@omega.js/backend 0.1.0

package/dist/cli/commands/migrate.js

@@ -0,0 +1,59 @@
+const chalk = require('chalk').default;
+const BaseCommand = require('./base-command');
+const { collectBareRequires } = require('../../vendor/devkit/bare-requires.js');
+
+/**
+ * `omega migrate` on a backend target: the ported-project report
+ * ([#600](https://github.com/Omega-JS-Stack/omega/issues/600)).
+ *
+ * Today it carries ONE finding class, the dependency-resolution scan. Under the
+ * legacy FLAT BEM install every framework dependency sat in the consumer's own
+ * `node_modules`, so a ported route could `require('fs-jetpack')` and be right.
+ * Under OMEGA the framework is a package with its own tree and that require
+ * resolves only by HOISTING, which holds on one install and not on the next.
+ * The requires that carried it were LAZY, inside the handler, so the module
+ * loads fine and the route 500s the first time a request reaches it.
+ *
+ * REPORT ONLY. Which package version a brand wants is the brand's call, so the
+ * verb names the file, the line and the fix and stops. The scan is devkit's
+ * (`src/bare-requires.js`), the SAME one @omega.js/web's `omega migrate` runs,
+ * so the two frameworks cannot answer the question differently. A backend has
+ * no bundler and therefore no aliases to exclude: every bare specifier is a
+ * real dependency or a built-in.
+ *
+ * The one-time CONVERSIONS stay their own run-alone verbs (`migrate:rules`,
+ * `migrate:markers`): those change what the project enforces, and this one
+ * changes nothing.
+ */
+class MigrateCommand extends BaseCommand {
+  /**
+   * @returns {Promise<Array<{ file: string, line: number, module: string, fix: string }>>}
+   *   The findings, so a caller can act on the same list the report printed.
+   */
+  async execute() {
+    const projectDir = this.main.firebaseProjectPath;
+
+    this.ui.header('Backend migration report', { subtitle: projectDir, subtitleColor: chalk.dim });
+
+    const bareRequires = collectBareRequires(projectDir);
+
+    if (bareRequires.length === 0) {
+      this.ui.status('pass', 'Every package this target requires is declared in its package.json.');
+
+      return bareRequires;
+    }
+
+    this.ui.status('warn', `${bareRequires.length} bare ${bareRequires.length === 1 ? 'require' : 'requires'} of ${chalk.bold('undeclared')} packages:`);
+
+    for (const entry of bareRequires) {
+      this.ui.status('warn', `${entry.file}:${entry.line} \`${entry.module}\`: ${entry.fix}`, { level: 2 });
+    }
+
+    this.ui.blank();
+    this.ui.status('running', `Nothing was installed: declare each one, then run ${chalk.bold('npx omega test')}.`);
+
+    return bareRequires;
+  }
+}
+
+module.exports = MigrateCommand;

package/dist/cli/commands/serve.js

@@ -0,0 +1,208 @@
+const BaseCommand = require('./base-command');
+const path = require('path');
+const chalk = require('chalk').default;
+const powertools = require('node-powertools');
+const WatchCommand = require('./watch');
+const { createChildLog } = require('../utils/attach-log-file');
+const { refuseWhenCustom } = require('../utils/project-type');
+
+class ServeCommand extends BaseCommand {
+  async execute() {
+    const self = this.main;
+    const projectDir = self.firebaseProjectPath;
+
+    // Custom-server mode boots its own server, not the emulator suite (#584)
+    if (refuseWhenCustom(projectDir, 'serve')) return;
+
+    // The backend's dev loop → <targetRoot>/logs/dev.log (#197). A SUPERSET of the
+    // firebase CHILD's dist/dev.log wired further down: our own output (port
+    // allocation, proxy, watcher) PLUS every child chunk, because we mirror the
+    // child to our stdout and this tee catches it there. dist/dev.log is the
+    // child-only view — and the one that rolls on each reload.
+    this.attachVerbLog('dev');
+    const { isPortFree, resolvePorts, writePortsFile, clearPortsFile } = require('../../vendor/config/index.js');
+    const { loadEmulatorPorts } = require('./setup-tests/emulator-config.js');
+
+    // HTTPS: proxy on the public port (classic 5002), firebase serve on an
+    // internal port (classic 5443). Disable with --no-https.
+    const httpsEnabled = self.argv.https !== false;
+
+    // N7: allocate instead of killing the incumbent — a taken port bumps +1
+    // (a second brand's serve just lands next door). An explicit --port (or
+    // positional) PINS: busy = hard error, never a silent move.
+    const flagPort = parseInt(self.argv.port || self.argv?._?.[1], 10) || null;
+    const pins = {};
+    if (flagPort) {
+      if (!(await isPortFree(flagPort))) {
+        throw new Error(`Port ${flagPort} (pinned via --port) is already in use — free it or pick another`);
+      }
+      pins.public = flagPort;
+    }
+    const { ports: servePorts, bumped } = await resolvePorts({
+      wanted: {
+        public: flagPort || loadEmulatorPorts(projectDir).hosting || 5000,
+        internal: 5443,
+      },
+      pins,
+    });
+    const port = servePorts.public;
+    const internalPort = servePorts.internal;
+    if (bumped.length) {
+      this.log(chalk.yellow(`  Ports bumped (classic taken): ${bumped.map((name) => `${name}→${servePorts[name]}`).join(', ')}\n`));
+    }
+
+    // Wipe stale firebase-tools debug logs + any leftover @omega.js/backend logs from older
+    // versions. Keeps the project tree clean across runs.
+    this.sweepStaleLogs();
+
+    // functions/ is staged output (src/dist pillar): stage fresh + re-stage on
+    // src edits — firebase serve watches the functions dir, so a re-stage IS
+    // the hot reload. Closed when the firebase child exits below.
+    // `development` is PINNED (#586), the same local lane as the emulator: the
+    // composed dist/.env follows the LANE, never the shell's environment.
+    this.ensureStaged({ environment: 'development' });
+    const stageWatch = this.startStageWatch({ environment: 'development' });
+
+    // Start @omega.js/backend watcher in background
+    const watcher = new WatchCommand(self);
+    watcher.startBackground();
+
+    // Start HTTPS proxy if enabled. If certs can't be obtained, fall back to
+    // plain HTTP — don't set OMEGA_HTTPS_PORT or redirect to the internal port.
+    const httpsReady = httpsEnabled
+      ? await this._startHttpsProxy(port, internalPort, projectDir)
+      : false;
+
+    // Start Stripe webhook forwarding in background, aimed at the port that
+    // actually speaks plain http: the internal firebase-serve port under the
+    // https proxy, the public port otherwise. (Pre-N7 it re-derived hosting
+    // from firebase.json and pointed http at the TLS proxy — a dead target.)
+    this.startStripeWebhookForwarding(httpsReady ? internalPort : port);
+
+    // Publish the resolved map for siblings (N7): `omega dev` composes it
+    // into the page chrome, so @omega.js/client's getApiUrl follows even a
+    // bumped serve. `https` = the mkcert proxy, `hosting` = wherever hosting
+    // speaks plain http. Retracted when the firebase child exits.
+    writePortsFile(projectDir, httpsReady
+      ? { https: port, hosting: internalPort }
+      : { hosting: port });
+
+    // The firebase child's own log, beside firebase-tools' *-debug.log files.
+    // The reset sentinel lets a sibling process ask this long-lived log for a
+    // fresh slate mid-run; the poll + roll live in the shared child-log sink.
+    const logPath = this.getLogsPath('dev.log');
+    const RELOAD_MARKER = /Using node@\d+ from host\./;
+    const childLog = createChildLog({
+      logPath,
+      resetPath: this.getTempPath('dev.log.reset'),
+    });
+    let reloadCount = 0;
+
+    this.log(chalk.gray(`  Logs saving to: ${logPath}\n`));
+
+    // demo-* projects are emulator-only by convention: `firebase serve`'s
+    // hosting upstream fetches LIVE site config and 403s (there is no live
+    // project to reach — BEM 1.4b residue; the serve mechanics themselves
+    // are fine, cp90). Functions still serve, so warn-and-continue and point
+    // at the hosting EMULATOR for the full surface.
+    const { resolveProjectId } = require('./firebase-init');
+    const serveProjectId = resolveProjectId(projectDir);
+    if (String(serveProjectId || '').startsWith('demo-')) {
+      this.log(chalk.yellow(`  ⚠ ${serveProjectId} is a demo-* (emulator-only) project — the hosting upstream will 403 here.`));
+      this.log(chalk.yellow(`    Use ${chalk.cyan('omega emulator')} for demo-* hosting (its hosting emulator serves it fine).\n`));
+    }
+
+    // Execute with tee to log file
+    const firebasePort = httpsReady ? internalPort : port;
+    const firebaseEnv = {
+      ...process.env,
+      FORCE_COLOR: '1',
+    };
+
+    if (httpsReady) {
+      // Internal calls (getApiUrl → BEMClient) loop through the HTTPS proxy
+      // under the local mkcert certificate: the child TRUSTS that root (#795)
+      // instead of switching verification off, so Node prints no warning. A
+      // shell-set value wins verbatim; a host whose mkcert root vanished under
+      // existing certs still takes the old bypass.
+      const { mkcertCaRootPem } = require('../../vendor/devkit/local-https.js');
+      const caPem = process.env.NODE_EXTRA_CA_CERTS || mkcertCaRootPem();
+
+      if (caPem) {
+        firebaseEnv.NODE_EXTRA_CA_CERTS = caPem;
+      } else {
+        firebaseEnv.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+        this.log(chalk.yellow('  mkcert root CA not found — internal calls fall back to NODE_TLS_REJECT_UNAUTHORIZED=0 (Node will warn)'));
+      }
+      firebaseEnv.OMEGA_HTTPS_PORT = String(port);
+    }
+    // Where hosting speaks plain http (N7 env channel — functions inherit)
+    firebaseEnv.OMEGA_HOSTING_PORT = String(firebasePort);
+
+    try {
+      await powertools.execute(`firebase serve --port ${firebasePort}`, {
+        log: false,
+        cwd: projectDir,
+        config: {
+          stdio: ['inherit', 'pipe', 'pipe'],
+          env: firebaseEnv,
+        },
+      }, (child) => {
+        child.stdout.on('data', (data) => {
+          process.stdout.write(data);
+          const text = data.toString();
+          if (RELOAD_MARKER.test(text)) {
+            reloadCount++;
+            if (reloadCount > 1) {
+              childLog.roll();
+            }
+          }
+          childLog.write(data);
+        });
+
+        child.stderr.on('data', (data) => {
+          process.stderr.write(data);
+          childLog.write(data);
+        });
+
+        child.on('close', () => {
+          childLog.close();
+          stageWatch.close();
+          // Retract the published port map (clean shutdown)
+          clearPortsFile(projectDir);
+        });
+      });
+    } catch (error) {
+      this.log(chalk.gray('\n  Server stopped.\n'));
+    }
+  }
+
+  // The mechanism lives in @omega.js/devkit/local-https (shared with
+  // `omega emulator` and web's `omega dev`): mkcert certs in .temp/certs
+  // (staleness-checked), TLS proxy on the public port → plain-http target.
+  async _startHttpsProxy(httpsPort, httpPort, projectDir) {
+    const { ensureLocalHttpsCerts, startLocalHttpsProxy, mkcertInstallHint } = require('../../vendor/devkit/local-https.js');
+
+    const certs = await ensureLocalHttpsCerts({
+      certsDir: path.join(this.getTempPath(), 'certs'),
+      log: (line) => this.log(chalk.gray(`  ${line}`)),
+    });
+
+    if (!certs) {
+      this.log(chalk.yellow('  HTTPS disabled — could not obtain certificates.'));
+      this.log(chalk.yellow(`  Install mkcert for trusted local HTTPS: ${mkcertInstallHint()}\n`));
+      return false;
+    }
+
+    startLocalHttpsProxy({
+      port: httpsPort,
+      targetPort: httpPort,
+      certs,
+      log: (line) => this.log(chalk.green(`  ${line}`)),
+    });
+
+    return true;
+  }
+}
+
+module.exports = ServeCommand;

package/dist/cli/commands/setup-tests/base-test.js

@@ -0,0 +1,174 @@
+/**
+ * Base class for all setup tests
+ * Each test should extend this class and implement the `run()` method
+ */
+class BaseTest {
+  constructor(context) {
+    this.context = context;
+    this.self = context.main;
+  }
+
+  /**
+   * demo-* project ids are EMULATOR-ONLY by convention — checks that touch
+   * live Firebase gate on this (there is no live project to reach).
+   * @returns {boolean}
+   */
+  get isDemoProject() {
+    return String(this.self.projectId || '').startsWith('demo-');
+  }
+
+  /**
+   * `cloud.shared: true` — one Firebase project carrying every tenant brand's
+   * state. Checks that PULL live state down into this brand's repo gate on this
+   * for the same reason the demo one above exists: what is up there is not one
+   * brand's to track, and merging it in ships another tenant's definitions
+   * ([#716](https://github.com/Omega-JS-Stack/omega/issues/716)).
+   * @returns {boolean}
+   */
+  get isSharedProject() {
+    const { loadConfig } = require('../../../vendor/config/index.js');
+
+    try {
+      return loadConfig(this.self.firebaseProjectPath, 'backend').config.cloud?.shared === true;
+    } catch (e) {
+      // No config, or an unloadable one — the omega-config check reports that.
+      // An unreadable config is not a shared project.
+      return false;
+    }
+  }
+
+  /**
+   * `--offline` mode: the run may still READ live cloud state, but nothing may
+   * MUTATE it. A check whose fix (or whose check itself) deploys/writes to the
+   * brand's live project downgrades to a reported 'warn' instead of spawning
+   * `firebase`/`gsutil` — scaffolding a fresh app must never rewrite production
+   * infrastructure as a side effect ([#284](https://github.com/Omega-JS-Stack/omega/issues/284)).
+   * @returns {boolean}
+   */
+  get isOffline() {
+    return !!(this.self.argv || {}).offline;
+  }
+
+  /**
+   * Re-stage functions/ from the authored tree. Fixes that write STAGED
+   * INPUTS (the target manifest, .env, .nvmrc, service-account.json, config)
+   * call this so the already-staged tree reflects the fix within the same
+   * setup run — idempotent and cheap (src/dist pillar).
+   */
+  restage() {
+    const { stageFunctions } = require('../../utils/stage-functions');
+    stageFunctions({ projectDir: this.self.firebaseProjectPath });
+  }
+
+  /**
+   * Reload the TARGET MANIFEST from disk into the SHARED in-memory object
+   * (self.package === context.package — one object, every check reads it).
+   * npm-driven fixes rewrite the file mid-run, so any fix that WRITES the
+   * manifest must start from disk truth: writing the stale snapshot erases
+   * the deps npm just added (cp195 journey catch — the project-scripts fix
+   * clobbered the firebase-admin/functions installs, and the next setup's
+   * re-install raced the monorepo watch and killed the boot).
+   *
+   * @returns {Object} The live manifest object (same identity as self.package)
+   */
+  readTargetManifest() {
+    const jetpack = require('fs-jetpack');
+    const fresh = jetpack.read(`${this.self.firebaseProjectPath}/package.json`, 'json') || {};
+    const target = this.self.package;
+    for (const key of Object.keys(target)) {
+      delete target[key];
+    }
+    Object.assign(target, fresh);
+    return target;
+  }
+
+  /**
+   * Persist the target manifest (call after readTargetManifest() + mutation).
+   * npm's own shape, trailing newline included — the SAME byte contract
+   * ensure-target's scaffoldPackageJson and the sibling writers keep
+   * ([#590](https://github.com/Omega-JS-Stack/omega/issues/590)). A fix that
+   * dropped it flipped the consumer's manifest between two byte shapes
+   * depending on which writer ran last (jetpack.write emits none).
+   */
+  writeTargetManifest() {
+    const jetpack = require('fs-jetpack');
+    jetpack.write(`${this.self.firebaseProjectPath}/package.json`, `${JSON.stringify(this.self.package, null, 2)}\n`);
+  }
+
+  /**
+   * The npm install command a dependency fix runs, at the TARGET ROOT (runtime
+   * deps live on the target manifest — src/dist pillar). `--ignore-scripts` is
+   * load-bearing: in a file:-linked brand, a bare install re-runs the LINKED
+   * framework's prepare inside the monorepo — re-staging framework dist
+   * mid-run and racing the watch/running stacks (cp195 journey catch: the
+   * race rmdir-killed @omega.js/backend's own dist). The packages these
+   * fixes install are pre-built registry tarballs; no scripts are needed.
+   *
+   * @param {string} name - Package name
+   * @param {string} [version] - Version suffix ('@^1.2.3'); '@latest' when omitted
+   * @param {string} [type] - 'dev'/'--save-dev' for devDependencies
+   * @returns {string} The full npm command
+   */
+  buildInstallCommand(name, version, type) {
+    let v;
+    if (name.indexOf('file:') > -1) {
+      v = '';
+    } else if (!version) {
+      v = '@latest';
+    } else {
+      v = version;
+    }
+
+    const t = (type === 'dev' || type === '--save-dev') ? ' --save-dev' : '';
+
+    return `npm i ${name}${v}${t} --ignore-scripts`;
+  }
+
+  /**
+   * Install a package at the target root (via safeInstall/Socket Firewall) and
+   * resync the shared in-memory manifest with what npm wrote.
+   */
+  async installPkg(name, version, type) {
+    const { safeInstall } = require('../../utils/safe-install');
+    const command = this.buildInstallCommand(name, version, type);
+
+    console.log('Running ', command);
+    await safeInstall(command, { log: true, config: { cwd: this.self.firebaseProjectPath } });
+
+    this.readTargetManifest();
+  }
+
+  /**
+   * Override this method in each test
+   * @returns {Promise<boolean>} True if test passes, false if it fails
+   */
+  async run() {
+    throw new Error('Test must implement run() method');
+  }
+
+  /**
+   * Override this method to provide a fix for failed tests
+   * @returns {Promise<void>}
+   */
+  async fix() {
+    throw new Error('No automatic fix available for this test');
+  }
+
+  /**
+   * Override to provide warning details when run() returns 'warn'.
+   * @returns {string[]}
+   */
+  getWarning() {
+    return [];
+  }
+
+  /**
+   * Get the test name (used for logging)
+   * @returns {string}
+   */
+  getName() {
+    return this.constructor.name.replace(/Test$/, '').replace(/([A-Z])/g, ' $1').trim().toLowerCase();
+  }
+}
+
+module.exports = BaseTest;

package/dist/cli/commands/setup-tests/emulator-config.js

@@ -0,0 +1,109 @@
+const BaseTest = require('./base-test');
+const path = require('path');
+const jetpack = require('fs-jetpack');
+const JSON5 = require('json5');
+const _ = require('lodash');
+
+// Default emulator ports - SSOT for fallback values
+const DEFAULT_EMULATOR_PORTS = {
+  auth: 9099,
+  functions: 5001,
+  firestore: 8080,
+  database: 9000,
+  hosting: 5002,
+  storage: 9199,
+  pubsub: 8085,
+  ui: 4050,
+};
+
+/**
+ * Load a project's emulator ports from firebase.json, falling back to the
+ * classic defaults. ONE home (N7) — emulator.js, test.js, and
+ * firebase-init.js import this instead of carrying their own copies.
+ * @param {string} projectDir - Firebase project directory.
+ * @returns {object} Name → port map.
+ */
+function loadEmulatorPorts(projectDir) {
+  const emulatorPorts = { ...DEFAULT_EMULATOR_PORTS };
+  const firebaseJsonPath = path.join(projectDir, 'firebase.json');
+
+  if (jetpack.exists(firebaseJsonPath)) {
+    try {
+      const firebaseConfig = JSON5.parse(jetpack.read(firebaseJsonPath));
+      if (firebaseConfig.emulators) {
+        for (const name of Object.keys(DEFAULT_EMULATOR_PORTS)) {
+          emulatorPorts[name] = firebaseConfig.emulators[name]?.port || DEFAULT_EMULATOR_PORTS[name];
+        }
+      }
+    } catch (error) {
+      console.warn(`Warning: Could not parse firebase.json: ${error.message}`);
+    }
+  }
+
+  return emulatorPorts;
+}
+
+const REQUIRED_EMULATORS = {
+  auth: { port: DEFAULT_EMULATOR_PORTS.auth },
+  functions: { port: DEFAULT_EMULATOR_PORTS.functions },
+  firestore: { port: DEFAULT_EMULATOR_PORTS.firestore },
+  database: { port: DEFAULT_EMULATOR_PORTS.database },
+  hosting: { port: DEFAULT_EMULATOR_PORTS.hosting },
+  storage: { port: DEFAULT_EMULATOR_PORTS.storage },
+  pubsub: { port: DEFAULT_EMULATOR_PORTS.pubsub },
+  ui: { enabled: true, port: DEFAULT_EMULATOR_PORTS.ui },
+};
+
+class EmulatorConfigTest extends BaseTest {
+  getName() {
+    return 'emulator config in firebase.json';
+  }
+
+  async run() {
+    const emulators = this.self.firebaseJSON?.emulators;
+
+    if (!emulators) {
+      return false;
+    }
+
+    // Check each required emulator
+    for (const [name, config] of Object.entries(REQUIRED_EMULATORS)) {
+      if (!emulators[name]) {
+        return false;
+      }
+
+      // Check all required properties
+      for (const [key, value] of Object.entries(config)) {
+        if (emulators[name][key] !== value) {
+          return false;
+        }
+      }
+    }
+
+    // Check singleProjectMode
+    if (emulators.singleProjectMode !== true) {
+      return false;
+    }
+
+    return true;
+  }
+
+  async fix() {
+    // Set each emulator config
+    for (const [name, config] of Object.entries(REQUIRED_EMULATORS)) {
+      for (const [key, value] of Object.entries(config)) {
+        _.set(this.self.firebaseJSON, `emulators.${name}.${key}`, value);
+      }
+    }
+
+    // Set singleProjectMode
+    _.set(this.self.firebaseJSON, 'emulators.singleProjectMode', true);
+
+    // Write updated config
+    jetpack.write(`${this.self.firebaseProjectPath}/firebase.json`, JSON.stringify(this.self.firebaseJSON, null, 2));
+  }
+}
+
+module.exports = EmulatorConfigTest;
+module.exports.DEFAULT_EMULATOR_PORTS = DEFAULT_EMULATOR_PORTS;
+module.exports.loadEmulatorPorts = loadEmulatorPorts;

package/dist/cli/commands/setup-tests/env-runtime-config-deprecated.js

@@ -0,0 +1,47 @@
+const BaseTest = require('./base-test');
+const jetpack = require('fs-jetpack');
+
+class EnvRuntimeConfigDeprecatedTest extends BaseTest {
+  getName() {
+    return 'does not use deprecated RUNTIME_CONFIG';
+  }
+
+  async run() {
+    // The authored .env (target root) — OPTIONAL and human-written since #678:
+    // it is the per-key override over the brand root's, and no machine writes it
+    const envPath = `${this.self.firebaseProjectPath}/.env`;
+    const existingContent = jetpack.read(envPath);
+
+    // If no .env file, pass (other test will handle that)
+    if (!existingContent) {
+      return true;
+    }
+
+    // Check if RUNTIME_CONFIG exists in the file
+    const hasRuntimeConfig = existingContent.split('\n').some(line => {
+      const trimmed = line.trim();
+      // Skip comments
+      if (trimmed.startsWith('#')) {
+        return false;
+      }
+      // Check for RUNTIME_CONFIG= at start of line
+      return trimmed.startsWith('RUNTIME_CONFIG=');
+    });
+
+    // Return true (pass) if RUNTIME_CONFIG is NOT found
+    return !hasRuntimeConfig;
+  }
+
+  async fix() {
+    throw new Error(
+      'RUNTIME_CONFIG is deprecated and must be manually migrated.\n' +
+      '  The new format uses individual environment variables:\n' +
+      '    OMEGA_ADMIN_KEY=\n' +
+      '    OMEGA_NAMESPACE=\n' +
+      '    GH_TOKEN=\n' +
+      '  Please update your .env file manually and remove RUNTIME_CONFIG.'
+    );
+  }
+}
+
+module.exports = EnvRuntimeConfigDeprecatedTest;

package/dist/cli/commands/setup-tests/firebase-admin.js

@@ -0,0 +1,49 @@
+const BaseTest = require('./base-test');
+const chalk = require('chalk').default;
+const wonderfulVersion = require('wonderful-version');
+const powertools = require('node-powertools');
+const helpers = require('./helpers');
+
+class FirebaseAdminTest extends BaseTest {
+  getName() {
+    return 'using updated firebase-admin';
+  }
+
+  async run() {
+    const pkg = 'firebase-admin';
+    const latest = this.context.packageJSON.peerDependencies['firebase-admin'];
+    const mine = this.context.package.dependencies[pkg];
+    const bemv = this.context.packageJSON.peerDependencies[pkg];
+
+    // Not in package.json at all — must install
+    if (!mine) {
+      return false;
+    }
+
+    // Get level difference
+    const levelDifference = wonderfulVersion.levelDifference(latest, mine);
+
+    // Log
+    this.bemPackageVersionWarning(pkg, bemv, latest);
+
+    // Log if major version mismatch
+    if (levelDifference === 'major') {
+      console.log(chalk.red(`Version ${chalk.bold(latest)} of ${chalk.bold(pkg)} available but you must install this manually because it is a major update.`));
+    }
+
+    // Ensure the version is up to date
+    return wonderfulVersion.is(mine, '>=', latest) || levelDifference === 'major';
+  }
+
+  async fix() {
+    await this.installPkg('firebase-admin', `@${this.context.packageJSON.peerDependencies['firebase-admin']}`);
+  }
+
+  bemPackageVersionWarning(packageName, current, latest) {
+    if (wonderfulVersion.greaterThan(latest, current)) {
+      console.log(chalk.yellow(`${packageName} needs to be updated in @omega.js/backend: ${current} => ${latest}`));
+    }
+  }
+}
+
+module.exports = FirebaseAdminTest;

package/dist/cli/commands/setup-tests/firebase-auth.js

@@ -0,0 +1,26 @@
+const BaseTest = require('./base-test');
+const powertools = require('node-powertools');
+
+class FirebaseAuthTest extends BaseTest {
+  getName() {
+    return 'firebase CLI is authenticated';
+  }
+
+  getWarning() {
+    return [
+      'You are not logged in to Firebase.',
+      'Run: firebase login',
+    ];
+  }
+
+  async run() {
+    try {
+      await powertools.execute('firebase projects:list', { log: false });
+      return true;
+    } catch (error) {
+      return 'warn';
+    }
+  }
+}
+
+module.exports = FirebaseAuthTest;