@omega.js/extension 0.1.0

package/dist/vendor/devkit/framework-deps.js

@@ -0,0 +1,46 @@
+// framework-deps — the ONE reader of a framework's declared dependency set (#87).
+//
+// The contract it serves: a CONSUMER may import any library the framework declares
+// by BARE specifier, and it resolves from the FRAMEWORK's own installation — the
+// framework's copy wins (one copy per bundle, shared with the framework code that
+// uses it), and anything the framework does not declare is untouched and fails with
+// the bundler's normal resolution error.
+//
+// `bundle.js` wires the esbuild resolve hook around this reader, so every
+// framework bundling through it gets the contract (it was @omega.js/web's own
+// hook in packages/web/src/assets.js until #736). @omega.js/desktop bundles
+// through the same hook since #737, @omega.js/extension since #738 — where it
+// replaced webpack's `resolve.modules` ordering, which also won for the
+// transitives the framework merely carries, a trade this reader does NOT make.
+// See docs/devkit/index.md and #87.
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * The set of libraries a consumer may import by BARE specifier: every package the
+ * framework declares as a dependency — no hand-curated list, the declared set IS
+ * the list. `@omega.js/*` deps are excluded: the client is wired explicitly by each
+ * framework and the private packages are vendored, so neither resolves through
+ * node_modules here.
+ * @param {string} frameworkRoot - the framework package's root (the dir holding its package.json)
+ * @returns {string[]} dependency names
+ */
+function frameworkDependencyNames(frameworkRoot) {
+  const pkg = JSON.parse(fs.readFileSync(path.join(frameworkRoot, 'package.json'), 'utf8'));
+  return Object.keys(pkg.dependencies || {}).filter((name) => !name.startsWith('@omega.js/'));
+}
+
+/**
+ * A matcher for those names: the bare specifier and any subpath of it
+ * (`chart.js`, `chart.js/auto`), and nothing else — so the hook stays off every
+ * other import the bundler resolves.
+ * @param {string[]} names - dependency names
+ * @returns {RegExp} the matcher
+ */
+function frameworkDepsPattern(names) {
+  const escaped = names.map((name) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+  return new RegExp(`^(${escaped.join('|')})(/|$)`);
+}
+
+module.exports = { frameworkDependencyNames, frameworkDepsPattern };

package/dist/vendor/devkit/icons.js

@@ -0,0 +1,178 @@
+/**
+ * Font Awesome build-side helpers (C4 cp111/112) — ONE implementation for
+ * every target that assembles an icon set at build time (web site builds,
+ * extension dist builds; desktop resolves at runtime in its own main lib).
+ *
+ * Root resolution, best-first:
+ *
+ *   1. OMEGA_FONTAWESOME_ROOT — a fontawesome.com "Pro for Web" download
+ *      dir (contains svgs/ + metadata/); no npm token needed.
+ *   2. @fortawesome/fontawesome-pro — installed by the brand with its own
+ *      FA npm token. NEVER a dependency of any omega package (license).
+ *   3. @fortawesome/fontawesome-free — the declared-dependency floor
+ *      (web, desktop, extension all declare it).
+ *
+ * Every available rung stays in the chain, so a partial supply (an old
+ * solid-only download) never loses icons a lower rung has. Preference
+ * order itself is icon-core's PACKAGES — shared with desktop's runtime
+ * icon server and the browser renderer so no surface can drift.
+ */
+const fs = require('node:fs');
+const path = require('node:path');
+
+const {
+  PACKAGES, ICONS_DIR, candidateRelPaths, buildAliasMap,
+} = require('@omega.js/client/modules/icon-core.js');
+
+/**
+ * Resolve the icon roots for a build.
+ *
+ * @param {object} [env] - Environment map (injectable for tests).
+ * @returns {{ svgsDirs: string[], aliasFile: string, source: 'env'|'pro'|'free' }}
+ *   svgsDirs — ordered svgs/ dirs (brand set first when present, free last);
+ *   aliasFile — the richest icon-families.json available;
+ *   source — where the winning set came from.
+ */
+function resolveFontAwesomeRoots(env = process.env) {
+  const roots = [];
+  let source = 'free';
+
+  const envRoot = env.OMEGA_FONTAWESOME_ROOT;
+  if (envRoot && fs.existsSync(path.join(envRoot, 'svgs'))) {
+    roots.push(envRoot);
+    source = 'env';
+  }
+
+  try {
+    roots.push(path.dirname(require.resolve(`${PACKAGES[0]}/package.json`)));
+    if (source === 'free') source = 'pro';
+  } catch (e) {
+    // Pro npm set not installed — the normal case for brands without a token
+  }
+
+  roots.push(path.dirname(require.resolve(`${PACKAGES[PACKAGES.length - 1]}/package.json`)));
+
+  const aliasRoot = roots.find((root) => fs.existsSync(path.join(root, 'metadata', 'icon-families.json')))
+    || roots[roots.length - 1];
+  return {
+    svgsDirs: roots.map((root) => path.join(root, 'svgs')),
+    aliasFile: path.join(aliasRoot, 'metadata', 'icon-families.json'),
+    source,
+  };
+}
+
+/**
+ * Emit the merged icon set into a build output — feeds the browser-side
+ * auto-render (@omega.js/client icon-renderer): web fetches from the
+ * site's own /assets/icons/, extension pages from
+ * chrome.runtime.getURL('assets/icons/…'). Only icons a page actually uses
+ * ever transfer.
+ *
+ * @param {object} options
+ * @param {string} options.outDir - Build output dir (_site, dist).
+ * @param {string} [options.coreIconsDir] - Curated core icons (highest priority).
+ * @param {string[]} [options.svgsDirs] - Ordered svgs dirs, best-first
+ *   (defaults to the resolved chain).
+ * @returns {{ files: number, dest: string }} Emitted file count + dir.
+ */
+function emitIcons(options) {
+  const svgsDirs = options.svgsDirs || resolveFontAwesomeRoots().svgsDirs;
+  const dest = path.join(options.outDir, 'assets', ICONS_DIR);
+
+  // Lowest priority first — later copies overwrite, so the chain's best
+  // source (and finally the curated core set) wins per file.
+  const sources = [...svgsDirs].reverse();
+  if (options.coreIconsDir && fs.existsSync(options.coreIconsDir)) {
+    sources.push(options.coreIconsDir);
+  }
+
+  for (const dir of sources) {
+    if (fs.existsSync(dir)) {
+      fs.cpSync(dir, dest, { recursive: true, force: true });
+    }
+  }
+
+  let files = 0;
+  for (const entry of fs.readdirSync(dest, { recursive: true, withFileTypes: true })) {
+    if (entry.isFile()) files++;
+  }
+  return { files, dest };
+}
+
+/**
+ * The flag set carries hardcoded width/height="512" on the root — strip them
+ * so icon-core's standard 1em inline-icon sizing applies (Font Awesome
+ * sources never carry dimensions; the flags are the exception).
+ *
+ * @param {string} svg - Raw SVG source.
+ * @returns {string} SVG with any root width/height removed.
+ */
+function stripRootSize(svg) {
+  return svg.replace(/<svg([^>]*)>/, (match, attrs) => `<svg${attrs.replace(/\s(?:width|height)="[^"]*"/g, '')}>`);
+}
+
+/**
+ * A build-time icon reader over a resolved chain — the file-reading half of
+ * icon-core, which owns every decision ABOUT the files (candidate order,
+ * aliases) but reads none of them. Web's build-time inlining pass
+ * (@omega.js/web src/inline-icons.js) is the caller; the browser reads the
+ * SAME bytes at runtime out of what `emitIcons` shipped.
+ *
+ * Aliases and file contents are cached for the process — a site inlines the
+ * same chrome icons on every one of its pages.
+ *
+ * @param {object} options
+ * @param {string[]} options.svgsDirs - Ordered icon roots, best-first (each
+ *   holding `<style>/<name>.svg`).
+ * @param {string} [options.aliasFile] - icon-families.json for alias
+ *   resolution ('search' → 'magnifying-glass').
+ * @returns {function(string, string): (string|null)} (name, style) → raw SVG.
+ */
+function createIconLoader(options) {
+  const dirs = options.svgsDirs || [];
+  const cache = new Map();
+  let aliases = null;
+
+  const aliasFor = (name) => {
+    if (!aliases) {
+      aliases = new Map();
+      try {
+        aliases = buildAliasMap(JSON.parse(fs.readFileSync(options.aliasFile, 'utf8')));
+      } catch {
+        // No (readable) metadata in this chain — resolve without aliases.
+      }
+    }
+    return aliases.get(name) || null;
+  };
+
+  return function loadIcon(name, style) {
+    const key = `${style}/${name}`;
+    if (cache.has(key)) return cache.get(key);
+
+    const alias = aliasFor(name);
+    let svg = null;
+
+    for (const dir of dirs) {
+      for (const candidate of (alias ? [name, alias] : [name])) {
+        for (const rel of candidateRelPaths(candidate, style)) {
+          try {
+            svg = fs.readFileSync(path.join(dir, rel), 'utf8');
+          } catch {
+            continue;
+          }
+          break;
+        }
+        if (svg) break;
+      }
+      if (svg) break;
+    }
+
+    if (svg) svg = stripRootSize(svg);
+    cache.set(key, svg);
+    return svg;
+  };
+}
+
+// ICONS_DIR is icon-core's, re-exported here so the build side has one import
+// for the whole icon contract.
+module.exports = { ICONS_DIR, resolveFontAwesomeRoots, emitIcons, createIconLoader };

package/dist/vendor/devkit/license.js

@@ -0,0 +1,155 @@
+/**
+ * resolveLicenseVerdict — the deploy-time license check
+ * ([#320](https://github.com/Omega-JS-Stack/omega/issues/320)).
+ *
+ * A published OMEGA install needs a license to enable the payment system and
+ * remove the omega attribution. A license is a subscription bought on
+ * omegajs.dev and the KEY is that account's API key — opaque, one per account,
+ * unlimited brands for now. The verdict is decided SERVER-side: the key plus
+ * the brand id go to the omega brand's own backend and the resolved
+ * subscription on the answer decides. No offline signing, no local shape check.
+ *
+ * This module is the "get the verdict" half only. Each target's deploy asks
+ * once and bakes the answer into that artifact; runtime never phones home, so
+ * a cancelled key holds until the next deploy (accepted, spec call 3).
+ *
+ * Honesty system, deliberately (spec call 6): plain readable code, no
+ * obfuscation and no artifact signing. The legal backing is the package license
+ * (Elastic License 2.0), whose terms forbid circumventing license-key
+ * functionality and removing notices.
+ */
+
+const { isDemoProject } = require('../config/index.js');
+const { resolveSubscription } = require('../account/index.js');
+
+// The omega brand's own api host, HARDCODED. Every other api base in OMEGA is
+// derived from a brand's `brand.url` (api.<host>) because it belongs to that
+// brand — this one is the PRODUCT's license server, the same host for every
+// brand that installs OMEGA, so config can never name it.
+const LICENSE_ENDPOINT = 'https://api.omegajs.dev/omega/user';
+
+const FETCH_TIMEOUT_MS = 30 * 1000;
+
+// The one keyless answer: payments in test mode, attribution shown.
+function keyless(reason) {
+  return { licensed: false, payments: 'gated', attribution: 'shown', reason };
+}
+
+/**
+ * Resolve what a deploy is licensed to ship.
+ *
+ * @param {object} input
+ * @param {object} input.config - The resolved omega.json5 (brand.id, cloud.config.projectId).
+ * @param {object} [input.env] - The environment holding OMEGA_LICENSE_KEY (default: process.env).
+ * @param {function} [input.transport] - The fetch seam (default: global fetch).
+ * @returns {Promise<{ licensed: boolean, payments: 'live'|'gated', attribution: 'removed'|'shown', reason: string }>}
+ * @throws {Error} A key IS present but the server could not answer for it.
+ */
+async function resolveLicenseVerdict({ config, env = process.env, transport = fetch } = {}) {
+  const projectId = config?.cloud?.config?.projectId;
+
+  // Local dev, the test brands and every demo-* project run keyless forever
+  // (spec call 5) — the carve-out comes FIRST, so a developer with a real key
+  // in their shell still never spends a check on an emulator-only build.
+  if (isDemoProject(projectId)) {
+    return keyless(`${projectId} is a demo-* (emulator-only) project — no license check runs`);
+  }
+
+  const key = String(env.OMEGA_LICENSE_KEY || '').trim();
+  if (!key) {
+    return keyless('no OMEGA_LICENSE_KEY in the environment');
+  }
+
+  const url = new URL(LICENSE_ENDPOINT);
+  url.searchParams.set('apiKey', key);
+  // Sent on every check and ignored by the server today: it is what lets a
+  // future per-key brand limit be a server-side change alone (spec call 1).
+  url.searchParams.set('brandId', String(config?.brand?.id || ''));
+
+  let response;
+  try {
+    response = await transport(url.toString(), {
+      headers: { accept: 'application/json' },
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+  } catch (e) {
+    // LOUD: a key is present, so the brand believes it is licensed. Shipping a
+    // gated artifact because the network blinked would be the worst answer.
+    throw new Error(`OMEGA_LICENSE_KEY is set but the license server could not be reached (${LICENSE_ENDPOINT}): ${e.message}`);
+  }
+
+  if (!response.ok) {
+    throw new Error(`OMEGA_LICENSE_KEY was rejected by the license server (HTTP ${response.status}) — check the key on omegajs.dev`);
+  }
+
+  let body;
+  try {
+    body = await response.json();
+  } catch (e) {
+    throw new Error(`The license server's answer could not be read as JSON (${LICENSE_ENDPOINT}): ${e.message}`);
+  }
+
+  const user = body?.user;
+  if (!user) {
+    throw new Error(`OMEGA_LICENSE_KEY resolved no account on omegajs.dev — check the key on your account's API page`);
+  }
+
+  // The SAME derivation the backend and the client run, so "licensed" means
+  // exactly what "subscribed" means everywhere else: `basic` is the reserved
+  // free sentinel a cancelled or never-paid account resolves to.
+  const { plan } = resolveSubscription(user);
+  if (plan === 'basic') {
+    return keyless('the OMEGA_LICENSE_KEY account has no active omegajs.dev subscription');
+  }
+
+  return {
+    licensed: true,
+    payments: 'live',
+    attribution: 'removed',
+    reason: `licensed by the omegajs.dev "${plan}" subscription`,
+  };
+}
+
+/**
+ * The verdict as an ARTIFACT records it: the three decided facts under one
+ * shape, shared by every consumer — the website's `site.license` build fact,
+ * the desktop/extension build stamp, and the backend's OMEGA_LICENSE_STATUS
+ * (its `status` alone, because an env value is a string). The human `reason`
+ * is dropped: it names the account's plan, and a shipped bundle is public.
+ *
+ * @param {object} verdict - A resolveLicenseVerdict answer.
+ * @returns {{ status: 'licensed'|'keyless', payments: string, attribution: string }}
+ */
+function licenseStamp(verdict) {
+  return {
+    status: verdict.licensed ? 'licensed' : 'keyless',
+    payments: verdict.payments,
+    attribution: verdict.attribution,
+  };
+}
+
+// What a build that ran no check at all carries (a dev build, a test, any lane
+// that never asks) — the keyless verdict's own stamp, because that is exactly
+// what such a build is.
+const KEYLESS_STAMP = Object.freeze(licenseStamp(keyless('no license check ran')));
+
+/**
+ * The stamp a build bakes: a PRODUCTION build asks the license server once (a
+ * key that cannot be answered for throws, gating the deploy); everything else
+ * is keyless by definition and never phones home — spec call 5's "no check
+ * fires outside deploy" half, with ONE home for all three baking targets.
+ *
+ * @param {object} input
+ * @param {object} input.config - The resolved omega.json5.
+ * @param {boolean} input.production - Whether this build ships.
+ * @param {object} [input.env] - See resolveLicenseVerdict.
+ * @param {function} [input.transport] - See resolveLicenseVerdict.
+ * @returns {Promise<{ status: string, payments: string, attribution: string }>}
+ */
+async function resolveLicenseStamp({ config, production, env, transport }) {
+  if (!production) return { ...KEYLESS_STAMP };
+
+  return licenseStamp(await resolveLicenseVerdict({ config, env, transport }));
+}
+
+module.exports = { resolveLicenseVerdict, resolveLicenseStamp, licenseStamp, KEYLESS_STAMP, LICENSE_ENDPOINT };