backend-manager 5.0.104 → 5.0.106

package/CHANGELOG.md

@@ -14,6 +14,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.0.104] - 2026-03-02
+### Added
+- `POST /payments/cancel`: cancels subscription at period end via processor abstraction (Stripe sets `cancel_at_period_end=true`; test processor writes webhook directly into the Firestore pipeline).
+- `POST /payments/portal`: creates Stripe Billing Portal session with cancellation disabled (users must use the cancel endpoint).
+- Payment transition pipeline: `transitions/index.js` detects all subscription state changes (new-subscription, payment-failed, payment-recovered, cancellation-requested, subscription-cancelled, plan-changed) and one-time transitions (purchase-completed, purchase-failed). Handlers fire-and-forget, send transactional emails.
+- Payment analytics: `analytics.js` tracks GA4 payment events for all transitions (non-blocking, skipped in tests).
+- Shared payment processor libraries: `payment/processors/stripe.js` (toUnifiedSubscription, toUnifiedOneTime, resolveCustomer, resolvePriceId, fetchResource), `payment/processors/paypal.js`, `payment/processors/test.js`, `payment/order-id.js`.
+- `Email` library (`libraries/email.js`): shared transactional email via SendGrid, used by transition handlers and admin routes.
+- `infer-contact.js` library: infers user name from payment processor data, auto-fills on first purchase.
+- `routes/user/data-request/` (get/post/delete): GDPR data request endpoints.
+- `cron/daily/data-requests.js`: daily cron to process pending GDPR data requests.
+- CLI commands: `auth` (get/list/delete/set-claims), `firestore` (get/set/query/delete), `firebase-init`, `emulator` (renamed from `emulators`).
+- `setup-tests/firestore-indexes-required.js`: validates required Firestore indexes exist before tests run.
+- Comprehensive payment test suite: journey tests for one-time purchase, one-time failure, payment failure, plan change, cancel endpoint; route validation tests for cancel and portal; unit tests for `toUnifiedOneTime()`, `stripe-parse-webhook`, `infer-contact`, `email`; real Stripe CLI fixtures.
+- Dedicated isolated test accounts for every mutating payment test (no shared state between tests).
+
+### Changed
+- `admin/email/post.js`, `general/email/post.js`: refactored to delegate to shared Email library (~400 lines removed from each).
+- `marketing/contact/post.js`, `api/general/add-marketing-contact.js`: delegate to infer-contact + marketing library.
+- `user/signup/post.js`: rewritten with new middleware pattern.
+- `auth/on-create.js`: simplified, inline logic moved to middleware.
+- `api/admin/send-email.js`: removed `ensureUnique` and SendGrid contact name lookup (handled by Email library).
+- All admin routes: middleware pattern cleanup.
+- `config.payment.products` now supports `type: 'one-time'` products with `prices.once` key.
+- Test runner: improved discovery, filtering, and output formatting.
+
+### Removed
+- `src/manager/libraries/stripe.js`, `src/manager/libraries/test.js`: replaced by `payment/processors/` shared libs.
+- `REFACTOR-BEM-API.md`, `REFACTOR-MIDDLEWARE.md`, `REFACTOR-PAYMENT.md`: work completed, files deleted.
+- `bin/bem`: replaced by `bin/backend-manager`.
+
 # [5.0.84] - 2026-02-19
 ### BREAKING
 - Moved `config.products` to `config.payment.products`. All product lookups now use `config.payment.products`.

package/CLAUDE.md

@@ -59,11 +59,12 @@ src/
       utilities.js                    # Batch operations
       metadata.js                     # Timestamps/tags
     libraries/
-      payment-processors/             # Shared payment processor utilities
-        stripe.js                     # Stripe SDK init, fetchResource, toUnified*
-        test.js                       # Test processor (delegates to Stripe shapes)
+      payment/                        # Shared payment utilities
         order-id.js                   # Order ID generation (XXXX-XXXX-XXXX)
-        resolve-price-id.js           # Shared price ID resolver from config
+        processors/                   # Payment processor libraries
+          stripe.js                   # Stripe SDK init, fetchResource, toUnified*, resolvePriceId
+          paypal.js                   # PayPal fetchResource, toUnified* (custom_id parsing)
+          test.js                     # Test processor (delegates to Stripe shapes)
     functions/core/                   # Built-in functions
       actions/
         api.js                        # Main bm_api handler
@@ -88,12 +89,28 @@ src/
           post.js                     # Intent creation orchestrator
           processors/                 # Per-processor intent creators
             stripe.js                 # Stripe Checkout Session creation
+            paypal.js                 # PayPal subscription + one-time order creation
             test.js                   # Test processor (auto-fires webhooks)
         webhook/                      # POST /payments/webhook
           post.js                     # Webhook ingestion + Firestore write
           processors/                 # Per-processor webhook parsers
             stripe.js                 # Stripe event parsing + categorization
+            paypal.js                 # PayPal event parsing + categorization
             test.js                   # Test processor (delegates to Stripe)
+        cancel/                       # POST /payments/cancel
+          processors/
+            stripe.js                 # Stripe cancel_at_period_end
+            paypal.js                 # PayPal subscription cancel
+            test.js                   # Test cancel (writes webhook doc)
+        refund/                       # POST /payments/refund
+          processors/
+            stripe.js                 # Stripe refund + immediate cancel
+            paypal.js                 # PayPal refund + cancel
+            test.js                   # Test refund (writes webhook doc)
+        portal/                       # POST /payments/portal
+          processors/
+            stripe.js                 # Stripe billing portal URL
+            paypal.js                 # PayPal management URL
     schemas/                          # Built-in schemas
   cli/
     index.js                          # CLI entry point
@@ -421,6 +438,15 @@ npx bm test      # Terminal 2 - runs tests
 npx bm test
 ```
 
+### Log Files
+Both `npx bm emulator` and `npx bm test` automatically save all output to log files in the project directory while still streaming to the console:
+- **`emulator.log`** — Full emulator output (Firebase emulator + Cloud Functions logs)
+- **`test.log`** — Test runner output (when running against an existing emulator)
+
+When `npx bm test` starts its own emulator, logs go to `emulator.log` (since it delegates to the emulator command). When running against an already-running emulator, logs go to `test.log`.
+
+These files are overwritten on each run and are gitignored (`*.log`). Use them to search for errors, debug webhook pipelines, or review full function output after a test run.
+
 ### Filtering Tests
 ```bash
 npx bm test rules/             # Run rules tests (both BEM and project)
@@ -772,9 +798,24 @@ The payment system follows a linear pipeline: **Intent → Webhook → On-Write
 
 4. **Transitions** (fire-and-forget): Handler files run asynchronously after detection. Failures never block webhook processing. Skipped during tests unless `TEST_EXTENDED_MODE` is set.
 
+### 3-Layer Architecture
+
+The payment system is cleanly separated into three independent layers:
+
+| Layer | Purpose | Tests |
+|-------|---------|-------|
+| **Processor input** (Stripe, PayPal, Test) | Parse raw webhooks + transform to unified shape | Helper tests per processor (`payment/stripe/to-unified-subscription.js`, `payment/paypal/to-unified-one-time.js`, etc.) |
+| **Unified pipeline** (processor-agnostic) | Transition detection, Firestore writes, analytics | Journey tests (`journey-payments-*.js`) |
+| **Transition handlers** (fire-and-forget) | Emails, notifications, side effects | Skipped during tests unless `TEST_EXTENDED_MODE` |
+
+Each processor transforms its raw data into the **same unified shape**. Once data enters the pipeline, the code doesn't know or care which processor it came from. This means:
+- Adding a new processor = implement the processor interface (below). The pipeline handles the rest.
+- Journey tests use the `test` processor but exercise the full unified pipeline end-to-end.
+- Processor-specific tests only need to verify correct transformation to the unified shape.
+
 ### Processor Interface
 
-Each processor implements two modules:
+Each processor implements three modules:
 
 **Intent processor** (`routes/payments/intent/processors/{processor}.js`):
 ```javascript
@@ -793,25 +834,73 @@ module.exports = {
 };
 ```
 
-**Shared library** (`libraries/payment-processors/{processor}.js`):
+**Cancel processor** (`routes/payments/cancel/processors/{processor}.js`):
+```javascript
+module.exports = {
+  async cancelAtPeriodEnd({ resourceId, uid, subscription, assistant }) { /* cancel at end of period */ },
+};
+```
+
+**Refund processor** (`routes/payments/refund/processors/{processor}.js`):
+```javascript
+module.exports = {
+  async processRefund({ resourceId, uid, subscription, assistant }) {
+    return { amount, currency, full };
+  },
+};
+```
+
+**Portal processor** (`routes/payments/portal/processors/{processor}.js`):
+```javascript
+module.exports = {
+  async createPortalSession({ resourceId, uid, returnUrl, assistant }) {
+    return { url };
+  },
+};
+```
+
+**Shared library** (`libraries/payment/processors/{processor}.js`):
 ```javascript
 module.exports = {
   init() { /* return SDK instance */ },
   async fetchResource(resourceType, resourceId, rawFallback, context) { /* return resource */ },
+  getOrderId(resource) { /* return orderId string or null */ },
   toUnifiedSubscription(rawSubscription, options) { /* return unified object */ },
   toUnifiedOneTime(rawResource, options) { /* return unified object */ },
 };
 ```
 
+### Product Resolution
+
+Products are resolved differently per processor, but always end up matching a product in `config.payment.products`:
+
+| Processor | Resolution chain | Stable ID |
+|-----------|-----------------|-----------|
+| **Stripe** | `sub.items.data[0].price.product` or `raw.plan.product` → match `product.stripe.productId` or `legacyProductIds` | `prod_xxx` |
+| **PayPal** | `sub → plan_id → plan → product_id` → match `product.paypal.productId` | PayPal catalog product ID |
+| **Test** | Uses `product.stripe.productId` in Stripe-shaped data | Same as Stripe |
+
+Falls back to `{ id: 'basic' }` if no match found.
+
+### Processor-Specific Details
+
+**Stripe:** Uses `metadata.uid` and `metadata.orderId` on subscriptions for UID/order resolution.
+
+**PayPal:** Uses `custom_id` field on subscriptions with format `uid:{uid},orderId:{orderId}`. Product resolution fetches the plan from the subscription, then gets `product_id` from the plan. Plans are scoped by `product_id` query param to avoid cross-brand matches on shared PayPal accounts.
+
 ### Product Configuration
 
 Products are defined in `backend-manager-config.json` under `payment.products`:
 
 ```javascript
 payment: {
+  processors: {
+    stripe: { publishableKey: 'pk_live_...' },
+    paypal: { clientId: 'ARvf...' },
+  },
   products: [
     {
-      id: 'basic',           // Free tier (no prices)
+      id: 'basic',           // Free tier (no prices, no processor keys)
       name: 'Basic',
       type: 'subscription',
       limits: { requests: 100 },
@@ -821,30 +910,31 @@ payment: {
       name: 'Premium',
       type: 'subscription',
       limits: { requests: 1000 },
-      trial: { days: 14 },   // Optional trial period
-      prices: {
-        monthly:  { amount: 4.99,  stripe: 'price_xxx', paypal: null },
-        annually: { amount: 49.99, stripe: 'price_yyy', paypal: null },
-      },
+      trial: { days: 14 },
+      prices: { monthly: 4.99, annually: 49.99 },       // Flat numbers only
+      stripe: { productId: 'prod_xxx', legacyProductIds: ['prod_OLD'] },
+      paypal: { productId: 'PROD-abc123' },
     },
     {
       id: 'credits-100',     // One-time purchase
       name: '100 Credits',
       type: 'one-time',
-      prices: {
-        once: { amount: 9.99, stripe: 'price_zzz' },
-      },
+      prices: { once: 9.99 },
+      stripe: { productId: 'prod_yyy' },
+      paypal: { productId: null },
     },
   ],
 }
 ```
 
 Key rules:
-- `type` is `'subscription'` (default) or `'one-time'`
-- Subscription prices are keyed by frequency: `monthly`, `annually`
-- One-time prices are keyed as `once`
-- Each price object has processor-specific IDs (`stripe`, `paypal`, etc.)
-- `basic` product has no `prices` — it's the free tier
+- `prices` contains **flat numbers only** — no processor-specific IDs
+- Processor IDs live at the product level: `stripe: { productId }`, `paypal: { productId }`
+- `stripe.productId` is stable — never changes even when prices change
+- `stripe.legacyProductIds` maps old pre-migration Stripe products to this product
+- Price IDs (Stripe `price_xxx`, PayPal plan IDs) are **resolved at runtime** by matching amount + interval against active prices on the processor's product
+- `basic` product has no `prices` and no processor keys — it's the free tier
+- `archived: true` stops offering a product to new subscribers while keeping it resolvable for existing ones
 
 ### Firestore Collections
 
@@ -900,10 +990,10 @@ The `test` processor generates Stripe-shaped data and auto-fires webhooks to the
 | Webhook processing (on-write) | `src/manager/events/firestore/payments-webhooks/on-write.js` |
 | Payment analytics | `src/manager/events/firestore/payments-webhooks/analytics.js` |
 | Transition detection | `src/manager/events/firestore/payments-webhooks/transitions/index.js` |
-| Payment processor libraries | `src/manager/libraries/payment-processors/` |
-| Stripe library | `src/manager/libraries/payment-processors/stripe.js` |
-| Price ID resolver | `src/manager/libraries/payment-processors/resolve-price-id.js` |
-| Order ID generator | `src/manager/libraries/payment-processors/order-id.js` |
+| Payment processor libraries | `src/manager/libraries/payment/processors/` |
+| Stripe library | `src/manager/libraries/payment/processors/stripe.js` |
+| PayPal library | `src/manager/libraries/payment/processors/paypal.js` |
+| Order ID generator | `src/manager/libraries/payment/order-id.js` |
 | Test accounts | `src/test/test-accounts.js` |
 
 ## Environment Detection

package/README.md

@@ -793,6 +793,14 @@ npx bm test project:rules/     # Only project's rules tests
 npx bm test user/ admin/       # Multiple paths
 ```
 
+### Log Files
+
+Both `npx bm emulator` and `npx bm test` automatically save all output to log files in the project directory:
+- **`emulator.log`** — Full emulator + Cloud Functions output
+- **`test.log`** — Test runner output (when running against an existing emulator)
+
+Logs are overwritten on each run. Use them to debug failing tests or review function output.
+
 ### Test Locations
 
 - **BEM core tests:** `test/`
@@ -871,7 +879,7 @@ See `CLAUDE.md` for complete test API documentation.
 
 ## Subscription System
 
-BEM includes a built-in payment/subscription system with Stripe integration (extensible to other providers).
+BEM includes a built-in payment/subscription system with Stripe and PayPal integration.
 
 ### Subscription Statuses
 
@@ -894,6 +902,39 @@ BEM includes a built-in payment/subscription system with Stripe integration (ext
 | `incomplete_expired` | `cancelled` | Expired before completion |
 | `active` + `cancel_at_period_end` | `active` | `cancellation.pending = true` |
 
+### PayPal Status Mapping
+
+| PayPal Status | `subscription.status` | Notes |
+|---|---|---|
+| `ACTIVE` | `active` | Normal active subscription |
+| `SUSPENDED` | `suspended` | Payment failed or manually suspended |
+| `CANCELLED` | `cancelled` | Subscription terminated |
+| `EXPIRED` | `cancelled` | Billing cycles completed |
+
+### Product Configuration
+
+Products are defined in `config.payment.products` with flat prices and per-processor IDs:
+
+```javascript
+payment: {
+  products: [
+    { id: 'basic', name: 'Basic', type: 'subscription', limits: { requests: 10 } },
+    {
+      id: 'plus', name: 'Plus', type: 'subscription',
+      limits: { requests: 100 }, trial: { days: 14 },
+      prices: { monthly: 28, annually: 276 },
+      stripe: { productId: 'prod_xxx' },
+      paypal: { productId: 'PROD-abc123' },
+    },
+    {
+      id: 'boost', name: 'Boost Pack', type: 'one-time',
+      prices: { once: 9.99 },
+      stripe: { productId: 'prod_yyy' },
+    },
+  ],
+}
+```
+
 ### Unified Subscription Object
 
 The same subscription shape is stored in `users/{uid}.subscription` and `payments-orders/{orderId}.subscription`:

package/TODO-PAYMENT-v2.md

@@ -24,9 +24,12 @@ Note: * for managing and cancelling, they should be under a sinlge button/dropdo
   * we need to make it hard to cancel, buried in some info, and make it more prominent to manage it, since we want to encourage users to manage their subscription rather than cancelling it.
 
 payments/refund
-  * takes a subscription id and requests a refund.
+  * takes a subscription id and requests a refund to the payment processor
   * we can only refund the most recent payment and we can only refund if the subscription is cancelled.
-  * we can only refund if the most recent payment in FULL was made less than 7 days ago, otherwise we can only refund a prorated amount.
+  * we can only refund if the most recent payment in FULL was made less than 7 days ago, otherwise we can only refund a prorated amount based on how much time is left
+  * i want the subscription to be immediately revoked upon refund request
+  * generally, we dont modify the subscription DURING the http endpoint (such as payment intent, or cancel), rather we WAIT FOR THE WEBHOOOK. Can we do that here???
+
 payments/reactivate
   * takes a subscription id and reactivates a cancelled subscription. this can only be done if the subscription is still within its billing period, otherwise the user would have to create a new subscription.
 payments/upgrade

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.0.104",
+  "version": "5.0.106",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/cli/commands/deploy.js

@@ -1,5 +1,4 @@
 const BaseCommand = require('./base-command');
-const chalk = require('chalk');
 const powertools = require('node-powertools');
 
 class DeployCommand extends BaseCommand {
@@ -7,9 +6,8 @@ class DeployCommand extends BaseCommand {
     const self = this.main;
 
     // Quick check that not using local packages
-    let deps = JSON.stringify(self.packageJSON.dependencies);
-    let hasLocal = deps.includes('file:');
-    if (hasLocal) {
+    const allDeps = JSON.stringify(self.packageJSON.dependencies || {}) + JSON.stringify(self.packageJSON.devDependencies || {});
+    if (allDeps.includes('file:')) {
       this.logError(`Please remove local packages before deploying!`);
       return;
     }

package/src/cli/commands/emulator.js

@@ -1,5 +1,6 @@
 const BaseCommand = require('./base-command');
 const path = require('path');
+const fs = require('fs');
 const chalk = require('chalk');
 const jetpack = require('fs-jetpack');
 const JSON5 = require('json5');
@@ -60,9 +61,37 @@ class EmulatorCommand extends BaseCommand {
     // Use double quotes for command wrapper since the command may contain single quotes (JSON strings)
     const emulatorCommand = `BEM_TESTING=true firebase emulators:exec --only functions,firestore,auth,database,hosting,pubsub --ui "${command}"`;
 
+    // Set up log file in the project directory
+    const logPath = path.join(projectDir, 'emulator.log');
+    const logStream = fs.createWriteStream(logPath, { flags: 'w' });
+    const stripAnsi = (str) => str.replace(/\x1B\[[0-9;]*[a-zA-Z]/g, '');
+
+    this.log(chalk.gray(`  Logs saving to: ${logPath}\n`));
+
     await powertools.execute(emulatorCommand, {
-      log: true,
+      log: false,
       cwd: projectDir,
+      config: {
+        stdio: ['inherit', 'pipe', 'pipe'],
+        env: { ...process.env, FORCE_COLOR: '1' },
+      },
+    }, (child) => {
+      // Tee stdout to both console and log file (strip ANSI codes for clean log)
+      child.stdout.on('data', (data) => {
+        process.stdout.write(data);
+        logStream.write(stripAnsi(data.toString()));
+      });
+
+      // Tee stderr to both console and log file (strip ANSI codes for clean log)
+      child.stderr.on('data', (data) => {
+        process.stderr.write(data);
+        logStream.write(stripAnsi(data.toString()));
+      });
+
+      // Clean up log stream when child exits
+      child.on('close', () => {
+        logStream.end();
+      });
     });
   }
 

package/src/cli/commands/test.js

@@ -1,5 +1,6 @@
 const BaseCommand = require('./base-command');
 const path = require('path');
+const fs = require('fs');
 const chalk = require('chalk');
 const jetpack = require('fs-jetpack');
 const JSON5 = require('json5');
@@ -176,15 +177,45 @@ class TestCommand extends BaseCommand {
    * Run tests directly (emulator already running)
    */
   async runTestsDirectly(testCommand, functionsDir, emulatorPorts) {
+    const projectDir = this.main.firebaseProjectPath;
+
     this.log(chalk.gray(`  Hosting: http://127.0.0.1:${emulatorPorts.hosting}`));
     this.log(chalk.gray(`  Firestore: 127.0.0.1:${emulatorPorts.firestore}`));
     this.log(chalk.gray(`  Auth: 127.0.0.1:${emulatorPorts.auth}`));
-    this.log(chalk.gray(`  UI: http://127.0.0.1:${emulatorPorts.ui}\n`));
+    this.log(chalk.gray(`  UI: http://127.0.0.1:${emulatorPorts.ui}`));
+
+    // Set up log file in the project directory
+    const logPath = path.join(projectDir, 'test.log');
+    const logStream = fs.createWriteStream(logPath, { flags: 'w' });
+    const stripAnsi = (str) => str.replace(/\x1B\[[0-9;]*[a-zA-Z]/g, '');
+
+    this.log(chalk.gray(`  Logs saving to: ${logPath}\n`));
 
     try {
       await powertools.execute(testCommand, {
-        log: true,
+        log: false,
         cwd: functionsDir,
+        config: {
+          stdio: ['inherit', 'pipe', 'pipe'],
+          env: { ...process.env, FORCE_COLOR: '1' },
+        },
+      }, (child) => {
+        // Tee stdout to both console and log file (strip ANSI codes for clean log)
+        child.stdout.on('data', (data) => {
+          process.stdout.write(data);
+          logStream.write(stripAnsi(data.toString()));
+        });
+
+        // Tee stderr to both console and log file (strip ANSI codes for clean log)
+        child.stderr.on('data', (data) => {
+          process.stderr.write(data);
+          logStream.write(stripAnsi(data.toString()));
+        });
+
+        // Clean up log stream when child exits
+        child.on('close', () => {
+          logStream.end();
+        });
       });
     } catch (error) {
       process.exit(1);

package/src/manager/events/firestore/payments-webhooks/on-write.js

@@ -55,7 +55,7 @@ module.exports = async ({ assistant, change, context }) => {
     // Load the shared library for this processor
     let library;
     try {
-      library = require(`../../../libraries/payment-processors/${processor}.js`);
+      library = require(`../../../libraries/payment/processors/${processor}.js`);
     } catch (e) {
       throw new Error(`Unknown processor library: ${processor}`);
     }
@@ -72,8 +72,8 @@ module.exports = async ({ assistant, change, context }) => {
     const nowUNIX = powertools.timestamp(now, { output: 'unix' });
     const webhookReceivedUNIX = dataAfter.metadata?.received?.timestampUNIX || nowUNIX;
 
-    // Extract orderId from resource metadata (set at intent creation)
-    const orderId = resource.metadata?.orderId || null;
+    // Extract orderId from resource (processor-agnostic)
+    const orderId = library.getOrderId(resource);
 
     // Process the payment event (subscription or one-time)
     if (category !== 'subscription' && category !== 'one-time') {
@@ -243,6 +243,20 @@ function extractCustomerName(resource, resourceType) {
     fullName = resource.customer_name;
   }
 
+  // PayPal orders have payer.name
+  if (resourceType === 'order') {
+    const givenName = resource.payer?.name?.given_name;
+    const surname = resource.payer?.name?.surname;
+
+    if (givenName) {
+      const { capitalize } = require('../../../libraries/infer-contact.js');
+      return {
+        first: capitalize(givenName) || null,
+        last: capitalize(surname) || null,
+      };
+    }
+  }
+
   // Subscriptions only have customer ID, no name
 
   if (!fullName) {

package/src/manager/events/firestore/payments-webhooks/transitions/index.js

@@ -92,6 +92,7 @@ function detectSubscriptionTransition(before, after) {
  * @returns {string|null} Transition name
  */
 function detectOneTimeTransition(eventType) {
+  // Stripe
   if (eventType === 'checkout.session.completed') {
     return 'purchase-completed';
   }
@@ -100,6 +101,11 @@ function detectOneTimeTransition(eventType) {
     return 'purchase-failed';
   }
 
+  // PayPal
+  if (eventType === 'CHECKOUT.ORDER.APPROVED') {
+    return 'purchase-completed';
+  }
+
   return null;
 }
 

package/src/manager/index.js

@@ -1,6 +1,6 @@
 // Libraries
 const path = require('path');
-const { merge } = require('lodash');
+const { mergeWith, isArray } = require('lodash');
 const jetpack = require('fs-jetpack');
 const JSON5 = require('json5');
 const EventEmitter = require('events');
@@ -129,10 +129,13 @@ Manager.prototype.init = function (exporter, options) {
   }
 
   // Load config
-  self.config = merge(
+  // Use mergeWith to replace arrays instead of merging by index
+  // (lodash merge merges arrays positionally, causing template defaults to bleed into project values)
+  self.config = mergeWith(
     {},
     requireJSON5(BEM_CONFIG_TEMPLATE_PATH, true),
     requireJSON5(self.project.backendManagerConfigPath, true),
+    (_objValue, srcValue) => isArray(srcValue) ? srcValue : undefined,
   );
 
   // Resolve legacy paths