@omega.js/backend 0.1.0

package/test/analytics/match-normalization.test.js

@@ -0,0 +1,238 @@
+/**
+ * Test: the per-provider match-parameter tables
+ * ([#577](https://github.com/Omega-JS-Stack/omega/issues/577)).
+ *
+ * Meta scored the playground's StartTrial 6.2/10 on event match quality and its
+ * CompleteRegistration around 4/10, because every server event carried `em` +
+ * `external_id` and nothing else — while the account doc already held the name,
+ * birthday, gender, location and phone the platforms accept. The plumbing now
+ * exists for EVERY parameter each platform documents (Ian's ruling, 2026-08-24),
+ * and a value a brand does not hold compacts away exactly as before.
+ *
+ * NORMALIZATION IS THE WHOLE JOB. An unnormalized hash is accepted by every one
+ * of these APIs and matches NOBODY — the #397/#403 failure mode, one field at a
+ * time. So each provider gets its OWN table, and this file walks it value by
+ * value against the rule the platform's live spec states:
+ *
+ *   META  (developers.facebook.com/docs/marketing-api/conversions-api/parameters/
+ *          customer-information-parameters, fetched 2026-08-24) — every one of
+ *          fn ln ct st zp country db ge is "hashing required", each with its own
+ *          normalization: names lowercase with no punctuation, city with no
+ *          spaces either, `st` the 2-character ANSI code in lowercase, `zp` the
+ *          first five digits of a US zip, `country` ISO 3166-1 alpha-2 lowercase,
+ *          `db` YYYYMMDD, `ge` the lowercase initial.
+ *   GA4   (developers.google.com/analytics/devguides/collection/ga4/uid-data) —
+ *          names and street HASHED with digits and symbols removed; city, region,
+ *          postal code and country sent in the CLEAR, and country UPPERCASE.
+ *   TIKTOK (business-api.tiktok.com/portal/docs?id=1771101303285761) — its
+ *          Events API `user` object accepts email, phone, external_id, ttclid,
+ *          ttp, ip and user_agent, and NO name or address parameter at all. The
+ *          absence is asserted, because inventing keys a platform does not read
+ *          is the same silent nothing as an unnormalized hash.
+ *
+ * Run: npx omega test framework:analytics/match-normalization
+ */
+const crypto = require('crypto');
+const matchData = require('../../dist/manager/libraries/analytics/match-data.js');
+const conversions = require('../../dist/manager/libraries/analytics/conversions.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+function sha256(value) {
+  return crypto.createHash('sha256').update(value).digest('hex');
+}
+
+// A user doc as the account schema stores one, with the values in the messy
+// shapes real accounts carry: mixed case, punctuation, a spaced city, a state
+// written out in full, a US zip with its +4, a birthday stamp.
+function fullUserDoc() {
+  return {
+    auth: { uid: '_test-match-uid', email: '  Ada.Lovelace@Example.COM ' },
+    personal: {
+      name: { first: "  Ada-Marie ", last: "O'Byrne " },
+      birthday: { timestamp: '1985-02-16T00:00:00.000Z', timestampUNIX: 477273600 },
+      gender: 'female',
+      location: { country: 'US', region: 'California', city: 'San Diego', postalCode: '94035-1234' },
+      telephone: { countryCode: 1, national: 5550102030 },
+    },
+  };
+}
+
+module.exports = defineCases({
+  description: 'Match parameters: one normalization table per provider',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'meta-normalizes-every-customer-information-parameter-its-own-way',
+      auth: 'none',
+
+      async run({ assert }) {
+        const identity = matchData.buildIdentity({ uid: '_test-match-uid', user: fullUserDoc() });
+        const meta = identity.meta;
+
+        assert.equal(meta.fn, sha256('adamarie'), 'fn: lowercase with no punctuation');
+        assert.equal(meta.ln, sha256('obyrne'), 'ln: the apostrophe is punctuation too');
+        assert.equal(meta.ct, sha256('sandiego'), 'ct: no spaces either (Meta\'s own example is newyork)');
+        assert.equal(meta.st, sha256('ca'), 'st: the 2-character ANSI code, lowercase');
+        assert.equal(meta.zp, sha256('94035'), 'zp: the first five digits of a US zip');
+        assert.equal(meta.country, sha256('us'), 'country: ISO 3166-1 alpha-2, lowercase');
+        assert.equal(meta.db, sha256('19850216'), 'db: YYYYMMDD');
+        assert.equal(meta.ge, sha256('f'), 'ge: the lowercase initial');
+
+        // The hashes are of the NORMALIZED value, which is the entire point: a
+        // digest of the stored string is accepted by Meta and matches nobody.
+        assert.equal(meta.ct === sha256('San Diego'), false, 'the raw city must never be what was hashed');
+        assert.equal(JSON.stringify(identity).includes('San Diego'), false, 'and no raw personal value rides the identity block');
+        assert.equal(JSON.stringify(identity).includes('Ada'), false);
+      },
+    },
+
+    {
+      name: 'meta-sends-nothing-it-cannot-normalize-to-the-spec',
+      auth: 'none',
+
+      async run({ assert }) {
+        // A value the platform's own rule cannot express is worth LESS than no
+        // key: it matches nobody and reads as a field we tried and failed to
+        // send. Meta accepts f and m alone, and a 2-letter country code alone.
+        const identity = matchData.buildIdentity({
+          uid: '_test-match-uid',
+          user: {
+            personal: {
+              gender: 'non-binary',
+              location: { country: 'United States', region: 'Bavaria', city: 'München' },
+            },
+          },
+        });
+
+        assert.equal(Object.hasOwn(identity.meta, 'ge'), false, 'a gender outside Meta\'s two initials sends no key');
+        assert.equal(Object.hasOwn(identity.meta, 'db'), false, 'and no birthday means no key');
+        assert.equal(Object.hasOwn(identity.meta, 'country'), false, 'a country NAME is not the alpha-2 code Meta matches on');
+        assert.equal(identity.meta.st, sha256('bavaria'), 'a non-US state is lowercase with no spaces, per the same rule');
+        assert.equal(identity.meta.ct, sha256('münchen'), 'a UTF-8 city keeps its own characters');
+
+        // Nothing at all is still nothing at all — the whole block goes.
+        const empty = matchData.buildIdentity({ uid: '_test-match-uid' });
+
+        assert.equal(Object.hasOwn(empty, 'meta'), false, 'an account with no personal data carries no Meta block');
+        assert.deepEqual(empty, { externalId: '_test-match-uid', tiktokExternalIdHash: matchData.hashExternalId('_test-match-uid') }, 'external_id alone, exactly as before');
+      },
+    },
+
+    {
+      name: 'the-schema-default-birthday-is-not-a-birthday',
+      auth: 'none',
+
+      async run({ assert, Manager }) {
+        // `personal.birthday` is a `$timestamp` branch, and its default is the
+        // EPOCH — the same shape of trap `personal.telephone`'s `0` default is
+        // (#388): hashing it would hand every account with no birthday on file
+        // the digest of `19700101`, one junk match key shared by all of them.
+        // The user comes from the production resolver, so the default is the
+        // real one and not a hand-written stand-in.
+        const user = Manager.User({ auth: { uid: '_test-match-uid', email: 'buyer@example.com' } }).properties;
+
+        assert.equal(user.personal.birthday.timestampUNIX, 0, 'precondition: the schema default is the epoch');
+
+        const identity = matchData.buildIdentity({ uid: '_test-match-uid', user: user });
+
+        assert.equal(Object.hasOwn(identity, 'meta'), false, 'nothing on this account normalizes to a match key');
+        assert.equal(JSON.stringify(identity).includes(sha256('19700101')), false, 'the epoch must not be hashed under any key');
+
+        // A real birthday still goes.
+        const born = matchData.buildIdentity({
+          uid: '_test-match-uid',
+          user: { personal: { birthday: { timestamp: '1985-02-16T00:00:00.000Z', timestampUNIX: 477273600 } } },
+        });
+
+        assert.equal(born.meta.db, sha256('19850216'), 'a real date is still sent');
+      },
+    },
+
+    {
+      // The account schema HOLDS an address now — `personal.location.postalCode`
+      // and `.street` ([#663](https://github.com/Omega-JS-Stack/omega/issues/663))
+      // — so the reader's `zip` key finally finds a value on a real doc. The bag
+      // key stays `zip` because that is the parameter name Meta's own table
+      // normalizes; the schema's name is the international one.
+      name: 'the-postal-code-and-street-come-off-the-account-schema',
+      auth: 'none',
+
+      async run({ assert, Manager }) {
+        const user = Manager.User({
+          auth: { uid: '_test-match-uid', email: 'buyer@example.com' },
+          personal: { location: { postalCode: '90210', street: '123 Main Street' } },
+        }).properties;
+
+        assert.equal(user.personal.location.postalCode, '90210', 'precondition: the resolver keeps the schema field');
+
+        const fields = matchData.readUserMatchFields(user);
+
+        assert.equal(fields.zip, '90210', 'postalCode rides the platform\'s own zip key');
+        assert.equal(fields.street, '123 Main Street', 'street reads as it always did');
+
+        const identity = matchData.buildIdentity({ uid: '_test-match-uid', user: user });
+
+        assert.equal(identity.meta.zp, sha256('90210'), 'and reaches Meta\'s zp, normalized by Meta\'s rule');
+
+        // `personal.location.zip` was never a schema field — a doc carrying one
+        // is read as the nothing it is, rather than as a second home for the value.
+        const legacy = matchData.readUserMatchFields({ personal: { location: { zip: '90210' } } });
+
+        assert.equal(legacy.zip, undefined, 'personal.location.zip is not read any more');
+      },
+    },
+
+    {
+      name: 'ga4-normalizes-its-address-block-per-its-own-spec',
+      auth: 'none',
+
+      async run({ assert }) {
+        // GA4's rules are NOT Meta's: names drop digits and symbols but keep
+        // their spaces, city/region/postal code ride in the CLEAR, and the
+        // country code is uppercase (its own reference sample sends 'US').
+        assert.equal(matchData.hashGA4Name('  Ada-Marie 2 '), sha256('adamarie'), 'names: digits and symbols removed, lowercased, trimmed');
+        assert.equal(matchData.hashGA4Street(' 123 Main Street. '), sha256('123 main street'), 'street keeps its digits, loses its symbols');
+        assert.equal(matchData.ga4Place('  San Diego '), 'san diego', 'city and region keep their spaces and are never hashed');
+        assert.equal(matchData.ga4Place('California'), 'california', 'GA4 wants the region NAME where Meta wants the ANSI code');
+        assert.equal(matchData.ga4PostalCode(' 94035-1234 '), '94035-1234', 'only . and ~ come out of a postal code');
+        assert.equal(matchData.ga4Country('us'), 'US', 'the country code is uppercase alpha-2');
+        assert.equal(matchData.ga4Country('United States'), '', 'a country name is not a code, so nothing is sent');
+      },
+    },
+
+    {
+      name: 'tiktok-carries-no-parameter-its-events-api-does-not-accept',
+      auth: 'none',
+
+      async run({ assert, ctx, Manager }) {
+        // TikTok's Events API 2.0 `user` object documents email, phone,
+        // external_id, ttclid, ttp, ip and user_agent — and nothing else. A
+        // name or address key there is not rejected: it is read by nobody.
+        const identity = matchData.buildIdentity({ uid: '_test-match-uid', user: fullUserDoc() });
+        const results = conversions.deliverConversion({
+          event: 'sign_up',
+          params: { method: 'email', user_id: '_test-match-uid' },
+          identity: identity,
+          providers: ['tiktok'],
+          eventId: 'sign_up._test-match',
+          ctx: ctx,
+          Manager: Manager,
+        });
+
+        const user = conversions.buildTikTokBody({
+          descriptor: results.find((result) => result.provider === 'tiktok').descriptor,
+          identity: identity,
+          eventId: 'sign_up._test-match',
+          pixelCode: '_TEST_PIXEL',
+        }).data[0].user;
+
+        assert.deepEqual(Object.keys(user).sort(), ['email', 'external_id', 'phone'], 'only the keys TikTok reads');
+
+        for (const key of ['first_name', 'last_name', 'city', 'state', 'zip_code', 'country', 'fn', 'ln', 'ct', 'st', 'zp', 'db', 'ge']) {
+          assert.equal(Object.hasOwn(user, key), false, `${key} is not a TikTok parameter`);
+        }
+      },
+    },
+  ],
+});

package/test/analytics/signup-conversion.test.js

@@ -0,0 +1,135 @@
+/**
+ * Test: the SERVER half of `sign_up`, fired from the post-auth request
+ * ([#577](https://github.com/Omega-JS-Stack/omega/issues/577)).
+ *
+ * It used to fire from the auth trigger, which has no HTTP request behind it:
+ * no IP, no user agent, no `_fbc`/`_fbp`/`_ttp`, and an attribution the browser
+ * had not posted yet. Meta scored the resulting CompleteRegistration around
+ * 4/10 on match quality for exactly that reason.
+ *
+ * So the fire moved to the one request the browser ALREADY makes after auth
+ * (`POST /user/signup`), which carries all four. The trigger fires nothing —
+ * that is what keeps a registration from being counted twice — and this module
+ * is the ONE home of the server half: its dedupe id, its provider selection and
+ * its method vocabulary are the contract with the browser half.
+ *
+ *   THE DEDUPE ID IS `sign_up.<uid>`.
+ *
+ * Pure: `buildSignupFire()` is what `trackSignup()` hands to `deliverConversion`,
+ * so the payload can be read without a route, a request or a platform.
+ *
+ * Run: npx omega test framework:analytics/signup-conversion
+ */
+const crypto = require('crypto');
+const signup = require('../../dist/manager/libraries/analytics/signup.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+const UID = '_test-signup-conversion-uid';
+const IP = '203.0.113.9';
+const USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)';
+
+function sha256(value) {
+  return crypto.createHash('sha256').update(value).digest('hex');
+}
+
+// The Auth record the route reads back, and the doc it just wrote — carrying the
+// attribution the browser posted, cookies included (the checkout intent's shape).
+function authUser(providerId = 'password') {
+  return {
+    uid: UID,
+    email: 'Ada.Lovelace@Example.COM',
+    providerData: [{ providerId: providerId }],
+  };
+}
+
+function userRecord() {
+  return {
+    auth: { uid: UID, email: 'Ada.Lovelace@Example.COM' },
+    personal: {
+      name: { first: 'Ada', last: 'Lovelace' },
+      location: { country: 'US', region: 'California', city: 'San Diego' },
+    },
+    attribution: {
+      last: {
+        tags: { utm_source: 'meta', utm_medium: 'cpc' },
+        clickIds: { fbclid: 'FB-CLICK' },
+        url: 'https://brand.test/signup',
+        timestamp: '2026-08-01T00:00:00.000Z',
+      },
+      cookies: { fbc: 'fb.1.1754006400000.REAL-COOKIE', fbp: 'fb.1.1754006400000.987654321', ttp: 'TTP-COOKIE' },
+    },
+    trackingConsent: { analytics: true, marketing: true, region: 'opt-in', version: 1 },
+  };
+}
+
+module.exports = defineCases({
+  description: 'sign_up: the server half fires from the post-auth request, with the request\'s match data',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'the-server-half-carries-the-requests-ip-user-agent-and-cookies',
+      auth: 'none',
+
+      async run({ assert }) {
+        const fire = signup.buildSignupFire({
+          authUser: authUser(),
+          userRecord: userRecord(),
+          request: { ip: IP, userAgent: USER_AGENT },
+        });
+
+        assert.equal(fire.event, 'sign_up');
+        assert.equal(fire.eventId, `sign_up.${UID}`, 'the dedupe id is the one the browser half sends');
+        assert.deepEqual(fire.providers, ['meta', 'tiktok'], 'GA4 has no cross-source dedupe — the browser half owns it');
+
+        // The four things the auth trigger could never see.
+        assert.equal(fire.identity.ip, IP, 'the request\'s IP');
+        assert.equal(fire.identity.userAgent, USER_AGENT, 'and its user agent');
+        assert.equal(fire.attribution.fbp, 'fb.1.1754006400000.987654321', 'the platform cookies the browser posted');
+        assert.equal(fire.attribution.fbc, 'fb.1.1754006400000.REAL-COOKIE');
+        assert.equal(fire.attribution.ttp, 'TTP-COOKIE');
+        assert.equal(fire.attribution.source, 'meta', 'and the campaign that brought them here');
+
+        // Plus the account itself, through the shared reader.
+        assert.equal(fire.identity.emailHash, sha256('ada.lovelace@example.com'));
+        assert.equal(fire.identity.meta.ct, sha256('sandiego'), 'the personal set rides too');
+        assert.equal(fire.trackingConsent.marketing, true, 'the consent snapshot the record stored gates the fire');
+      },
+    },
+
+    {
+      name: 'the-method-speaks-the-same-vocabulary-as-the-browser-half',
+      auth: 'none',
+
+      async run({ assert }) {
+        // The client fires trackSignup('email') / trackSignup('google'); the
+        // server twin must not say 'password' / 'google.com' for the same act.
+        assert.equal(signup.resolveSignupMethod({ providerData: [{ providerId: 'password' }] }), 'email');
+        assert.equal(signup.resolveSignupMethod({ providerData: [{ providerId: 'google.com' }] }), 'google');
+        assert.equal(signup.resolveSignupMethod({ providerData: [{ providerId: 'apple.com' }] }), 'apple');
+        assert.equal(signup.resolveSignupMethod({}), 'email', 'an unknown provider reads as the default email signup');
+
+        const fire = signup.buildSignupFire({ authUser: authUser('google.com'), userRecord: userRecord(), request: {} });
+
+        assert.equal(fire.params.method, 'google', 'and the params carry it');
+        assert.equal(fire.params.user_id, UID);
+      },
+    },
+
+    {
+      name: 'a-signup-with-nothing-behind-it-still-fires-on-external-id',
+      auth: 'none',
+
+      async run({ assert }) {
+        // A blocked pixel, a cleared jar, a request with no geolocation header:
+        // absent match data never blocks the registration itself.
+        const fire = signup.buildSignupFire({ authUser: { uid: UID }, userRecord: {}, request: {} });
+
+        assert.deepEqual(Object.keys(fire.attribution), [], 'no attribution to send');
+        assert.equal(Object.hasOwn(fire.identity, 'ip'), false, 'an absent key is absent, never empty');
+        assert.equal(fire.identity.externalId, UID, 'external_id alone still identifies the registration');
+        assert.equal(fire.trackingConsent, null, 'and an unrecorded snapshot is not a denial');
+      },
+    },
+  ],
+});

package/test/boot/cli-dispatch.test.js

@@ -0,0 +1,142 @@
+/**
+ * CLI dispatch pins — the tail of Main.process()'s dispatch loop. The old chain
+ * had no terminal branch: bare `omega` and any unknown command returned
+ * undefined and exited 0 in silence. Pins: help never falls through to a
+ * command, the unknown path names the command and sets a failing exit code,
+ * bare invocation prints the listing (since #675 retired `setup` no entry
+ * claims the default slot), and `clean` is accepted bare alongside `clean:npm`.
+ *
+ * Plus the issue #20 pin: help is GENERATED from the command table both halves
+ * read, so a command can never dispatch without appearing in the listing.
+ */
+
+const Main = require('../../dist/cli/index.js');
+const table = require('../../dist/cli/command-table.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+// Capture console + exit code around a process() call, restoring after.
+async function captured(fn) {
+  const out = [];
+  const err = [];
+  const origLog = console.log;
+  const origError = console.error;
+  const origExitCode = process.exitCode;
+  console.log = (...args) => out.push(args.join(' '));
+  console.error = (...args) => err.push(args.join(' '));
+  try {
+    await fn();
+    return { out: out.join('\n'), err: err.join('\n'), exitCode: process.exitCode };
+  } finally {
+    console.log = origLog;
+    console.error = origError;
+    process.exitCode = origExitCode;
+  }
+}
+
+module.exports = defineCases({
+  description: 'CLI dispatch — help, unknown-command, and default-verb behavior',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'help-prints-the-command-listing-and-runs-nothing',
+      async run({ assert }) {
+        const { out, exitCode } = await captured(() => new Main().process(['node', 'script', '--help']));
+        assert.ok(out.includes('Usage: omega <command>'), 'help prints the usage banner');
+        assert.ok(!out.includes('setup'), 'help does not list the retired setup command');
+        assert.notEqual(exitCode, 1, 'help is not an error');
+      },
+    },
+    {
+      name: 'unknown-command-prints-listing-and-sets-exit-code-1',
+      async run({ assert }) {
+        const { err, exitCode } = await captured(() => new Main().process(['node', 'script', 'dpeloy']));
+        assert.ok(err.includes('Unknown command "dpeloy"'), 'names the unknown command');
+        assert.ok(err.includes('Usage: omega <command>'), 'prints the command listing');
+        assert.equal(exitCode, 1, 'unknown command is a failing exit');
+      },
+    },
+    {
+      name: 'bare-invocation-prints-help-and-clean-is-accepted-bare',
+      async run({ assert }) {
+        // The terminal branch runs whatever the table marks default. #675
+        // retired `setup`, so nothing claims the slot and a bare `omega` prints
+        // the listing instead of silently running a command.
+        assert.equal(table.defaultCommand(), undefined, 'no command claims the default slot');
+        assert.equal(
+          table.COMMANDS.filter((command) => command.default).length,
+          0,
+          'no command is marked default',
+        );
+
+        const { out, exitCode } = await captured(() => new Main().process(['node', 'script']));
+        assert.ok(out.includes('Usage: omega <command>'), 'a bare invocation prints the listing');
+        assert.notEqual(exitCode, 1, 'a bare invocation is not an error');
+
+        const clean = table.COMMANDS.find((command) => command.name === 'clean');
+        assert.ok(clean, 'bare `clean` is a dispatchable command');
+        assert.contains(table.tokensOf(clean), 'clean:npm', '`clean:npm` dispatches the same command');
+      },
+    },
+    {
+      name: 'every-dispatchable-token-appears-in-the-help-listing',
+      async run({ assert }) {
+        const help = table.buildHelpText();
+
+        for (const command of table.COMMANDS) {
+          for (const token of table.tokensOf(command)) {
+            assert.ok(help.includes(token), `help lists the "${token}" token`);
+          }
+          for (const arg of Object.keys(command.args || {})) {
+            assert.ok(help.includes(arg), `help lists the "${command.name} ${arg}" argument`);
+          }
+          assert.ok(command.description, `${command.name} carries a description`);
+          assert.isType(command.run, 'function', `${command.name} dispatches to something`);
+        }
+      },
+    },
+    {
+      name: 'help-is-generated-from-the-table-not-hand-written',
+      async run({ assert }) {
+        // Add a command to the live table: if help were hand-maintained the new
+        // command would dispatch invisibly — the exact drift this replaced.
+        const probe = { name: 'zzz-probe-command', description: 'probe', run: () => {} };
+        table.COMMANDS.push(probe);
+
+        try {
+          assert.ok(table.buildHelpText().includes('zzz-probe-command'), 'a new table entry appears in help with no edit to the listing');
+
+          const { out } = await captured(() => new Main().process(['node', 'script', '--help']));
+          assert.ok(out.includes('zzz-probe-command'), '`omega help` prints the generated listing');
+        } finally {
+          table.COMMANDS.splice(table.COMMANDS.indexOf(probe), 1);
+        }
+
+        assert.ok(!table.buildHelpText().includes('zzz-probe-command'), 'the probe is gone again');
+      },
+    },
+    {
+      name: 'install-resolves-its-mode-aliases-from-the-table',
+      async run({ assert }) {
+        const install = table.COMMANDS.find((command) => command.name === 'install');
+
+        assert.equal(table.matchCommand(install, { install: true, local: true }), 'local', '`install local`');
+        assert.equal(table.matchCommand(install, { i: true, dev: true }), 'local', '`i dev`');
+        assert.equal(table.matchCommand(install, { install: true, production: true }), 'live', '`install production`');
+        assert.equal(table.matchCommand(install, { live: true }), 'live', 'bare `live`');
+        assert.equal(table.matchCommand(install, { install: true }), table.MISSING_ARG, 'a bare `install` is a missing-mode error, not an unknown command');
+        assert.equal(table.matchCommand(install, { deploy: true }), false, 'an unrelated command does not match install');
+      },
+    },
+    {
+      name: 'bare-install-names-the-real-mode-spellings',
+      async run({ assert }) {
+        const { err, exitCode } = await captured(() => new Main().process(['node', 'script', 'install']));
+
+        assert.ok(err.includes('omega install local'), 'names the local spelling');
+        assert.ok(err.includes('omega install live'), 'names the live spelling');
+        assert.equal(exitCode, 1, 'a mode-less install is a failing exit');
+      },
+    },
+  ],
+});