docstoc
Paste your unpaid invoices. Get the follow-up email already written, in the right tone for how late it is.
docstoc never emails your clients for you — it drafts follow-ups you copy into Gmail, Outlook, or Apple Mail. Tone escalates with days overdue (friendly → firm → direct).
Live URLs
Worker PUBLIC_APP_URL is https://docstoc.io (magic links, OAuth callbacks, Stripe return URLs, digest links).
Legacy chasa.io / api.chasa.io 301 to docstoc (Pages _middleware.ts + worker redirect). See scripts/oauth-redirect-uris.md for provider console URIs.
Go-live checklist
- Attach
docstoc.io on Cloudflare Pages project chasa and wait for Active.
www.docstoc.io → apex: handled by apps/web/functions/_middleware.ts (redeploy web).chasa.io / www.chasa.io → docstoc.io: same middleware.api.chasa.io → api.docstoc.io: worker middleware in apps/worker/src/lib/legacyHostRedirect.ts.- Register OAuth redirect URIs on
api.docstoc.io — see scripts/oauth-redirect-uris.md.
- Optional DMARC:
./scripts/dmarc-remove-rua.sh (removes rua= from _dmarc.docstoc.io).
- Run
./scripts/go-live-verify.sh.
The order does not matter: browser-facing links are built from the origin the request came in on (see “App origin resolution” below), so pages.dev and chasa.io both keep working whichever is deployed first.
App origin resolution
Magic links, post-login redirects, Stripe return URLs and team invites use the origin the user is actually on, not PUBLIC_APP_URL. The Pages /api proxy forwards it as X-Docstoc-App-Origin, and the worker honours it only if it matches lib/appUrl.ts's allowlist (PUBLIC_APP_URL, docstoc.io, www.docstoc.io, legacy chasa.io hosts, *.pages.dev project/preview hosts, localhost). This keeps preview deploys self-contained and makes the domain cutover zero-downtime.
Requests that arrive without a trusted origin — provider OAuth callbacks hitting api.docstoc.io directly, and the digest cron — still fall back to PUBLIC_APP_URL.
Product specs
Plans & pricing
| Plan | Price | AI drafts | Team seats | Notes |
|---|
| Free | $0 | 5 / month (server-enforced) | 1 (owner only) | No signup required for drafts; sign in to upgrade |
| Pro | $14.99 / mo | Unlimited | 5 (owner + invites) | Flat workspace fee — not per-seat; most popular |
| Business | $39.99 / mo | Unlimited | 20 | Smart reply, risk score, demand letters, cert branding, SSL automation |
Stripe price IDs live in apps/worker/wrangler.toml as STRIPE_PRICE_SOLO (maps to Pro), STRIPE_PRICE_PRO / STRIPE_PRICE_ENTERPRISE (map to Business; non-secret). Billing portal and webhooks update accounts.plan and is_paid.
Feature matrix (by plan)
| Feature | Free | Pro+ |
|---|
| AI chase email drafts (tone by days overdue) | 5/mo | Unlimited |
15+ copy-paste email templates (/free-templates/) | ✓ | ✓ |
| CSV invoice upload (Tool) | ✓ | ✓ |
| Manual invoice list + aging board (Tool) | ✓ | ✓ |
| Rewrite softer / firmer / shorter | — | ✓ |
| Thank-you, reply-to-client, 3-step sequence, SMS/WhatsApp drafts | — | ✓ |
| Clients CRM + contact notes | — | ✓ |
| Aging sync (Tool → server) | — | ✓ |
| Reminder calendar (planned chase dates) | — | ✓ |
| Chase timeline + mark sent/paid | — | ✓ |
| Daily chase digest email (9 AM Eastern, approve-to-send) | — | ✓ |
| Reminder snooze + stop when marked paid | — | ✓ |
| Email open/click tracking on tracked HTML | — | ✓ |
| Default payment link (Stripe, PayPal, Venmo, Zelle…) | — | ✓ |
| Zapier templates (FreshBooks, Wave, Zoho Books) | — | ✓ |
| Smart reply classifier + promised pay date detection | — | Business |
| Client payment risk score | — | Business |
| Formal demand letter + collections evidence pack | — | Business |
| Custom certificate branding + SSL automation | — | Business |
| Custom branding (logo, late-fee hint) | — | ✓ (admin role) |
Outbound webhooks (chase.drafted, chase.sent, …) + HMAC signatures | — | ✓ (admin) |
| Click tracking (tracked copy HTML) | — | ✓ |
| Team invites (admin / member roles) | — | ✓ |
| Cloud storage PDF import (Dropbox, OneDrive, Box) | — | ✓ |
Workspace roles: owner is always admin. Invited members can use Pro+ features; admin-only actions: branding, webhooks, connector OAuth connect/import, API key CRUD, team invites.
App routes (/app/*)
| Route | Purpose |
|---|
/ | Tool — invoice list, AI drafts, CSV/PDF import, multi-select batch |
/login | Magic-link login + Cloudflare Turnstile |
/account | Plan, billing portal, payment link |
/team | Invite members, roles (Pro+) |
/clients | Client CRM (Pro+) |
/branding | Logo + late-fee hint (workspace admin) |
/webhooks | Outbound webhook URLs (workspace admin) |
/connector | Cloud storage + QBO/Xero OAuth + API keys |
/admin | Internal admin dashboard (separate cookie) |
All app routes except /login and /admin require a session. Unauthenticated users redirect to /login. SPA analytics require cookie consent (GDPR).
This is the beginning of the README. Read the rest at the original. Read the full README ↗
