backend-manager 5.9.4 → 5.9.6

package/CLAUDE.md

@@ -2,6 +2,8 @@
 
 > **Note for contributors and Claude:** This file is the architectural overview — identity, top-level conventions, and a map to deep references. The **meat** (per-subsystem APIs, behavior tables, recipes) lives in `docs/<topic>.md`. When extending or adding content, write it in the matching `docs/*.md` file and cross-link from here — do NOT inline it. If a topic doesn't have a doc yet, create one. Goal: keep this file under 250 lines.
 
+> **Mirrored structure:** BEM, UJM, BXM, and EM CLAUDE.md files mirror each other — shared sections (Supply-Chain Security, Development Workflow, File Conventions, etc.) appear in the **same order at the same position** across all four. When adding a section that applies to multiple frameworks, insert it in the same spot in all of them.
+
 ## Identity
 
 Backend Manager (BEM) is a comprehensive framework for building modern Firebase Cloud Functions backends. Sister project to Electron Manager (EM), Browser Extension Manager (BXM), and Ultimate Jekyll Manager (UJM). Provides a single `Manager.init(exports, {...})` bootstrap that wires built-in functions (`bm_api`, auth events, cron jobs), helper classes (Assistant, User, Analytics, Usage, Middleware, Settings, Utilities, Metadata), payment processor integrations (Stripe / PayPal), Firestore-trigger pipelines, marketing campaign automation, an MCP server, and a CLI for emulator/deploy/logs/auth/Firestore operations.
@@ -94,6 +96,10 @@ See [docs/cli-firestore-auth.md](docs/cli-firestore-auth.md) and [docs/cli-logs.
 - **If the user reports an error**, check the emulator/test output for the root cause before guessing.
 - **Live-test UI changes via CDP.** When working on admin dashboards or browser-facing endpoints, use the `chrome-devtools` MCP tools (screenshots, click, evaluate JS, console logs) to verify the change works in the running browser. See `~/.claude/mcp-server/servers/chrome-devtools/CLAUDE.md`.
 
+## Supply-Chain Security
+
+All `npm install` calls in CLI commands (`npx mgr i`, `npx mgr setup`, setup-tests) route through the `safeInstall()` helper (`src/cli/utils/safe-install.js`). It prefixes `sfw` (Socket Firewall) when installed — blocking confirmed malware at the network level before packages reach disk. Falls back to plain npm if sfw isn't available. CI workflows install sfw globally and run `sfw npm install`/`sfw npm ci`. Installs will **fail if sfw detects confirmed malware** in any package in the dependency tree; non-critical CVEs and quality warnings pass through.
+
 ## File Conventions
 
 - **CommonJS** throughout. `prepare-package` copies `src/` → `dist/` 1:1 (no transforms).

package/package.json

@@ -1,8 +1,15 @@
 {
   "name": "backend-manager",
-  "version": "5.9.4",
+  "version": "5.9.6",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
+  "files": [
+    "src/",
+    "dist/",
+    "bin/",
+    "docs/",
+    "CLAUDE.md"
+  ],
   "bin": {
     "bm": "./bin/backend-manager",
     "bem": "./bin/backend-manager",

package/src/cli/commands/install.js

@@ -5,6 +5,7 @@ const powertools = require('node-powertools');
 const Npm = require('npm-api');
 const jetpack = require('fs-jetpack');
 const wonderfulVersion = require('wonderful-version');
+const { safeInstall } = require('../utils/safe-install');
 
 class InstallCommand extends BaseCommand {
   async execute(type) {
@@ -110,12 +111,12 @@ class InstallCommand extends BaseCommand {
       const command = name;
       this.log('Running ', command);
       
-      return await powertools.execute(command, { log: true })
+      return await safeInstall(command, { log: true })
         .catch((e) => {
           throw e;
         });
     }
-    
+
     if (name.indexOf('file:') > -1) {
       v = '';
     } else if (!version) {
@@ -133,7 +134,7 @@ class InstallCommand extends BaseCommand {
     const command = `npm i ${name}${v}${t}`;
     this.log('Running ', command);
 
-    return await powertools.execute(command, { log: true })
+    return await safeInstall(command, { log: true })
       .catch((e) => {
         throw e;
       });

package/src/cli/commands/setup-tests/backend-manager.js

@@ -4,6 +4,7 @@ const wonderfulVersion = require('wonderful-version');
 const powertools = require('node-powertools');
 const Npm = require('npm-api');
 const helpers = require('./helpers');
+const { safeInstall } = require('../../utils/safe-install');
 
 class BackendManagerTest extends BaseTest {
   getName() {
@@ -72,7 +73,7 @@ class BackendManagerTest extends BaseTest {
     console.log('Running ', command);
 
     // Execute
-    await powertools.execute(command, { log: true });
+    await safeInstall(command);
   }
 }
 

package/src/cli/commands/setup-tests/firebase-admin.js

@@ -3,6 +3,7 @@ const chalk = require('chalk').default;
 const wonderfulVersion = require('wonderful-version');
 const powertools = require('node-powertools');
 const helpers = require('./helpers');
+const { safeInstall } = require('../../utils/safe-install');
 
 class FirebaseAdminTest extends BaseTest {
   getName() {
@@ -64,7 +65,7 @@ class FirebaseAdminTest extends BaseTest {
     console.log('Running ', command);
 
     // Execute
-    await powertools.execute(command, { log: true });
+    await safeInstall(command);
   }
 }
 

package/src/cli/commands/setup-tests/firebase-functions.js

@@ -3,6 +3,7 @@ const chalk = require('chalk').default;
 const wonderfulVersion = require('wonderful-version');
 const powertools = require('node-powertools');
 const helpers = require('./helpers');
+const { safeInstall } = require('../../utils/safe-install');
 
 class FirebaseFunctionsTest extends BaseTest {
   getName() {
@@ -64,7 +65,7 @@ class FirebaseFunctionsTest extends BaseTest {
     console.log('Running ', command);
 
     // Execute
-    await powertools.execute(command, { log: true });
+    await safeInstall(command);
   }
 }
 

package/src/cli/utils/safe-install.js

@@ -0,0 +1,13 @@
+const { execute } = require('node-powertools');
+
+let _hasSfw;
+async function safeInstall(command, options) {
+  if (_hasSfw === undefined) {
+    _hasSfw = await execute('sfw --version', { log: false }).then(() => true).catch(() => false);
+  }
+  const isInstall = /^npm\s+(install|i)\b/.test(command);
+  const prefix = (_hasSfw && isInstall) ? 'sfw ' : '';
+  return execute(`${prefix}${command}`, options || { log: true });
+}
+
+module.exports = { safeInstall };

package/src/manager/routes/payments/cancel/post.js

@@ -26,8 +26,8 @@ module.exports = async ({ assistant, user, settings }) => {
 
   const subscription = user.subscription;
 
-  // Require an active, paid subscription
-  if (!subscription || subscription.status !== 'active' || subscription.product?.id === 'basic') {
+  // Require an active or suspended paid subscription
+  if (!subscription || (subscription.status !== 'active' && subscription.status !== 'suspended') || subscription.product?.id === 'basic') {
     assistant.log(`Cancel rejected: uid=${uid}, status=${subscription?.status}, product=${subscription?.product?.id}`);
     return assistant.respond('No active paid subscription found', { code: 400 });
   }
@@ -69,6 +69,26 @@ module.exports = async ({ assistant, user, settings }) => {
   try {
     await processorModule.cancelAtPeriodEnd({ resourceId, uid, subscription, assistant });
   } catch (e) {
+    // If the subscription is suspended and the processor rejects (subscription already dead/gone),
+    // directly reset the user's subscription to cancelled so they can re-subscribe
+    if (subscription.status === 'suspended') {
+      assistant.log(`Processor cancel failed for suspended subscription (${e.message}), resetting directly`);
+      const admin = assistant.Manager.libraries.admin;
+      const now = powertools.timestamp(new Date(), { output: 'string' });
+      const nowUNIX = powertools.timestamp(now, { output: 'unix' });
+
+      await admin.firestore().doc(`users/${uid}`).set({
+        subscription: {
+          status: 'cancelled',
+          product: { id: 'basic', name: 'Basic' },
+          cancellation: { pending: false, date: { timestamp: now, timestampUNIX: nowUNIX } },
+        },
+      }, { merge: true });
+
+      assistant.log(`Directly cancelled suspended subscription for uid=${uid}`);
+      return assistant.respond({ success: true });
+    }
+
     assistant.log(`Failed to cancel subscription via ${processor}: ${e.message}`);
     return assistant.respond(`Failed to cancel subscription: ${e.message}`, { code: 500, sentry: true });
   }

package/src/test/fixtures/firebase-project/.temp/newsletter/run-2026-06-11T03-28-07/metadata.json

@@ -0,0 +1,14 @@
+{
+  "mode": "fixture",
+  "fixture": "clean",
+  "template": "clean",
+  "renderMs": 23,
+  "tags": [
+    "linkedin",
+    "youtube",
+    "platform-policy",
+    "creator-economy",
+    "operator-tools"
+  ],
+  "timestamp": "2026-06-11T03:28:09.151Z"
+}