@omega.js/backend 0.1.0

package/dist/cli/commands/setup-tests/omega-config.js

@@ -0,0 +1,84 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+const path = require('path');
+const { loadConfig, hasOmegaConfig, findBrandRoot } = require('../../../vendor/config/index.js');
+
+// The framework template seeds STANDALONE consumers at the target root; brand
+// targets carry NO local-layer file at all — brand `targets.*` is the per-target
+// home and the stage step composes the runtime file (src/dist pillar).
+const TEMPLATES_DIR = path.resolve(__dirname, '../../../../templates');
+
+class OmegaConfigTest extends BaseTest {
+  getName() {
+    return 'using proper config/omega.json5';
+  }
+
+  /**
+   * The shared schema is the required-key oracle (dogfood friction #5): the
+   * RESOLVED config (local ← brand root ← defaults, targets overlaid) must load
+   * and validate. The template stopped being a requirements list — its every
+   * leaf demanded keys (brand.address, brand.images, …) the canonical schema
+   * calls optional, and a brand target resolves shared sections from the brand
+   * root that a raw file walk can never see.
+   */
+  async run() {
+    // A brand target legitimately has no file of its own — the brand root's
+    // omega.json5 is the config (loadConfig rides it alone since cp121c)
+    if (!hasOmegaConfig(this.self.firebaseProjectPath) && !findBrandRoot(this.self.firebaseProjectPath)) {
+      this.errors = ['config/omega.json5 is missing (standalone projects carry config/omega.json5 at the target root)'];
+      return false;
+    }
+
+    try {
+      const loaded = loadConfig(this.self.firebaseProjectPath, 'backend');
+      this.errors = (loaded.errors || []).map((error) => (typeof error === 'string' ? error : error.message || JSON.stringify(error)));
+    } catch (e) {
+      this.errors = [e.message];
+    }
+
+    return this.errors.length === 0;
+  }
+
+  async fix() {
+    const ui = require('../../utils/ui');
+
+    // STANDALONE project with a missing/empty config → seed the full template at
+    // the target root (the same escape hatch every target uses). Brand targets have
+    // nothing to seed — their config IS the brand file.
+    if (!this.context.hasContent(this.self.omegaConfigJSON)
+      && !findBrandRoot(this.self.firebaseProjectPath)) {
+      jetpack.copy(
+        path.join(TEMPLATES_DIR, 'config', 'omega.json5'),
+        `${this.self.firebaseProjectPath}/config/omega.json5`,
+        { overwrite: true },
+      );
+      this.restage();
+
+      // Re-check: a fresh seed resolves clean.
+      if (await this.run()) {
+        return;
+      }
+    }
+
+    ui.note(`Fix ${chalk.bold('config/omega.json5')} — the resolved config (local ← brand root) fails the shared schema:`, 3);
+    for (const message of this.errors) {
+      console.log(`${ui.indent(4)}${chalk.red('•')} ${message}`);
+    }
+
+    const preview = this.errors.slice(0, 8);
+    const summaryDetails = [
+      chalk.dim(`Resolve ${chalk.bold(this.errors.length)} config error(s) in config/omega.json5:`),
+      ...preview.map((message) => `${chalk.red('•')} ${message}`),
+    ];
+    if (this.errors.length > preview.length) {
+      summaryDetails.push(chalk.dim(`…and ${this.errors.length - preview.length} more (see list above)`));
+    }
+
+    const error = new Error('config/omega.json5 fails the shared schema');
+    error.summaryDetails = summaryDetails;
+    throw error;
+  }
+}
+
+module.exports = OmegaConfigTest;

package/dist/cli/commands/setup-tests/project-directories.js

@@ -0,0 +1,34 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+
+const DIRS = [
+  'routes',
+  'schemas',
+  'hooks/auth',
+  'hooks/cron/daily',
+];
+
+class ProjectDirectoriesTest extends BaseTest {
+  getName() {
+    return 'project directories exist';
+  }
+
+  async run() {
+    const self = this.self;
+    // The AUTHORED tree (src/dist pillar): consumer code lives in src/, the
+    // stage step mirrors it into functions/
+    const srcDir = `${self.firebaseProjectPath}/src`;
+
+    for (const dir of DIRS) {
+      jetpack.dir(`${srcDir}/${dir}`);
+    }
+
+    return true;
+  }
+
+  async fix() {
+    throw new Error('No automatic fix available for this test');
+  }
+}
+
+module.exports = ProjectDirectoriesTest;

package/dist/cli/commands/setup-tests/project-id-consistency.js

@@ -0,0 +1,201 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const JSON5 = require('json5');
+const chalk = require('chalk').default;
+const { hasOmegaConfig, loadConfig, writeConfigValues, findBrandRoot } = require('../../../vendor/config/index.js');
+const { buildDemoServiceAccount } = require('./service-account');
+
+/**
+ * Ensures projectId is consistent across all configuration files:
+ * - functions/config/omega.json5 (cloud.config.projectId — resolved, so a
+ *   brand-level cloud.config in a brand monorepo counts) — THE SOURCE OF
+ *   TRUTH: config carries user choices, everything else is derived
+ * - .firebaserc (projects.default) — derived artifact, rewritten from config
+ * - functions/service-account.json (project_id) — derived for demo-*
+ *   (regenerated fake), downloaded for real projects
+ *
+ * Mismatches cause tests to fail when running emulator in separate terminals
+ * because different parts of the system connect to different Firestore
+ * databases. Direction matters (dogfood friction #11): the old fixer wrote a
+ * STALE .firebaserc value INTO the config (comment-stripping rewrite included)
+ * — precedence is config → derived artifacts, never the reverse.
+ */
+class ProjectIdConsistencyTest extends BaseTest {
+  getName() {
+    return 'project IDs are consistent across all config files';
+  }
+
+  async run() {
+    const sources = this.getProjectIdSources();
+    const expectedProjectId = sources.bemConfig.projectId || sources.firebaserc.projectId;
+
+    if (!expectedProjectId) {
+      console.error(chalk.red('No project id anywhere: set cloud.config.projectId in config/omega.json5 (demo-<id> for emulator-only)'));
+      return false;
+    }
+
+    const mismatches = [];
+
+    if (!sources.firebaserc.exists || !sources.firebaserc.projectId) {
+      mismatches.push({
+        file: '.firebaserc',
+        field: 'projects.default',
+        expected: expectedProjectId,
+        actual: '(missing)',
+      });
+    } else if (sources.firebaserc.projectId !== expectedProjectId) {
+      mismatches.push({
+        file: '.firebaserc',
+        field: 'projects.default',
+        expected: expectedProjectId,
+        actual: sources.firebaserc.projectId,
+      });
+    }
+
+    // Config missing the id while .firebaserc has one — the config should own it
+    if (sources.bemConfig.exists && !sources.bemConfig.projectId) {
+      mismatches.push({
+        file: 'config/omega.json5',
+        field: 'cloud.config.projectId',
+        expected: expectedProjectId,
+        actual: '(missing)',
+      });
+    }
+
+    // Check service-account.json
+    if (sources.serviceAccount.exists) {
+      if (sources.serviceAccount.projectId !== expectedProjectId) {
+        mismatches.push({
+          file: 'service-account.json',
+          field: 'project_id',
+          expected: expectedProjectId,
+          actual: sources.serviceAccount.projectId || '(missing)',
+        });
+      }
+    }
+
+    if (mismatches.length > 0) {
+      console.error(chalk.red('\nProject ID mismatches detected:'));
+      console.error(chalk.gray(`  Source of truth: config cloud.config.projectId → ${expectedProjectId}\n`));
+
+      for (const mismatch of mismatches) {
+        console.error(chalk.red(`  ${mismatch.file} (${mismatch.field})`));
+        console.error(chalk.gray(`    Expected: ${mismatch.expected}`));
+        console.error(chalk.gray(`    Actual:   ${mismatch.actual}\n`));
+      }
+
+      return false;
+    }
+
+    return true;
+  }
+
+  getProjectIdSources() {
+    const projectPath = this.self.firebaseProjectPath;
+
+    // .firebaserc
+    const firebasercPath = `${projectPath}/.firebaserc`;
+    const firebasercContent = jetpack.read(firebasercPath);
+    const firebasercData = firebasercContent ? JSON5.parse(firebasercContent) : null;
+
+    // config/omega.json5 — resolved through the loader so the projectId is
+    // found wherever the hierarchy puts it (local file or brand file; a brand
+    // app with no file of its own still resolves via the brand root)
+    let omegaProjectId = null;
+    const omegaExists = hasOmegaConfig(projectPath) || !!findBrandRoot(projectPath);
+    if (omegaExists) {
+      try {
+        omegaProjectId = loadConfig(projectPath, 'backend').config.cloud?.config?.projectId || null;
+      } catch (e) {
+        // Unloadable config — the omega-config test reports it; treat as missing here
+      }
+    }
+
+    // service-account.json — source chain: target root (standalone) → brand
+    // .omega/secrets/ (src/dist pillar; the stage step reads the same chain)
+    const brandRoot = findBrandRoot(projectPath);
+    const serviceAccountPath = [
+      `${projectPath}/service-account.json`,
+      brandRoot ? `${brandRoot}/.omega/secrets/service-account.json` : null,
+    ].filter(Boolean).find((candidate) => jetpack.exists(candidate)) || `${projectPath}/service-account.json`;
+    const serviceAccountContent = jetpack.read(serviceAccountPath);
+    const serviceAccountData = serviceAccountContent ? JSON5.parse(serviceAccountContent) : null;
+
+    return {
+      firebaserc: {
+        exists: !!firebasercContent,
+        projectId: firebasercData?.projects?.default || null,
+      },
+      bemConfig: {
+        exists: omegaExists,
+        projectId: omegaProjectId,
+      },
+      serviceAccount: {
+        exists: !!serviceAccountContent,
+        projectId: serviceAccountData?.project_id || null,
+      },
+    };
+  }
+
+  async fix() {
+    const projectPath = this.self.firebaseProjectPath;
+    const sources = this.getProjectIdSources();
+    const expectedProjectId = sources.bemConfig.projectId || sources.firebaserc.projectId;
+
+    if (!expectedProjectId) {
+      console.log(chalk.red('Cannot fix: no project id in config/omega.json5 or .firebaserc'));
+      console.log(chalk.yellow('Set cloud.config.projectId in config/omega.json5 (demo-<id> for emulator-only)'));
+      throw new Error('No project id configured');
+    }
+
+    // Config lacks the id (only .firebaserc had one) — land it in config via
+    // the comment-preserving editor, so the config owns it from here on. A
+    // brand target has no file of its own → the value belongs in the BRAND file.
+    if (sources.bemConfig.exists && !sources.bemConfig.projectId) {
+      const configHome = hasOmegaConfig(projectPath) ? projectPath : findBrandRoot(projectPath);
+      writeConfigValues(configHome, { 'cloud.config.projectId': expectedProjectId });
+      console.log(chalk.green(`Fixed: config/omega.json5 → cloud.config.projectId = ${expectedProjectId}`));
+      this.restage();
+    }
+
+    // .firebaserc is DERIVED — rewrite it from config
+    if (sources.firebaserc.projectId !== expectedProjectId) {
+      const firebasercPath = `${projectPath}/.firebaserc`;
+      const firebasercData = sources.firebaserc.exists ? JSON5.parse(jetpack.read(firebasercPath)) : {};
+      firebasercData.projects = firebasercData.projects || {};
+      firebasercData.projects.default = expectedProjectId;
+      jetpack.write(firebasercPath, `${JSON.stringify(firebasercData, null, 2)}\n`);
+      console.log(chalk.green(`Fixed: .firebaserc → projects.default = ${expectedProjectId}`));
+    }
+
+    // service-account.json: demo-* fakes regenerate; real ones must be downloaded
+    if (sources.serviceAccount.exists && sources.serviceAccount.projectId !== expectedProjectId) {
+      if (this.isDemoProject) {
+        const saPath = `${projectPath}/service-account.json`;
+        jetpack.write(saPath, `${JSON.stringify(buildDemoServiceAccount(expectedProjectId), null, 2)}\n`);
+        this.restage();
+        console.log(chalk.green(`Fixed: regenerated fake service-account.json for ${expectedProjectId}`));
+      } else {
+        console.log(chalk.red(`\nCannot auto-fix service-account.json`));
+        console.log(chalk.yellow(`  Current project_id: ${sources.serviceAccount.projectId}`));
+        console.log(chalk.yellow(`  Expected project_id: ${expectedProjectId}`));
+        console.log(chalk.yellow(`\n  Download the correct service account from:`));
+        console.log(chalk.cyan(`  https://console.firebase.google.com/project/${expectedProjectId}/settings/serviceaccounts/adminsdk`));
+        throw new Error('service-account.json has wrong project_id - download correct one from Firebase Console');
+      }
+    }
+
+    // Later checks read the SHARED setup context (isDemoProject gates, console
+    // URLs) — self.projectId was snapshotted from .firebaserc at boot, so a
+    // rewrite here must refresh it or a demo→real swap keeps demo semantics
+    // for the rest of the run (caught live: check 39 skipped seeding
+    // omegajs-playground because self still said demo-omega).
+    this.self.projectId = expectedProjectId;
+    this.self.projectUrl = `https://console.firebase.google.com/project/${expectedProjectId}`;
+    if (this.self.firebaseRC?.projects) {
+      this.self.firebaseRC.projects.default = expectedProjectId;
+    }
+  }
+}
+
+module.exports = ProjectIdConsistencyTest;

package/dist/cli/commands/setup-tests/public-html-files.js

@@ -0,0 +1,22 @@
+const BaseTest = require('./base-test');
+const { writePublicFiles } = require('../../utils/public-files');
+
+class PublicHtmlFilesTest extends BaseTest {
+  getName() {
+    return 'create public .html files';
+  }
+
+  async run() {
+    const self = this.self;
+
+    writePublicFiles(self.firebaseProjectPath, { url: self.omegaConfigJSON.brand.url, overwrite: true });
+
+    return true;
+  }
+
+  async fix() {
+    throw new Error('No automatic fix available for this test');
+  }
+}
+
+module.exports = PublicHtmlFilesTest;

package/dist/cli/commands/setup-tests/realtime-rules-file.js

@@ -0,0 +1,69 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+const { omegaAllRulesRegex } = require('./helpers.js');
+const { MARKER_MIGRATION_COMMAND, isPreFamilyMarkerFile, markerMigrationDeferralNotice } = require('../../utils/compile-rules');
+
+class RealtimeRulesFileTest extends BaseTest {
+  getName() {
+    return 'update realtime rules file';
+  }
+
+  getWarning() {
+    return markerMigrationDeferralNotice('database.rules.json');
+  }
+
+  async run() {
+    const self = this.self;
+    const exists = jetpack.exists(`${self.firebaseProjectPath}/database.rules.json`);
+    const contents = jetpack.read(`${self.firebaseProjectPath}/database.rules.json`) || '';
+
+    // A pre-family file DEFERS rather than failing: the driver auto-fixes a
+    // failure, and this check's fix() can only refuse one
+    // ([#40](https://github.com/Omega-JS-Stack/omega/issues/40)).
+    if (isPreFamilyMarkerFile(contents)) {
+      return 'warn';
+    }
+
+    const containsCore = contents.match(omegaAllRulesRegex);
+    const matchesVersion = contents.match(self.default.rulesVersionRegex);
+
+    return (exists && !!containsCore && !!matchesVersion);
+  }
+
+  async fix() {
+    const self = this.self;
+    const name = 'database.rules.json';
+    const path = `${self.firebaseProjectPath}/${name}`;
+    const exists = jetpack.exists(path);
+    let contents = jetpack.read(path) || '';
+
+    if (!exists || !contents) {
+      console.log(chalk.yellow(`Writing new ${name} file...`));
+      jetpack.write(path, self.default.databaseRulesWhole);
+      contents = jetpack.read(path) || '';
+    }
+
+    const hasTemplate = contents.match(omegaAllRulesRegex);
+    if (!hasTemplate) {
+      // A PRE-FAMILY file is not a missing marker block, it is an unreadable
+      // one — and converting it is the run-alone verb's job, never setup's
+      // ([#40](https://github.com/Omega-JS-Stack/omega/issues/40)).
+      if (isPreFamilyMarkerFile(contents)) {
+        console.log(chalk.red(`${name} still carries a pre-family marker ('{{ backend-manager }}' or a '///---...---///' block), which this check does not speak. Run \`${MARKER_MIGRATION_COMMAND}\` to convert it, then run this again.`));
+        return;
+      }
+      console.log(chalk.red(`Could not find rules template. Please edit ${name} and add the '// ========== OMEGA Rules (v0.0.0) ==========' ... '// ========== End OMEGA Rules ==========' marker block to it.`));
+      return;
+    }
+
+    const matchesVersion = contents.match(self.default.rulesVersionRegex);
+    if (!matchesVersion) {
+      contents = contents.replace(omegaAllRulesRegex, self.default.databaseRulesCore);
+      jetpack.write(path, contents);
+      console.log(chalk.yellow(`Writing core rules to ${name} file...`));
+    }
+  }
+}
+
+module.exports = RealtimeRulesFileTest;

package/dist/cli/commands/setup-tests/realtime-rules-in-json.js

@@ -0,0 +1,20 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const _ = require('lodash');
+
+class RealtimeRulesInJsonTest extends BaseTest {
+  getName() {
+    return 'realtime rules in JSON';
+  }
+
+  async run() {
+    return this.self.firebaseJSON?.database?.rules === 'database.rules.json';
+  }
+
+  async fix() {
+    _.set(this.self.firebaseJSON, 'database.rules', 'database.rules.json');
+    jetpack.write(`${this.self.firebaseProjectPath}/firebase.json`, JSON.stringify(this.self.firebaseJSON, null, 2));
+  }
+}
+
+module.exports = RealtimeRulesInJsonTest;

package/dist/cli/commands/setup-tests/remoteconfig-template-file.js

@@ -0,0 +1,32 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const path = require('path');
+const chalk = require('chalk').default;
+
+class RemoteconfigTemplateFileTest extends BaseTest {
+  getName() {
+    return 'update remoteconfig template file';
+  }
+
+  async run() {
+    const self = this.self;
+    const exists = jetpack.exists(`${self.firebaseProjectPath}/remoteconfig.template.json`);
+    return exists;
+  }
+
+  async fix() {
+    const self = this.self;
+    const name = 'remoteconfig.template.json';
+    const filePath = `${self.firebaseProjectPath}/${name}`;
+    const exists = jetpack.exists(filePath);
+    let contents = jetpack.read(filePath) || '';
+
+    if (!exists) {
+      console.log(chalk.yellow(`Writing new ${name} file...`));
+      jetpack.write(filePath, jetpack.read(path.resolve(`${__dirname}/../../../../templates/${name}`)));
+      contents = jetpack.read(filePath) || '';
+    }
+  }
+}
+
+module.exports = RemoteconfigTemplateFileTest;

package/dist/cli/commands/setup-tests/remoteconfig-template-in-json.js

@@ -0,0 +1,31 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const _ = require('lodash');
+
+const ENABLED = false;
+
+class RemoteconfigTemplateInJsonTest extends BaseTest {
+  getName() {
+    return 'remoteconfig template in JSON';
+  }
+
+  async run() {
+    if (ENABLED) {
+      return this.self.firebaseJSON?.remoteconfig?.template === 'remoteconfig.template.json';
+    }
+
+    return !this.self.firebaseJSON?.remoteconfig;
+  }
+
+  async fix() {
+    if (ENABLED) {
+      _.set(this.self.firebaseJSON, 'remoteconfig.template', 'remoteconfig.template.json');
+    } else {
+      delete this.self.firebaseJSON.remoteconfig;
+    }
+
+    jetpack.write(`${this.self.firebaseProjectPath}/firebase.json`, JSON.stringify(this.self.firebaseJSON, null, 2));
+  }
+}
+
+module.exports = RemoteconfigTemplateInJsonTest;

package/dist/cli/commands/setup-tests/service-account.js

@@ -0,0 +1,86 @@
+const { generateKeyPairSync } = require('node:crypto');
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+
+/**
+ * Build a FAKE service-account.json for an emulator-only demo-* project:
+ * shaped like the real thing (firebase-admin's cert() parses it) but with a
+ * throwaway locally-generated RSA key — no live credential exists for a
+ * project that doesn't exist. Real projects still require the downloaded
+ * file (friction #10).
+ */
+function buildDemoServiceAccount(projectId) {
+  const { privateKey } = generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+
+  return {
+    type: 'service_account',
+    project_id: projectId,
+    private_key_id: 'demo-local-throwaway',
+    private_key: privateKey,
+    client_email: `demo@${projectId}.iam.gserviceaccount.com`,
+    client_id: '0',
+    auth_uri: 'https://accounts.google.com/o/oauth2/auth',
+    token_uri: 'https://oauth2.googleapis.com/token',
+    auth_provider_x509_cert_url: 'https://www.googleapis.com/oauth2/v1/certs',
+    client_x509_cert_url: `https://www.googleapis.com/robot/v1/metadata/x509/demo%40${projectId}.iam.gserviceaccount.com`,
+  };
+}
+
+class ServiceAccountTest extends BaseTest {
+  getName() {
+    return 'has correct service-account.json';
+  }
+
+  async run() {
+    // Source chain (src/dist pillar): target root (standalone) → brand
+    // .omega/secrets/ (the firebase manage service mints it there); the
+    // stage step carries whichever exists into dist/
+    const serviceAccount = jetpack.read(this.resolveSaPath());
+
+    // Make sure the service account exists
+    if (!serviceAccount) {
+      console.error(chalk.red('Missing service-account.json'));
+      return false;
+    }
+
+    return true;
+  }
+
+  /** First existing SA in the source chain; target root as the write default. */
+  resolveSaPath() {
+    const { findBrandRoot } = require('../../../vendor/config/index.js');
+    const path = require('path');
+    const targetRootPath = `${this.self.firebaseProjectPath}/service-account.json`;
+    const brandRoot = findBrandRoot(this.self.firebaseProjectPath);
+    const brandPath = brandRoot ? path.join(brandRoot, '.omega', 'secrets', 'service-account.json') : null;
+
+    if (jetpack.exists(targetRootPath)) return targetRootPath;
+    if (brandPath && jetpack.exists(brandPath)) return brandPath;
+    return targetRootPath;
+  }
+
+  async fix() {
+    // Emulator-only demo-* projects get an auto-generated fake — the runtime
+    // only reads the file on the PRODUCTION branch, but setup and tooling
+    // expect it to exist.
+    if (this.isDemoProject) {
+      const saPath = `${this.self.firebaseProjectPath}/service-account.json`;
+      jetpack.write(saPath, `${JSON.stringify(buildDemoServiceAccount(this.self.projectId), null, 2)}\n`);
+      this.restage();
+      console.log(chalk.green(`  ✓ Generated fake service-account.json for demo project ${chalk.bold(this.self.projectId)} (throwaway local key)`));
+      return;
+    }
+
+    console.log(chalk.red(`There is no automatic fix for this check.`));
+    console.log(chalk.red(`Please install a service account --> ` + chalk.yellow.red(`${this.self.projectUrl}/settings/serviceaccounts/adminsdk`)));
+    throw new Error('Missing or incorrect service-account.json');
+  }
+}
+
+module.exports = ServiceAccountTest;
+module.exports.buildDemoServiceAccount = buildDemoServiceAccount;

package/dist/cli/commands/setup-tests/storage-lifecycle-policy.js

@@ -0,0 +1,81 @@
+const BaseTest = require('./base-test');
+const powertools = require('node-powertools');
+const path = require('path');
+const chalk = require('chalk').default;
+
+class StorageLifecyclePolicyTest extends BaseTest {
+  getName() {
+    return 'set storage lifecycle policy';
+  }
+
+  getWarning() {
+    return [
+      'storage lifecycle policy not applied (--offline) — no `gsutil lifecycle set` ran; re-run `npx omega test` without --offline to apply it',
+    ];
+  }
+
+  async run() {
+    const self = this.self;
+
+    // demo-* projects are emulator-only — the buckets can never exist, so there
+    // is nothing to set and nothing to warn about (gates before --offline so a
+    // demo scaffold does not warn about a policy that can never apply).
+    if (this.isDemoProject) {
+      console.log(chalk.dim(`  demo-* project (${self.projectId}) — storage lifecycle skipped (emulator-only)`));
+      return true;
+    }
+
+    // This check IS the mutation — it writes the lifecycle policy onto live GCS
+    // buckets. Under --offline it downgrades to a non-blocking warning before
+    // any gsutil spawns, so a scaffold run never rewrites live infra (#284).
+    if (this.isOffline) {
+      return 'warn';
+    }
+
+    const result = await this.cmd_setStorageLifecycle(self).catch(e => e);
+    return !(result instanceof Error);
+  }
+
+  async fix() {
+    console.error(chalk.red(`There is no automatic fix. Please run: \n${chalk.bold('firebase deploy && npx bm setup')}`));
+    throw new Error('No automatic fix available');
+  }
+
+  async cmd_setStorageLifecycle(self) {
+    return new Promise(async (resolve, reject) => {
+      const buckets = [
+        {
+          name: `us.artifacts.${self.projectId}.appspot.com`,
+          config: path.resolve(`${__dirname}/../../../../templates/storage-lifecycle-config-1-day.json`)
+        },
+        {
+          name: `bm-backup-firestore-${self.projectId}`,
+          config: path.resolve(`${__dirname}/../../../../templates/storage-lifecycle-config-30-days.json`)
+        }
+      ];
+
+      try {
+        for (const bucket of buckets) {
+          // Check if bucket exists first
+          const checkCommand = `gsutil ls -b gs://${bucket.name}`;
+          const exists = await powertools.execute(checkCommand, { log: false })
+            .then(() => true)
+            .catch(() => false);
+
+          if (exists) {
+            const command = `gsutil lifecycle set ${bucket.config} gs://${bucket.name}`;
+            await powertools.execute(command, { log: true });
+          } else {
+            console.log(chalk.yellow(`Skipping bucket gs://${bucket.name} (does not exist)`));
+          }
+        }
+        resolve('Success');
+      } catch (e) {
+        console.error(chalk.red(`Failed to set storage lifecycle policy`, e));
+        reject(e);
+      }
+    });
+  }
+}
+
+module.exports = StorageLifecyclePolicyTest;