen in
-    // the app. Anyone who opened devtools and drove the Firebase SDK straight
-    // kept every read and write they had before. Now the flag is checked here,
-    // where it cannot be walked around.
-    // An account with no profile document yet is NOT deactivated — registration
-    // seeds the profile a moment after the account exists, and that gap must
-    // not lock a brand new person out of their own sign-up.
-    function notDeactivated() {
-      return isAuth() &&
-             (!profileExists() || profile().get('inactive', false) != true);
-    }
-
-    // Firebase flips email_verified once the link in the verification mail is
-    // clicked; Google sign-ins arrive already verified. Every rule below
-    // spends this rather than isAuth(), so a half-registered account cannot
-    // walk past the /verify screen by driving the SDK from a browser console —
-    // and, since the deactivation check lives here too, neither can a
-    // deactivated one.
-    //
-    // Somebody who signed in with a PHONE NUMBER has no address to verify, so
-    // there is nothing here for them to fail and nothing for them to skip:
-    // the code texted to their phone is the check, and Firebase has already
-    // made it before the token exists. Without this line such a person is
-    // refused every read and write in the app — see hasNoEmailToVerify.
-    function isVerified() {
-      return isAuth() &&
-             (request.auth.token.email_verified == true || hasNoEmailToVerify()) &&
-             notDeactivated();
-    }
-
-    // A sign-in that carries no email address at all. Phone sign-in is the one
-    // Firebase offers; the check is on the PROVIDER, never on the address
-    // being blank, so an email account cannot reach this by clearing its own
-    // address.
-    function hasNoEmailToVerify() {
-      return request.auth.token.firebase.sign_in_provider == 'phone';
-    }
-
-    function role() {
-      return profile().role;
-    }
-
-    function hasProfile() {
-      return isVerified() && profileExists();
-    }
-
-    function isAdmin() { 
-      return hasProfile() && role() == 'admin';
-    }
-
-    // Internal members and admins. Registering is NOT enough: an admin has to
-    // set the level under /users. Everything a free user must never see —
-    // every mem_ collection, which is what internal pages read and write, and
-    // the list of people under user_profiles — hangs off this one function.
-    function isInternal() {
-      return hasProfile() && role() in ['internal', 'admin'];
-    }
-
-    // ── Who may delete ────────────────────────────────────────────────────
-    // "My team can move a job along but never delete one." Until 1.14.66 that
-    // was a button the page did not draw, and these rules let every internal
-    // member delete every mem_ record all the same. Now a page row has a
-    // switch — WHO MAY DELETE — and the app stamps every record saved through
-    // such a page with \`lock: { delete: ['admin'] }\`: a list of the roles that
-    // may delete it. These two read it. A record with no lock is deleted by
-    // whoever may change it, as before; a locked one only by a role on the
-    // list — and admins, who pass everything through the wildcard above.
-    //
-    // The lock has to ride on the record: a page's records live under a name
-    // the assistant chose, which no rule here could look up a switch for.
-    function deleteLocked() {
-      return 'lock' in resource.data
-             && resource.data.lock is map
-             && 'delete' in resource.data.lock
-             && resource.data.lock.delete is list;
-    }
-
-    function mayDelete() {
-      return !deleteLocked() || role() in resource.data.lock.delete;
-    }
-
-    // And nobody but an admin may TOUCH the lock on an update — or a team
-    // member would unlock a record in order to delete it. Rewriting the same
-    // lock back is not a change, so a page that saves a whole record is fine.
-    function keepsLock() {
-      return !request.resource.data.diff(resource.data).affectedKeys().hasAny(['lock']);
-    }
-
-    // ── Roles you invented ────────────────────────────────────────────────
-    // A role you make on the Pages screen — Client, Supplier — is stored in
-    // the same \`role\` field these three words live in, and it grants nothing
-    // by itself: to every rule above it, somebody marked Client is a free
-    // user. What it opens is the collections of the pages you kept for it,
-    // which are named after the role: role_client_projects, role_client_notes.
-    //
-    // The role is read straight out of the collection name — everything
-    // between the first underscore and the second — so a role you invent
-    // tomorrow works without these rules ever being pasted again. That is only
-    // safe because a role's id is squeezed to lowercase letters and digits
-    // before it is ever stored (roleIdFrom, in src/lib/access.ts): it can
-    // never contain the underscore this splits on, and never be one of the
-    // words listed below, which the app already means something by. A
-    // collection whose name does not pass both tests matches no rule here at
-    // all, so it is the admins' alone, through the wildcard above.
-    function collectionRole(name) {
-      return name.split('_')[1];
-    }
-
-    // A word the owner made up, rather than one this app already means
-    // something by. The list is the same one src/lib/access.ts refuses when
-    // the role is first named, and it is what makes reading a role straight
-    // out of a name safe.
-    function isInventedRole(id) {
-      return id.matches('^[a-z][a-z0-9]*$') &&
-             !(id in
-               ['user', 'users', 'free', 'guest', 'guests', 'internal', 'admin',
-                'admins', 'public', 'owner', 'team', 'member', 'members', 'none',
-                'role', 'roles']);
-    }
-
-    function isRoleData(name) {
-      return name.matches('^role_[a-z][a-z0-9]*_.*') &&
-             isInventedRole(collectionRole(name));
-    }
-
-    // Everybody marked with the role reads and writes the SAME records. That
-    // is the whole difference between this space and user_, where each person
-    // sees only their own: a client portal can hold one shared price list
-    // without it being public and without every client getting a copy.
-    function hasRoleFor(name) {
-      return hasProfile() && role() == collectionRole(name) && planStillPaid();
-    }
-
-    // ── Entries that are sent to people ───────────────────────────────────
-    // A collection whose name begins case_ holds records that each say for
-    // themselves who they are for. Two lists on the record do it:
-    //
-    //   access   who may SEE it
-    //   editors  who may CHANGE it, delete it, or send it on
-    //
-    // A key on either list is one person — 'uid:abc123' — or everybody marked
-    // with one role — 'role:manager'. Every request below is answered by
-    // reading the caller's own two keys and looking for them on the list, so
-    // an entry is invisible to anyone it was not sent to. That is what makes a
-    // client portal possible: a manager hands a client's card to somebody in
-    // customer satisfaction, that member fills it in, the client reads their
-    // own card and nothing else, and none of them can reach a card that was
-    // never sent to them — not from the page, and not from a browser console.
-    //
-    // The names are read out of the collection exactly as role_ names are, so
-    // a collection invented tomorrow is guarded without this file being pasted
-    // again.
-    function caseKey() { return 'uid:' + request.auth.uid; }
-
-    // A member who registered has no role WRITTEN on their profile until the
-    // app marks them 'user' at a sign-in (isMarkingSelfMember, below) — and
-    // the app calls them 'user' either way. Read bare, role() is an error for
-    // them, so an entry sent to Members never reached them and their own
-    // list by role was refused: every buyer on an Orders page saw "could not
-    // be read" (2026-09-22).
-    function roleKey() { return 'role:' + profile().get('role', 'user'); }
-
-    function isCaseData(name) { return name.matches('^case_.*'); }
-
-    // On one of these lists, by name or by role. A role a plan sold lasts
-    // only as long as the plan does, the same way it does everywhere else.
-    // The third key: whoever PROVES an address is theirs. An order made on a
-    // page anybody can open is very often made signed out — the buyer typed
-    // their email, paid, and registered a day later, or never opened the
-    // account the checkout made for them and started another. A 'uid:' key
-    // names an account, so that order could never reach them; this names the
-    // person, the way a guest's booking already does (mem_bookings below).
-    //
-    // email_verified is asked for HERE, by name, and not left to isVerified():
-    // a phone sign-in passes that with no verified address at all, and an
-    // address nobody proved is anybody's to type. Folded to lower case because
-    // the app folds the one it writes (forAddress, src/lib/cases.ts).
-    function holdsAddress(keys) {
-      return request.auth.token.email != null &&
-             request.auth.token.email_verified == true &&
-             ('email:' + request.auth.token.email.lower()) in keys;
-    }
-
-    // The fourth key, and the only one that names nobody: 'everyone' means
-    // everybody signed in. It is how a person PUBLISHES something they made —
-    // a property listing, a piece of work, a page they want found — and it is
-    // the one thing the three keys above could never say. uid: names an
-    // account, role: names a group the owner marks people into, email: names
-    // an address; all three are lists somebody else keeps. A listing is seen
-    // by people nobody listed.
-    //
-    // Signed in, not the open internet: pub_ is that, and this is deliberately
-    // not it. Somebody with no account sees nothing of this, which is what
-    // separates "share it inside the app" from "put it on the website".
-    //
-    // No profile is asked for and no plan: a person who registered a minute
-    // ago browses what other people published, the way they browse a public
-    // page. The wall is on the other side — 'everyone' is refused on \`editors\`
-    // below, so a published record is still only its author's to change.
-    function published(keys) { return 'everyone' in keys; }
-
-    // Somebody NAMED on one of the lists. This is what changing an entry is
-    // proved against, and 'everyone' is deliberately not in it: publishing is
-    // a key for READING, and a record whose \`editors\` somehow held that word
-    // — an admin writing through the wildcard above, an install older than
-    // the rule that refuses it — must still not be everybody's to delete.
-    function named(keys) {
-      return isVerified() &&
-             (caseKey() in keys ||
-              holdsAddress(keys) ||
-              (hasProfile() && roleKey() in keys && planStillPaid()));
-    }
-
-    // Somebody who may SEE it: named on the list, or the thing was published.
-    function listed(keys) { return named(keys) || (isVerified() && published(keys)); }
-
-    // The lists are what every read of this collection is proved against, so
-    // they are the one thing worth a size cap: fifty is far past a card handed
-    // round a company and cheap to check. Nothing else about the record is
-    // capped — an admin writing through the wildcard above never reaches here.
-    //
-    // And 'everyone' is an \`access\` key and never an \`editors\` one. On editors
-    // it would mean anybody signed in may rewrite or delete anybody's listing
-    // — the whole shape undone by one word in one array, written by an
-    // assistant that read the other list and matched it. It is refused here,
-    // where no page can talk its way past it.
-    function caseListsSane(data) {
-      return data.access.size() <= 50 && data.editors.size() <= 50 &&
-             !('everyone' in data.editors);
-    }
-
-    // ── The people one of your roles may pick from ────────────────────────
-    // An entry that is sent has to be sent TO somebody, and picking them
-    // means reading names. Only your team reads user_profiles, so a manager —
-    // a role you invented, a free user to every rule above — opened an empty
-    // picker and could hand nothing to anybody.
-    //
-    // Being on the same sent-entries page is what opens it. The Pages screen
-    // works out, from your own pages, which roles need to see which others and
-    // writes the answer on the role itself (sys_roles/<id>.sees); this reads
-    // it. A role never sees its OWN people, so two clients on one portal can
-    // never list each other, and it is pinned by the query — a list has to ask
-    // for one role at a time (where('role', '==', 'customersatisfaction')).
-    //
-    // Worth saying plainly: a profile is one document, so whoever may read it
-    // reads every field on it, including whatever people answered when they
-    // registered.
-    function seesRole(target) {
-      return isInventedRole(role()) && planStillPaid() && target != role() &&
-             target in get(/databases/$(database)/documents/sys_roles/$(role())).data.get('sees', []);
-    }
-
-    // ── The Inbox, Users and Transactions tabs ────────────────────────────
-    // These three used to be the admins' alone. On the Pages screen an admin
-    // can now tick who else opens each one — your team, or a role you
-    // invented — and the ticks are kept in sys_configs/tab_access, which only
-    // an admin can write.
-    //
-    // Never everybody signed in. These are every message anybody sent you,
-    // everybody who signed up, and every payment with the buyer's details on
-    // it, and "everybody signed in" is whoever registers. A list that still
-    // says 'user' from when that was on offer opens nothing here: a plain
-    // member is refused whatever the list holds.
-    //
-    // Opening one of these tabs is READING what it shows: the messages people
-    // sent, the people who signed up, the payments' orders. Nothing here lets
-    // anybody but an admin archive, delete or change any of it — those stay
-    // with the wildcard below. Admins are not named here either: they read
-    // everything through that same wildcard.
-    //
-    // An app where nothing was ever ticked has no such document, and a get()
-    // of a document that is not there is a refusal, so the tabs stay the
-    // admins'. A role a plan gave counts only while the plan is paid, the
-    // same as everywhere else.
-    function tabAudience(tab) {
-      return get(/databases/$(database)/documents/sys_configs/tab_access).data.get(tab, []);
-    }
-
-    function opensTab(tab) {
-      return hasProfile() &&
-             profile().get('role', '') != 'user' &&
-             profile().get('role', '') in tabAudience(tab) &&
-             planStillPaid();
-    }
-    
-    function isDocOwner() {
-      return isVerified() && 
-             (resource == null || resource.data.uid == request.auth.uid) && 
-             (request.resource == null || request.resource.data.uid == request.auth.uid);
-    }
-
-    // ── Chat ──────────────────────────────────────────────────────────────
-    // One collection holds every conversation in the app, and \`kind\` says
-    // which of three it is:
-    //
-    //   support  the conversation between ONE member and your whole team.
-    //            Its id is that member's own uid, which is what makes it
-    //            *the* conversation with them: the side panel, a card on a
-    //            team page and the box on the member's own page all open the
-    //            same address and see the same messages, and nobody can make
-    //            a second one — the create rule below insists the id and the
-    //            single participant are the same person.
-    //   direct   two people, id \`d_<uid>_<uid>\` with the pair sorted. The id
-    //            is worked out from the two names rather than invented, so
-    //            two "New chat" clicks racing each other cannot leave two
-    //            conversations behind where the browser meant one.
-    //   group    2 to 50 people, a random id, opened by your team.
-    //
-    // Notes your team writes to each other about a member are NOT here. In
-    // the app this was taken from they were messages in the very list the
-    // member reads, hidden on screen and readable from a browser console.
-    // Here they live in mem_chat_notes and mem_chat_state, which the mem_
-    // lines below already give the team and give a member nothing — so a
-    // member's attempt to list the notes on their own conversation is
-    // refused by the database rather than filtered by a screen.
-    function chatThread(id) {
-      return get(/databases/$(database)/documents/chat_threads/$(id)).data;
-    }
-
-    // In this conversation, by name.
-    function inThread(data) {
-      return isVerified() && request.auth.uid in data.participants;
-    }
-
-    // Every support thread is your whole team's: a member writes to "the
-    // team", and whoever is free answers. Which of them it is MEANT for is
-    // \`handlerUid\` on the thread, and that changes who is told first and how
-    // the list is sorted — never who may read it.
-    function teamOnSupport(data) {
-      return data.kind == 'support' && isInternal();
-    }
-
-    function mayReadThread(data) {
-      return inThread(data) || teamOnSupport(data);
-    }
-
-    // A conversation nobody has written in yet has no document, and the panel
-    // still has to be able to listen to it — a member opening a brand new
-    // chat, or a colleague opening a member's card before either has said
-    // anything. Without this the very first thing a member sees is a refusal.
-    // It opens nothing: there is no document to read.
-    function mayOpenMissingThread(id) {
-      return isInternal() || (isVerified() && request.auth.uid == id);
-    }
-
-    // What a thread document may hold, whoever writes it. The participant cap
-    // is the one number worth holding: every message rule reads this list.
-    function threadShape(data) {
-      return data.kind in ['support', 'direct', 'group']
-             && data.participants is list
-             && data.participants.size() >= 1 && data.participants.size() <= 50
-             && data.keys().hasOnly(['kind', 'participants', 'participantNames',
-                                     'createdBy', 'createdAt', 'updatedAt',
-                                     'lastMessage', 'lastMessageSender', 'lastMessageAt',
-                                     'lastReadAt', 'lastReadBy', 'reads',
-                                     'groupName', 'groupIconUrl',
-                                     'handlerUid', 'handlerName']);
-    }
-
-    // A member moves the conversation on and marks it read — and touches
-    // nothing else about it. Without this fence somebody outside your team
-    // could add themselves to a group, rename it, or hand their own support
-    // thread to a colleague who never took it.
-    function memberThreadKeys() {
-      return request.resource.data.diff(resource.data).affectedKeys()
-               .hasOnly(['lastMessage', 'lastMessageSender', 'lastMessageAt',
-                         'updatedAt', 'lastReadAt', 'lastReadBy', 'reads']);
-    }
-
-    // ── The first admin ───────────────────────────────────────────────────
-    // The Setup page writes your own address in here before you copy the rules,
-    // so this list already names you by the time you paste it into Firebase.
-    // It is the one and only way a person can hand themselves a role, it can
-    // only ever grant 'admin', and it only works from a verified address —
-    // otherwise anyone could register under your email and claim the app
-    // without ever opening your inbox.
-    function adminEmails() {
-      return ['your@email.com'];
-    }
-
-    function isSeedingOwnAdmin() {
-      return isVerified() &&
-             request.auth.token.email_verified == true &&
-             request.auth.token.email.lower() in adminEmails() &&
-             request.resource.data.role == 'admin' &&
-             request.resource.data.diff(resource.data).affectedKeys().hasOnly(['role']);
-    }
-
-    // \`role\` and \`inactive\` are the entire access model, so they are read-only
-    // to the person they describe: admins set them from /users, and the seed
-    // above and a paid plan below are the only exceptions. \`planUntil\` and
-    // \`planPass\` say how long a plan's role lasts, so they are guarded the
-    // same way. So are the tombstone's marks: a person who could write
-    // \`removed\` onto themselves vanished from the Users screen — where the
-    // admin would have switched them off — with their role still working.
-    // Name, avatar and the rest stay the owner's to write.
-    function grantsUntouched() {
-      return resource == null
-             ? !request.resource.data.keys().hasAny(['role', 'inactive', 'planUntil', 'planPass', 'removed', 'removedAt', 'removedMs'])
-             : !request.resource.data.diff(resource.data).affectedKeys().hasAny(['role', 'inactive', 'planUntil', 'planPass', 'removed', 'removedAt', 'removedMs']);
-    }
-
-    // ── Marking yourself a member ─────────────────────────────────────────
-    // A person who registered has no word on their profile at all, and a
-    // role the owner invented lists people BY a word (seesRole above): a
-    // Teacher whose page was ticked for Members asks for the profiles
-    // marked 'user', and found only the few an admin had set to Member by
-    // hand — never the students who signed themselves up. So the app writes
-    // the word itself, at sign-in, onto the person's own profile. 'user' is
-    // the word the Users screen writes for Member, and it grants nothing:
-    // to every rule here somebody marked 'user' is exactly who they were.
-    //
-    // Only that word, only on its own, and only where there was none — a
-    // client cannot hand their role back this way, nobody writes any other
-    // word onto themselves, and a tombstone stays as the deletion left it.
-    function isMarkingSelfMember() {
-      return resource.data.get('role', null) == null &&
-             resource.data.get('removed', false) != true &&
-             request.resource.data.role == 'user' &&
-             request.resource.data.diff(resource.data).affectedKeys().hasOnly(['role']);
-    }
-
-    // ── Starting afresh after being deleted ──────────────────────────────
-    // Deleting somebody on /users leaves a tombstone on their profile —
-    // { removed, inactive, removedAt, removedMs } — which shuts them out at
-    // once. Their SIGN-IN cannot be deleted from a browser (that takes a
-    // server key), so it is still there, and the next time it is used it is
-    // somebody starting afresh, who must work like anybody else. So the
-    // tombstone may be REPLACED with a new profile, the way a first one is
-    // made: only by a sign-in made AFTER the deletion (a session already open
-    // when they were deleted stays shut out until they sign in again), and
-    // never with a role, a lock, a plan or the tombstone's own marks in it.
-    // A tombstone written before removedMs existed counts as the oldest.
-    function isStartingAfresh() {
-      return resource.data.get('removed', false) == true &&
-             request.auth.token.auth_time * 1000 > resource.data.get('removedMs', 0) &&
-             !request.resource.data.keys().hasAny(['role', 'inactive', 'planUntil', 'planPass', 'removed', 'removedAt', 'removedMs']);
-    }
-
-    // ── A role bought with a plan ─────────────────────────────────────────
-    // A subscription plan on the Payments screen can make its buyer one of
-    // your own roles — Premium, Gold. The server has no key to this database,
-    // so it never writes the role: it hands the buyer's own browser a PASS
-    // for exactly that role, that person and that date, and this checks it.
-    // The pass is a hash of the three with the plan key only your admins can
-    // read (admin_keys/plans — the Payments screen keeps it in step with
-    // Stripe), so a pass can never be made up, handed to somebody else,
-    // turned into another role or stretched past the date it names.
-    function planKey() {
-      return get(/databases/$(database)/documents/admin_keys/plans).data.key;
-    }
-
-    function planPassFor(data) {
-      return hashing.sha256(planKey() + ':' + request.auth.uid + ':' + data.role + ':' +
-                            string(data.planUntil)).toHexString().lower();
-    }
-
-    // A PAID booking's hold on a time is kept, let go or taken over only on
-    // the server's word: a pass made with the same key, naming this one hold,
-    // the deadline it was held until, and what became of it — 'paid' or
-    // 'free'. The server signs 'free' only once every checkout for that hold
-    // has expired unpaid, so no browser can talk its way into a paid time.
-    function bookingPass(docId, until, what) {
-      return hashing.sha256(planKey() + ':' + docId + ':' + string(until) + ':' + what).toHexString().lower();
-    }
-
-    // A plan only ever changes a member, or a role an earlier plan gave. It
-    // never touches your team, your admins or a role you gave by hand.
-    function planMayReplace() {
-      return resource.data.get('role', 'user') in ['user', 'free', null] ||
-             resource.data.get('planUntil', 0) != 0;
-    }
-
-    function isTakingPlanRole() {
-      return isVerified() && planMayReplace() &&
-             request.resource.data.diff(resource.data).affectedKeys().hasOnly(['role', 'planUntil', 'planPass']) &&
-             request.resource.data.role.matches('^[a-z][a-z0-9]*$') &&
-             !(request.resource.data.role in ['user', 'free', 'internal', 'admin']) &&
-             request.time.toMillis() < request.resource.data.planUntil &&
-             request.resource.data.planPass == planPassFor(request.resource.data);
-    }
-
-    // When the plan ends, the same browser hands the role back — and only a
-    // role a plan gave can be handed back this way.
-    function isLeavingPlanRole() {
-      return resource.data.get('planUntil', 0) != 0 &&
-             request.resource.data.role == 'user' &&
-             request.resource.data.get('planUntil', 0) == 0 &&
-             request.resource.data.diff(resource.data).affectedKeys().hasOnly(['role', 'planUntil', 'planPass']);
-    }
-
-    // A plan's role lasts until the date on its pass, whether or not the
-    // browser ever hands it back. A role you gave by hand has no date.
-    function planStillPaid() {
-      return profile().get('planUntil', 0) == 0 ||
-             request.time.toMillis() < profile().planUntil;
-    }
-
-    // user_ collections an ordinary page reads and writes. Profiles and
-    // submissions are carved out below — they each have their own rules.
-    function isUserData(collectionName) {
-      return collectionName.matches('^user_.*') &&
-             collectionName != 'user_profiles' &&
-             collectionName != 'user_submissions';
-    }
-
-    // Named for the person, or carrying their uid. A document named for
-    // SOMEBODY ELSE's uid is theirs, whatever uid is written inside it: taken
-    // first by a stranger (their basket, their phone claim) it stayed the
-    // stranger's to read and write beside them.
-    // The uid a new booking may carry: the guest mark, or the writer's own.
-    function isBookersOwnUid() {
-      return request.resource.data.get('uid', 'guest') == 'guest'
-             || (request.auth != null && request.resource.data.uid == request.auth.uid);
-    }
-
-    // ── A public COPY of private data ─────────────────────────────────────
-    // Every pub_ document is writable by anybody signed in: that is what lets
-    // members post on a public board. But pub_products is a COPY of the
-    // team's mem_products, kept by the page that owns it (lib/publicCopy.ts),
-    // and for a while it was writable by anybody too — any registered account
-    // could rewrite a price or delete the whole shop. A copy carries \`copyOf\`,
-    // the private collection it copies, and may be written only by whoever
-    // may write THAT: the team for mem_, admins for admin_, the role for
-    // role_<id>_. Both sides are read — the document as it is and as it would
-    // be — so a copy cannot be unmarked, and a member's post cannot be turned
-    // into a copy by anybody but the team.
-    function mayWriteSource(name) {
-      return (name.matches('^mem_.*') && isInternal())
-             || (name.matches('^admin_.*') && isAdmin())
-             || (isRoleData(name) && hasRoleFor(name));
-    }
-
-    function copyStaysTheOwners(data) {
-      return data.get('copyOf', '') == '' || mayWriteSource(data.copyOf);
-    }
-
-    function publicWriteAllowed() {
-      return (resource == null || copyStaysTheOwners(resource.data))
-             && (request.resource == null || copyStaysTheOwners(request.resource.data));
-    }
-
-    function ownsUserDoc(docId) {
-      return isVerified() &&
-             (request.auth.uid == docId ||
-              (isDocOwner() && !exists(/databases/$(database)/documents/user_profiles/$(docId))));
-    }
-
-    // A form entry sent by somebody signed out is the one document the whole
-    // internet may write, which makes it the one thing a script can aim at.
-    // The rules cannot count how OFTEN somebody writes — that is App Check, a
-    // setting in the Firebase console, and setup never opens the console — but
-    // they can say how BIG one entry may be, and a document of thousands of
-    // invented fields is the cheapest way to run up somebody else's bill.
-    // Sixty is far past any form an owner builds: an entry carries one key per
-    // question plus a handful about the sender, and a long intake form is
-    // twenty questions. An admin writes through the wildcard above and is
-    // never held to this.
-    function isFormSized() {
-      return request.resource.data.keys().size() < 60;
-    }
-
-    // ── Counting what visitors do ─────────────────────────────────────────
-    // How many people opened a product, how many put it in their basket: a
-    // count of presses made by people who are mostly signed OUT, which the
-    // team reads beside the thing itself. It is the second thing the whole
-    // internet may write, so it is held tighter than a form entry: a tally is
-    // a handful of named counters and nothing else, a new one starts every
-    // counter it carries at exactly 1, and a change moves each counter it
-    // touches up by exactly 1 — so nobody can write a word into one, set a
-    // number, take one back down or jump it by a thousand. As with a form
-    // entry, the rules cannot say how OFTEN (that is App Check), so a count is
-    // something to steer by and never something to bill by.
-    function tallyStartsAtOne(k) {
-      return request.resource.data.get(k, 1) == 1;
-    }
-    function tallyUpByOne(k) {
-      return request.resource.data.get(k, 0) == resource.data.get(k, 0)
-          || request.resource.data.get(k, 0) == resource.data.get(k, 0) + 1;
-    }
-
-    // Admins are trusted with everything in this database — that is what the
-    // role is. There used to be a per-document owner test bolted onto update
-    // and delete for admin_ collections, but the collection rule below grants
-    // admins read+write on admin_ outright and rules OR together, so it never
-    // denied anything. It has been removed rather than left to read as a
-    // protection that is not there. If you ever want one admin's records to be
-    // off limits to another, it has to be built in both places at once: here
-    // AND in the admin_ collection rule below.
-    match /{document=**} {
-      allow read, write: if isAdmin();
-    }
-
-    // ── Profiles ──────────────────────────────────────────────────────────
-    // Unverified people reach this one document on purpose: registration seeds
-    // it before the email goes out, and /verify needs to read it back. What
-    // they cannot do is touch role or inactive.
-    // Reading stays open to the owner even when deactivated — the app has to
-    // be able to see the flag to show the Access Denied screen — but writing
-    // does not: a deactivated account changes nothing about itself.
-    // The team reads every profile: a page for the team offers a person to
-    // assign a card to, to book, to hand a lead to, and the people it offers
-    // are this collection. Free users and guests never see it — a page for
-    // signed-in users renders the name saved on the record instead. Writing
-    // somebody else's profile stays the admin's, through the wildcard above.
-    match /user_profiles/{uid} {
-      allow get: if isAuth() && request.auth.uid == uid;
-      allow read: if isInternal();
-      allow read: if hasProfile() && seesRole(resource.data.role);
-      // Whoever an admin let open the Users tab reads the people on it.
-      allow read: if opensTab('users');
-      allow create: if isAuth() && request.auth.uid == uid && grantsUntouched();
-      allow update: if isAuth() && request.auth.uid == uid && notDeactivated() &&
-                       (grantsUntouched() || isSeedingOwnAdmin() || isMarkingSelfMember() ||
-                        isTakingPlanRole() || isLeavingPlanRole());
-      // Somebody an admin deleted, signed in again since: a new profile over
-      // the tombstone (isStartingAfresh).
-      allow update: if isAuth() && request.auth.uid == uid && isStartingAfresh();
-    }
-
-    // ── Chat ──────────────────────────────────────────────────────────────
-    // See the functions above for what the three kinds are and why notes are
-    // not in here. Three things about this block are worth saying plainly,
-    // because the app is built on them:
-    //
-    // A LIST HAS TO BE PINNED. Firestore proves a query against its own
-    // filters, never against the documents it would return, so
-    // where('participants', 'array-contains', me) is what proves \`inThread\`
-    // and where('kind', '==', 'support') is what proves \`teamOnSupport\`. A
-    // plain read of the whole collection is refused for everybody but an
-    // admin. Every query the app makes lives in src/lib/chat.ts.
-    //
-    // THE THREAD EXISTS BEFORE ITS FIRST MESSAGE. The message rule reads the
-    // thread with get(), which sees the database as it stood BEFORE the
-    // write — so a batch that makes the thread and its first message together
-    // is refused. sendMessage() makes the thread first and batches the
-    // message with the thread's preview after it: two round trips on the very
-    // first message of a conversation, one on every message after.
-    //
-    // A MEMBER CANNOT FORGE, WIDEN OR MOVE A CONVERSATION. Their support
-    // thread has to be at their own uid with themselves as the only
-    // participant; opening a direct or a group conversation is your team's;
-    // every message has to name its sender; and an update from outside the
-    // team may touch the preview and the read marks and nothing else.
-    match /chat_threads/{threadId} {
-      allow get: if resource == null ? mayOpenMissingThread(threadId)
-                                     : mayReadThread(resource.data);
-      allow list: if mayReadThread(resource.data);
-
-      allow create: if threadShape(request.resource.data) && (
-             // One support thread per member, at the member's own uid —
-             // started by them, or by whoever on your team writes first.
-             (request.resource.data.kind == 'support'
-                && request.resource.data.participants == [threadId]
-                && ((isVerified() && request.auth.uid == threadId) || isInternal()))
-             // A direct or a group conversation is your team's to open, and
-             // they are in it. Two members never talk to each other here:
-             // they cannot see each other anywhere else in the app, and chat
-             // does not change that.
-          || (request.resource.data.kind != 'support' && isInternal()
-                && request.auth.uid in request.resource.data.participants));
-
-      allow update: if threadShape(request.resource.data) && (
-             (isInternal() && mayReadThread(resource.data))
-          || (inThread(resource.data) && memberThreadKeys()));
-
-      // Only the colleague who made a group can take it away, and only a
-      // group: a support thread is a person's whole history with you, and a
-      // direct conversation is two people's.
-      allow delete: if isInternal() && resource.data.kind == 'group'
-                    && resource.data.createdBy == request.auth.uid;
-
-      match /messages/{messageId} {
-        allow read: if mayReadThread(chatThread(threadId));
-        allow create: if mayReadThread(chatThread(threadId))
-                      && request.resource.data.uid == request.auth.uid
-                      && request.resource.data.keys().hasOnly(['uid', 'senderName', 'senderPhoto',
-                                                               'text', 'file', 'createdAt'])
-                      && request.resource.data.text is string
-                      && request.resource.data.text.size() <= 4000;
-        // Taking back what you said. Editing is not offered at all — a
-        // message somebody has already read should not be able to change
-        // under them.
-        allow delete: if isVerified() && resource.data.uid == request.auth.uid;
-      }
-    }
-
-    match /{collectionName}/{docId} {
-      
-      allow read, write: if collectionName.matches('^admin_.*') && isAdmin();
-
-      // sys_ holds theme, page and form config. It is read openly because the
-      // login screen has to paint itself before anyone has signed in.
-      allow read: if collectionName.matches('^sys_.*');
-      allow write: if collectionName.matches('^sys_.*') && isAdmin();
-
-      // ── A team member's own schedule ──────────────────────────────────────
-      // sys_schedules is the one sys_ collection the whole team writes, and
-      // each of them writes exactly one row of it: their own. \`memberId\` is
-      // whose time the schedule offers, so requiring it to equal the caller's
-      // own uid — on the document as it stands AND on the document as it is
-      // being written — means a team member can set their hours, their length,
-      // their questions and their link without an admin, and cannot touch a
-      // colleague's or hand their schedule to somebody else. Everything else
-      // under sys_ (the theme, the pages, the forms, the payments) stays the
-      // admin's through the line above; that is why this names the collection
-      // rather than matching a prefix.
-      allow create: if collectionName == 'sys_schedules' && isInternal()
-                    && request.resource.data.memberId == request.auth.uid;
-      allow update: if collectionName == 'sys_schedules' && isInternal()
-                    && resource.data.memberId == request.auth.uid
-                    && request.resource.data.memberId == request.auth.uid;
-      allow delete: if collectionName == 'sys_schedules' && isInternal()
-                    && resource.data.memberId == request.auth.uid;
-
-      // ── A team member's own booking page ─────────────────────────────────
-      // A booking page is one address with several of somebody's meetings on
-      // it — the link that goes in a signature. It is made by whoever it is
-      // for, so it is written the same way their schedule is: the document
-      // says whose it is in \`memberId\`, and a team member may write the rows
-      // carrying their own uid and no others. A page made before pages had an
-      // owner carries none, so it stays the admins' through the sys_ line
-      // above, which is where it already was. Renaming a page is a write at
-      // the new address and a delete at the old, so both are needed for the
-      // owner to move their own link.
-      allow create: if collectionName == 'sys_bookingpages' && isInternal()
-                    && request.resource.data.memberId == request.auth.uid;
-      allow update: if collectionName == 'sys_bookingpages' && isInternal()
-                    && resource.data.memberId == request.auth.uid
-                    && request.resource.data.memberId == request.auth.uid;
-      allow delete: if collectionName == 'sys_bookingpages' && isInternal()
-                    && resource.data.memberId == request.auth.uid;
-
-      // A page kept for one of your own roles. Admins reach it through the
-      // wildcard above, the way they reach everything else.
-      // Update and delete are two lines rather than one \`write\`, so the
-      // delete lock (mayDelete, above) can hold on a page kept for a role.
-      allow read, create: if isRoleData(collectionName) && hasRoleFor(collectionName);
-      allow update: if isRoleData(collectionName) && hasRoleFor(collectionName) && keepsLock();
-      allow delete: if isRoleData(collectionName) && hasRoleFor(collectionName) && mayDelete();
-
-      // ── An entry that was sent to you ────────────────────────────────────
-      // Reading is proved against the record's own \`access\` list. A LIST has
-      // to name a key it is looking for — where('access', 'array-contains',
-      // 'uid:me') — because Firestore proves a query against its filters and
-      // not against the documents it would return; a bare read of the whole
-      // collection is refused for everybody but an admin, which is exactly
-      // what stops one client fetching every other client's card.
-      allow get, list: if isCaseData(collectionName) && listed(resource.data.access);
-
-      // Adding one is open to any verified person, as sending a form entry
-      // is — and the two checks are what keep it honest. The record names its
-      // author, so an entry cannot be forged as somebody else's; and the
-      // author's own key is on \`access\`, so nobody writes something they then
-      // cannot read.
-      allow create: if isCaseData(collectionName) && isVerified()
-                    && request.resource.data.uid == request.auth.uid
-                    && caseKey() in request.resource.data.access
-                    && caseListsSane(request.resource.data);
-
-      // Changing one, deleting one and SENDING IT ON are the same permission,
-      // because sending it on is a change to the lists. Being on \`access\`
-      // alone is therefore read-only, enforced here rather than drawn: a
-      // client looking at their own card, a team member seeing a buyer's name.
-      // What this cannot do is tell two editors apart — which of them may add
-      // an invoice is a button, not a wall.
-      // ...and where the row says only admins delete, an editor may not
-      // (mayDelete), nor may they touch the lock that says so.
-      allow update: if isCaseData(collectionName) && named(resource.data.editors)
-                    && caseListsSane(request.resource.data) && keepsLock();
-      allow delete: if isCaseData(collectionName) && named(resource.data.editors) && mayDelete();
-
-      // ── Telling somebody outside the team something ──────────────────────
-      // The bell's own records live in mem_, which only the team reads, so a
-      // notification could only ever be sent TO the team or to the admins.
-      // An entry that travels needs more: the dev lead has to hear that a
-      // ticket reached them, a client that their invoice is up. These are the
-      // same notification with an \`access\` list instead of a \`toRole\`, and
-      // they are read back through the case_ lines above.
-      //
-      // Unlike an ordinary case_ record, the sender is NOT required to be on
-      // the list — the whole point is to tell somebody else — so the list is
-      // held short, and creating is still all this opens: the sender cannot
-      // read, edit or delete a bell they wrote into.
-      // 'everyone' is refused here as well, and for a different reason than on
-      // a listing: a bell sent to everybody signed in is a broadcast, and this
-      // create is open to any verified person. Somebody may publish a listing
-      // for the whole app to find; nobody may ring the whole app's bell.
-      allow create: if collectionName == 'case_notifications' && isVerified()
-                    && request.resource.data.uid == request.auth.uid
-                    && !('everyone' in request.resource.data.access)
-                    && request.resource.data.access.size() <= 5
-                    && request.resource.data.keys().hasOnly(['access', 'editors', 'title', 'body', 'link', 'uid', 'fromName', 'createdAt', 'read']);
-
-      allow get: if isUserData(collectionName) && ownsUserDoc(docId);
-      allow list: if isUserData(collectionName) && isDocOwner();
-      // Somebody's own private records — and on a page whose row says only
-      // admins delete, not even their own (mayDelete).
-      allow create: if isUserData(collectionName) && ownsUserDoc(docId);
-      allow update: if isUserData(collectionName) && ownsUserDoc(docId) && keepsLock();
-      allow delete: if isUserData(collectionName) && ownsUserDoc(docId) && mayDelete();
-      
-      // Public forms post here from pages a guest can open, so creating stays
-      // open to everyone — held to the size of a form, and nothing else is:
-      // editing and deleting are the admin's, via the wildcard above. Without
-      // that split anyone could quietly overwrite or wipe every submission you
-      // have received.
-      allow read: if collectionName == 'user_submissions' && (isDocOwner() || isAdmin());
-      allow create: if collectionName == 'user_submissions' && isFormSized();
-
-      // Whoever an admin let open the Inbox reads what came in — both
-      // collections, because the Inbox is both. Reading only: archiving and
-      // deleting stay the admin's.
-      allow read: if collectionName in ['user_submissions', 'user_requests'] && opensTab('inbox');
-
-      // Whoever an admin let open Transactions reads the entries that are a
-      // payment's and no others. A list has to ask for exactly those —
-      // where('transaction', '==', true) — or it is refused, so the Inbox's
-      // messages never reach somebody who was only given the orders.
-      allow read: if collectionName in ['user_submissions', 'user_requests']
-                  && resource.data.transaction == true
-                  && opensTab('transactions');
-
-      // A team page is the team's. Every internal member reads, adds, edits
-      // and deletes every record on it — moving a card a colleague made, or
-      // one an admin imported from the Inbox, is the ordinary work of a shared
-      // board. Until 1.14.6 update and delete were the author's alone, so a
-      // team member who dragged somebody else's quote to the next stage was
-      // refused with "Missing or insufficient permissions".
-      //
-      // Update and delete are two lines since 1.14.66: rules OR together, so
-      // a delete lock could not be added on top of \`update, delete\` — the old
-      // line would have gone on allowing the delete. The lock is the row's
-      // WHO MAY DELETE switch, stamped on each record (mayDelete, above).
-      allow read, create: if collectionName.matches('^mem_.*') && isInternal();
-      allow update: if collectionName.matches('^mem_.*') && isInternal() && keepsLock();
-      allow delete: if collectionName.matches('^mem_.*') && isInternal() && mayDelete();
-
-      // ── Telling the team something from outside the team ──────────────────
-      // notify() writes the bell's notifications into mem_, so until this line
-      // only the team could send one. On a page kept for a role the owner
-      // invented — a client portal — the client IS the person with something
-      // to say, and their notify() was refused with "Missing or insufficient
-      // permissions" and swallowed into a console warning: the team was never
-      // told, and nothing on screen said why.
-      //
-      // Creating is the whole of what this opens. The key list has no \`toUid\`
-      // in it, so this can only ever address a whole audience and never one
-      // named person; \`uid\` has to be the sender's own, so a notification
-      // cannot be forged as somebody else; and reading, editing and deleting
-      // stay the team's through the two lines above — whoever sends one
-      // cannot read the bell they sent it to.
-      allow create: if collectionName == 'mem_notifications' && isVerified()
-                    && request.resource.data.uid == request.auth.uid
-                    && request.resource.data.toRole in ['admin', 'internal']
-                    && request.resource.data.keys().hasOnly(['toRole', 'title', 'body', 'link', 'uid', 'fromName', 'createdAt']);
-
-      // ── A tally: counting what visitors do ───────────────────────────────
-      // mem_tallies holds one document per counted thing — \`products_<id>\` —
-      // and nothing about who pressed. The team reads, resets and deletes them
-      // through the mem_ lines above; this is what lets everybody else, guests
-      // included, add one to a counter and do nothing more. The id has to be
-      // the thing and what it is a count of, so there is one tally per thing
-      // and nobody can start a second under a name of their own. It is kept in
-      // mem_ rather than pub_ on purpose: a pub_ collection is read by the
-      // whole internet, and how well something sells is the owner's business.
-      allow create: if collectionName == 'mem_tallies'
-                    && request.resource.data.keys().hasOnly(['thing', 'of', 'views', 'added', 'clicks', 'saves', 'shares', 'downloads'])
-                    && request.resource.data.thing is string
-                    && request.resource.data.thing.matches('[a-z0-9_-]{1,40}')
-                    && request.resource.data.of is string
-                    && request.resource.data.of.size() <= 120
-                    && docId == request.resource.data.thing + '_' + request.resource.data.of
-                    && tallyStartsAtOne('views') && tallyStartsAtOne('added')
-                    && tallyStartsAtOne('clicks') && tallyStartsAtOne('saves')
-                    && tallyStartsAtOne('shares') && tallyStartsAtOne('downloads');
-      allow update: if collectionName == 'mem_tallies'
-                    && request.resource.data.diff(resource.data).affectedKeys()
-                         .hasOnly(['views', 'added', 'clicks', 'saves', 'shares', 'downloads'])
-                    && tallyUpByOne('views') && tallyUpByOne('added')
-                    && tallyUpByOne('clicks') && tallyUpByOne('saves')
-                    && tallyUpByOne('shares') && tallyUpByOne('downloads');
-
-      // ── Booked times (the Schedule screen) ────────────────────────────────
-      // pub_bookings holds one document per TAKEN time and nothing about the
-      // person — the team member, the start, the end. Its id is the time
-      // itself, so a second booking of the same slot cannot be created: that
-      // is what stops a double booking. Anyone may take a time, guests
-      // included, exactly as anyone may send a public form — and the key list
-      // keeps a name or an email from ever landing in a public document.
-      // A time held while its booker PAYS also carries \`holdUntil\` — the
-      // moment it is free again if no payment is written on (see "The hold
-      // on a booked time" below).
-      allow create: if collectionName == 'pub_bookings'
-                    && request.resource.data.keys().hasOnly(['memberId', 'start', 'end', 'createdAt', 'holdUntil'])
-                    && request.resource.data.get('holdUntil', 0) is int;
-      // mem_bookings is who booked and what they answered — the team's copy,
-      // written in the same breath as the form entry. Anyone may create one;
-      // the team reads and cancels through the mem_ lines above; the person
-      // who booked, when they were signed in, may read their own.
-      // \`pending\` has to be here AND has to be true: a booking waits for the
-      // person it was booked with to accept it, and a booking that arrived
-      // already accepted would be one nobody agreed to. A document with no
-      // \`pending\` key at all is one written before acceptance existed, and
-      // the app reads those as accepted — which is why a NEW one may not
-      // leave the key out to get the same effect.
-      //
-      // A booking stands on a time that was CLAIMED — the hold under the same
-      // id — and names as its booker only the person writing it (or a guest):
-      // otherwise anybody could drop invented bookings into a member's bell,
-      // or into a stranger's /my-bookings by writing their uid.
-      allow create: if collectionName == 'mem_bookings'
-                    && request.resource.data.get('pending', false) == true
-                    && request.resource.data.keys().hasOnly(['memberId', 'memberName', 'scheduleId', 'scheduleName', 'paymentId', 'paymentSession', 'holdUntil', 'start', 'end', 'timeZone', 'name', 'email', 'answers', 'formId', 'entryId', 'uid', 'createdAt', 'pending'])
-                    && isBookersOwnUid()
-                    && exists(/databases/$(database)/documents/pub_bookings/$(docId));
-      // Read by the person it belongs to, and belonging is decided TWICE. By
-      // uid, for a booking taken while signed in. And by ADDRESS, for one
-      // taken as a guest: the booking carries the email it was made with,
-      // folded to lower case, and a verified account with that same address is
-      // the same person — so somebody who booked before they ever registered
-      // still finds every one of their bookings the day they sign up, free
-      // account and all. The team reads them all through the mem_ lines above.
-      allow read: if collectionName == 'mem_bookings'
-                  && (isDocOwner()
-                      || (isVerified()
-                          && request.auth.token.email_verified == true
-                          && request.auth.token.email != null
-                          && resource.data.email == request.auth.token.email.lower()));
-
-      // ── Calling off your own booking ──────────────────────────────────────
-      // The person who booked may cancel it, from /my-bookings, without being
-      // on the team — that is the whole of what they may write here. Belonging
-      // is decided the same two ways the read above decides it: by uid for a
-      // booking made while signed in, by address for one made as a guest.
-      //
-      // The key list is the fence. Cancelling may set only the five fields
-      // that say a booking was called off, and \`cancelled\` must come out TRUE,
-      // so this can never be used to un-cancel a meeting, move it, rewrite the
-      // answers or change whose diary it is in. Everything else about the
-      // document stays the team's, through the mem_ lines above.
-      allow update: if collectionName == 'mem_bookings'
-                    && (isDocOwner()
-                        || (isVerified()
-                            && request.auth.token.email_verified == true
-                            && request.auth.token.email != null
-                            && resource.data.email == request.auth.token.email.lower()))
-                    && request.resource.data.cancelled == true
-                    && request.resource.data.diff(resource.data).affectedKeys()
-                         .hasOnly(['cancelled', 'cancelledAt', 'cancelReason', 'cancelledBy', 'cancelledSide']);
-
-      // A time somebody called off is free again (cancelling gives its hold
-      // back), and booking it again writes the new booking over the old one
-      // under the same id. That write is an UPDATE of the cancelled document,
-      // which nothing but the team could make — so a cancelled hour stayed
-      // unbookable for every visitor for good. Only a cancelled booking, only
-      // with a fresh claim on the time, only as a whole new booking.
-      allow update: if collectionName == 'mem_bookings'
-                    && resource.data.get('cancelled', false) == true
-                    && request.resource.data.get('pending', false) == true
-                    && request.resource.data.keys().hasOnly(['memberId', 'memberName', 'scheduleId', 'scheduleName', 'paymentId', 'paymentSession', 'holdUntil', 'start', 'end', 'timeZone', 'name', 'email', 'answers', 'formId', 'entryId', 'uid', 'createdAt', 'pending'])
-                    && isBookersOwnUid()
-                    && exists(/databases/$(database)/documents/pub_bookings/$(docId));
-
-      // A PAID booking nobody paid for — its checkout walked away from, its
-      // time let go or run out — is written over the same way, by whoever
-      // books that time next: the hold now standing there carries the
-      // server's pass (\`freed\`) saying the old booking was never paid.
-      allow update: if collectionName == 'mem_bookings'
-                    && resource.data.get('holdUntil', 0) != 0
-                    && request.resource.data.get('pending', false) == true
-                    && request.resource.data.keys().hasOnly(['memberId', 'memberName', 'scheduleId', 'scheduleName', 'paymentId', 'paymentSession', 'holdUntil', 'start', 'end', 'timeZone', 'name', 'email', 'answers', 'formId', 'entryId', 'uid', 'createdAt', 'pending'])
-                    && isBookersOwnUid()
-                    && get(/databases/$(database)/documents/pub_bookings/$(docId)).data.get('freed', '')
-                         == bookingPass(docId, resource.data.holdUntil, 'free');
-
-      // Public pages are readable by guests — that is what makes them public —
-      // but writing is not anonymous. Left open, anyone on the internet could
-      // empty every public collection you have. Guest input goes through
-      // user_submissions instead.
-      allow read: if collectionName.matches('^pub_.*');
-      allow write: if collectionName.matches('^pub_.*') && collectionName != 'pub_bookings' && isVerified() && publicWriteAllowed();
-
-      // ── The hold on a booked time ─────────────────────────────────────────
-      // pub_bookings is the lock against a double booking, so it is NOT open
-      // to every registered account the way other pub_ documents are: anybody
-      // who could delete a hold could book straight over a live meeting. The
-      // team moves and frees times. Anybody else may give a hold back only
-      // when the booking on it was called off (cancelling frees the hour), or
-      // when no booking ever stood on it (a claim whose booking failed).
-      allow update, delete: if collectionName == 'pub_bookings' && isInternal();
-      allow delete: if collectionName == 'pub_bookings' && isVerified()
-                    && (!exists(/databases/$(database)/documents/mem_bookings/$(docId))
-                        || get(/databases/$(database)/documents/mem_bookings/$(docId)).data.get('cancelled', false) == true);
-
-      // A time held while its booker pays (it carries \`holdUntil\`) changes in
-      // three more ways, open to anybody — the one holding the server's pass
-      // is often a guest who has just paid, or just pressed Back on Stripe:
-      //   paid   — the checkout was paid, and the hold stands for good.
-      //   letGo  — the checkout was walked away from; the time is free.
-      //   taken over — somebody books a time that was let go, or that ran
-      //     out unpaid. The new hold carries the pass for the OLD one as
-      //     \`freed\`, and a new deadline of its own if it is paid for too.
-      allow update: if collectionName == 'pub_bookings'
-                    && resource.data.get('holdUntil', 0) != 0
-                    && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['paid'])
-                    && request.resource.data.paid == bookingPass(docId, resource.data.holdUntil, 'paid');
-      allow update: if collectionName == 'pub_bookings'
-                    && resource.data.get('holdUntil', 0) != 0
-                    && resource.data.get('paid', '') == ''
-                    && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['letGo'])
-                    && request.resource.data.letGo == bookingPass(docId, resource.data.holdUntil, 'free');
-      allow update: if collectionName == 'pub_bookings'
-                    && resource.data.get('holdUntil', 0) != 0
-                    && resource.data.get('paid', '') == ''
-                    && request.resource.data.keys().hasOnly(['memberId', 'start', 'end', 'createdAt', 'holdUntil', 'freed'])
-                    && request.resource.data.memberId == resource.data.memberId
-                    && request.resource.data.start == resource.data.start
-                    && request.resource.data.get('holdUntil', 0) is int
-                    && request.resource.data.get('holdUntil', 0) != resource.data.holdUntil
-                    && request.resource.data.freed == bookingPass(docId, resource.data.holdUntil, 'free');
-
-      match /{allPaths=**} {
-        allow read: if (collectionName.matches('^admin_.*') && isAdmin())
-                    || collectionName.matches('^sys_.*')
-                    || collectionName.matches('^pub_.*')
-                    || (collectionName.matches('^mem_.*') && isInternal())
-                    || (isRoleData(collectionName) && hasRoleFor(collectionName))
-                    || (collectionName.matches('^user_.*') && isDocOwner());
-        
-        allow create: if (collectionName.matches('^admin_.*') && isAdmin())
-                     || (collectionName.matches('^sys_.*') && isAdmin())
-                     || (isUserData(collectionName) && ownsUserDoc(docId))
-                     || (collectionName == 'user_submissions' && isFormSized())
-                     || (collectionName.matches('^pub_.*') && collectionName != 'pub_bookings' && isVerified() && publicWriteAllowed())
-                     || (collectionName.matches('^mem_.*') && isInternal())
-                     || (isRoleData(collectionName) && hasRoleFor(collectionName));
-
-        // Split the same way as the top-level lines, for the same reason: a
-        // document nested under a locked record's collection is locked too.
-        allow update: if (collectionName.matches('^pub_.*') && collectionName != 'pub_bookings' && isVerified() && publicWriteAllowed())
-                      || (collectionName.matches('^mem_.*') && isInternal() && keepsLock())
-                      || (isRoleData(collectionName) && hasRoleFor(collectionName) && keepsLock());
-
-        allow delete: if (collectionName.matches('^pub_.*') && collectionName != 'pub_bookings' && isVerified() && publicWriteAllowed())
-                      || (collectionName.matches('^mem_.*') && isInternal() && mayDelete())
-                      || (isRoleData(collectionName) && hasRoleFor(collectionName) && mayDelete());
-      }
-    }
-  }
-}
-`,_=`rules_version = '2';
-service firebase.storage {
-  match /b/{bucket}/o {
-
-    // --- Helper Functions ---
-    function isAuth() {
-      return request.auth != null;
-    }
-
-    function hasProfile(uid) {
-      return firestore.exists(/databases/(default)/documents/user_profiles/$(uid));
-    }
-
-    function profileRole(uid) {
-      return firestore.get(/databases/(default)/documents/user_profiles/$(uid)).data.role;
-    }
-
-    // Matches the Firestore rules: an admin who switches someone off under
-    // /users expects the files to close too. Until this was checked, only the
-    // app's own Access Denied screen stood in the way, and a deactivated person
-    // driving the SDK from a console kept every file they had. An account with
-    // no profile document yet counts as active — registration seeds the profile
-    // a moment after the account exists.
-    function notDeactivated() {
-      return isAuth() &&
-             (!hasProfile(request.auth.uid) ||
-              firestore.get(/databases/(default)/documents/user_profiles/$(request.auth.uid))
-                .data.get('inactive', false) != true);
-    }
-
-    // Matches the Firestore rules: a person who never opened the verification
-    // email has a signed-in token but no verified one, and nothing here opens
-    // for them. Google sign-ins arrive verified, and a phone sign-in has no
-    // address to verify at all — the texted code is that check, so the
-    // provider is accepted here exactly as it is in the Firestore rules.
-    function isVerified() {
-      return isAuth() &&
-             (request.auth.token.email_verified == true || hasNoEmailToVerify()) &&
-             notDeactivated();
-    }
-
-    // A sign-in that carries no email address: phone, and only phone.
-    function hasNoEmailToVerify() {
-      return request.auth.token.firebase.sign_in_provider == 'phone';
-    }
-
-    function isMemberDocAdmin(uid) {
-      return hasProfile(uid) && profileRole(uid) == 'admin';
-    }
-
-    function isAdmin() {
-      return isVerified() && isMemberDocAdmin(request.auth.uid);
-    }
-
-    // Files in mem_ folders belong to internal pages and to Drive's internal
-    // folder. Signing up does not open them — an admin marks the account
-    // internal under /users first.
-    function isInternal() {
-      return isVerified() && hasProfile(request.auth.uid) &&
-             profileRole(request.auth.uid) in ['internal', 'admin'];
-    }
-
-    // Files belonging to a page kept for a role the owner invented. The folder
-    // is named after the role exactly as its collections are —
-    // role_client_files — and the role is read straight out of the name, so a
-    // role invented tomorrow works without these rules being pasted again.
-    // Safe only because a role's id is squeezed to lowercase letters and
-    // digits before it is stored (roleIdFrom, src/lib/access.ts): it can never
-    // hold the underscore this splits on, nor be one of the words below. A
-    // folder that fails either test matches nothing here and is the admins'.
-    function folderRole(folder) {
-      return folder.split('_')[1];
-    }
-
-    function isRoleFolder(folder) {
-      return folder.matches('^role_[a-z][a-z0-9]*_.*') &&
-             !(folderRole(folder) in
-               ['user', 'users', 'free', 'guest', 'guests', 'internal', 'admin',
-                'admins', 'public', 'owner', 'team', 'member', 'members', 'none',
-                'role', 'roles']);
-    }
-
-    function hasFolderRole(folder) {
-      return isVerified() && hasProfile(request.auth.uid) &&
-             profileRole(request.auth.uid) == folderRole(folder) &&
-             planStillPaid();
-    }
-
-    // A role a paid plan gave lasts until the date on its pass (see
-    // isTakingPlanRole in firestore.rules) — here too, so the files close
-    // with the records. A role given by hand has no date.
-    function planStillPaid() {
-      return firestore.get(/databases/(default)/documents/user_profiles/$(request.auth.uid))
-               .data.get('planUntil', 0) == 0 ||
-             request.time.toMillis() <
-               firestore.get(/databases/(default)/documents/user_profiles/$(request.auth.uid)).data.planUntil;
-    }
-
-    // ── Files on an entry that was sent to people ─────────────────────────
-    // A file here belongs to ONE record — its path carries the record's
-    // collection and its id — so the record is what says who may open it,
-    // exactly as the record says who may read the record. The two lists on it
-    // are read the same way firestore.rules reads them: 'uid:<me>' for the
-    // person, 'role:<my role>' for everybody marked with it.
-    function caseRecordExists(coll, recordId) {
-      return firestore.exists(/databases/(default)/documents/$(coll)/$(recordId));
-    }
-
-    function caseRecord(coll, recordId) {
-      return firestore.get(/databases/(default)/documents/$(coll)/$(recordId)).data;
-    }
-
-    // Whoever may SEE the record. The same list, plus the one key that names
-    // nobody: a record carrying 'everyone' on \`access\` has been published to
-    // everybody signed in (firestore.rules), and its pictures are most of what
-    // was published — a listing whose photographs answer 403 to everybody but
-    // its author is not a listing.
-    //
-    // Kept apart from onCaseList rather than folded into it, because the two
-    // lists are asked different questions: this one is read against \`access\`,
-    // and onCaseList below stays what it was, so 'everyone' can never grant an
-    // upload or a delete even on a record written before the rule that refuses
-    // it on \`editors\`.
-    function onCaseListOrPublished(keys) {
-      return 'everyone' in keys || onCaseList(keys);
-    }
-
-    function onCaseList(keys) {
-      return ('uid:' + request.auth.uid) in keys ||
-             // Whoever proves the address an entry was made with — a buyer who
-             // ordered signed out (holdsAddress in firestore.rules).
-             (request.auth.token.email != null &&
-              request.auth.token.email_verified == true &&
-              ('email:' + request.auth.token.email.lower()) in keys) ||
-             (hasProfile(request.auth.uid) &&
-              ('role:' + profileRole(request.auth.uid)) in keys &&
-              planStillPaid());
-    }
-
-    // Whoever put the file there. It is what lets an upload happen BEFORE the
-    // record it belongs to is saved, and what lets the person who made that
-    // upload take it down again if they change their mind.
-    function isFileOwner() {
-      return resource != null && hasOwnerMeta(resource) &&
-             resource.metadata.ownerId == request.auth.uid;
-    }
-
-    function hasOwnerMeta(reqRes) {
-      return reqRes != null && 'metadata' in reqRes && reqRes.metadata != null && 'ownerId' in reqRes.metadata;
-    }
-
-    // ── Files in a conversation ──────────────────────────────────────────
-    // A file here belongs to ONE conversation — its path carries the
-    // conversation's id — so the conversation is what says who may open it,
-    // exactly as it says who may read the messages. Two Firestore reads per
-    // upload and per delete (the caller's profile, the conversation); none
-    // per view, because a download link carries its own token.
-    function chatThreadData(threadId) {
-      return firestore.get(/databases/(default)/documents/chat_threads/$(threadId)).data;
-    }
-
-    // In the conversation by name, or on the team and it is a member's
-    // support thread — the same two answers firestore.rules gives.
-    function onChatThread(threadId) {
-      return isVerified() &&
-             (request.auth.uid in chatThreadData(threadId).participants ||
-              (chatThreadData(threadId).kind == 'support' && isInternal()));
-    }
-
-    // --- Upload limits ---
-    // Nothing capped uploads before this: any verified account could push a
-    // file of any size and any kind into user_ or mem_, and the bill is the
-    // owner's. 10 MB covers the documents, photos and short clips these pages
-    // are for. Admins are exempt on purpose — the Assets screen is where the
-    // owner puts their own logo, fonts and anything else the app needs.
-    function underSizeCap(bytes) {
-      return request.resource != null && request.resource.size < bytes;
-    }
-
-    // An allowlist rather than a blocklist, so a new dangerous type does not
-    // arrive open. SVG is excluded from images because it can carry script and
-    // Firebase serves it inline from the storage domain; the admin Assets path
-    // can still take one.
-    function allowedFileType() {
-      return request.resource != null && request.resource.contentType != null && (
-        // Lower-cased: \`image/SVG+xml\` is the same scriptable picture.
-        (request.resource.contentType.lower().matches('image/.*') &&
-         !request.resource.contentType.lower().matches('image/svg.*')) ||
-        request.resource.contentType.matches('audio/.*') ||
-        request.resource.contentType.matches('video/.*') ||
-        request.resource.contentType in [
-          'text/plain', 'text/csv', 'text/markdown', 'text/calendar',
-          'application/pdf', 'application/json', 'application/rtf',
-          'application/zip', 'application/x-zip-compressed',
-          'application/msword',
-          'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-          'application/vnd.ms-excel',
-          'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-          'application/vnd.ms-powerpoint',
-          'application/vnd.openxmlformats-officedocument.presentationml.presentation',
-          'application/vnd.oasis.opendocument.text',
-          'application/vnd.oasis.opendocument.spreadsheet',
-          'application/vnd.oasis.opendocument.presentation'
-        ]
-      );
-    }
-
-    function isUploadableImage() {
-      return request.resource != null &&
-             request.resource.contentType != null &&
-             request.resource.contentType.lower().matches('image/.*') &&
-             !request.resource.contentType.lower().matches('image/svg.*');
-    }
-
-    // --- Special Match: User Avatars ---
-    // A picture, and a small one: the profile screen already refuses anything
-    // over 2 MB, this is the same rule where it cannot be skipped.
-    match /user_avatars/{uid}/{fileName} {
-      allow read: if isVerified();
-      allow create, update: if isVerified()
-                            && request.auth.uid == uid
-                            && isUploadableImage()
-                            && underSizeCap(5 * 1024 * 1024)
-                            && (hasOwnerMeta(request.resource) ? request.resource.metadata.ownerId == request.auth.uid : true);
-      allow delete: if isVerified() && request.auth.uid == uid;
-    }
-
-    // --- Special Match: files on a sent entry ---
-    // The path is case_files/<collection>/<record id>/<file>, and that record
-    // id is the whole point: it is what lets these rules ask the RECORD who
-    // may open the file, rather than guessing from a folder name. One
-    // Firestore read per upload and per delete; none per view, because a
-    // download link carries its own token and never comes back through here.
-    //
-    // An upload lands BEFORE the record is saved — the add form mints the id
-    // first, so the box inside it has somewhere to put things — which is why
-    // creating is allowed while the record does not exist yet, exactly as a
-    // form attachment may arrive before its entry. Once the record is there,
-    // uploading is an editor's.
-    match /case_files/{coll}/{recordId}/{fileName} {
-      allow read: if isVerified() && coll.matches('^case_.*')
-                  && ((caseRecordExists(coll, recordId) && onCaseListOrPublished(caseRecord(coll, recordId).access))
-                      || isFileOwner());
-
-      allow create: if isVerified() && coll.matches('^case_.*')
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && hasOwnerMeta(request.resource)
-                    && request.resource.metadata.ownerId == request.auth.uid
-                    && (!caseRecordExists(coll, recordId)
-                        || onCaseList(caseRecord(coll, recordId).editors));
-
-      // Overwriting a file in place stays the uploader's, as it is everywhere
-      // else — nothing in the app does it, and it would change what somebody
-      // else's link already serves.
-      allow update: if isVerified() && coll.matches('^case_.*')
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && isFileOwner();
-
-      // Deleting follows the record: whoever may delete the entry may take
-      // its files with it, or the file would be stranded behind a record
-      // already gone — out of everybody's reach and still on the bill.
-      allow delete: if isVerified() && coll.matches('^case_.*')
-                    && ((caseRecordExists(coll, recordId) && onCaseList(caseRecord(coll, recordId).editors))
-                        || isFileOwner());
-    }
-
-    // --- Special Match: files in a conversation ---
-    // A group's photo is chat_files/<conversation>/icon/<name>; anything
-    // somebody sends inside a message sits under the message's own id. There
-    // is no upload before the conversation exists: unlike a sent entry, whose
-    // id is minted before the add form opens, a conversation is made by its
-    // first message and a file only ever follows one.
-    match /chat_files/{threadId}/{allPaths=**} {
-      allow read: if onChatThread(threadId);
-
-      allow create: if onChatThread(threadId)
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && hasOwnerMeta(request.resource)
-                    && request.resource.metadata.ownerId == request.auth.uid;
-
-      // Nothing in the app overwrites a file in place, and doing it here
-      // would change what somebody else's link already serves — a message
-      // already read would quietly become a different message.
-      allow update: if false;
-
-      // Whoever put it there takes it down. Leaving a group's old photo
-      // behind costs pennies; letting anybody in a conversation delete what
-      // somebody else sent does not read as chat.
-      allow delete: if isVerified() && resource != null && hasOwnerMeta(resource)
-                    && resource.metadata.ownerId == request.auth.uid;
-    }
-
-    // --- Generic Folder Match ---
-    match /{folder}/{allPaths=**} {
-
-      // Public folder access
-      allow read: if folder.matches('^pub_.*');
-
-      // Internal folder access — internal members and admins only.
-      // The folder test comes first on purpose: isInternal() reaches across to
-      // Firestore, so every read of a pub_ file would otherwise pay for a
-      // profile lookup it does not need. (Signed-in reads pay one either way
-      // now — isVerified() has to look the deactivation flag up.)
-      allow read: if folder.matches('^mem_.*') && isInternal();
-      allow create: if folder.matches('^mem_.*')
-                    && isInternal()
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && hasOwnerMeta(request.resource)
-                    && request.resource.metadata.ownerId == request.auth.uid;
-      allow update: if folder.matches('^mem_.*')
-                    && isInternal()
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && resource != null
-                    && hasOwnerMeta(resource)
-                    && resource.metadata.ownerId == request.auth.uid;
-      // Deleting follows the record, not the uploader. Since 1.14.6 every team
-      // member may delete every mem_ record, whoever added it, and the record
-      // is the only place the file's link lives — so a delete that stopped at
-      // the uploader left the file stranded behind a record already gone, out
-      // of everybody's reach and still on the owner's bill. Overwriting a file
-      // in place (update, above) stays the uploader's: nothing in the app does
-      // it, and it would change what a colleague's link serves.
-      allow delete: if folder.matches('^mem_.*')
-                    && isInternal();
-
-      // A page kept for one of your own roles — the same shape as mem_ above:
-      // everybody marked with the role reads every file there and may delete
-      // any of them, exactly as they may delete any record on the page; each
-      // of them may overwrite only what they put up themselves.
-      allow read: if isRoleFolder(folder) && hasFolderRole(folder);
-      allow create: if isRoleFolder(folder)
-                    && hasFolderRole(folder)
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && hasOwnerMeta(request.resource)
-                    && request.resource.metadata.ownerId == request.auth.uid;
-      allow update: if isRoleFolder(folder)
-                    && hasFolderRole(folder)
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && resource != null
-                    && hasOwnerMeta(resource)
-                    && resource.metadata.ownerId == request.auth.uid;
-      allow delete: if isRoleFolder(folder)
-                    && hasFolderRole(folder);
-
-      // The team's own public pictures. A booking page carries a photo of the
-      // person it is for, and since 1.14.18 that person makes the page
-      // themselves — so the picture has to be theirs to put up. Same shape as
-      // mem_ above: capped, type-filtered, stamped with who uploaded it, and
-      // only that person (or an admin, below) may change or remove it. It is
-      // the ONE public folder the team writes; everything else under pub_ is
-      // still the admins' or the form attachments below.
-      allow create: if folder == 'pub_files'
-                    && isInternal()
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && hasOwnerMeta(request.resource)
-                    && request.resource.metadata.ownerId == request.auth.uid;
-      allow update: if folder == 'pub_files'
-                    && isInternal()
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && resource != null
-                    && hasOwnerMeta(resource)
-                    && resource.metadata.ownerId == request.auth.uid;
-      allow delete: if folder == 'pub_files'
-                    && isInternal()
-                    && resource != null
-                    && hasOwnerMeta(resource)
-                    && resource.metadata.ownerId == request.auth.uid;
-
-      // Form attachments. A visitor answering a public form is not signed in,
-      // so this one folder takes an anonymous create — capped and
-      // type-filtered like every other non-admin write, and write-once: no
-      // update, no delete, so a submitted file cannot be swapped after the
-      // owner has read the entry. The pub_ prefix is what makes the file
-      // readable back, which the download link in the Inbox entry needs.
-      allow create: if folder == 'pub_form_uploads'
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType();
-
-      // User-specific folders. user_avatars starts with user_ too, and until
-      // it was named here any verified account could drop a file at the path
-      // where somebody else's picture goes; the avatars have their own match
-      // above and answer to that alone.
-      allow create: if isVerified()
-                    && folder.matches('^user_.*')
-                    && folder != 'user_avatars'
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && hasOwnerMeta(request.resource)
-                    && request.resource.metadata.ownerId == request.auth.uid;
-      allow update: if isVerified()
-                    && folder.matches('^user_.*')
-                    && folder != 'user_avatars'
-                    && underSizeCap(10 * 1024 * 1024)
-                    && allowedFileType()
-                    && resource != null
-                    && hasOwnerMeta(resource)
-                    && resource.metadata.ownerId == request.auth.uid;
-      allow read, delete: if isVerified()
-                          && folder.matches('^user_.*')
-                          && resource != null
-                          && hasOwnerMeta(resource)
-                          && resource.metadata.ownerId == request.auth.uid;
-
-      // Admin access overrides — the Assets screen holds the logo, the favicon
-      // and anything else the owner needs the app to serve, so it is not capped
-      // or filtered.
-      allow read, create: if isAdmin();
-      allow update, delete: if isAdmin();
-    }
-  }
-}
-`,v=[{key:`VITE_FIREBASE_API_KEY`,label:`API Key`,shownAs:`apiKey`},{key:`VITE_FIREBASE_AUTH_DOMAIN`,label:`Auth Domain`,shownAs:`authDomain`},{key:`VITE_FIREBASE_PROJECT_ID`,label:`Project ID`,shownAs:`projectId`},{key:`VITE_FIREBASE_STORAGE_BUCKET`,label:`Storage Bucket`,shownAs:`storageBucket`},{key:`VITE_FIREBASE_MESSAGING_SENDER_ID`,label:`Messaging Sender ID`,shownAs:`messagingSenderId`},{key:`VITE_FIREBASE_APP_ID`,label:`App ID`,shownAs:`appId`}];function y(e){let t;try{if(t={BASE_URL:`/`,DEV:!1,MODE:`production`,PROD:!0,SSR:!1,VITE_ADMIN_EMAILS:void 0,VITE_FIREBASE_API_KEY:void 0,VITE_FIREBASE_APP_ID:void 0,VITE_FIREBASE_AUTH_DOMAIN:void 0,VITE_FIREBASE_MESSAGING_SENDER_ID:void 0,VITE_FIREBASE_PROJECT_ID:void 0,VITE_FIREBASE_STORAGE_BUCKET:void 0}?.[e],t&&typeof t==`string`&&t.trim()!==``)return t}catch{}try{if(t=(typeof window<`u`?window:globalThis)?.process?.env?.[e],t&&typeof t==`string`&&t.trim()!==``)return t}catch{}try{switch(e){case`VITE_FIREBASE_API_KEY`:t=void 0;break;case`VITE_FIREBASE_AUTH_DOMAIN`:t=void 0;break;case`VITE_FIREBASE_PROJECT_ID`:t=void 0;break;case`VITE_FIREBASE_STORAGE_BUCKET`:t=void 0;break;case`VITE_FIREBASE_MESSAGING_SENDER_ID`:t=void 0;break;case`VITE_FIREBASE_APP_ID`:t=void 0;break}if(t&&typeof t==`string`&&t.trim()!==``)return t}catch{}return``}function b(e,t){let n=y(e);if(n)return n;if(t?.firebaseConfig){let n={VITE_FIREBASE_API_KEY:`apiKey`,VITE_FIREBASE_AUTH_DOMAIN:`authDomain`,VITE_FIREBASE_PROJECT_ID:`projectId`,VITE_FIREBASE_STORAGE_BUCKET:`storageBucket`,VITE_FIREBASE_MESSAGING_SENDER_ID:`messagingSenderId`,VITE_FIREBASE_APP_ID:`appId`}[e];if(n&&t.firebaseConfig[n])return t.firebaseConfig[n]}return``}function x(e){let t=[],n=[],r=t=>b(t,e);for(let{key:e,label:i}of v){let a=r(e);a?a.trim()===``&&n.push(i):t.push(i)}let i=[...t,...n];return{allSet:i.length===0,missing:i,empty:n}}function S(){return x().allSet}var C=_;function w(e){let t=e.map(e=>e.trim().toLowerCase()).filter(Boolean).filter((e,t,n)=>n.indexOf(e)===t),n=t.length?t.map(e=>`'${e.replace(/'/g,``)}'`).join(`, `):`'your@email.com'`;return g.replace(/(function adminEmails\(\) \{\s*return )\[[^\]]*\];/,`$1[${n}];`)}function T(e){return e.split(/[,\s]+/).map(e=>e.trim()).filter(Boolean)}var E=/^[^@\s]+@[^@\s]+\.[^@\s]+$/;function D({code:e,label:r,compact:i,onCopy:a}){let[o,s]=c.default.useState(!1);return(0,l.jsxs)(n.rt.button,{whileHover:{scale:1.02},whileTap:{scale:.98},onClick:()=>{navigator.clipboard?.writeText(e),a?.(),s(!0),setTimeout(()=>s(!1),2e3)},className:`inline-flex items-center font-bold transition-all shrink-0 cursor-pointer ${i?`gap-1.5 h-9 px-3 rounded-xl text-[12px] self-start sm:self-auto`:`gap-2 px-4 py-2 mt-2 rounded-xl text-[13px] tracking-wide`} ${o?`bg-emerald-500/10 text-emerald-500 border border-emerald-500/20`:`btn-secondary${i?``:` shadow-sm`}`}`,children:[o?(0,l.jsx)(n.jt,{className:i?`w-3.5 h-3.5`:`w-4 h-4`}):(0,l.jsx)(t._,{className:i?`w-3.5 h-3.5`:`w-4 h-4`}),o?i?`Copied`:`Copied to Clipboard!`:r]})}function O(e){let t=``;try{t=new URL(e).hostname}catch{t=``}let n=t===`localhost`||t===`127.0.0.1`||t.endsWith(`.local`);return{host:t,local:n}}function k(){let{host:e,local:t}=O(typeof window>`u`?``:window.location.href);return e?(0,l.jsxs)(`div`,{className:`glass-panel border border-[var(--panel-border)] rounded-2xl bg-background flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2 sm:gap-3 px-4 py-3 mt-3`,children:[(0,l.jsxs)(`div`,{className:`min-w-0`,children:[(0,l.jsx)(`div`,{className:`text-[13.5px] font-bold text-foreground break-all sm:break-normal sm:truncate`,children:e}),(0,l.jsx)(`div`,{className:`text-[12.5px] text-foreground/50 font-medium`,children:t?`this machine — Firebase trusts it already, nothing to add`:`your app's address, read from this page`})]}),!t&&(0,l.jsx)(D,{compact:!0,code:e,label:`Copy the address`})]}):null}function A({name:e,shownAs:r,hint:i}){let[a,o]=c.default.useState(!1);return(0,l.jsxs)(`div`,{className:`flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2 sm:gap-3 px-4 py-3 border-b border-[var(--panel-border)]/40 last:border-0`,children:[(0,l.jsxs)(`div`,{className:`min-w-0`,children:[(0,l.jsx)(`div`,{className:`text-[13.5px] font-bold text-foreground break-all sm:break-normal sm:truncate`,children:e}),(0,l.jsx)(`div`,{className:`text-[12.5px] text-foreground/50 font-medium`,children:i??(0,l.jsxs)(l.Fragment,{children:[`the value Firebase labels `,r]})})]}),(0,l.jsxs)(`button`,{type:`button`,onClick:()=>{navigator.clipboard?.writeText(e),o(!0),setTimeout(()=>o(!1),2e3)},className:`inline-flex items-center gap-1.5 h-9 px-3 rounded-xl text-[12px] font-bold shrink-0 self-start sm:self-auto transition-all cursor-pointer active:scale-[0.98] ${a?`bg-emerald-500/10 text-emerald-500 border border-emerald-500/20`:`btn-secondary`}`,children:[a?(0,l.jsx)(n.jt,{className:`w-3.5 h-3.5`}):(0,l.jsx)(t._,{className:`w-3.5 h-3.5`}),a?`Copied`:`Copy name`]})]})}var j={VITE_FIREBASE_API_KEY:`AIzaSyD3k9xQeL7vR2mN8pT4wY6…`,VITE_FIREBASE_AUTH_DOMAIN:`your-project.firebaseapp.com`,VITE_FIREBASE_PROJECT_ID:`your-project`,VITE_FIREBASE_MESSAGING_SENDER_ID:`482915736204`,VITE_FIREBASE_APP_ID:`1:482915736204:web:9c1e7a4b2d8f6e3a`},M=v.map(({key:e})=>e===`VITE_FIREBASE_STORAGE_BUCKET`?{name:e,value:`leave empty`,empty:!0}:{name:e,value:j[e]});function N({name:e,value:t,empty:n}){return(0,l.jsxs)(`div`,{className:`px-3 sm:px-4 py-1.5 flex flex-col gap-1 sm:grid sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_2.25rem] sm:gap-3 sm:items-center`,children:[(0,l.jsx)(`div`,{title:e,className:`min-w-0 sm:h-9 sm:px-3 flex items-center sm:rounded-xl sm:bg-foreground/[0.05] text-[12.5px] sm:text-[13px] font-semibold text-foreground/80`,children:(0,l.jsx)(`span`,{className:`break-all sm:truncate`,children:e})}),(0,l.jsxs)(`div`,{className:`flex items-center gap-2 sm:contents`,children:[(0,l.jsx)(`div`,{className:`flex-1 min-w-0 h-9 px-3 flex items-center rounded-xl border text-[12.5px] sm:text-[13px] font-medium ${n?`border-dashed border-accent/40 text-accent`:`border-[var(--panel-border)]/60 text-foreground/45`}`,children:(0,l.jsx)(`span`,{className:`truncate`,children:t})}),(0,l.jsx)(`span`,{"aria-hidden":`true`,className:`w-9 h-9 shrink-0 rounded-xl flex items-center justify-center bg-foreground/[0.05] text-foreground/35`,children:(0,l.jsx)(a.t,{className:`w-4 h-4`})})]})]})}function P(){return(0,l.jsxs)(`div`,{className:`glass-panel border border-[var(--panel-border)] rounded-2xl overflow-hidden bg-background`,children:[(0,l.jsx)(`div`,{className:`max-sm:hidden sm:grid grid-cols-[minmax(0,1fr)_minmax(0,1fr)_2.25rem] gap-3 px-4 pt-3.5 pb-1`,children:[`Name`,`Value`].map(e=>(0,l.jsx)(`span`,{className:`px-3 text-[12.5px] font-semibold text-foreground/45`,children:e},e))}),(0,l.jsx)(`div`,{className:`py-2 sm:py-1.5`,children:M.map(e=>(0,l.jsx)(N,{...e},e.name))}),(0,l.jsx)(`div`,{className:`flex justify-end px-3 sm:px-4 py-3 border-t border-[var(--panel-border)]/40`,children:(0,l.jsx)(`span`,{"aria-hidden":`true`,className:`btn-secondary inline-flex items-center h-9 px-4 rounded-xl text-[12.5px] font-bold select-none`,children:`Apply`})})]})}function F(){let[e,t]=(0,c.useState)(n.zt),[r,i]=(0,c.useState)(``),[a,o]=(0,c.useState)([]),[u,d]=(0,c.useState)(``),f=e=>{t(e),n.Rt(e),r&&(i(``),o([])),u&&d(``)},p=()=>{let t=T(e);if(t.length===0){d(`Type an email address first — it is what the rules will name.`);return}let n=t.filter(e=>!E.test(e));if(n.length>0){d(`That does not look like an email address: ${n.join(`, `)}`);return}d(``),o(t.map(e=>e.trim().toLowerCase())),i(w(t))};return(0,l.jsxs)(`div`,{className:`glass-panel border border-[var(--panel-border)] rounded-2xl p-5 mb-2 flex flex-col gap-4`,children:[(0,l.jsxs)(`div`,{className:`flex items-center gap-3.5 min-w-0`,children:[(0,l.jsx)(`div`,{className:`w-10 h-10 rounded-2xl flex items-center justify-center shrink-0 border border-[var(--panel-border)]/50 bg-accent/10 text-accent`,children:(0,l.jsx)(s.t,{className:`w-5 h-5`})}),(0,l.jsxs)(`div`,{className:`flex flex-col gap-0.5 min-w-0`,children:[(0,l.jsx)(`h3`,{className:`text-[15px] font-bold text-foreground tracking-tight leading-tight truncate`,children:`Who runs this app?`}),(0,l.jsx)(`p`,{className:`text-[12px] text-foreground/50 font-normal leading-snug truncate`,children:`The email you sign in with becomes the owner — separate several with commas.`})]})]}),(0,l.jsxs)(`div`,{className:`flex flex-col sm:flex-row sm:items-center gap-2`,children:[(0,l.jsx)(`input`,{type:`text`,value:e,"aria-label":`The email address you will sign in with`,placeholder:`you@yourcompany.com`,onChange:e=>f(e.target.value),onKeyDown:e=>{e.key===`Enter`&&(e.preventDefault(),p())},className:`w-full h-10 px-3.5 rounded-[var(--input-radius,0.75rem)] border border-[var(--panel-border)] bg-[var(--panel-bg)] text-[13.5px] text-foreground outline-none transition-all duration-300 placeholder:text-foreground/35 hover:border-accent/40 focus:border-accent console-field ${u?`is-invalid border-red-500/60`:``}`}),(0,l.jsx)(`button`,{type:`button`,onClick:p,className:`btn-primary inline-flex items-center justify-center h-10 px-4 rounded-[var(--btn-radius,0.75rem)] text-[12.5px] font-bold text-white shrink-0 cursor-pointer active:scale-[0.98] transition-transform whitespace-nowrap`,children:`Generate the rules`})]}),u&&(0,l.jsx)(`p`,{className:`text-[12px] font-semibold text-red-500 leading-snug px-1`,children:u}),r&&(0,l.jsxs)(`div`,{className:`rounded-2xl border border-emerald-500/20 bg-emerald-500/[0.05] px-3.5 py-3 flex flex-col sm:flex-row sm:items-center gap-2 sm:gap-3`,children:[(0,l.jsx)(`span`,{className:`w-7 h-7 rounded-full bg-emerald-500/10 border border-emerald-500/20 flex items-center justify-center shrink-0`,children:(0,l.jsx)(n.jt,{className:`w-3.5 h-3.5 text-emerald-500`})}),(0,l.jsxs)(`div`,{className:`min-w-0 flex-1 flex flex-col gap-0.5`,children:[(0,l.jsxs)(`p`,{"data-admin-emails":!0,className:`text-[13px] font-bold text-foreground leading-snug break-all`,children:[`Ready — they make `,a.join(`, `),` the owner.`]}),(0,l.jsx)(`p`,{className:`text-[12px] font-medium text-foreground/50 leading-snug`,children:`Paste them into Firebase, then sign in with that address — your admin tabs appear on their own within a minute or two.`})]}),(0,l.jsx)(D,{compact:!0,code:r,label:`Copy the rules`,onCopy:()=>n.Lt(a)})]})]})}function I({text:e,label:t}){return(0,l.jsxs)(`div`,{className:`glass-panel border border-[var(--panel-border)] rounded-2xl bg-background overflow-hidden`,children:[(0,l.jsxs)(`div`,{className:`flex items-center justify-between gap-3 px-4 py-3 border-b border-[var(--panel-border)]/40`,children:[(0,l.jsx)(`span`,{className:`text-[12px] font-extrabold tracking-tight text-gradient truncate max-sm:hidden`,children:`Paste this into your assistant`}),(0,l.jsx)(D,{compact:!0,code:e,label:t})]}),(0,l.jsx)(`pre`,{className:`px-4 py-3 max-h-64 overflow-auto text-[11.5px] leading-relaxed font-mono text-foreground/70 whitespace-pre-wrap [overflow-wrap:anywhere]`,children:e})]})}function L({number:e,title:t,aside:n,children:r}){return(0,l.jsxs)(`div`,{className:`flex flex-col relative pb-10 mb-10 border-b border-[var(--panel-border)]/50 last:border-0 last:pb-0 last:mb-0`,children:[(0,l.jsxs)(`div`,{className:`flex items-center gap-3 mb-4`,children:[(0,l.jsx)(`span`,{className:`w-8 h-8 shrink-0 rounded-full bg-accent/10 border border-accent/20 text-accent flex items-center justify-center text-[14px] font-extrabold`,children:e}),(0,l.jsx)(`h3`,{className:`text-[17px] md:text-[19px] font-bold text-foreground tracking-tight flex-1 min-w-0`,children:t}),n]}),(0,l.jsx)(`div`,{className:`text-[14px] md:text-[15px] text-foreground/70 leading-relaxed space-y-4`,children:r})]})}function R({basename:e}){let[t,i]=(0,c.useState)(!1);return(0,l.jsxs)(`div`,{className:`mt-6 sm:mt-8 relative z-10 flex flex-col sm:flex-row sm:items-center gap-4 sm:gap-6 p-5 sm:p-6 rounded-3xl border border-accent/20 bg-accent/[0.06]`,children:[(0,l.jsxs)(`div`,{className:`min-w-0 flex-1`,children:[(0,l.jsx)(`h3`,{className:`text-[16px] sm:text-[17px] font-bold text-foreground tracking-tight`,children:`Worked through every step?`}),(0,l.jsx)(`p`,{className:`text-[13px] sm:text-[13.5px] text-foreground/60 font-medium leading-relaxed mt-1`,children:`Your app will start again and take you to sign in. Use the email address you typed into the rules — that is the one this app knows as its owner.`})]}),(0,l.jsx)(n.rt.button,{type:`button`,whileHover:t?void 0:{scale:1.02},whileTap:t?void 0:{scale:.98},onClick:()=>{if(t)return;i(!0),h();let n=String(e||``).replace(/\/+$/,``);window.location.assign(`${n}/login`)},disabled:t,"aria-busy":t,className:`btn-primary inline-flex items-center justify-center h-12 px-6 rounded-[var(--btn-radius,0.75rem)] text-[13.5px] font-bold text-white shrink-0 cursor-pointer whitespace-nowrap shadow-lg disabled:cursor-default`,children:(0,l.jsxs)(`span`,{className:`grid place-items-center`,children:[(0,l.jsxs)(`span`,{"aria-hidden":t,className:`col-start-1 row-start-1 inline-flex items-center gap-2 ${t?`invisible`:``}`,children:[`I've completed all the steps`,(0,l.jsx)(r.t,{className:`w-4 h-4`})]}),(0,l.jsxs)(`span`,{"aria-hidden":!t,className:`col-start-1 row-start-1 inline-flex items-center gap-2 ${t?``:`invisible`}`,children:[`Starting your app`,(0,l.jsx)(o.r,{className:`w-4 h-4 animate-spin`})]})]})})]})}function z({standalone:e}){let r=n.mi(),[a,o]=f(),s=a===`local`,u={project:s?2:1,webApp:s?3:2,keys:s?4:3,signIn:s?5:4,database:s?6:5,storage:s?7:6},d=O(typeof window>`u`?``:window.location.href).local,[m]=(0,c.useState)(()=>{let e=null;try{e=localStorage.getItem(`theme-mode`)}catch{}return e===`light`?!1:e===`dark`?!0:window.matchMedia(`(prefers-color-scheme: dark)`).matches});return(0,c.useEffect)(()=>{e&&document.documentElement.setAttribute(`data-theme`,m?`dark`:`light`)},[m,e]),(0,c.useEffect)(()=>{if(e&&t.b.faviconUrl){let e=document.querySelector(`link[rel*='icon']`);e||(e=document.createElement(`link`),e.rel=`icon`,document.head.appendChild(e)),e.href=t.b.faviconUrl}},[e]),(0,l.jsxs)(`main`,{className:`flex-1 w-full max-w-7xl mx-auto p-4 pt-2 md:p-8 md:pt-4 z-10 flex flex-col min-h-screen`,children:[(0,l.jsx)(n.rt.div,{initial:{opacity:0,y:20},animate:{opacity:1,y:0},className:`mb-6 flex items-center justify-between`,children:(0,l.jsxs)(`div`,{children:[(0,l.jsx)(t.t,{children:`Setup`}),(0,l.jsxs)(`div`,{className:`flex items-center gap-2 text-foreground/40 font-bold uppercase tracking-[0.2em] text-[11px]`,children:[(0,l.jsx)(`span`,{className:`w-8 h-[1px] bg-foreground/10`}),`/setup`]})]})}),(0,l.jsxs)(`div`,{className:`flex flex-col gap-6 flex-1 pb-16`,children:[(0,l.jsxs)(n.rt.div,{initial:{opacity:0,y:20},animate:{opacity:1,y:0},transition:{delay:.1},className:`glass-panel border border-[var(--panel-border)] rounded-3xl p-4 sm:p-6 md:p-10 shadow-2xl relative overflow-hidden bg-background flex flex-col fbos-tab-fill`,children:[(0,l.jsx)(`div`,{className:`mb-6 pb-4 sm:mb-8 sm:pb-6 border-b border-[var(--panel-border)]/50 relative z-10`,children:(0,l.jsxs)(`div`,{className:`min-w-0`,children:[(0,l.jsx)(`h2`,{className:`text-[17px] sm:text-xl font-bold text-foreground tracking-tight truncate`,children:`Connect your app to Firebase`}),(0,l.jsxs)(`p`,{className:`text-[13px] font-medium text-foreground/50 mt-1 sm:mt-1.5 leading-snug truncate`,children:[(0,l.jsx)(`span`,{className:`sm:hidden`,children:`Google's free data and sign-in service.`}),(0,l.jsx)(`span`,{className:`max-sm:hidden`,children:`Firebase is Google's free service that stores your data and signs people in — about ten minutes, once.`})]})]})}),!1,(0,l.jsxs)(`div`,{className:`flex flex-col relative z-10 p-4 sm:p-6 md:p-8 bg-foreground/[0.015] rounded-3xl border border-[var(--panel-border)]/50`,children:[s&&(0,l.jsxs)(L,{number:1,title:`Set your project up`,children:[(0,l.jsx)(`p`,{className:`text-foreground/80`,children:`Your assistant does this part — none of it is yours to type. Copy the block below into Claude Code, Codex or Antigravity and let it finish before you carry on. If you are already looking at this page on your own machine, paste it anyway: it only fills in what is missing and changes nothing that is already right.`}),(0,l.jsx)(I,{text:p,label:`Copy the setup prompt`})]}),(0,l.jsx)(L,{number:u.project,title:`Create a Firebase project`,children:(0,l.jsxs)(`ol`,{className:`space-y-2 list-decimal list-inside text-foreground/80`,children:[(0,l.jsxs)(`li`,{children:[`Open`,` `,(0,l.jsx)(`a`,{href:`https://console.firebase.google.com`,target:`_blank`,rel:`noopener noreferrer`,className:`text-accent underline underline-offset-2 font-semibold hover:text-accent-deep transition-colors`,children:`console.firebase.google.com`}),` `,`and click `,(0,l.jsx)(`strong`,{children:`Add project`}),`. Sign in with your Google account if it asks.`]}),(0,l.jsxs)(`li`,{children:[`Type any name you like and click `,(0,l.jsx)(`strong`,{children:`Continue`}),`.`]}),(0,l.jsxs)(`li`,{children:[`If it offers `,(0,l.jsx)(`strong`,{children:`Enable Gemini in Firebase`}),`, switch it off.`]}),(0,l.jsxs)(`li`,{children:[`Switch off `,(0,l.jsx)(`strong`,{children:`Enable Google Analytics for this project`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Click `,(0,l.jsx)(`strong`,{children:`Create project`}),`, wait, then click `,(0,l.jsx)(`strong`,{children:`Continue`}),`.`]})]})}),(0,l.jsx)(L,{number:u.webApp,title:`Add a web app and copy the six values`,children:(0,l.jsxs)(`ol`,{className:`space-y-2 list-decimal list-inside text-foreground/80`,children:[(0,l.jsxs)(`li`,{children:[`On that page click `,(0,l.jsx)(`strong`,{children:`+ Add app`}),` under your project's name, then pick the `,(0,l.jsx)(`strong`,{children:`</> Web`}),` icon.`]}),(0,l.jsxs)(`li`,{children:[`Give it any nickname (`,(0,l.jsx)(`span`,{className:`text-accent`,children:`MyApp`}),` is fine). Leave `,(0,l.jsx)(`strong`,{children:`Firebase Hosting`}),` unticked.`]}),(0,l.jsxs)(`li`,{children:[`Click `,(0,l.jsx)(`strong`,{children:`Register app`}),`.`]}),(0,l.jsx)(`li`,{children:`Firebase now shows six values on screen, each with a label beside it — apiKey, authDomain, projectId, storageBucket, messagingSenderId and appId. You will copy them one at a time in the next step, so keep this tab open.`})]})}),(0,l.jsx)(L,{number:u.keys,title:s?`Put the six values in your .env`:`Paste the values into the environment variables window`,children:s?(0,l.jsxs)(l.Fragment,{children:[(0,l.jsxs)(`p`,{className:`text-foreground/80`,children:[`Step 1 made a `,(0,l.jsx)(`strong`,{children:`.env`}),` file, and every name below is already a line in it. Open it — or ask your assistant to open it for you — and put each value from your Firebase tab between that line's quotes. The names have to match letter for letter, so find them with the Copy name button rather than retyping.`]}),(0,l.jsxs)(`p`,{className:`text-foreground/80`,children:[`Six lines, and that is all of them. Fill five of them now and leave`,` `,(0,l.jsx)(`strong`,{children:`VITE_FIREBASE_STORAGE_BUCKET`}),` empty — step `,u.storage,` gives you its real value.`]}),(0,l.jsxs)(`p`,{className:`text-foreground/80`,children:[(0,l.jsx)(`strong`,{children:`Leave the app as it is for now.`}),` One value is still missing, and starting it again is the last thing you do on this whole page.`]}),(0,l.jsx)(`div`,{className:`glass-panel border border-[var(--panel-border)] rounded-2xl overflow-hidden bg-background`,children:v.map(({key:e,shownAs:t})=>(0,l.jsx)(A,{name:e,shownAs:t,hint:e===`VITE_FIREBASE_STORAGE_BUCKET`?`leave this one empty — step ${u.storage} gives you the real address`:void 0},e))})]}):(0,l.jsxs)(l.Fragment,{children:[(0,l.jsxs)(`p`,{className:`text-foreground/80`,children:[`AI Studio pops up a window that says`,` `,(0,l.jsx)(`strong`,{children:`Enter your environment variables to continue`}),`, with a form like the one below. Paste each value from your Firebase tab into its row — the values below are only examples of what each one looks like.`]}),(0,l.jsxs)(`p`,{className:`text-foreground/80`,children:[`Leave `,(0,l.jsx)(`strong`,{children:`VITE_FIREBASE_STORAGE_BUCKET`}),` empty and keep the window open — don't press `,(0,l.jsx)(`strong`,{children:`Apply`}),` yet. Step `,u.storage,` gives you the last value, and Apply comes after it.`]}),(0,l.jsx)(P,{})]})}),(0,l.jsxs)(L,{number:u.signIn,title:`Turn on sign-in`,children:[(0,l.jsxs)(`ol`,{className:`space-y-2 list-decimal list-inside text-foreground/80`,children:[(0,l.jsxs)(`li`,{children:[`In the Firebase menu on the left, open `,(0,l.jsx)(`strong`,{children:`Authentication`}),` and click `,(0,l.jsx)(`strong`,{children:`Get started`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Open the `,(0,l.jsx)(`strong`,{children:`Sign-in method`}),` tab.`]}),(0,l.jsxs)(`li`,{children:[`Click `,(0,l.jsx)(`strong`,{children:`Email/Password`}),`, switch on the first toggle, also switch on `,(0,l.jsx)(`strong`,{children:`Email link (passwordless sign-in)`}),`, and `,(0,l.jsx)(`strong`,{children:`Save`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Click `,(0,l.jsx)(`strong`,{children:`Add provider`}),`, choose `,(0,l.jsx)(`strong`,{children:`Google`}),`, switch it on, pick your own address as the support email, and `,(0,l.jsx)(`strong`,{children:`Save`}),`. The app needs this for the `,(0,l.jsx)(`strong`,{children:`Sign in with Google`}),` button to work.`]}),(0,l.jsxs)(`li`,{children:[`Click `,(0,l.jsx)(`strong`,{children:`Add provider`}),`, choose `,(0,l.jsx)(`strong`,{children:`Anonymous`}),`, switch it on, and `,(0,l.jsx)(`strong`,{children:`Save`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Open the `,(0,l.jsx)(`strong`,{children:`Settings`}),` tab, then `,(0,l.jsx)(`strong`,{children:`Authorized domains`}),`. Your app has to be listed here or nobody can sign in.`]}),d?(0,l.jsxs)(`li`,{children:[(0,l.jsx)(`strong`,{children:`Nothing to add here yet.`}),` This app is being served from your own machine, and Firebase trusts that address from the start. Come back and add the real one the day you put your app on the internet.`]}):(0,l.jsxs)(`li`,{children:[(0,l.jsx)(`strong`,{children:`Your app's address is right here`}),` — copy it below, then in Firebase click `,(0,l.jsx)(`strong`,{children:`Add domain`}),`, paste it, and save.`]})]}),(0,l.jsx)(k,{})]}),(0,l.jsxs)(L,{number:u.database,title:`Create the database and publish its rules`,children:[(0,l.jsxs)(`ol`,{className:`space-y-2 list-decimal list-inside text-foreground/80 mb-4`,children:[(0,l.jsxs)(`li`,{children:[`In the Firebase menu, open `,(0,l.jsx)(`strong`,{children:`Firestore Database`}),` and click `,(0,l.jsx)(`strong`,{children:`Create database`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Pick `,(0,l.jsx)(`strong`,{children:`Standard edition`}),` if asked, choose the location closest to your people, start in `,(0,l.jsx)(`strong`,{children:`Production mode`}),`, and click Continue.`]}),(0,l.jsxs)(`li`,{children:[`In the box below, type the email address you will sign in with and click `,(0,l.jsx)(`strong`,{children:`Generate the rules`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Click `,(0,l.jsx)(`strong`,{children:`Copy the rules`}),`, then in Firebase open the `,(0,l.jsx)(`strong`,{children:`Rules`}),` tab, select everything that is there, paste over it, and click `,(0,l.jsx)(`strong`,{children:`Publish`}),`.`]})]}),(0,l.jsx)(F,{})]}),(0,l.jsxs)(L,{number:u.storage,title:`Create storage and publish its rules`,children:[(0,l.jsxs)(`ol`,{className:`space-y-2 list-decimal list-inside text-foreground/80 mb-4`,children:[(0,l.jsxs)(`li`,{children:[`In the Firebase menu, open `,(0,l.jsx)(`strong`,{children:`Storage`}),`. Google asks you to upgrade the project first: click `,(0,l.jsx)(`strong`,{children:`Upgrade project`}),` and pick the pay-as-you-go`,` `,(0,l.jsx)(`strong`,{children:`Blaze plan`}),`. Profile photos and attachments cost about $0.03 per gigabyte a month, so this is cents. Set a budget you are comfortable with (say $20), link a billing account, and continue.`]}),(0,l.jsxs)(`li`,{children:[`Click `,(0,l.jsx)(`strong`,{children:`Get started`}),`, choose a no-cost location, start in `,(0,l.jsx)(`strong`,{children:`Production mode`}),`, and click `,(0,l.jsx)(`strong`,{children:`Create`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Open the `,(0,l.jsx)(`strong`,{children:`Rules`}),` tab, select everything that is there, paste these over it, and click `,(0,l.jsx)(`strong`,{children:`Publish`}),`.`]}),(0,l.jsxs)(`li`,{children:[`Now Firebase shows the storage address at the top of the page — something like`,` `,`your-project.firebasestorage.app. `,(0,l.jsx)(`strong`,{children:`Copy that`}),`. This is the real one; the one Firebase showed you back in step `,u.webApp,` was a guess made before storage existed.`]}),s?(0,l.jsxs)(`li`,{children:[`Back in your `,(0,l.jsx)(`strong`,{children:`.env`}),` file, paste it into`,` `,(0,l.jsx)(`strong`,{children:`VITE_FIREBASE_STORAGE_BUCKET`}),` — the line you left empty.`]}):(0,l.jsxs)(`li`,{children:[`Back in the environment variables window from step `,u.keys,`, paste it into`,` `,(0,l.jsx)(`strong`,{children:`VITE_FIREBASE_STORAGE_BUCKET`}),` — the row you left empty.`]}),s?(0,l.jsxs)(`li`,{children:[(0,l.jsx)(`strong`,{children:`Start the app again.`}),` Stop it and start it once more — or just ask your assistant to restart it. A value added while it is running is not read until then. That is the last thing to do: then reload this page and your app is connected.`]}):(0,l.jsxs)(`li`,{children:[(0,l.jsx)(`strong`,{children:`Press Apply, then reload this page.`}),` Your app is connected.`]})]}),(0,l.jsx)(D,{code:C,label:`Copy the storage rules`})]})]}),(0,l.jsx)(R,{basename:r.basename})]}),(0,l.jsx)(i.t,{video:`setup`})]})]})}Object.defineProperty(exports,`a`,{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,`i`,{enumerable:!0,get:function(){return S}}),Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return A}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return z}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return D}});