@omega.js/backend 0.1.0

package/dist/cli/commands/setup-tests/firebase-cli.js

@@ -0,0 +1,26 @@
+const BaseTest = require('./base-test');
+const powertools = require('node-powertools');
+
+class FirebaseCliTest extends BaseTest {
+  getName() {
+    return 'firebase CLI is installed';
+  }
+
+  getWarning() {
+    return [
+      'Firebase CLI is not installed.',
+      'Install with: npm install -g firebase-tools',
+    ];
+  }
+
+  async run() {
+    try {
+      await powertools.execute('firebase --version', { log: false });
+      return true;
+    } catch (error) {
+      return 'warn';
+    }
+  }
+}
+
+module.exports = FirebaseCliTest;

package/dist/cli/commands/setup-tests/firebase-functions.js

@@ -0,0 +1,49 @@
+const BaseTest = require('./base-test');
+const chalk = require('chalk').default;
+const wonderfulVersion = require('wonderful-version');
+const powertools = require('node-powertools');
+const helpers = require('./helpers');
+
+class FirebaseFunctionsTest extends BaseTest {
+  getName() {
+    return 'using updated firebase-functions';
+  }
+
+  async run() {
+    const pkg = 'firebase-functions';
+    const latest = this.context.packageJSON.peerDependencies['firebase-functions'];
+    const mine = this.context.package.dependencies[pkg];
+    const bemv = this.context.packageJSON.peerDependencies[pkg];
+
+    // Not in package.json at all — must install
+    if (!mine) {
+      return false;
+    }
+
+    // Get level difference
+    const levelDifference = wonderfulVersion.levelDifference(latest, mine);
+
+    // Log
+    this.bemPackageVersionWarning(pkg, bemv, latest);
+
+    // Log if major version mismatch
+    if (levelDifference === 'major') {
+      console.log(chalk.red(`Version ${chalk.bold(latest)} of ${chalk.bold(pkg)} available but you must install this manually because it is a major update.`));
+    }
+
+    // Ensure the version is up to date
+    return wonderfulVersion.is(mine, '>=', latest) || levelDifference === 'major';
+  }
+
+  async fix() {
+    await this.installPkg('firebase-functions', `@${this.context.packageJSON.peerDependencies['firebase-functions']}`);
+  }
+
+  bemPackageVersionWarning(packageName, current, latest) {
+    if (wonderfulVersion.greaterThan(latest, current)) {
+      console.log(chalk.yellow(`${packageName} needs to be updated in @omega.js/backend: ${current} => ${latest}`));
+    }
+  }
+}
+
+module.exports = FirebaseFunctionsTest;

package/dist/cli/commands/setup-tests/firestore-indexes-file.js

@@ -0,0 +1,72 @@
+const path = require('path');
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+
+class FirestoreIndexesFileTest extends BaseTest {
+  getName() {
+    return 'update firestore indexes file';
+  }
+
+  async run() {
+    const self = this.self;
+    const filePath = `${self.firebaseProjectPath}/firestore.indexes.json`;
+
+    if (!jetpack.exists(filePath)) {
+      return false;
+    }
+
+    // A file that isn't JSON is a poisoned artifact (the pre-fix live pull
+    // shell-redirected 403 error text into it — friction #8) and breaks every
+    // later consumer; treat it as missing so the fix rewrites it.
+    try {
+      JSON.parse(jetpack.read(filePath));
+      return true;
+    } catch (e) {
+      console.log(chalk.yellow(`  ${filePath} is not valid JSON (poisoned by a failed live pull?) — rewriting`));
+      return false;
+    }
+  }
+
+  async fix() {
+    const self = this.self;
+    const name = 'firestore.indexes.json';
+    const filePath = `${self.firebaseProjectPath}/${name}`;
+
+    // Clear a poisoned (unparseable) file so both paths below rewrite it.
+    let exists = jetpack.exists(filePath);
+    if (exists) {
+      try {
+        JSON.parse(jetpack.read(filePath));
+      } catch (e) {
+        jetpack.remove(filePath);
+        exists = false;
+      }
+    }
+
+    if (!exists) {
+      console.log(chalk.yellow(`Writing new ${name} file...`));
+
+      // demo-* projects are emulator-only — there is no live project to pull
+      // indexes from (friction #8's second head: this fix used the same
+      // shell-redirect that poisons the file with the 403 text). Seed the
+      // template's empty shape; the emulator needs no composite indexes.
+      // A shared project has a live set, but it is every tenant brand's, not
+      // this one's — pulling it writes another tenant's indexes into this
+      // brand's repo, and this ungated pull runs BEFORE the gated sync check
+      // ([#716](https://github.com/Omega-JS-Stack/omega/issues/716)). Seed the
+      // same template and let the brand author its own.
+      if (this.isDemoProject || this.isSharedProject) {
+        jetpack.copy(path.resolve(__dirname, '../../../../templates', name), filePath);
+        return;
+      }
+
+      const IndexesCommand = require('../indexes');
+      const indexesCmd = new IndexesCommand(self);
+
+      await indexesCmd.get(name, false);
+    }
+  }
+}
+
+module.exports = FirestoreIndexesFileTest;

package/dist/cli/commands/setup-tests/firestore-indexes-in-json.js

@@ -0,0 +1,20 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const _ = require('lodash');
+
+class FirestoreIndexesInJsonTest extends BaseTest {
+  getName() {
+    return 'firestore indexes in JSON';
+  }
+
+  async run() {
+    return this.self.firebaseJSON?.firestore?.indexes === 'firestore.indexes.json';
+  }
+
+  async fix() {
+    _.set(this.self.firebaseJSON, 'firestore.indexes', 'firestore.indexes.json');
+    jetpack.write(`${this.self.firebaseProjectPath}/firebase.json`, JSON.stringify(this.self.firebaseJSON, null, 2));
+  }
+}
+
+module.exports = FirestoreIndexesInJsonTest;

package/dist/cli/commands/setup-tests/firestore-indexes-required.js

@@ -0,0 +1,108 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const _ = require('lodash');
+const chalk = require('chalk').default;
+const requiredIndexes = require('./helpers/required-indexes');
+
+class FirestoreIndexesRequiredTest extends BaseTest {
+  getName() {
+    return 'firestore indexes have required @omega.js/backend indexes';
+  }
+
+  async run() {
+    const filePath = `${this.self.firebaseProjectPath}/firestore.indexes.json`;
+
+    if (!jetpack.exists(filePath)) {
+      return false;
+    }
+
+    const indexesFile = JSON.parse(jetpack.read(filePath));
+    const existingIndexes = indexesFile.indexes || [];
+
+    // Check that the first N indexes match the required indexes (must be at the top)
+    const topIsCorrect = requiredIndexes.every((required, i) => {
+      return this._indexMatches(existingIndexes[i], required);
+    });
+
+    // Check no duplicates exist (each required index should appear exactly once)
+    const noDuplicates = requiredIndexes.every(required => {
+      const count = existingIndexes.filter(existing => this._indexMatches(existing, required)).length;
+      return count === 1;
+    });
+
+    return topIsCorrect && noDuplicates;
+  }
+
+  async fix() {
+    const filePath = `${this.self.firebaseProjectPath}/firestore.indexes.json`;
+    let indexesFile;
+
+    if (jetpack.exists(filePath)) {
+      indexesFile = JSON.parse(jetpack.read(filePath));
+    } else {
+      indexesFile = { indexes: [], fieldOverrides: [] };
+    }
+
+    indexesFile.indexes = indexesFile.indexes || [];
+
+    // Remove any existing copies of required indexes
+    for (const required of requiredIndexes) {
+      indexesFile.indexes = indexesFile.indexes.filter(existing => !this._indexMatches(existing, required));
+    }
+
+    // Add all required indexes to the top (in reverse so they end up in correct order)
+    for (let i = requiredIndexes.length - 1; i >= 0; i--) {
+      indexesFile.indexes.unshift(requiredIndexes[i]);
+    }
+
+    jetpack.write(filePath, JSON.stringify(indexesFile, null, 2));
+
+    console.log(chalk.green(`  + Ensured ${requiredIndexes.length} required indexes at top of indexes array`));
+    console.log(chalk.yellow(`  Remember to deploy indexes: ${chalk.bold('firebase deploy --only firestore:indexes')}`));
+  }
+
+  /**
+   * Check if an existing index matches a required index definition
+   */
+  _indexMatches(existing, required) {
+    if (!existing) {
+      return false;
+    }
+
+    // Must match collectionGroup
+    if (existing.collectionGroup !== required.collectionGroup) {
+      return false;
+    }
+
+    // Must match queryScope (default COLLECTION)
+    if ((existing.queryScope || 'COLLECTION') !== (required.queryScope || 'COLLECTION')) {
+      return false;
+    }
+
+    // Strip implicit __name__ fields that Firebase adds to live indexes
+    const existingFields = (existing.fields || []).filter(f => f.fieldPath !== '__name__');
+
+    // Must have same number of fields
+    if (existingFields.length !== required.fields.length) {
+      return false;
+    }
+
+    // Each field must match
+    return required.fields.every((reqField, i) => {
+      const exField = existingFields[i];
+
+      if (exField.fieldPath !== reqField.fieldPath) {
+        return false;
+      }
+
+      // Match order or arrayConfig
+      if (reqField.arrayConfig) {
+        return exField.arrayConfig === reqField.arrayConfig;
+      }
+
+      return exField.order === reqField.order;
+    });
+  }
+}
+
+module.exports = FirestoreIndexesRequiredTest;

package/dist/cli/commands/setup-tests/firestore-indexes-synced.js

@@ -0,0 +1,236 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+const _ = require('lodash');
+const powertools = require('node-powertools');
+
+class FirestoreIndexesSyncedTest extends BaseTest {
+  getName() {
+    return 'firestore indexes synced';
+  }
+
+  getWarning() {
+    return [
+      'live index deploy skipped (--offline) — the drift above is reported only; re-run `npx omega test` without --offline to deploy',
+    ];
+  }
+
+  async run() {
+    const self = this.self;
+    const tempPath = '_firestore.indexes.json';
+
+    // demo-* projects are emulator-only — there is no live Firestore to sync
+    // with. The old behavior hit the live API, got a 403, and the shell
+    // redirect wrote the ERROR TEXT into the json file (friction #8).
+    if (this.isDemoProject) {
+      console.log(chalk.dim(`  demo-* project (${self.projectId}) — live index sync skipped (emulator-only)`));
+      return true;
+    }
+
+    // A shared project's deployed indexes belong to every brand on it, not to
+    // this one. Pulling them down merged ~400 lines of other tenants'
+    // collections into the consumer's authored firestore.indexes.json, silently,
+    // during the commit gate's own test run
+    // ([#716](https://github.com/Omega-JS-Stack/omega/issues/716)). There is no
+    // drift to report here, because there is no one-brand live set to compare to.
+    if (this.isSharedProject) {
+      console.log(chalk.dim(`  shared cloud project (${self.projectId}) — live index sync skipped (its indexes belong to every brand on it)`));
+      return true;
+    }
+
+    const IndexesCommand = require('../indexes');
+    const indexesCmd = new IndexesCommand(self);
+
+    const liveIndexes = await indexesCmd.get(tempPath, false);
+
+    const localIndexes_exists = jetpack.exists(`${self.firebaseProjectPath}/firestore.indexes.json`);
+    let localIndexes;
+    if (localIndexes_exists) {
+      localIndexes = require(`${self.firebaseProjectPath}/firestore.indexes.json`);
+    }
+
+    // Firebase adds implicit properties to live indexes (__name__ fields, density, etc.)
+    // and returns them in a different order. Normalize before comparing.
+    const normalizeIndexes = (indexes) => {
+      if (!indexes?.indexes) {
+        return indexes;
+      }
+      return {
+        ...indexes,
+        indexes: _.sortBy(indexes.indexes.map(idx => {
+          const { density, ...rest } = idx;
+          return {
+            ...rest,
+            fields: (rest.fields || []).filter(f => f.fieldPath !== '__name__'),
+          };
+        }), idx => `${idx.collectionGroup}:${(idx.fields || []).map(f => f.fieldPath).join(',')}`),
+      };
+    };
+
+    const equal = _.isEqual(normalizeIndexes(liveIndexes), normalizeIndexes(localIndexes));
+
+    jetpack.remove(`${self.firebaseProjectPath}/${tempPath}`);
+
+    if (!equal && localIndexes_exists) {
+      // Log what differs so the user can see why (use stripped versions for accurate comparison)
+      const strippedLocal = normalizeIndexes(localIndexes);
+      const strippedLive = normalizeIndexes(liveIndexes);
+      const localOnly = _.differenceWith(strippedLocal?.indexes || [], strippedLive?.indexes || [], _.isEqual);
+      const liveOnly = _.differenceWith(strippedLive?.indexes || [], strippedLocal?.indexes || [], _.isEqual);
+
+      if (localOnly.length > 0) {
+        console.log(chalk.yellow(`  Indexes in local but not live:`));
+        for (const idx of localOnly) {
+          console.log(chalk.gray(`    - ${idx.collectionGroup} [${(idx.fields || []).map(f => `${f.fieldPath} ${f.order || f.arrayConfig}`).join(', ')}]`));
+        }
+      }
+      if (liveOnly.length > 0) {
+        console.log(chalk.yellow(`  Indexes in live but not local:`));
+        for (const idx of liveOnly) {
+          console.log(chalk.gray(`    - ${idx.collectionGroup} [${(idx.fields || []).map(f => `${f.fieldPath} ${f.order || f.arrayConfig}`).join(', ')}]`));
+        }
+      }
+      if (localOnly.length === 0 && liveOnly.length === 0) {
+        // Indexes arrays match but fieldOverrides or other top-level keys differ
+        const localKeys = Object.keys(localIndexes || {});
+        const liveKeys = Object.keys(liveIndexes || {});
+        const allKeys = _.union(localKeys, liveKeys);
+        for (const key of allKeys) {
+          if (!_.isEqual(localIndexes?.[key], liveIndexes?.[key])) {
+            console.log(chalk.yellow(`  Difference in "${key}":`));
+            console.log(chalk.gray(`    Local: ${JSON.stringify(localIndexes?.[key])}`));
+            console.log(chalk.gray(`    Live:  ${JSON.stringify(liveIndexes?.[key])}`));
+          }
+        }
+      }
+    }
+
+    // The read-only comparison above already printed what is out of sync. Under
+    // --offline the only remedy (fix() → `firebase deploy`) is off the table, so
+    // the verdict downgrades to a non-blocking warning: the runner reports the
+    // drift in the summary and never reaches the mutating fix (#284).
+    if (!equal && localIndexes_exists && this.isOffline) {
+      return 'warn';
+    }
+
+    return !localIndexes_exists || equal;
+  }
+
+  async fix() {
+    const self = this.self;
+    const filePath = `${self.firebaseProjectPath}/firestore.indexes.json`;
+
+    if (this.isDemoProject) {
+      return; // run() never fails demo projects; never touch the live API here
+    }
+
+    // Belt for a direct caller: run() never fails a shared project either, and
+    // the merge below is exactly the write that ships another tenant's indexes.
+    if (this.isSharedProject) {
+      return;
+    }
+
+    // Belt for a direct caller: run() already downgrades drift to a warning
+    // under --offline, so the runner can never land here. Nothing below may
+    // spawn — the deploy at the end rewrites the live project's indexes.
+    if (this.isOffline) {
+      console.log(chalk.yellow(`  ⚠ Skipping the live index sync (--offline) — indexes are out of sync and were NOT deployed`));
+      return;
+    }
+
+    // Fetch live indexes
+    const IndexesCommand = require('../indexes');
+    const indexesCmd = new IndexesCommand(self);
+    const tempPath = '_firestore.indexes.json';
+    const liveIndexes = await indexesCmd.get(tempPath, false);
+    jetpack.remove(`${self.firebaseProjectPath}/${tempPath}`);
+
+    // Read local indexes
+    let localIndexes = { indexes: [], fieldOverrides: [] };
+    if (jetpack.exists(filePath)) {
+      localIndexes = JSON.parse(jetpack.read(filePath));
+    }
+
+    // Merge: start with local, add any live indexes that don't already exist locally
+    const merged = [...(localIndexes.indexes || [])];
+    const liveList = (liveIndexes?.indexes || []);
+
+    for (const liveIdx of liveList) {
+      const alreadyExists = merged.some(localIdx => this._normalizedMatch(localIdx, liveIdx));
+
+      if (!alreadyExists) {
+        merged.push(this._stripImplicitFields(liveIdx));
+      }
+    }
+
+    // Merge fieldOverrides the same way
+    const mergedOverrides = [...(localIndexes.fieldOverrides || [])];
+    for (const liveOverride of (liveIndexes?.fieldOverrides || [])) {
+      const alreadyExists = mergedOverrides.some(lo => _.isEqual(lo, liveOverride));
+
+      if (!alreadyExists) {
+        mergedOverrides.push(liveOverride);
+      }
+    }
+
+    // Write merged result locally
+    const result = { indexes: merged, fieldOverrides: mergedOverrides };
+    jetpack.write(filePath, JSON.stringify(result, null, 2));
+
+    const addedCount = merged.length - (localIndexes.indexes || []).length;
+    console.log(chalk.green(`  ✓ Merged indexes (${merged.length} total, ${addedCount} added from live)`));
+
+    // Deploy merged indexes to live
+    console.log(chalk.yellow(`  Deploying merged indexes to live...`));
+    await powertools.execute('firebase deploy --only firestore:indexes', {
+      log: true,
+      cwd: self.firebaseProjectPath,
+    });
+
+    console.log(chalk.green(`  ✓ Live indexes synced`));
+  }
+
+  /**
+   * Check if two indexes match (ignoring implicit __name__ fields and density)
+   */
+  _normalizedMatch(a, b) {
+    if (!a || !b) {
+      return false;
+    }
+
+    if (a.collectionGroup !== b.collectionGroup) {
+      return false;
+    }
+
+    if ((a.queryScope || 'COLLECTION') !== (b.queryScope || 'COLLECTION')) {
+      return false;
+    }
+
+    const aFields = (a.fields || []).filter(f => f.fieldPath !== '__name__');
+    const bFields = (b.fields || []).filter(f => f.fieldPath !== '__name__');
+
+    if (aFields.length !== bFields.length) {
+      return false;
+    }
+
+    return aFields.every((af, i) => {
+      const bf = bFields[i];
+      return af.fieldPath === bf.fieldPath
+        && (af.order || null) === (bf.order || null)
+        && (af.arrayConfig || null) === (bf.arrayConfig || null);
+    });
+  }
+
+  /**
+   * Strip implicit fields Firebase adds to live indexes (density, __name__)
+   */
+  _stripImplicitFields(idx) {
+    const { density, ...rest } = idx;
+    return {
+      ...rest,
+      fields: (rest.fields || []).filter(f => f.fieldPath !== '__name__'),
+    };
+  }
+}
+
+module.exports = FirestoreIndexesSyncedTest;

package/dist/cli/commands/setup-tests/firestore-rules-file.js

@@ -0,0 +1,115 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+const {
+  BRAND_RULES_FILE,
+  COMPILED_RULES_FILE,
+  MARKER_MIGRATION_COMMAND,
+  RULES_MIGRATION_COMMAND,
+  compileFirestoreRules,
+  deferredRulesTarget,
+  ensureBrandRulesSource,
+  isPreFamilyMarkerFile,
+  markerMigrationDeferralNotice,
+  needsRulesMigration,
+} = require('../../utils/compile-rules');
+
+/**
+ * The brand's `firestore.rules` is SOURCE, not a managed block
+ * ([#255](https://github.com/Omega-JS-Stack/omega/issues/255)): setup seeds it
+ * once and migrates an older one ONCE — a legacy marker-block file, or a v2
+ * hook-era file whose retired hooks merge-by-match replaced
+ * ([#353](https://github.com/Omega-JS-Stack/omega/issues/353)). The deployed
+ * artifact is `dist/firestore.rules`, compiled by every stage.
+ *
+ * ONCE, but never behind a brand's back: while firebase.json still names the
+ * brand's own file, that brand deploys the legacy posture deliberately and the
+ * check DEFERS rather than rewriting the source under it
+ * ([#522](https://github.com/Omega-JS-Stack/omega/issues/522)).
+ */
+class FirestoreRulesFileTest extends BaseTest {
+  getName() {
+    return 'compile firestore rules';
+  }
+
+  // Which deferral run() hit, so the reported lines match the reason. Two
+  // deferrals share this check: the compiled-rules one (#522) and the
+  // pre-family marker one (#40).
+  getWarning() {
+    if (this.deferral === 'pre-family') {
+      return markerMigrationDeferralNotice(BRAND_RULES_FILE);
+    }
+
+    return [
+      `${BRAND_RULES_FILE} was left untouched — the compiled-rules migration is deferred while firebase.json points at it.`,
+      `Run it deliberately, on its own: ${RULES_MIGRATION_COMMAND}`,
+    ];
+  }
+
+  async run() {
+    const self = this.self;
+
+    // The deferral is the firebase.json target's question — answered before we
+    // look at the source at all, so nothing here can rewrite it.
+    if (deferredRulesTarget({ projectDir: self.firebaseProjectPath, firebaseJSON: self.firebaseJSON })) {
+      return 'warn';
+    }
+
+    const contents = jetpack.read(`${self.firebaseProjectPath}/${BRAND_RULES_FILE}`) || '';
+
+    // A pre-family source DEFERS, before the migration question below: nothing
+    // in this check speaks those markers, and a plain `false` would send the
+    // driver into fix() — which refuses, and scores as a healed check
+    // ([#40](https://github.com/Omega-JS-Stack/omega/issues/40)).
+    if (isPreFamilyMarkerFile(contents)) {
+      this.deferral = 'pre-family';
+      return 'warn';
+    }
+
+    // An unparseable file fails the check and lets fix() throw with the
+    // compiler's precise message — setup must never quietly rewrite rules it
+    // could not read.
+    try {
+      if (needsRulesMigration(contents)) {
+        return false;
+      }
+    } catch (error) {
+      return false;
+    }
+
+    // The artifact is stage output — a source-only pass still has to leave a
+    // current compile behind (setup's own stage ran before this check).
+    compileFirestoreRules({ projectDir: self.firebaseProjectPath });
+
+    return jetpack.exists(`${self.firebaseProjectPath}/${COMPILED_RULES_FILE}`) === 'file';
+  }
+
+  async fix() {
+    const self = this.self;
+    const result = ensureBrandRulesSource({ projectDir: self.firebaseProjectPath });
+
+    // Refused, not fixed: the source is pre-family and was left untouched, so
+    // there is nothing to compile from it either ([#40](https://github.com/Omega-JS-Stack/omega/issues/40)).
+    if (result.refused) {
+      console.log(chalk.red(`${BRAND_RULES_FILE} still carries a pre-family marker ('{{ backend-manager }}' or a '///---...---///' block), which this check does not speak — it was left untouched. Run \`${MARKER_MIGRATION_COMMAND}\` to convert it, then run this again.`));
+      return;
+    }
+
+    if (result.created) {
+      console.log(chalk.yellow(`Seeded ${BRAND_RULES_FILE} — your rules, compiled with the framework half. It is yours to edit.`));
+    }
+    if (result.migrated) {
+      console.log(chalk.yellow(`Migrated ${BRAND_RULES_FILE} to rules v3 (merge-by-match) — your own rules were kept, and a match block of yours that names a framework path now MERGES into it instead of sitting beside it.`));
+    }
+    for (const hook of result.strippedHooks) {
+      console.log(chalk.yellow(`Removed the retired \`${hook}()\` hook from ${BRAND_RULES_FILE} — it still carried the default body, and nothing calls it any more.`));
+    }
+    for (const hook of result.keptHooks) {
+      console.log(chalk.red(`${BRAND_RULES_FILE}: the retired \`${hook}()\` hook carried YOUR code, so it was kept as an ordinary function — but NOTHING CALLS IT NOW. Move what it enforced into a \`match\` block of your own (it merges into the framework's), then delete it.`));
+    }
+
+    compileFirestoreRules({ projectDir: self.firebaseProjectPath });
+  }
+}
+
+module.exports = FirestoreRulesFileTest;

package/dist/cli/commands/setup-tests/firestore-rules-in-json.js

@@ -0,0 +1,49 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const _ = require('lodash');
+const {
+  COMPILED_RULES_FILE,
+  deferredRulesTarget,
+  rulesMigrationDeferralNotice,
+} = require('../../utils/compile-rules');
+
+/**
+ * firebase.json points at the COMPILED artifact, never the brand's source
+ * ([#255](https://github.com/Omega-JS-Stack/omega/issues/255)) — one path for
+ * both the emulator and `firebase deploy`.
+ *
+ * Retargeting a legacy `"firestore.rules"` entry is the migration's other half,
+ * and it is NOT this check's to do: repointing the deploy at the compiled
+ * artifact changes what the live project enforces, so a brand still naming its
+ * own file has DEFERRED the migration and the check reports it instead
+ * ([#522](https://github.com/Omega-JS-Stack/omega/issues/522)).
+ */
+class FirestoreRulesInJsonTest extends BaseTest {
+  getName() {
+    return 'firestore rules in JSON';
+  }
+
+  getWarning() {
+    return rulesMigrationDeferralNotice(this.deferredTarget);
+  }
+
+  async run() {
+    this.deferredTarget = deferredRulesTarget({
+      projectDir: this.self.firebaseProjectPath,
+      firebaseJSON: this.self.firebaseJSON,
+    });
+
+    if (this.deferredTarget) {
+      return 'warn';
+    }
+
+    return this.self.firebaseJSON?.firestore?.rules === COMPILED_RULES_FILE;
+  }
+
+  async fix() {
+    _.set(this.self.firebaseJSON, 'firestore.rules', COMPILED_RULES_FILE);
+    jetpack.write(`${this.self.firebaseProjectPath}/firebase.json`, JSON.stringify(this.self.firebaseJSON, null, 2));
+  }
+}
+
+module.exports = FirestoreRulesInJsonTest;