backend-manager 5.0.193 → 5.0.195

package/CHANGELOG.md

@@ -14,6 +14,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.0.195] - 2026-04-10
+### Fixed
+- 24-hour cancellation guard in `payments/cancel` was comparing `Date.now()` (milliseconds) against `startDateUNIX` (seconds), producing an "age" of ~56 years for every subscription — guard never fired and users could cancel brand-new subscriptions. Now multiplies `startDateUNIX` by 1000 before subtraction.
+### Changed
+- Standardized CLI examples in `CLAUDE.md` and `README.md` to use `npx mgr` instead of the deprecated `npx bm` alias
+
+# [5.0.194] - 2026-04-08
+### Fixed
+- Fix email template data merge: caller's `settings.data` is now deep-merged at root of template data tree, removing the broken `data.` prefix indirection that caused empty order confirmation emails since 5.0.185
+### Added
+- `preview` as a top-level setting on `email.send()` (alongside `subject`)
+- `logs:read` CLI: `--search`, `--order`, `--filter` flags and increased default limit to 300
+### Changed
+- Email templates now access caller data at root (`{{order.id}}`, `{{body.message}}`) instead of under `data.*`
+
 # [5.0.192] - 2026-04-02
 ### Added
 - Setup test to create `hooks/auth/` and `hooks/cron/daily/` directories in consumer projects during `npx bm setup`

package/CLAUDE.md

@@ -600,30 +600,30 @@ The `POST /admin/post` route creates blog posts via GitHub's API. It handles ima
 ### Running Tests
 ```bash
 # Option 1: Two terminals
-npx bm emulator  # Terminal 1 - keeps emulator running
-npx bm test      # Terminal 2 - runs tests
+npx mgr emulator  # Terminal 1 - keeps emulator running
+npx mgr test      # Terminal 2 - runs tests
 
 # Option 2: Single command (auto-starts emulator)
-npx bm test
+npx mgr test
 ```
 
 ### Log Files
 BEM CLI commands automatically save all output to log files in `functions/` while still streaming to the console:
-- **`functions/serve.log`** — Output from `npx bm serve` (Firebase serve)
+- **`functions/serve.log`** — Output from `npx mgr serve` (Firebase serve)
 - **`functions/emulator.log`** — Full emulator output (Firebase emulator + Cloud Functions logs)
 - **`functions/test.log`** — Test runner output (when running against an existing emulator)
-- **`functions/logs.log`** — Cloud Function logs from `npx bm logs:read` or `npx bm logs:tail` (raw JSON for `read`, streaming text for `tail`)
+- **`functions/logs.log`** — Cloud Function logs from `npx mgr logs:read` or `npx mgr logs:tail` (raw JSON for `read`, streaming text for `tail`)
 
-When `npx bm test` starts its own emulator, logs go to `emulator.log` (since it delegates to the emulator command). When running against an already-running emulator, logs go to `test.log`.
+When `npx mgr test` starts its own emulator, logs go to `emulator.log` (since it delegates to the emulator command). When running against an already-running emulator, logs go to `test.log`.
 
 These files are overwritten on each run and are gitignored (`*.log`). Use them to search for errors, debug webhook pipelines, or review full function output after a test run.
 
 ### Filtering Tests
 ```bash
-npx bm test rules/             # Run rules tests (both BEM and project)
-npx bm test bem:rules/         # Only BEM's rules tests
-npx bm test project:rules/     # Only project's rules tests
-npx bm test user/ admin/       # Multiple paths
+npx mgr test rules/             # Run rules tests (both BEM and project)
+npx mgr test bem:rules/         # Only BEM's rules tests
+npx mgr test project:rules/     # Only project's rules tests
+npx mgr test user/ admin/       # Multiple paths
 ```
 
 ### Test Locations
@@ -716,7 +716,7 @@ assert.fail(message)                           // Explicit fail
 
 ## Stripe Webhook Forwarding
 
-BEM auto-starts Stripe CLI webhook forwarding when running `npx bm serve` or `npx bm emulator`. This forwards Stripe test webhooks to the local server so the full payment pipeline works end-to-end during development.
+BEM auto-starts Stripe CLI webhook forwarding when running `npx mgr serve` or `npx mgr emulator`. This forwards Stripe test webhooks to the local server so the full payment pipeline works end-to-end during development.
 
 **Requirements:**
 - `STRIPE_SECRET_KEY` set in `functions/.env`
@@ -725,7 +725,7 @@ BEM auto-starts Stripe CLI webhook forwarding when running `npx bm serve` or `np
 
 **Standalone usage:**
 ```bash
-npx bm stripe
+npx mgr stripe
 ```
 
 If any prerequisite is missing, webhook forwarding is silently skipped with an info message.
@@ -736,26 +736,28 @@ The forwarding URL is: `http://localhost:{hostingPort}/backend-manager/payments/
 
 Quick commands for reading/writing Firestore and managing Auth users directly from the terminal. Works in any BEM consumer project (requires `functions/service-account.json` for production, or `--emulator` for local).
 
+**IMPORTANT: All CLI commands (`npx mgr ...`) MUST be run from the consumer project's `functions/` subdirectory** (e.g., `cd /path/to/my-project/functions && npx mgr ...`). The `mgr` binary lives in `functions/node_modules/.bin/` — running from the project root or any other directory will fail.
+
 ### Firestore Commands
 
 ```bash
-npx bm firestore:get <path>                          # Read a document
-npx bm firestore:set <path> '<json>'                 # Write/merge a document
-npx bm firestore:set <path> '<json>' --no-merge      # Overwrite a document entirely
-npx bm firestore:query <collection>                  # Query a collection (default limit 25)
+npx mgr firestore:get <path>                          # Read a document
+npx mgr firestore:set <path> '<json>'                 # Write/merge a document
+npx mgr firestore:set <path> '<json>' --no-merge      # Overwrite a document entirely
+npx mgr firestore:query <collection>                  # Query a collection (default limit 25)
   --where "field==value"                              #   Filter (repeatable for AND)
   --orderBy "field:desc"                              #   Sort
   --limit N                                           #   Limit results
-npx bm firestore:delete <path>                       # Delete a document (prompts for confirmation)
+npx mgr firestore:delete <path>                       # Delete a document (prompts for confirmation)
 ```
 
 ### Auth Commands
 
 ```bash
-npx bm auth:get <uid-or-email>                       # Get user by UID or email (auto-detected via @)
-npx bm auth:list [--limit N] [--page-token T]        # List users (default 100)
-npx bm auth:delete <uid-or-email>                    # Delete user (prompts for confirmation)
-npx bm auth:set-claims <uid-or-email> '<json>'       # Set custom claims
+npx mgr auth:get <uid-or-email>                       # Get user by UID or email (auto-detected via @)
+npx mgr auth:list [--limit N] [--page-token T]        # List users (default 100)
+npx mgr auth:delete <uid-or-email>                    # Delete user (prompts for confirmation)
+npx mgr auth:set-claims <uid-or-email> '<json>'       # Set custom claims
 ```
 
 ### Logs Commands
@@ -763,24 +765,63 @@ npx bm auth:set-claims <uid-or-email> '<json>'       # Set custom claims
 Fetch or stream Cloud Function logs from Google Cloud Logging. Requires `gcloud` CLI installed and authenticated. Auto-resolves the project ID from `service-account.json`, `.firebaserc`, or `GCLOUD_PROJECT`.
 
 ```bash
-npx bm logs:read                                     # Read last 1h of logs (default: 50 entries)
-npx bm logs:read --fn bm_api                         # Filter by function name
-npx bm logs:read --fn bm_api --severity ERROR        # Filter by severity (DEBUG, INFO, WARNING, ERROR, CRITICAL)
-npx bm logs:read --since 2d --limit 100              # Custom time range and limit
-npx bm logs:tail                                     # Stream live logs
-npx bm logs:tail --fn bm_paymentsWebhookOnWrite      # Stream filtered live logs
+npx mgr logs:read                                     # Read last 1h of logs (default: 300 entries, newest first)
+npx mgr logs:read --fn bm_api                         # Filter by function name
+npx mgr logs:read --fn bm_api --severity ERROR        # Filter by severity (DEBUG, INFO, WARNING, ERROR, CRITICAL)
+npx mgr logs:read --since 2d --limit 100              # Custom time range and limit
+npx mgr logs:read --search "72.134.242.25"            # Search textPayload for a string (IP, email, error, etc.)
+npx mgr logs:read --fn bm_authBeforeCreate --search "ian@example.com" --since 7d  # Combined filters
+npx mgr logs:read --order asc                         # Oldest first (default: desc/newest first)
+npx mgr logs:read --filter 'jsonPayload.level="error"'  # Raw gcloud filter passthrough
+npx mgr logs:tail                                     # Stream live logs
+npx mgr logs:tail --fn bm_paymentsWebhookOnWrite      # Stream filtered live logs
 ```
 
 Both commands save output to `functions/logs.log` (overwritten on each run). `logs:read` saves raw JSON; `logs:tail` streams text.
 
+**Cloud Logs vs Local Logs:** These commands query **production** Google Cloud Logging. For **local/dev** logs, read `functions/serve.log` (from `npx mgr serve`) or `functions/emulator.log` (from `npx mgr test`) directly — they are plain text files, not gcloud.
+
 | Flag | Description | Default | Commands |
 |------|-------------|---------|----------|
-| `--fn <name>` | Filter by Cloud Function name | all | both |
-| `--severity <level>` | Minimum severity level | all | both |
+| `--fn <name>` | Filter by Cloud Function name (see table below) | all | both |
+| `--severity <level>` | Minimum severity: `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL` | all | both |
+| `--search <text>` | Search textPayload for a substring (IP, email, uid, error message) | none | both |
+| `--filter <expr>` | Raw gcloud logging filter expression (appended to built-in filters) | none | both |
 | `--since <duration>` | Time range (`30m`, `1h`, `2d`, `1w`) | `1h` | read only |
-| `--limit <n>` | Max entries | `50` | read only |
+| `--limit <n>` | Max entries | `300` | read only |
+| `--order <dir>` | Sort order: `asc` (oldest first) or `desc` (newest first) | `desc` | read only |
+| `--interval <sec>` | Polling interval in seconds | `5` | tail only |
 | `--raw` | Output raw JSON | false | both |
 
+#### `--fn` Function Name Reference
+
+The `--fn` flag uses the **deployed Cloud Function name**, not the route path.
+
+**BEM built-in functions (always deployed):**
+
+| Function name | Type | Description |
+|---------------|------|-------------|
+| `bm_api` | HTTPS | Main API router — all consumer routes (GET/POST/PUT/DELETE) go through this |
+| `bm_authBeforeCreate` | Auth blocking | Before user creation: disposable email blocking, IP rate limiting, consumer hooks |
+| `bm_authBeforeSignIn` | Auth blocking | Before sign-in: consumer hooks |
+| `bm_authOnCreate` | Auth event | After user creation: user doc setup |
+| `bm_authOnDelete` | Auth event | After user deletion |
+| `bm_paymentsWebhookOnWrite` | Firestore trigger | Processes payment webhooks |
+| `bm_paymentsDisputeOnWrite` | Firestore trigger | Processes payment disputes |
+| `bm_notificationsOnWrite` | Firestore trigger | Sends push notifications |
+| `bm_cronDaily` | Scheduled | Daily cron (midnight UTC) |
+| `bm_cronFrequent` | Scheduled | Frequent cron (every 10 min) |
+
+**Consumer-defined functions** use the export name from `functions/index.js` (e.g., `exports.items = ...` → `--fn items`).
+
+**Quick lookup — which function to query:**
+- API route errors → `--fn bm_api`
+- Signup/auth blocked → `--fn bm_authBeforeCreate`
+- Sign-in issues → `--fn bm_authBeforeSignIn`
+- User doc not created → `--fn bm_authOnCreate`
+- Payment not processing → `--fn bm_paymentsWebhookOnWrite`
+- Cron job issues → `--fn bm_cronDaily` or `--fn bm_cronFrequent`
+
 ### Shared Flags
 
 | Flag | Description |
@@ -793,22 +834,22 @@ Both commands save output to `functions/logs.log` (overwritten on each run). `lo
 
 ```bash
 # Read a user document from production
-npx bm firestore:get users/abc123
+npx mgr firestore:get users/abc123
 
 # Write to emulator
-npx bm firestore:set users/test123 '{"name":"Test User"}' --emulator
+npx mgr firestore:set users/test123 '{"name":"Test User"}' --emulator
 
 # Query with filters
-npx bm firestore:query users --where "subscription.status==active" --limit 10
+npx mgr firestore:query users --where "subscription.status==active" --limit 10
 
 # Look up auth user by email
-npx bm auth:get user@example.com
+npx mgr auth:get user@example.com
 
 # Set admin claims
-npx bm auth:set-claims user@example.com '{"admin":true}'
+npx mgr auth:set-claims user@example.com '{"admin":true}'
 
 # Delete from emulator (no confirmation needed)
-npx bm firestore:delete users/test123 --emulator
+npx mgr firestore:delete users/test123 --emulator
 ```
 
 ## Usage & Rate Limiting
@@ -1325,7 +1366,7 @@ Campaigns reference segments by SSOT key: `segments: ['subscription_free']`. Aut
 
 ### Seed Campaigns
 
-Created by `npx bm setup` (idempotent, enforced fields checked every run):
+Created by `npx mgr setup` (idempotent, enforced fields checked every run):
 
 | ID | Type | Description |
 |----|------|-------------|
@@ -1378,7 +1419,7 @@ marketing: {
 
 8. **Increment usage before update** - Call `usage.increment()` then `usage.update()`
 
-9. **Add Firestore composite indexes for new compound queries** - Any new Firestore query using multiple `.where()` clauses or `.where()` + `.orderBy()` requires a composite index. Add it to `src/cli/commands/setup-tests/helpers/required-indexes.js` (the SSOT). Consumer projects pick these up via `npx bm setup`, which syncs them into `firestore.indexes.json`. Without the index, the query will crash with `FAILED_PRECONDITION` in production.
+9. **Add Firestore composite indexes for new compound queries** - Any new Firestore query using multiple `.where()` clauses or `.where()` + `.orderBy()` requires a composite index. Add it to `src/cli/commands/setup-tests/helpers/required-indexes.js` (the SSOT). Consumer projects pick these up via `npx mgr setup`, which syncs them into `firestore.indexes.json`. Without the index, the query will crash with `FAILED_PRECONDITION` in production.
 
 ## Key Files Reference
 
@@ -1422,7 +1463,7 @@ marketing: {
 ```javascript
 assistant.isDevelopment()  // true when ENVIRONMENT !== 'production' or in emulator
 assistant.isProduction()   // true when ENVIRONMENT === 'production'
-assistant.isTesting()      // true when running tests (via npx bm test)
+assistant.isTesting()      // true when running tests (via npx mgr test)
 ```
 
 ## Model Context Protocol (MCP)
@@ -1432,7 +1473,7 @@ BEM includes a built-in MCP server that exposes BEM routes as tools for Claude C
 ### Architecture
 
 Two transport modes:
-- **Stdio** (local): `npx bm mcp` — for Claude Code / Claude Desktop
+- **Stdio** (local): `npx mgr mcp` — for Claude Code / Claude Desktop
 - **Streamable HTTP** (remote): `POST /backend-manager/mcp` — for Claude Chat (stateless, Firebase Functions compatible)
 
 ### Available Tools (19)
@@ -1466,7 +1507,7 @@ Two transport modes:
 
 ### Hosting Rewrites
 
-The `npx bm setup` command automatically adds required Firebase Hosting rewrites for MCP OAuth:
+The `npx mgr setup` command automatically adds required Firebase Hosting rewrites for MCP OAuth:
 ```json
 {
   "source": "{/backend-manager,/backend-manager/**,/.well-known/oauth-protected-resource,/.well-known/oauth-authorization-server,/authorize,/token}",
@@ -1477,7 +1518,7 @@ The `npx bm setup` command automatically adds required Firebase Hosting rewrites
 ### CLI Usage
 
 ```bash
-npx bm mcp                    # Start stdio MCP server (for Claude Code)
+npx mgr mcp                    # Start stdio MCP server (for Claude Code)
 ```
 
 ### Claude Code Configuration

package/README.md

@@ -89,7 +89,7 @@ module.exports = function (assistant) {
 Run the setup command:
 
 ```bash
-npx bm setup
+npx mgr setup
 ```
 
 ## Initialization Options
@@ -802,28 +802,28 @@ BEM includes an integration test framework that runs against the Firebase emulat
 
 ```bash
 # Option 1: Two terminals (recommended for development)
-npx bm emulator  # Terminal 1 - keeps emulator running
-npx bm test      # Terminal 2 - runs tests
+npx mgr emulator  # Terminal 1 - keeps emulator running
+npx mgr test      # Terminal 2 - runs tests
 
 # Option 2: Single command (auto-starts emulator, shuts down after)
-npx bm test
+npx mgr test
 ```
 
 ### Filtering Tests
 
 ```bash
-npx bm test rules/             # Run rules tests (both BEM and project)
-npx bm test bem:rules/         # Only BEM's rules tests
-npx bm test project:rules/     # Only project's rules tests
-npx bm test user/ admin/       # Multiple paths
+npx mgr test rules/             # Run rules tests (both BEM and project)
+npx mgr test bem:rules/         # Only BEM's rules tests
+npx mgr test project:rules/     # Only project's rules tests
+npx mgr test user/ admin/       # Multiple paths
 ```
 
 ### Log Files
 
 BEM CLI commands automatically save output to log files in the project directory:
-- **`emulator.log`** — Full emulator + Cloud Functions output (`npx bm emulator`)
-- **`test.log`** — Test runner output (`npx bm test`, when running against an existing emulator)
-- **`logs.log`** — Cloud Function logs (`npx bm logs:read` or `npx bm logs:tail`)
+- **`emulator.log`** — Full emulator + Cloud Functions output (`npx mgr emulator`)
+- **`test.log`** — Test runner output (`npx mgr test`, when running against an existing emulator)
+- **`logs.log`** — Cloud Function logs (`npx mgr logs:read` or `npx mgr logs:tail`)
 
 Logs are overwritten on each run. Use them to debug failing tests or review function output.
 

package/TODO-2.md

@@ -23,6 +23,26 @@ waht about when they request a cancel
 Read cancellation-requested.js
 The category is order/cancellation-requested (line 13).
 
+----
+add a dedicated BEM JSON field for usage to reset
+  * this way we can have clear LIMITS with their definitions like
+  * [
+    {
+      name: 'credits'
+      reset: true,
+    },
+    {
+      name: 'agents',
+      reset: false,
+    }
+  ]
+  * mirrors: [
+    {
+      collection: 'agents',
+      fields: ['usage.credits.daily', 'runs.replies.daily],
+    }
+  ]
+
 ---
 MIRROR settigns in BEM JSON so that usage reset can properly get MIRRED DOCS liek slapform forms or chatsy agents DOCS
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.0.193",
+  "version": "5.0.195",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/cli/commands/logs.js

@@ -56,11 +56,12 @@ class LogsCommand extends BaseCommand {
 
   /**
    * Fetch historical logs.
-   * Usage: npx bm logs:read [--fn bm_api] [--severity ERROR] [--since 1h] [--limit 300]
+   * Usage: npx bm logs:read [--fn bm_api] [--severity ERROR] [--since 1h] [--limit 300] [--search "text"] [--order desc] [--filter 'raw gcloud filter']
    */
   async read(projectId, argv) {
     const filter = this.buildFilter(argv);
     const limit = parseInt(argv.limit, 10) || 300;
+    const order = argv.order || 'desc';
 
     const cmd = [
       'gcloud', 'logging', 'read',
@@ -68,7 +69,7 @@ class LogsCommand extends BaseCommand {
       `--project=${projectId}`,
       `--limit=${limit}`,
       '--format=json',
-      '--order=asc',
+      `--order=${order}`,
     ].filter(Boolean).join(' ');
 
     // Set up log file in the project directory
@@ -83,7 +84,7 @@ class LogsCommand extends BaseCommand {
       const output = execSync(cmd, {
         encoding: 'utf8',
         maxBuffer: 10 * 1024 * 1024, // 10MB
-        timeout: 30000,
+        timeout: 60000,
       });
 
       const entries = JSON.parse(output || '[]');
@@ -233,6 +234,16 @@ class LogsCommand extends BaseCommand {
       parts.push(`severity>=${argv.severity.toUpperCase()}`);
     }
 
+    // Text search filter (searches textPayload)
+    if (argv.search) {
+      parts.push(`textPayload:"${argv.search}"`);
+    }
+
+    // Raw filter passthrough (appended as-is)
+    if (argv.filter) {
+      parts.push(argv.filter);
+    }
+
     // Timestamp filter (read only, not tail)
     if (!options.excludeTimestamp) {
       const since = argv.since || '1h';

package/src/manager/libraries/disposable-domains.json

@@ -3152,6 +3152,7 @@
   "moneypipe.net",
   "mongrec.top",
   "monmail.fr.nf",
+  "monomoho.site",
   "monumentmail.com",
   "moolee.net",
   "moonapps.org",

package/src/manager/libraries/email/transactional/index.js

@@ -142,6 +142,8 @@ Transactional.prototype.build = async function (settings) {
     throw errorWithCode('Parameter subject is required', 400);
   }
 
+  const preview = settings.preview || settings?.data?.email?.preview || null;
+
   const templateId = TEMPLATES[settings.template] || settings.template || TEMPLATES['default'];
 
   // Resolve sender category
@@ -176,7 +178,7 @@ Transactional.prototype.build = async function (settings) {
   const unsubSig = crypto.createHmac('sha256', process.env.UNSUBSCRIBE_HMAC_KEY).update(to[0].email.toLowerCase()).digest('hex');
   const unsubscribeUrl = `${Manager.project.websiteUrl}/portal/email-preferences?email=${encode(to[0].email)}&asmId=${encode(groupId)}&templateId=${encode(templateId)}&sig=${unsubSig}`;
 
-  // Build signoff
+  // Build signoff defaults
   const signoff = settings?.data?.signoff || {};
   signoff.type = signoff.type || 'team';
 
@@ -188,12 +190,12 @@ Transactional.prototype.build = async function (settings) {
     signoff.urlText = signoff.urlText || '@ianwieds';
   }
 
-  // Build dynamic template data defaults
+  // Build dynamic template data — system-generated defaults
   const dynamicTemplateData = {
     email: {
       id: Manager.require('uuid').v4(),
       subject,
-      preview: null,
+      preview,
       body: null,
       unsubscribeUrl,
       categories,
@@ -209,18 +211,20 @@ Transactional.prototype.build = async function (settings) {
     signoff,
     brand: brandData,
     user: userProperties,
-    data: {},
   };
 
-  // Deep-merge caller's data on top so they can override any field
-  // (e.g. email.preview, email.subject, personalization.name, data.body.*, etc.)
+  // Deep-merge caller's data on top of defaults.
+  // This is the single template data tree — everything the template can access.
+  // Callers can override any field (email.preview, signoff.type, etc.)
+  // and add custom data (order.*, body.*, abandonedCart.*, etc.) at the root.
+  // Templates access all fields at the root: {{order.id}}, {{email.preview}}, {{brand.name}}.
   if (settings.data) {
     _.merge(dynamicTemplateData, settings.data);
   }
 
-  // Process markdown in body fields (after merge so all data paths are resolved)
-  if (dynamicTemplateData.data?.body?.message) {
-    dynamicTemplateData.data.body.message = md.render(dynamicTemplateData.data.body.message);
+  // Process markdown in body fields (after merge so caller data is resolved)
+  if (dynamicTemplateData.body?.message) {
+    dynamicTemplateData.body.message = md.render(dynamicTemplateData.body.message);
   }
   if (dynamicTemplateData.email?.body) {
     dynamicTemplateData.email.body = md.render(dynamicTemplateData.email.body);
@@ -235,8 +239,8 @@ Transactional.prototype.build = async function (settings) {
     utm: settings.utm,
   };
 
-  if (dynamicTemplateData.data?.body?.message) {
-    dynamicTemplateData.data.body.message = tagLinks(dynamicTemplateData.data.body.message, utmOptions);
+  if (dynamicTemplateData.body?.message) {
+    dynamicTemplateData.body.message = tagLinks(dynamicTemplateData.body.message, utmOptions);
   }
   if (dynamicTemplateData.email?.body) {
     dynamicTemplateData.email.body = tagLinks(dynamicTemplateData.email.body, utmOptions);

package/src/manager/routes/payments/cancel/post.js

@@ -35,7 +35,7 @@ module.exports = async ({ assistant, user, settings }) => {
   // Guard: subscription younger than 24 hours
   const startDateUNIX = subscription.payment?.startDate?.timestampUNIX;
   if (startDateUNIX) {
-    const ageMs = Date.now() - startDateUNIX;
+    const ageMs = Date.now() - (startDateUNIX * 1000);
     const twentyFourHoursMs = 24 * 60 * 60 * 1000;
     if (ageMs < twentyFourHoursMs) {
       assistant.log(`Cancel rejected: uid=${uid}, subscription is only ${Math.round(ageMs / 1000 / 60)} minutes old`);