fix: add /change-email route in index.ts + fix SQL query escaping in keys.ts

- Register GET /change-email route in src/index.ts (serves change-email.html)
- Fix updateKeyEmail() SQL query string (dollar signs were stripped by heredoc)
- Fix updateEmailByCustomer() SQL query string
- Rebuild TypeScript dist/

dist/index.js

@@ -196,6 +196,10 @@ app.get("/terms", (_req, res) => {
     res.setHeader('Cache-Control', 'public, max-age=86400');
     res.sendFile(path.join(__dirname, "../public/terms.html"));
 });
+app.get("/change-email", (_req, res) => {
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.sendFile(path.join(__dirname, "../public/change-email.html"));
+});
 app.get("/status", (_req, res) => {
     res.setHeader("Cache-Control", "public, max-age=60");
     res.sendFile(path.join(__dirname, "../public/status.html"));

dist/routes/billing.js

@@ -1,6 +1,6 @@
 import { Router } from "express";
 import Stripe from "stripe";
-import { createProKey, revokeByCustomer } from "../services/keys.js";
+import { createProKey, downgradeByCustomer, updateEmailByCustomer } from "../services/keys.js";
 import logger from "../services/logger.js";
 function escapeHtml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -18,6 +18,27 @@ function getStripe() {
 const router = Router();
 // Track provisioned session IDs to prevent duplicate key creation
 const provisionedSessions = new Set();
+const DOCFAST_PRODUCT_ID = "prod_TygeG8tQPtEAdE";
+// Returns true if the given Stripe subscription contains a DocFast product.
+// Used to filter webhook events — this Stripe account is shared with other projects.
+async function isDocFastSubscription(subscriptionId) {
+    try {
+        const sub = await getStripe().subscriptions.retrieve(subscriptionId, {
+            expand: ["items.data.price.product"],
+        });
+        return sub.items.data.some((item) => {
+            const price = item.price;
+            const productId = typeof price?.product === "string"
+                ? price.product
+                : price?.product?.id;
+            return productId === DOCFAST_PRODUCT_ID;
+        });
+    }
+    catch (err) {
+        logger.error({ err, subscriptionId }, "isDocFastSubscription: failed to retrieve subscription");
+        return false;
+    }
+}
 // Create a Stripe Checkout session for Pro subscription
 router.post("/checkout", async (_req, res) => {
     try {
@@ -114,7 +135,6 @@ router.post("/webhook", async (req, res) => {
             const customerId = session.customer;
             const email = session.customer_details?.email;
             // Filter by product — this Stripe account is shared with other projects
-            const DOCFAST_PRODUCT_ID = "prod_TygeG8tQPtEAdE";
             try {
                 const fullSession = await getStripe().checkout.sessions.retrieve(session.id, {
                     expand: ["line_items"],
@@ -143,11 +163,44 @@ router.post("/webhook", async (req, res) => {
             logger.info({ email, customerId }, "checkout.session.completed: provisioned pro key");
             break;
         }
+        case "customer.subscription.updated": {
+            const sub = event.data.object;
+            const customerId = sub.customer;
+            const shouldDowngrade = sub.status === "canceled" ||
+                sub.status === "past_due" ||
+                sub.status === "unpaid" ||
+                sub.cancel_at_period_end === true;
+            if (shouldDowngrade) {
+                if (!(await isDocFastSubscription(sub.id))) {
+                    logger.info({ subscriptionId: sub.id }, "customer.subscription.updated: ignoring event for different product");
+                    break;
+                }
+                await downgradeByCustomer(customerId);
+                logger.info({ customerId, status: sub.status, cancelAtPeriodEnd: sub.cancel_at_period_end }, "customer.subscription.updated: downgraded key to free tier");
+            }
+            break;
+        }
         case "customer.subscription.deleted": {
             const sub = event.data.object;
             const customerId = sub.customer;
-            await revokeByCustomer(customerId);
+            if (!(await isDocFastSubscription(sub.id))) {
-            logger.info({ customerId }, "Subscription cancelled, key revoked");
+                logger.info({ subscriptionId: sub.id }, "customer.subscription.deleted: ignoring event for different product");
+                break;
+            }
+            await downgradeByCustomer(customerId);
+            logger.info({ customerId }, "customer.subscription.deleted: downgraded key to free tier");
+            break;
+        }
+        case "customer.updated": {
+            const customer = event.data.object;
+            const customerId = customer.id;
+            const newEmail = customer.email;
+            if (customerId && newEmail) {
+                const updated = await updateEmailByCustomer(customerId, newEmail);
+                if (updated) {
+                    logger.info({ customerId, newEmail }, "Customer email synced from Stripe");
+                }
+            }
             break;
         }
         default:

dist/services/keys.js

@@ -77,12 +77,11 @@ export async function createProKey(email, stripeCustomerId) {
     keysCache.push(entry);
     return entry;
 }
-export async function revokeByCustomer(stripeCustomerId) {
+export async function downgradeByCustomer(stripeCustomerId) {
-    const idx = keysCache.findIndex((k) => k.stripeCustomerId === stripeCustomerId);
+    const entry = keysCache.find((k) => k.stripeCustomerId === stripeCustomerId);
-    if (idx >= 0) {
+    if (entry) {
-        const key = keysCache[idx].key;
+        entry.tier = "free";
-        keysCache.splice(idx, 1);
+        await pool.query("UPDATE api_keys SET tier = 'free' WHERE stripe_customer_id = $1", [stripeCustomerId]);
-        await pool.query("DELETE FROM api_keys WHERE key = $1", [key]);
         return true;
     }
     return false;
@@ -98,3 +97,11 @@ export async function updateKeyEmail(apiKey, newEmail) {
     await pool.query("UPDATE api_keys SET email = $1 WHERE key = $2", [newEmail, apiKey]);
     return true;
 }
+export async function updateEmailByCustomer(stripeCustomerId, newEmail) {
+    const entry = keysCache.find(k => k.stripeCustomerId === stripeCustomerId);
+    if (!entry)
+        return false;
+    entry.email = newEmail;
+    await pool.query("UPDATE api_keys SET email = $1 WHERE stripe_customer_id = $2", [newEmail, stripeCustomerId]);
+    return true;
+}

public/impressum.html

@@ -20,7 +20,7 @@ body { font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Robo
 a { color: var(--accent); text-decoration: none; transition: color 0.2s; }
 a:hover { color: var(--accent-hover); }
 .container { max-width: 800px; margin: 0 auto; padding: 0 24px; }
-nav { padding: 20px 0; border-bottom: 1px solid var(--border); position: sticky; top: 0; background: var(--bg); z-index: 100; }
+nav { padding: 20px 0; border-bottom: 1px solid var(--border); }
 nav .container { display: flex; align-items: center; justify-content: space-between; }
 .logo { font-size: 1.25rem; font-weight: 700; letter-spacing: -0.5px; color: var(--fg); display: flex; align-items: center; gap: 8px; text-decoration: none; }
 .logo span { color: var(--accent); }
@@ -44,8 +44,6 @@ footer .container { display: flex; justify-content: space-between; align-items:
   footer .container { flex-direction: column; text-align: center; }
   .nav-links { gap: 16px; }
 }
-
-.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
 </style>
 </head>
 <body>
@@ -98,8 +96,9 @@ footer .container { display: flex; justify-content: space-between; align-items:
     <div class="footer-links">
       <a href="/">Home</a>
       <a href="/docs">Docs</a>
-      <a href="/status">API Status</a>
+      <a href="/health">API Status</a>
-      <a href="/change-email">Change Email</a>
+      <a href="/#change-email" class="open-email-change">Change Email</a>
+      <a href="mailto:support@docfast.dev">Support</a>
       <a href="/impressum">Impressum</a>
       <a href="/privacy">Privacy Policy</a>
       <a href="/terms">Terms of Service</a>

public/index.html

@@ -17,7 +17,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"SoftwareApplication","name":"DocFast","url":"https://docfast.dev","applicationCategory":"DeveloperApplication","operatingSystem":"Web","description":"Convert HTML and Markdown to beautiful PDFs with a simple API call. Fast, reliable, developer-friendly.","offers":[{"@type":"Offer","price":"0","priceCurrency":"EUR","name":"Free","description":"100 PDFs/month"},{"@type":"Offer","price":"9","priceCurrency":"EUR","name":"Pro","description":"2,500 PDFs per month","billingIncrement":"P1M"}]}
+{"@context":"https://schema.org","@type":"SoftwareApplication","name":"DocFast","url":"https://docfast.dev","applicationCategory":"DeveloperApplication","operatingSystem":"Web","description":"Convert HTML and Markdown to beautiful PDFs with a simple API call. Fast, reliable, developer-friendly.","offers":[{"@type":"Offer","price":"0","priceCurrency":"EUR","name":"Free","description":"100 PDFs/month"},{"@type":"Offer","price":"9","priceCurrency":"EUR","name":"Pro","description":"5,000 PDFs per month","billingIncrement":"P1M"}]}
 </script>
 <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>⚡</text></svg>">
 <style>
@@ -25,44 +25,22 @@
 :root {
   --bg: #0b0d11; --bg2: #12151c; --fg: #e4e7ed; --muted: #7a8194;
   --accent: #34d399; --accent-hover: #5eead4; --accent-glow: rgba(52,211,153,0.12);
-  --card: #151922; --border: #1e2433;
+  --accent2: #60a5fa; --card: #151922; --border: #1e2433;
   --radius: 12px; --radius-lg: 16px;
 }
 body { font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--fg); line-height: 1.65; -webkit-font-smoothing: antialiased; }
 a { color: var(--accent); text-decoration: none; transition: color 0.2s; }
 a:hover { color: var(--accent-hover); }
-.container { max-width: 800px; margin: 0 auto; padding: 0 24px; }
+.container { max-width: 1020px; margin: 0 auto; padding: 0 24px; }
-nav { padding: 20px 0; border-bottom: 1px solid var(--border); position: sticky; top: 0; background: var(--bg); z-index: 100; }
+
+/* Nav */
+nav { padding: 20px 0; border-bottom: 1px solid var(--border); }
 nav .container { display: flex; align-items: center; justify-content: space-between; }
-.logo { font-size: 1.25rem; font-weight: 700; letter-spacing: -0.5px; color: var(--fg); display: flex; align-items: center; gap: 8px; text-decoration: none; }
+.logo { font-size: 1.25rem; font-weight: 700; letter-spacing: -0.5px; color: var(--fg); display: flex; align-items: center; gap: 8px; }
 .logo span { color: var(--accent); }
 .nav-links { display: flex; gap: 28px; align-items: center; }
 .nav-links a { color: var(--muted); font-size: 0.9rem; font-weight: 500; }
 .nav-links a:hover { color: var(--fg); }
-.content { padding: 60px 0; min-height: 60vh; }
-.content h1 { font-size: 2rem; font-weight: 800; margin-bottom: 32px; letter-spacing: -1px; }
-.content h2 { font-size: 1.3rem; font-weight: 700; margin: 32px 0 16px; color: var(--fg); }
-.content h3 { font-size: 1.1rem; font-weight: 600; margin: 24px 0 12px; color: var(--fg); }
-.content p, .content li { color: var(--muted); margin-bottom: 12px; }
-.content ul, .content ol { padding-left: 24px; }
-.content strong { color: var(--fg); }
-footer { padding: 32px 0; border-top: 1px solid var(--border); margin-top: 60px; }
-footer .container { display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 16px; }
-.footer-left { color: var(--muted); font-size: 0.85rem; }
-.footer-links { display: flex; gap: 20px; flex-wrap: wrap; }
-.footer-links a { color: var(--muted); font-size: 0.85rem; }
-.footer-links a:hover { color: var(--fg); }
-@media (max-width: 768px) {
-  footer .container { flex-direction: column; text-align: center; }
-  .nav-links { gap: 16px; }
-}
-
-.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
-</style>
-<style>
-/* Index-page extra vars */
-:root { --accent2: #60a5fa; }
-.container { max-width: 1020px; }
 
 /* Hero */
 .hero { padding: 100px 0 80px; text-align: center; position: relative; }
@@ -143,10 +121,13 @@ section { position: relative; }
   .eu-icon { font-size: 2.5rem; }
 }
 
-/* Footer (index override) */
+/* Footer */
-footer { padding: 40px 0; }
+footer { padding: 40px 0; border-top: 1px solid var(--border); }
 footer .container { display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 16px; }
-.footer-links { gap: 24px; }
+.footer-left { color: var(--muted); font-size: 0.85rem; }
+.footer-links { display: flex; gap: 24px; flex-wrap: wrap; }
+.footer-links a { color: var(--muted); font-size: 0.85rem; }
+.footer-links a:hover { color: var(--fg); }
 
 /* Modal */
 .modal-overlay { display: none; position: fixed; inset: 0; background: rgba(0,0,0,0.75); backdrop-filter: blur(4px); z-index: 100; align-items: center; justify-content: center; }
@@ -175,20 +156,6 @@ footer .container { display: flex; align-items: center; justify-content: space-b
 .warning-box .icon { font-size: 1.1rem; flex-shrink: 0; }
 .signup-error { color: #f87171; font-size: 0.85rem; margin-bottom: 16px; display: none; padding: 10px 14px; background: rgba(248,113,113,0.06); border: 1px solid rgba(248,113,113,0.15); border-radius: 8px; }
 
-/* Recovery modal states */
-#recoverInitial, #recoverLoading, #recoverVerify, #recoverResult { display: none; }
-#recoverInitial.active { display: block; }
-#recoverLoading.active { display: flex; flex-direction: column; align-items: center; padding: 40px 0; text-align: center; }
-#recoverResult.active { display: block; }
-#recoverVerify.active { display: block; }
-
-/* Email change modal states */
-#emailChangeInitial, #emailChangeLoading, #emailChangeVerify, #emailChangeResult { display: none; }
-#emailChangeInitial.active { display: block; }
-#emailChangeLoading.active { display: flex; flex-direction: column; align-items: center; padding: 40px 0; text-align: center; }
-#emailChangeResult.active { display: block; }
-#emailChangeVerify.active { display: block; }
-
 /* Responsive */
 @media (max-width: 640px) {
   .hero { padding: 72px 0 56px; }
@@ -226,9 +193,9 @@ footer .container { display: flex; align-items: center; justify-content: space-b
   }
 }
 
-/* Mobile overflow fixes — overflow-x: clip (not hidden) preserves position:sticky */
+/* Additional mobile overflow fixes */
 html, body {
-  overflow-x: clip !important;
+  overflow-x: hidden !important;
   max-width: 100vw !important;
 }
 
@@ -237,7 +204,7 @@ html, body {
     max-width: 100% !important;
   }
   body { 
-    overflow-x: clip !important; 
+    overflow-x: hidden !important; 
   }
   .container { 
     overflow-x: hidden !important; 
@@ -279,6 +246,20 @@ html, body {
   }
 }
 
+/* Recovery modal states */
+#recoverInitial, #recoverLoading, #recoverVerify, #recoverResult { display: none; }
+#recoverInitial.active { display: block; }
+#recoverLoading.active { display: flex; flex-direction: column; align-items: center; padding: 40px 0; text-align: center; }
+#recoverResult.active { display: block; }
+#recoverVerify.active { display: block; }
+
+/* Email change modal states */
+#emailChangeInitial, #emailChangeLoading, #emailChangeVerify, #emailChangeResult { display: none; }
+#emailChangeInitial.active { display: block; }
+#emailChangeLoading.active { display: flex; flex-direction: column; align-items: center; padding: 40px 0; text-align: center; }
+#emailChangeResult.active { display: block; }
+#emailChangeVerify.active { display: block; }
+
 /* Focus-visible for accessibility */
 .btn:focus-visible, a:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
 </style>
@@ -292,15 +273,14 @@ html, body {
   <div class="container">
     <a href="/" class="logo">⚡ Doc<span>Fast</span></a>
     <div class="nav-links">
-      <a href="/#features">Features</a>
+      <a href="#features">Features</a>
-      <a href="/#pricing">Pricing</a>
+      <a href="#pricing">Pricing</a>
       <a href="/docs">Docs</a>
     </div>
   </div>
 </nav>
 
-<main role="main">
+<main class="hero" role="main">
-<section class="hero">
   <div class="container">
     <div class="badge">🚀 Simple PDF API for Developers</div>
     <h1>HTML to <span class="gradient">PDF</span><br>in one API call</h1>
@@ -326,7 +306,7 @@ html, body {
       </div>
     </div>
   </div>
-</section>
+</main>
 
 <section class="trust">
   <div class="container">
@@ -356,7 +336,7 @@ html, body {
     <div class="eu-badge">
       <div class="eu-icon">🇪🇺</div>
       <div class="eu-content">
-        <h2>Hosted in the EU</h2>
+        <h3>Hosted in the EU</h3>
         <p>Your data never leaves the EU • GDPR Compliant • Hetzner Germany (Nuremberg)</p>
       </div>
     </div>
@@ -424,7 +404,7 @@ html, body {
         <div class="price-amount">€9<span> /mo</span></div>
         <div class="price-desc">For production apps and businesses</div>
         <ul class="price-features">
-<li>2,500 PDFs per month</li>
+<li>5,000 PDFs per month</li>
           <li>All conversion endpoints</li>
           <li>All templates included</li>
           <li>Priority support (<a href="mailto:support@docfast.dev">support@docfast.dev</a>)</li>
@@ -435,16 +415,15 @@ html, body {
   </div>
 </section>
 
-</main>
-
 <footer aria-label="Footer">
   <div class="container">
     <div class="footer-left">© 2026 DocFast. Fast PDF generation for developers.</div>
     <div class="footer-links">
       <a href="/">Home</a>
       <a href="/docs">Docs</a>
-      <a href="/status">API Status</a>
+      <a href="/health">API Status</a>
-      <a href="/change-email">Change Email</a>
+      <a href="/#change-email" class="open-email-change">Change Email</a>
+      <a href="mailto:support@docfast.dev">Support</a>
       <a href="/impressum">Impressum</a>
       <a href="/privacy">Privacy Policy</a>
       <a href="/terms">Terms of Service</a>
@@ -455,13 +434,12 @@ html, body {
 <!-- Signup Modal -->
 <div class="modal-overlay" id="signupModal" role="dialog" aria-label="Sign up for API key">
   <div class="modal">
-    <button class="close" id="btn-close-signup" aria-label="Close">&times;</button>
+    <button class="close" id="btn-close-signup">&times;</button>
 
     <div id="signupInitial" class="active">
       <h2>Get your free API key</h2>
       <p>Enter your email to get started. No credit card required.</p>
       <div class="signup-error" id="signupError"></div>
-      <label for="signupEmail" class="sr-only">Email address</label>
       <input type="email" id="signupEmail" placeholder="your.email@example.com" style="width:100%;padding:12px;border:1px solid var(--border);background:var(--bg);color:var(--fg);border-radius:8px;font-size:0.9rem;margin-bottom:16px;" required>
       <button class="btn btn-primary" style="width:100%" id="signupBtn">Generate API Key →</button>
       <p style="margin-top:16px;color:var(--muted);font-size:0.8rem;text-align:center;">100 free PDFs/month • All endpoints included<br><a href="#" class="open-recover" style="color:var(--muted)">Lost your API key? Recover it →</a></p>
@@ -476,7 +454,6 @@ html, body {
       <h2>Enter verification code</h2>
       <p>We sent a 6-digit code to <strong id="verifyEmailDisplay"></strong></p>
       <div class="signup-error" id="verifyError"></div>
-      <label for="verifyCode" class="sr-only">Verification code</label>
       <input type="text" id="verifyCode" placeholder="123456" maxlength="6" pattern="[0-9]{6}" inputmode="numeric" style="width:100%;padding:14px;border:1px solid var(--border);background:var(--bg);color:var(--fg);border-radius:8px;font-size:1.4rem;letter-spacing:0.3em;text-align:center;margin-bottom:16px;font-family:monospace;" required>
       <button class="btn btn-primary" style="width:100%" id="verifyBtn">Verify →</button>
       <p style="margin-top:16px;color:var(--muted);font-size:0.8rem;text-align:center;">Code expires in 15 minutes</p>
@@ -499,15 +476,14 @@ html, body {
 
 
 <!-- Recovery Modal -->
-<div class="modal-overlay" id="recoverModal" role="dialog" aria-modal="true" aria-label="Recover API key">
+<div class="modal-overlay" id="recoverModal" role="dialog" aria-label="Recover API key">
   <div class="modal">
-    <button class="close" id="btn-close-recover" aria-label="Close">&times;</button>
+    <button class="close" id="btn-close-recover">&times;</button>
 
     <div id="recoverInitial" class="active">
       <h2>Recover your API key</h2>
       <p>Enter the email you signed up with. We'll send a verification code.</p>
       <div class="signup-error" id="recoverError"></div>
-      <label for="recoverEmailInput" class="sr-only">Email address</label>
       <input type="email" id="recoverEmailInput" placeholder="your.email@example.com" style="width:100%;padding:12px;border:1px solid var(--border);background:var(--bg);color:var(--fg);border-radius:8px;font-size:0.9rem;margin-bottom:16px;" required>
       <button class="btn btn-primary" style="width:100%" id="recoverBtn">Send Verification Code →</button>
       <p style="margin-top:16px;color:var(--muted);font-size:0.8rem;text-align:center;">Your key will be shown here after verification — never sent via email</p>
@@ -522,7 +498,6 @@ html, body {
       <h2>Enter verification code</h2>
       <p>We sent a 6-digit code to <strong id="recoverEmailDisplay"></strong></p>
       <div class="signup-error" id="recoverVerifyError"></div>
-      <label for="recoverCode" class="sr-only">Verification code</label>
       <input type="text" id="recoverCode" placeholder="123456" maxlength="6" pattern="[0-9]{6}" inputmode="numeric" style="width:100%;padding:14px;border:1px solid var(--border);background:var(--bg);color:var(--fg);border-radius:8px;font-size:1.4rem;letter-spacing:0.3em;text-align:center;margin-bottom:16px;font-family:monospace;" required>
       <button class="btn btn-primary" style="width:100%" id="recoverVerifyBtn">Verify →</button>
       <p style="margin-top:16px;color:var(--muted);font-size:0.8rem;text-align:center;">Code expires in 15 minutes</p>
@@ -544,7 +519,43 @@ html, body {
 </div>
 
 
-<script src="/app.js"></script>
+<!-- Email Change Modal -->
+<div class="modal-overlay" id="emailChangeModal" role="dialog" aria-label="Change email">
+  <div class="modal">
+    <button class="close" id="btn-close-email-change">&times;</button>
 
+    <div id="emailChangeInitial" class="active">
+      <h2>Change your email</h2>
+      <p>Enter your API key and new email address.</p>
+      <div class="signup-error" id="emailChangeError"></div>
+      <input type="text" id="emailChangeApiKey" placeholder="Your API key (df_free_... or df_pro_...)" style="width:100%;padding:12px;border:1px solid var(--border);background:var(--bg);color:var(--fg);border-radius:8px;font-size:0.9rem;margin-bottom:12px;font-family:monospace;" required>
+      <input type="email" id="emailChangeNewEmail" placeholder="new.email@example.com" style="width:100%;padding:12px;border:1px solid var(--border);background:var(--bg);color:var(--fg);border-radius:8px;font-size:0.9rem;margin-bottom:16px;" required>
+      <button class="btn btn-primary" style="width:100%" id="emailChangeBtn">Send Verification Code →</button>
+      <p style="margin-top:16px;color:var(--muted);font-size:0.8rem;text-align:center;">A verification code will be sent to your new email</p>
+    </div>
+
+    <div id="emailChangeLoading">
+      <div class="spinner"></div>
+      <p style="color:var(--muted);margin:0">Sending verification code…</p>
+    </div>
+
+    <div id="emailChangeVerify">
+      <h2>Enter verification code</h2>
+      <p>We sent a 6-digit code to <strong id="emailChangeEmailDisplay"></strong></p>
+      <div class="signup-error" id="emailChangeVerifyError"></div>
+      <input type="text" id="emailChangeCode" placeholder="123456" maxlength="6" pattern="[0-9]{6}" inputmode="numeric" style="width:100%;padding:14px;border:1px solid var(--border);background:var(--bg);color:var(--fg);border-radius:8px;font-size:1.4rem;letter-spacing:0.3em;text-align:center;margin-bottom:16px;font-family:monospace;" required>
+      <button class="btn btn-primary" style="width:100%" id="emailChangeVerifyBtn">Verify →</button>
+      <p style="margin-top:16px;color:var(--muted);font-size:0.8rem;text-align:center;">Code expires in 15 minutes</p>
+    </div>
+
+    <div id="emailChangeResult">
+      <h2>✅ Email updated!</h2>
+      <p>Your account email has been changed to <strong id="emailChangeNewDisplay"></strong></p>
+      <p style="margin-top:20px;color:var(--muted);font-size:0.9rem;"><a href="/docs">Read the docs →</a></p>
+    </div>
+  </div>
+</div>
+
+<script src="/app.js"></script>
 </body>
 </html>

public/privacy.html

@@ -20,7 +20,7 @@ body { font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Robo
 a { color: var(--accent); text-decoration: none; transition: color 0.2s; }
 a:hover { color: var(--accent-hover); }
 .container { max-width: 800px; margin: 0 auto; padding: 0 24px; }
-nav { padding: 20px 0; border-bottom: 1px solid var(--border); position: sticky; top: 0; background: var(--bg); z-index: 100; }
+nav { padding: 20px 0; border-bottom: 1px solid var(--border); }
 nav .container { display: flex; align-items: center; justify-content: space-between; }
 .logo { font-size: 1.25rem; font-weight: 700; letter-spacing: -0.5px; color: var(--fg); display: flex; align-items: center; gap: 8px; text-decoration: none; }
 .logo span { color: var(--accent); }
@@ -44,8 +44,6 @@ footer .container { display: flex; justify-content: space-between; align-items:
   footer .container { flex-direction: column; text-align: center; }
   .nav-links { gap: 16px; }
 }
-
-.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
 </style>
 </head>
 <body>
@@ -180,8 +178,9 @@ footer .container { display: flex; justify-content: space-between; align-items:
     <div class="footer-links">
       <a href="/">Home</a>
       <a href="/docs">Docs</a>
-      <a href="/status">API Status</a>
+      <a href="/health">API Status</a>
-      <a href="/change-email">Change Email</a>
+      <a href="/#change-email" class="open-email-change">Change Email</a>
+      <a href="mailto:support@docfast.dev">Support</a>
       <a href="/impressum">Impressum</a>
       <a href="/privacy">Privacy Policy</a>
       <a href="/terms">Terms of Service</a>

public/terms.html

@@ -20,7 +20,7 @@ body { font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Robo
 a { color: var(--accent); text-decoration: none; transition: color 0.2s; }
 a:hover { color: var(--accent-hover); }
 .container { max-width: 800px; margin: 0 auto; padding: 0 24px; }
-nav { padding: 20px 0; border-bottom: 1px solid var(--border); position: sticky; top: 0; background: var(--bg); z-index: 100; }
+nav { padding: 20px 0; border-bottom: 1px solid var(--border); }
 nav .container { display: flex; align-items: center; justify-content: space-between; }
 .logo { font-size: 1.25rem; font-weight: 700; letter-spacing: -0.5px; color: var(--fg); display: flex; align-items: center; gap: 8px; text-decoration: none; }
 .logo span { color: var(--accent); }
@@ -44,8 +44,6 @@ footer .container { display: flex; justify-content: space-between; align-items:
   footer .container { flex-direction: column; text-align: center; }
   .nav-links { gap: 16px; }
 }
-
-.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
 </style>
 </head>
 <body>
@@ -140,7 +138,7 @@ footer .container { display: flex; justify-content: space-between; align-items:
     <ul>
       <li><strong>Target:</strong> 99.5% uptime (best effort, no SLA for free tier)</li>
       <li><strong>Maintenance:</strong> Scheduled maintenance with advance notice</li>
-      <li><strong>Status page:</strong> <a href="/status">https://docfast.dev/status</a></li>
+      <li><strong>Status page:</strong> <a href="/health">https://docfast.dev/health</a></li>
     </ul>
 
     <h3>5.2 Performance</h3>
@@ -252,8 +250,9 @@ footer .container { display: flex; justify-content: space-between; align-items:
     <div class="footer-links">
       <a href="/">Home</a>
       <a href="/docs">Docs</a>
-      <a href="/status">API Status</a>
+      <a href="/health">API Status</a>
-      <a href="/change-email">Change Email</a>
+      <a href="/#change-email" class="open-email-change">Change Email</a>
+      <a href="mailto:support@docfast.dev">Support</a>
       <a href="/impressum">Impressum</a>
       <a href="/privacy">Privacy Policy</a>
       <a href="/terms">Terms of Service</a>

src/index.ts

@@ -217,6 +217,11 @@ app.get("/terms", (_req, res) => {
   res.sendFile(path.join(__dirname, "../public/terms.html"));
 });
 
+app.get("/change-email", (_req, res) => {
+  res.setHeader('Cache-Control', 'public, max-age=3600');
+  res.sendFile(path.join(__dirname, "../public/change-email.html"));
+});
+
 app.get("/status", (_req, res) => {
   res.setHeader("Cache-Control", "public, max-age=60");
   res.sendFile(path.join(__dirname, "../public/status.html"));

src/services/keys.ts

@@ -134,6 +134,6 @@ export async function updateEmailByCustomer(stripeCustomerId: string, newEmail:
   const entry = keysCache.find(k => k.stripeCustomerId === stripeCustomerId);
   if (!entry) return false;
   entry.email = newEmail;
-  await pool.query(UPDATE api_keys SET email = $1 WHERE stripe_customer_id = $2, [newEmail, stripeCustomerId]);
+  await pool.query("UPDATE api_keys SET email = $1 WHERE stripe_customer_id = $2", [newEmail, stripeCustomerId]);
   return true;
 }