BookifAI — Phases 1–4 shipped live (2026-07-10)

What Sondra asked

After Phase 0 (money-path fixes) landed, she said: skip Phase 0b (server-side assembly) "if we're skipping that for right now that's fine," and "continue doing phase one through four and finish this and don't bother me unless you absolutely need something" — fully autonomous, only surface a true can't-do-it blocker.

Shipped + LIVE (bookifai.app) — commit f0b62c0 (LOCAL only, not pushed, matches practice)

Phase 1 — shared shell/nav (root-cause fix for 4 complaints at once)

• NEW src/components/Shell.tsx — one app frame (sidebar + sticky header with **Sign Out

on EVERY page**, was Dashboard-only). Dashboard / MyBooks / Templates / Account now render <Shell>{content}</Shell> instead of each rebuilding its own sidebar+header.

• AppSidebar rebuilt — full nav: Dashboard · My Books · Templates · Buy Credits ·

KDP Resources · Account · Help & Support · conditional Admin (her email only) · Home. Plus a live credits box (books/images + "Buy credits" button) so buying is never buried in Account.

• Landing widened max-w-6xl → max-w-7xl across Index + 6 landing sections (the "tiny home

page").

• NEW src/lib/admin.ts — single isAdminEmail() source of truth (client show/hide only).

Phase 2 — surface security

• **CORS pinned off *** — new corsFor(req) allowlist in _shared/constants.ts reflects only

.bookifai.app / .pages.dev / localhost, else pins to https://bookifai.app. Wired into 10 edge functions (the trick: const corsHeaders = corsFor(req) as line 1 of each serve, so every existing reference keeps working). Verified live: bookifai.app origin reflected, evil origin pinned/blocked.

• DOMPurify sanitize — src/lib/sanitize.ts; book-export.ts's markdownToHtml now scrubs

the marked→HTML output before it hits innerHTML (self-XSS on the export path). NOTE: the prior handoff said "DOMPurify already bundled" — it was not; installed dompurify (+types). (The in-app editor uses TipTap, which already parses to a safe schema — that path was fine.)

• Password min length 6 → 8 via the Management API. **HIBP breached-password protection is a

Supabase Pro-plan feature** — it silently no-ops on the free project; left OFF, flagged.

Phase 3 — parity builds

• NEW admin edge fn — server-gated on the caller's verified email (ADMIN_EMAILS, service

role only reached after the gate). Returns stats (users, books, paid books, purchases, revenue, refunds) + the full support-message inbox. Verified: 401 unauthenticated.

• NEW src/pages/Admin.tsx (/admin) — stat tiles + support inbox; client-guarded (redirects

non-admins), server re-checks.

• NEW src/pages/KdpResources.tsx (/kdp-resources) — 4-step publish guide + official KDP links.
• Onboarding — first-run "how it works" 3-step card on Dashboard when the user has 0 books.
• Templates — added Children's Picture Book, Fiction & Novel, Cookbook cards + "any book" copy

on the Templates header and the landing hero.

Phase 4 — Google consent branding = HER manual step (the one true blocker)

Google OAuth consent-screen branding lives in Google Cloud Console (project → APIs & Services → OAuth consent screen → set app name/logo) so the sign-in popup shows "BookifAI" instead of the raw umnlokuehteqwrheoyai.supabase.co URL. Cannot be done without her Google account. Nothing else blocks.

Verified

• npx tsc --noEmit clean · npm run build ok.
• Live: CORS reflects bookifai.app / pins evil origin; admin + authorize-export return 401

unauthenticated (money + admin gates intact); apex serves the new bundle (index-CwnFOMtl.js); landing + /dashboard→/auth redirect render with 0 console errors (Playwright).

• No money-path regression: this session changed CORS/admin/nav/sanitize, NOT the

payment/credit/entitlement logic (Phase 0 gates untouched, re-verified 401).

Deploy state

• 11 edge functions deployed via Supabase CLI (admin + 10 CORS-hardened) to umnlokuehteqwrheoyai.
• Frontend deployed to Cloudflare Pages bookifai (Production, branch main).
• Commit f0b62c0 local-only (unpushed — remote is lovable-remix upstream, matches prior practice).

Open — all Sondra's

1. 🥇 TOP PRIORITY (her explicit ask 2026-07-10): put the launch "gold" on /kdp-resources.

That page currently has only generic publish steps. She wants buyers to get the deep-research launch tactics "for what they paid for." Source (already in repo): PROJECTS/Bookify AI Studio/knowledge/KDP-Childrens-Book-Guide.md (38KB) + Amazon-Book-Discovery-A10.md (17KB, Amazon A10 discovery/launch). Next session: distill both into a buyer-facing "How to launch your book successfully" section on src/pages/KdpResources.tsx (any-book, not just children's) → rebuild → redeploy bookifai. Content-only, no money change.

2. Test buy: she already bought once (money path proven) — no NEW purchase needed for this

work. Refund-clawback can be proven by refunding her EXISTING purchase in Stripe (optional).

3. Google: sign-in is ON + working (verified external_google_enabled=true, client_id set).

The only open Google piece is the cosmetic consent-screen branding (Cloud Console → OAuth consent screen → app name/logo), so the popup shows "BookifAI". Her manual step.

4. Logged-in eyeball of the new Shell nav / credits box / onboarding card / Admin page — couldn't

test without her login + email OTP.

5. Deferred (unchanged): Phase 3.5 Import-Your-Book (needs mammoth.js OK + its own PRD),

Phase 0b server-side assembly, HIBP if she ever upgrades to Supabase Pro.

6. Before any wide launch push / after the money path changes again → re-run /app-safety-check

(the launch-gold content itself is a safe content-only edit).