backend-manager 5.7.2 → 5.7.4

package/CHANGELOG.md

@@ -14,6 +14,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.7.4] - 2026-06-18
+
+### Added
+- **Gitignore root proxy artifacts.** Default `.gitignore` template now excludes `/package.json` and `/package-lock.json` at the repo root, so the setup-generated root proxy and any lockfile are not tracked.
+
+# [5.7.3] - 2026-06-18
+
+### Changed
+- **Root proxy preinstall forwards to functions/.** `npm install` at the project root now runs `cd functions && npm install` (forwarding deps to where they live) instead of just rejecting. Still exits 1 afterward to prevent npm from creating root-level artifacts.
+
 # [5.7.2] - 2026-06-18
 
 ### Fixed

package/PROGRESS.md

@@ -6,7 +6,7 @@
 * **Current Phase:** Implementation complete, untested in consumer
 * **Priority:** Medium
 * **Last Updated:** 2026-06-17 7:40 PM PDT
-* **Notes:** New setup test `root-package-json` generates a root `package.json` with proxy scripts so `npm test`/`npm start`/etc. work from the Firebase project root (not just `functions/`). Includes `preinstall` guard to block accidental `npm install` at root. Prior audit fixes still pending commit.
+* **Notes:** v5.7.2 shipped (npm + GitHub release). New setup test `root-package-json` generates a root `package.json` with proxy scripts so `npm test`/`npm start`/etc. work from the Firebase project root (not just `functions/`). Includes `preinstall` guard to block accidental `npm install` at root.
 
 ## 📌 Active Task List
 * [ ] Phase 3: Post-audit bug fixes
@@ -20,7 +20,7 @@
   * [x] Fix: `cancel-too-young` account `timestampUNIX` uses seconds (was ms)
   * [x] Fix: auth on-delete race condition — `deleteTestUsers` uses emulator bulk-clear REST API instead of individual `deleteUser()` calls (eliminates async on-delete triggers that clobbered freshly-created accounts)
   * [x] Diagnostic: auth-delete-race test — proved the race condition (80-100% clobber rate without mitigation), removed after fix verified
-  * [ ] Commit + publish framework fixes
+  * [x] Commit + publish framework fixes (v5.7.2)
   * [ ] Deploy somiibo-backend + advance stuck sendAt
 * [ ] Phase 4: Root package.json proxy scripts
   * [x] Task 4.1: Create `root-package-json.js` setup test (proxies `projectScripts` with `cd functions &&` prefix + `preinstall` guard)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.7.2",
+  "version": "5.7.4",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/cli/commands/setup-tests/root-package-json.js

@@ -48,7 +48,7 @@ class RootPackageJsonTest extends BaseTest {
       scripts[name] = `cd functions && ${command}`;
     }
 
-    scripts.preinstall = `echo "\\n  Dependencies live in functions/ — run:\\n    cd functions && npm install\\n" && exit 1`;
+    scripts.preinstall = `cd functions && npm install && echo "\\n  ✓ Dependencies installed in functions/ (not project root)\\n" && exit 1`;
 
     return scripts;
   }

package/templates/_.gitignore

@@ -51,6 +51,10 @@ bem-reload-trigger.js
 .temp/
 _legacy
 
+# Root proxy (generated by setup)
+/package.json
+/package-lock.json
+
 # ========== Custom Values ==========
 # Add your custom ignore patterns below this line
 # ...