backend-manager 5.9.11 → 5.9.14

package/CLAUDE.md

@@ -92,7 +92,7 @@ See [docs/cli-firestore-auth.md](docs/cli-firestore-auth.md) and [docs/cli-logs.
 ## Development Workflow
 
 - **🚫 NEVER run `npx mgr serve` / `npx mgr emulator`** — they're the user's long-running dev processes. Assume they're already running; if they aren't, **instruct the user to run them** rather than running them yourself (running them again kills theirs). To see output, **read the `functions/*.log` files** (`dev.log`, `emulator.log`, `test.log`) — never tail/attach to the process. Running `npx mgr test` is fine (it auto-starts its own emulator if needed).
-- **Where the output logs live:** BEM CLI commands tee output to `<projectDir>/functions/` (not `logs/` — BEM's deliberate exception, co-located with firebase-tools' `*-debug.log`): `dev.log` (`npx mgr serve`), `emulator.log` (`npx mgr emulator` / test with own emulator), `test.log` (`npx mgr test`), `production.log` (`npx mgr logs`). The `dev`/`test` names match EM/BXM/UJM; see [docs/test-framework.md](docs/test-framework.md#log-files).
+- **Where the output logs live:** BEM CLI commands tee output to `<projectDir>/functions/` (not `logs/` — BEM's deliberate exception, co-located with firebase-tools' `*-debug.log`): `dev.log` (`npx mgr serve`), `deploy.log` (`npx mgr deploy`), `emulator.log` (`npx mgr emulator` / test with own emulator), `test.log` (`npx mgr test`), `production.log` (`npx mgr logs`). The `dev`/`test` names match EM/BXM/UJM; see [docs/logging.md](docs/logging.md).
 - **If the user reports an error**, check the emulator/test output for the root cause before guessing.
 - **Live-test UI changes via CDP.** When working on admin dashboards or browser-facing endpoints, use the `chrome-devtools` MCP tools (screenshots, click, evaluate JS, console logs) to verify the change works in the running browser. See `~/.claude/mcp-server/servers/chrome-devtools/CLAUDE.md`.
 

package/docs/logging.md

@@ -9,12 +9,32 @@ All in `<projectDir>/functions/`:
 | File | Source | Lifetime |
 |---|---|---|
 | `dev.log` | `npx mgr serve` — BEM's local dev server (Firebase serve) | Overwritten each run |
+| `deploy.log` | `npx mgr deploy` — Firebase deployment output (function uploads, hosting deploys, errors) | Overwritten each run |
 | `emulator.log` | `npx mgr emulator` — full emulator output (Firebase emulator + Cloud Functions logs); also `npx mgr test` when it starts its own emulator | Overwritten each run |
 | `test.log` | `npx mgr test` runner output when running against an already-running emulator | Overwritten each run |
 | `production.log` | `npx mgr logs:read` / `npx mgr logs:tail` — production Cloud Function logs from Google Cloud Logging (raw JSON for `read`, streaming text for `tail`) | Overwritten each run |
 
 The `dev`/`test` names match EM/BXM/UJM for cross-framework parity.
 
+## attach-log-file utility
+
+`src/cli/utils/attach-log-file.js` — shared DRY utility (same pattern as BXM/UJM/EM). Intercepts `process.stdout.write` / `process.stderr.write` to tee all output to a log file while preserving console display. ANSI codes stripped from file output for grep-friendliness.
+
+```js
+const attachLogFile = require('../utils/attach-log-file');
+
+attachLogFile(this.getLogsPath('deploy.log'));
+// ... run command — all stdout/stderr is now teed to the log file ...
+await attachLogFile.detach();
+```
+
+- **Singleton**: default export is a process-wide singleton (one file at a time)
+- **Factory**: `attachLogFile.createTee()` returns an independent tee for stacking
+- **Idempotent**: attaching the same path twice returns the existing handle
+- **Flush-safe**: `detach()` returns a Promise — await before `process.exit()`
+
+Used by `deploy.js`. The `serve`/`emulator`/`test` commands use inline stream management (they need reset-sentinel polling and reload detection that the basic tee doesn't cover).
+
 ## What gets captured
 
 When `npx mgr test` starts its own emulator, logs go to `emulator.log` (it delegates to the emulator command). When running against an already-running emulator, logs go to `test.log`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.9.11",
+  "version": "5.9.14",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "files": [

package/src/cli/commands/base-command.js

@@ -70,6 +70,7 @@ class BaseCommand {
   sweepStaleLogs() {
     const logFiles = [
       'dev.log',
+      'deploy.log',
       'emulator.log',
       'test.log',
       'production.log',

package/src/cli/commands/deploy.js

@@ -1,5 +1,17 @@
 const BaseCommand = require('./base-command');
+const chalk = require('chalk').default;
 const powertools = require('node-powertools');
+const attachLogFile = require('../utils/attach-log-file');
+const { execSync } = require('child_process');
+const path = require('path');
+const jetpack = require('fs-jetpack');
+
+const DEFAULT_REGION = 'us-central1';
+const PUBLIC_HTTP_FUNCTIONS = [
+  'bm_api',
+  'bm_authBeforeCreate',
+  'bm_authBeforeSignIn',
+];
 
 class DeployCommand extends BaseCommand {
   async execute() {
@@ -12,9 +24,120 @@ class DeployCommand extends BaseCommand {
       return;
     }
 
-    // Execute
-    await powertools.execute('firebase deploy', { log: true, config: { cwd: self.firebaseProjectPath } });
+    const logPath = this.getLogsPath('deploy.log');
+    attachLogFile(logPath);
+    this.log(chalk.gray(`  Logs saving to: ${logPath}\n`));
+
+    try {
+      await powertools.execute('firebase deploy', {
+        log: false,
+        config: {
+          cwd: self.firebaseProjectPath,
+          stdio: ['inherit', 'pipe', 'pipe'],
+          env: { ...process.env, FORCE_COLOR: '1' },
+        },
+      }, (child) => {
+        child.stdout.on('data', (data) => process.stdout.write(data));
+        child.stderr.on('data', (data) => process.stderr.write(data));
+      });
+
+      // After successful deploy, ensure HTTP functions are publicly invocable
+      await this.ensurePublicInvoker();
+    } finally {
+      await attachLogFile.detach();
+    }
+  }
+
+  /**
+   * Ensure HTTP-triggered functions have allUsers as cloudfunctions.invoker.
+   *
+   * Firebase CLI used to set this automatically but stopped around the Node 10
+   * runtime transition. Without it, HTTP requests get a 403 at the IAM level
+   * before BEM's application-level auth (backendManagerKey) can run.
+   */
+  async ensurePublicInvoker() {
+    const projectId = this.getProjectId();
+
+    if (!projectId) {
+      return;
+    }
+
+    const gcloud = this.findGcloud();
+
+    if (!gcloud) {
+      this.log(chalk.gray('\n  Skipping public invoker check (gcloud not found)\n'));
+      return;
+    }
+
+    this.log(chalk.gray('\n  Ensuring HTTP functions are publicly invocable...\n'));
+
+    let fixed = 0;
+    let ok = 0;
+
+    for (const fnName of PUBLIC_HTTP_FUNCTIONS) {
+      try {
+        // Check current IAM policy
+        const policyOutput = execSync(
+          `${gcloud} functions get-iam-policy ${fnName} --project ${projectId} --region ${DEFAULT_REGION} --format=json`,
+          { encoding: 'utf8', timeout: 15000, stdio: ['pipe', 'pipe', 'pipe'] },
+        );
+
+        const policy = JSON.parse(policyOutput);
+        const hasAllUsers = (policy.bindings || []).some(
+          (b) => b.role === 'roles/cloudfunctions.invoker'
+            && (b.members || []).includes('allUsers'),
+        );
+
+        if (hasAllUsers) {
+          ok++;
+          continue;
+        }
+
+        // Add allUsers as invoker
+        execSync(
+          `${gcloud} functions add-iam-policy-binding ${fnName} --project ${projectId} --region ${DEFAULT_REGION} --member="allUsers" --role="roles/cloudfunctions.invoker"`,
+          { encoding: 'utf8', timeout: 30000, stdio: ['pipe', 'pipe', 'pipe'] },
+        );
+
+        this.log(`  ${chalk.green('✓')} Set public invoker on ${chalk.cyan(fnName)}`);
+        fixed++;
+      } catch {
+        // Function might not exist (not all projects use all functions) — skip silently
+      }
+    }
+
+    if (fixed > 0) {
+      this.log(`  ${chalk.green('✓')} Public invoker: ${ok + fixed} functions accessible (${fixed} just fixed)\n`);
+    } else if (ok > 0) {
+      this.log(`  ${chalk.green('✓')} Public invoker: ${ok} functions accessible\n`);
+    }
+  }
+
+  getProjectId() {
+    try {
+      const firebaserc = jetpack.read(path.join(this.main.firebaseProjectPath, '.firebaserc'), 'json');
+      return firebaserc?.projects?.default;
+    } catch {
+      return null;
+    }
+  }
+
+  findGcloud() {
+    const homeDir = require('os').homedir();
+    const sdkPath = path.join(homeDir, 'google-cloud-sdk', 'bin', 'gcloud');
+
+    if (jetpack.exists(sdkPath)) {
+      return sdkPath;
+    }
+
+    // Try PATH
+    try {
+      execSync('which gcloud', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+      return 'gcloud';
+    } catch {
+      return null;
+    }
   }
 }
 
-module.exports = DeployCommand;
+module.exports = DeployCommand;

package/src/cli/commands/setup-tests/firebase-admin.js

@@ -16,6 +16,11 @@ class FirebaseAdminTest extends BaseTest {
     const mine = this.context.package.dependencies[pkg];
     const bemv = this.context.packageJSON.peerDependencies[pkg];
 
+    // Not in package.json at all — must install
+    if (!mine) {
+      return false;
+    }
+
     // Get level difference
     const levelDifference = wonderfulVersion.levelDifference(latest, mine);
 

package/src/cli/commands/setup-tests/firebase-functions.js

@@ -16,6 +16,11 @@ class FirebaseFunctionsTest extends BaseTest {
     const mine = this.context.package.dependencies[pkg];
     const bemv = this.context.packageJSON.peerDependencies[pkg];
 
+    // Not in package.json at all — must install
+    if (!mine) {
+      return false;
+    }
+
     // Get level difference
     const levelDifference = wonderfulVersion.levelDifference(latest, mine);
 

package/src/cli/commands/setup-tests/root-package-json.js

@@ -48,7 +48,7 @@ class RootPackageJsonTest extends BaseTest {
       scripts[name] = `cd functions && ${command}`;
     }
 
-    scripts.preinstall = `cd functions && npm install && echo "\\n  ✓ Dependencies installed in functions/ (not project root)\\n" && exit 1`;
+    scripts.preinstall = `cd functions && npm install && echo "\\n  ✓ Dependencies installed in functions/ (not project root)\\n"`;
 
     return scripts;
   }

package/src/cli/commands/setup.js

@@ -255,29 +255,13 @@ class SetupCommand extends BaseCommand {
   scaffoldPackageJson() {
     const self = this.main;
     const ui = this.ui;
-    let changed = false;
-
-    // Ensure backend-manager is in dependencies (Cloud Functions only installs deps, not devDeps)
-    if (self.package.devDependencies?.['backend-manager'] && !self.package.dependencies?.['backend-manager']) {
-      const version = self.package.devDependencies['backend-manager'];
-      self.package.dependencies = self.package.dependencies || {};
-      self.package.dependencies['backend-manager'] = version;
-      delete self.package.devDependencies['backend-manager'];
-      if (Object.keys(self.package.devDependencies).length === 0) {
-        delete self.package.devDependencies;
-      }
-      changed = true;
-    }
 
     if (!self.package.engines || !self.package.engines.node) {
       const nodeVer = String(parseInt(process.versions.node, 10));
       self.package.engines = self.package.engines || {};
       self.package.engines.node = nodeVer;
-      changed = true;
-    }
-
-    if (changed) {
       jetpack.write(`${self.firebaseProjectPath}/functions/package.json`, JSON.stringify(self.package, null, 2));
+      ui.status('add', `Added ${chalk.cyan('engines.node')} = ${chalk.bold(nodeVer)} to package.json`, { level: 2 });
     }
   }
 

package/src/cli/utils/attach-log-file.js

@@ -0,0 +1,92 @@
+// attachLogFile(filePath) — duplicate process.stdout + process.stderr writes to a log file.
+//
+// Mirrors BXM/UJM/EM's attach-log-file pattern. Lets devs (and Claude) `tail -f` a log file to
+// see every line of output a process produces — child process stdout/stderr, console.log calls,
+// the works.
+//
+// ANSI color codes are stripped from the file output so it's grep-friendly. The console continues
+// to receive the original colored output unchanged.
+//
+// The default export is a process-wide SINGLETON (the common case: a CLI command tees its whole
+// run to one file). `attachLogFile.createTee()` returns an INDEPENDENT tee with its own state.
+// Tees STACK: a later attach() captures the CURRENT `process.stdout.write` (which may already be
+// an outer tee) as its "original", so writes fan out through every layer and detach() restores
+// the exact prior writer in LIFO order.
+//
+// Idempotent: calling attach() twice with the same path on one tee returns the existing handle.
+
+const fs = require('fs');
+const path = require('path');
+
+const ANSI_PATTERN = /\x1B\[[0-9;]*[a-zA-Z]/g;
+
+function stripAnsi(s) {
+  return String(s).replace(ANSI_PATTERN, '');
+}
+
+function createTee() {
+  let activeStream = null;
+  let activePath   = null;
+  let originalStdoutWrite = null;
+  let originalStderrWrite = null;
+
+  function attach(filePath) {
+    if (!filePath) return null;
+    const abs = path.resolve(filePath);
+
+    if (activeStream && activePath === abs) return activeStream;
+    if (activeStream) detach();
+
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    const stream = fs.createWriteStream(abs, { flags: 'w' });
+
+    stream.write(`# bem log — ${new Date().toISOString()} — pid=${process.pid}\n`);
+
+    originalStdoutWrite = process.stdout.write.bind(process.stdout);
+    originalStderrWrite = process.stderr.write.bind(process.stderr);
+
+    process.stdout.write = function (chunk, ...rest) {
+      try { stream.write(stripAnsi(String(chunk))); } catch (e) { /* ignore */ }
+      return originalStdoutWrite(chunk, ...rest);
+    };
+    process.stderr.write = function (chunk, ...rest) {
+      try { stream.write(stripAnsi(String(chunk))); } catch (e) { /* ignore */ }
+      return originalStderrWrite(chunk, ...rest);
+    };
+
+    activeStream = stream;
+    activePath   = abs;
+
+    return stream;
+  }
+
+  function detach() {
+    if (originalStdoutWrite) process.stdout.write = originalStdoutWrite;
+    if (originalStderrWrite) process.stderr.write = originalStderrWrite;
+    const stream = activeStream;
+    activeStream = null;
+    activePath   = null;
+    originalStdoutWrite = null;
+    originalStderrWrite = null;
+
+    return new Promise((resolve) => {
+      if (!stream) {
+        return resolve();
+      }
+      stream.end(resolve);
+    });
+  }
+
+  return { attach, detach };
+}
+
+const singleton = createTee();
+
+function attachLogFile(filePath) {
+  return singleton.attach(filePath);
+}
+
+module.exports = attachLogFile;
+module.exports.detach    = singleton.detach;
+module.exports.stripAnsi = stripAnsi;
+module.exports.createTee = createTee;

package/src/manager/libraries/email/data/disposable-domains.json

@@ -1566,6 +1566,7 @@
   "cuirushi.org",
   "cumnnm.us.ci",
   "cuoly.com",
+  "cuongaquarium.com",
   "cupbest.com",
   "curlhph.tk",
   "currentmail.com",
@@ -1883,6 +1884,7 @@
   "dotman.de",
   "dotmsg.com",
   "dotool8.top",
+  "dotos.dev",
   "dotslashrage.com",
   "dotvu.net",
   "dotzi.net",
@@ -3540,6 +3542,7 @@
   "jajxz.com",
   "jakarta.io.vn",
   "jakemsr.com",
+  "jakl.li",
   "jamesjfattorini.rocks",
   "jamesthynnealmshouse.co.uk",
   "jamyjmkqdsc.com",
@@ -5293,6 +5296,7 @@
   "pazard.com",
   "pazuric.com",
   "pbhak.dev",
+  "pcaa.lol",
   "pcbb.lol",
   "pckage.com",
   "pdf-cutter.com",
@@ -6136,6 +6140,7 @@
   "somelora.com",
   "somoj.com",
   "son2d.site",
+  "songsan.business",
   "songsign.com",
   "soniot.fr",
   "soniot.info",
@@ -7068,6 +7073,7 @@
   "verityemail.site",
   "vermutlich.net",
   "vernonbourne.uk",
+  "veronicamira.info",
   "vertexinbox.com",
   "vertexium.net",
   "veruvercomail.com",