@omega.js/extension 0.1.0

package/dist/test/suites/view/sidepanel.test.js

@@ -0,0 +1,16 @@
+// View-layer test for the sidepanel context. Most consumers of BXM use
+// chrome.sidePanel for the Chrome 114+ UI panel surface — verify that
+// the test harness can target it just like popup/options.
+
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  layer: 'view',
+  context: 'sidepanel',
+  description: 'view/sidepanel — DOM + context attribute',
+  run: async (ctx) => {
+    ctx.expect(document.body.dataset.omegaContext).toBe('sidepanel');
+    ctx.expect(document.title).toContain('Side Panel');
+    ctx.expect(typeof chrome.runtime.id).toBe('string');
+  },
+});

package/dist/test/utils/extended-mode-warning.js

@@ -0,0 +1,13 @@
+// TEST_EXTENDED_MODE warning — SSOT for consistent messaging.
+//
+// The headline + shape live in @omega.js/devkit (mirrored across @omega.js/backend/EM/UJM); these
+// detail lines describe BXM's blast radius. Used by the test command (printed to
+// console + teed to logs/test.log).
+const { makeExtendedModeWarning } = require('../../vendor/devkit/test/extended-mode-warning.js');
+
+const EXTENDED_MODE_WARNING = makeExtendedModeWarning([
+  'Tests that hit real external services (Firebase via @omega.js/client, push, any network call) are ENABLED!',
+  'This makes real network calls from the background service worker, popup, and content scripts against live backends.',
+]);
+
+module.exports = { EXTENDED_MODE_WARNING };

package/dist/utils/attach-log-file.js

@@ -0,0 +1,4 @@
+// Shared devkit module — vendored into dist/vendor/devkit at prepare time by the
+// preparePackage `after` hook. This shim keeps the framework's internal require
+// paths stable while the implementation lives in @omega.js/devkit.
+module.exports = require('../vendor/devkit/attach-log-file.js');

package/dist/utils/mode-helpers.js

@@ -0,0 +1,117 @@
+// Runtime mode helpers (@omega.js/backend/EM/UJM-pattern), shared across BXM's eight context Managers
+// (build / background / popup / options / content / sidepanel / page / offscreen).
+//
+// `getEnvironment()` is the SINGLE SOURCE OF TRUTH: it is the ONLY function that reads the
+// raw signals (OMEGA_TEST_MODE / manifest.update_url / OMEGA_BUILD_MODE / NODE_ENV /
+// config.omega.environment) and resolves them to exactly ONE of three mutually-exclusive
+// values. The three is*() checks DERIVE from it — they never read raw signals themselves,
+// so they can never disagree with getEnvironment().
+//
+//   isDevelopment() — `getEnvironment() === 'development'`: running unpacked from disk (an
+//                     unpacked extension via chrome://extensions or a dev build), and NOT
+//                     testing.
+//   isTesting()     — `getEnvironment() === 'testing'`: BXM's test framework is running this
+//                     process (OMEGA_TEST_MODE=true). TAKES PRECEDENCE — a test run is not dev.
+//   isProduction()  — `getEnvironment() === 'production'`: running from a packed .crx /
+//                     store-installed extension, and NOT testing. A real positive check —
+//                     NOT `!isDevelopment()`.
+//
+// To gate "anything non-production" use `!isProduction()` or `isDevelopment() ||
+// isTesting()` intentionally — never assume two values.
+//
+// Context caveat: in build-time Node (gulp / CLI), `chrome` is undefined. getEnvironment()
+// detects via `typeof chrome` so the same code works in every context. Browser detection
+// uses `chrome.runtime.getManifest().update_url` — packed store extensions have one,
+// unpacked ones do not.
+
+// getEnvironment() — the SINGLE SOURCE OF TRUTH. Reads every raw signal and resolves to
+// exactly ONE of 'development' | 'testing' | 'production' (mutually exclusive; testing wins).
+// Precedence: testing → production → development.
+function getEnvironment() {
+  // 1. Testing wins — set by BXM's test runners / harness, or a testing-baked build.
+  //    Works in Node (process.env), extension contexts (globalThis set before consumer JS),
+  //    and config-baked builds (config.omega.environment === 'testing').
+  if (typeof process !== 'undefined' && process.env && process.env.OMEGA_TEST_MODE === 'true') return 'testing';
+  if (typeof globalThis !== 'undefined' && globalThis.OMEGA_TEST_MODE === true) return 'testing';
+  if (this && this.config && this.config.omega && this.config.omega.environment === 'testing') return 'testing';
+
+  // 2. Browser-side: packed/store extensions have `update_url`; unpacked ones do not.
+  //    This is the authoritative runtime signal in an extension context.
+  if (typeof chrome !== 'undefined' && chrome.runtime && typeof chrome.runtime.getManifest === 'function') {
+    try {
+      return chrome.runtime.getManifest().update_url ? 'production' : 'development';
+    } catch (_) { /* fall through to Node/config signals */ }
+  }
+
+  // 3. Node / build-time + config signals.
+  if (process.env.OMEGA_BUILD_MODE === 'true') return 'production';
+  if (process.env.NODE_ENV === 'development') return 'development';
+  if (this && this.config && this.config.omega && this.config.omega.environment === 'development') return 'development';
+  if (this && this.config && this.config.omega && this.config.omega.environment === 'production') return 'production';
+
+  // 4. Default: development. BXM's deployed artifacts ALWAYS carry their signal — a packed /
+  //    store extension has `manifest.update_url`, and build-time Node sets OMEGA_BUILD_MODE. So
+  //    reaching here means a bare tooling / unpacked context, where development is the sensible
+  //    answer. (Contrast @omega.js/backend/EM, whose deployed RUNTIME can legitimately lack a signal, so they
+  //    default to production.)
+  return 'development';
+}
+
+// The three checks DERIVE from getEnvironment() — they never read raw signals, so they can
+// never disagree with it. isDevelopment() is NOT true in testing; isProduction() is a real
+// positive check (never `!isDevelopment()`).
+function isDevelopment() {
+  return getEnvironment.call(this) === 'development';
+}
+
+function isProduction() {
+  return getEnvironment.call(this) === 'production';
+}
+
+function isTesting() {
+  return getEnvironment.call(this) === 'testing';
+}
+
+// `getVersion()` — returns the extension's version string.
+//   1. `chrome.runtime.getManifest().version` when running inside an extension context.
+//   2. `<cwd>/package.json#version` for build-time scripts.
+//   3. null when neither resolves.
+function getVersion() {
+  if (typeof chrome !== 'undefined' && chrome.runtime && typeof chrome.runtime.getManifest === 'function') {
+    try {
+      return chrome.runtime.getManifest().version || null;
+    } catch (_) { /* fall through */ }
+  }
+  try {
+    const path = require('path');
+    const pkg = require(path.join(process.cwd(), 'package.json'));
+    return pkg.version || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+// Mix the helpers into a Manager constructor's prototype + the constructor itself
+// (so `Manager.isTesting()` works statically too, matching @omega.js/backend/EM/UJM pattern).
+// getEnvironment() is the SSOT and is attached here too — build.js no longer defines it.
+function attachTo(Manager) {
+  Manager.prototype.getEnvironment = getEnvironment;
+  Manager.prototype.isDevelopment  = isDevelopment;
+  Manager.prototype.isProduction   = isProduction;
+  Manager.prototype.isTesting      = isTesting;
+  Manager.prototype.getVersion     = getVersion;
+  Manager.getEnvironment = getEnvironment;
+  Manager.isDevelopment  = isDevelopment;
+  Manager.isProduction   = isProduction;
+  Manager.isTesting      = isTesting;
+  Manager.getVersion     = getVersion;
+}
+
+module.exports = {
+  attachTo,
+  getEnvironment,
+  isDevelopment,
+  isProduction,
+  isTesting,
+  getVersion,
+};

package/dist/utils/url-helpers.js

@@ -0,0 +1,69 @@
+// Backend URL helpers, shared across BXM's context Managers. Mirrors
+// @omega.js/desktop's src/utils/url-helpers.js (the SSOT for this contract) so
+// BXM apps hit the same dev/prod backends as EM and UJM consumers — currently
+// the getApiUrl subset; add the sibling helpers here when a caller needs them.
+//
+// `getEnvironment()` is the SINGLE SOURCE OF TRUTH and lives in
+// src/utils/mode-helpers.js. getApiUrl() routes through `this.getEnvironment()`
+// and resolves to LOCAL urls in BOTH development AND testing — callers normally
+// pass NO argument; an explicit `environment` arg is an override (used mainly by
+// tests to pin a specific environment's mapping).
+//
+// Context caveat: browser extension contexts (service worker, popup, …) have no
+// `process` — the resolved-port env channel (N7) only exists in build-time Node
+// and the test harness. A browser context learns a BUMPED port from the map the
+// build baked into every bundle as OMEGA_BUILD_JSON (`dev.ports`,
+// [#300](https://github.com/Omega-JS-Stack/omega/issues/300)), the same channel
+// background.js reads the auth port from; the classic defaults are the last
+// resort, for a build made with no local stack up.
+
+function envPort(name) {
+  return typeof process !== 'undefined' && process.env
+    ? process.env[name]
+    : undefined;
+}
+
+// One local port, from whichever channel this context has: the env var first
+// (build-time Node + the test harness), then the baked map
+// ([#744](https://github.com/Omega-JS-Stack/omega/issues/744)).
+function localPort(context, envName, name) {
+  return envPort(envName) || context?.config?.dev?.ports?.[name];
+}
+
+function getApiUrl(environment) {
+  const env = environment || this.getEnvironment();
+
+  // Local for development OR testing; production otherwise. Mirrors
+  // @omega.js/backend's getApiUrl (N7): a published OMEGA_HTTPS_PORT means
+  // `mgr serve`'s mkcert proxy is up (https); otherwise plain http to the
+  // hosting emulator (env port, baked port, or classic 5002).
+  if (env === 'development' || env === 'testing') {
+    const httpsPort = localPort(this, 'OMEGA_HTTPS_PORT', 'https');
+    return httpsPort
+      ? `https://localhost:${httpsPort}`
+      : `http://localhost:${localPort(this, 'OMEGA_HOSTING_PORT', 'hosting') || 5002}`;
+  }
+
+  // Prod: api.<brand host>. Mirrors @omega.js/client.getApiUrl. Never derive
+  // from authDomain — it is an auth concern (the brand host, with /__/auth/*
+  // self-hosted at build time) and must stay free to change independently.
+  const brandUrl = this?.config?.brand?.url;
+  if (!brandUrl) {
+    throw new Error('brand.url not set in config/omega.json5');
+  }
+
+  return `https://api.${new URL(brandUrl).hostname}`;
+}
+
+// Mix the URL helpers into a Manager constructor's prototype + the constructor
+// itself. These call `this.getEnvironment()`, so mode-helpers' attachTo() must
+// run before (or alongside) this one.
+function attachTo(Manager) {
+  Manager.prototype.getApiUrl = getApiUrl;
+  Manager.getApiUrl = getApiUrl;
+}
+
+module.exports = {
+  attachTo,
+  getApiUrl,
+};

package/dist/vendor/account/engine.js

@@ -0,0 +1,182 @@
+/**
+ * Schema resolution engine — extracted verbatim from @omega.js/backend's
+ * src/manager/helpers/user.js, with ONE change: the '$uuid'/'$randomId'/'$apiKey'
+ * value generators are injected via ctx.generators instead of being required
+ * in-module. Hosts that can generate them (@omega.js/backend, Node) inject real generators;
+ * hosts that can't (@omega.js/client, browser) pass none and the fields resolve to
+ * null — the doc's real values always come from the backend.
+ *
+ * The engine is environment-agnostic: no dependencies, no Node APIs.
+ */
+
+/**
+ * Check if a schema node is a leaf field definition (has 'type' and 'default')
+ */
+function isLeaf(node) {
+  return node !== null
+    && typeof node === 'object'
+    && typeof node.type === 'string'
+    && 'default' in node;
+}
+
+/**
+ * Coerce a value to the expected type. Returns the coerced value or undefined if coercion fails.
+ */
+function coerce(value, type) {
+  if (typeof value === type) {
+    return value;
+  }
+
+  switch (type) {
+    case 'number': {
+      const n = Number(value);
+      return Number.isNaN(n) ? undefined : n;
+    }
+    case 'boolean': {
+      if (value === 'true' || value === 1) return true;
+      if (value === 'false' || value === 0) return false;
+      return Boolean(value);
+    }
+    case 'string': {
+      return String(value);
+    }
+    default: {
+      return undefined;
+    }
+  }
+}
+
+/**
+ * Resolve a single leaf field value
+ */
+function resolveLeaf(leaf, value, ctx) {
+  // Null handling
+  if (value === null) {
+    return leaf.nullable ? null : resolveDefault(leaf.default, ctx);
+  }
+
+  // Undefined → apply default
+  if (value === undefined) {
+    return resolveDefault(leaf.default, ctx);
+  }
+
+  // Array type — just check it's an array, don't coerce
+  if (leaf.type === 'array') {
+    return Array.isArray(value) ? value : resolveDefault(leaf.default, ctx);
+  }
+
+  // Type coercion
+  if (typeof value !== leaf.type) {
+    const coerced = coerce(value, leaf.type);
+    return coerced !== undefined ? coerced : resolveDefault(leaf.default, ctx);
+  }
+
+  return value;
+}
+
+/**
+ * Resolve a default value, handling special tokens
+ */
+function resolveDefault(def, ctx) {
+  if (typeof def !== 'string' || !def.startsWith('$')) {
+    // For arrays, return a fresh copy to avoid shared references
+    if (Array.isArray(def)) {
+      return [...def];
+    }
+    return def;
+  }
+
+  switch (def) {
+    case '$uuid':
+      return ctx.generators.uuid ? ctx.generators.uuid() : null;
+    case '$randomId':
+      return ctx.generators.randomId ? ctx.generators.randomId() : null;
+    case '$apiKey':
+      return ctx.generators.apiKey ? ctx.generators.apiKey() : null;
+    case '$oldDate':
+      return ctx.oldDate;
+    case '$oldDateUNIX':
+      return ctx.oldDateUNIX;
+    case '$now':
+      return ctx.now;
+    case '$nowUNIX':
+      return ctx.nowUNIX;
+    default:
+      return def;
+  }
+}
+
+/**
+ * Expand $timestamp shorthand into a schema branch
+ */
+function expandTimestamp(variant) {
+  const useNow = variant === '$timestamp:now';
+
+  return {
+    timestamp: { type: 'string', default: useNow ? '$now' : '$oldDate' },
+    timestampUNIX: { type: 'number', default: useNow ? '$nowUNIX' : 0 },
+  };
+}
+
+/**
+ * Recursively resolve a schema node against input data
+ */
+function resolve(schema, data, ctx) {
+  data = data || {};
+  const result = {};
+
+  // If $passthrough, start by copying all existing keys from data
+  const isPassthrough = schema.$passthrough === true;
+  const template = schema.$template || null;
+
+  if (isPassthrough) {
+    // Copy all data keys first (they'll be overwritten by defined schema fields below)
+    for (const key of Object.keys(data)) {
+      if (template && !key.startsWith('$') && !(key in schema)) {
+        // Dynamic key — resolve against template
+        result[key] = resolve(template, data[key], ctx);
+      } else if (!(key in schema) || key.startsWith('$')) {
+        // Unknown key not in schema — passthrough as-is
+        result[key] = data[key];
+      }
+    }
+  }
+
+  // Now resolve each defined schema field
+  for (const [key, node] of Object.entries(schema)) {
+    // Skip meta keys
+    if (key.startsWith('$')) {
+      continue;
+    }
+
+    // Handle string shorthands
+    if (typeof node === 'string') {
+      if (node === '$template') {
+        // Resolve against parent's $template
+        result[key] = resolve(template, data[key], ctx);
+        continue;
+      }
+      if (node.startsWith('$timestamp')) {
+        // Expand timestamp shorthand and recurse
+        result[key] = resolve(expandTimestamp(node), data[key], ctx);
+        continue;
+      }
+    }
+
+    // Leaf field
+    if (isLeaf(node)) {
+      result[key] = resolveLeaf(node, data[key], ctx);
+      continue;
+    }
+
+    // Nested branch (plain object)
+    if (node !== null && typeof node === 'object') {
+      result[key] = resolve(node, data[key], ctx);
+      continue;
+    }
+  }
+
+  return result;
+}
+
+module.exports = { resolve };

package/dist/vendor/account/features.js

@@ -0,0 +1,220 @@
+/**
+ * features.js — the ONE reading of the features contract
+ * ([#647](https://github.com/Omega-JS-Stack/omega/issues/647)).
+ *
+ * A feature is DEFINED once, in the config's top-level `features` catalog:
+ *
+ *   features: {
+ *     saves:   { name: 'Saves', icon: 'feather', definition: '…',
+ *                usage: { pace: 'daily', mirror: ['teams'] } },
+ *     support: { name: 'Priority support', icon: 'headset' },
+ *   }
+ *
+ * A `usage` block makes the entry COUNTED (metered per user); an entry without
+ * one is a PERK, never counted. Each product then names only its VALUE:
+ * `features: { saves: 100, support: true }` — a number on a counted feature
+ * (the MONTHLY limit, -1 unlimited), true/false/a string on a perk.
+ *
+ * This module is the shared home of every derivation both sides make from
+ * those two halves plus a user's stored counters — the backend's `consume`
+ * gate and the browser's account page must never disagree about what a user's
+ * limit is:
+ *   - the EFFECTIVE limit, where an admin-written `usage.overrides.<feature>`
+ *     on the user doc wins over the plan's number;
+ *   - the DAY share, `ceil(limit / days in this month)`, so a monthly quota
+ *     cannot be burned on day one (pacing is the default; `pace: false` opts
+ *     out to a plain monthly counter);
+ *   - the two counters a counted feature carries per user, month and day.
+ *
+ * -1 is the unlimited sentinel everywhere it can appear: a limit, a day share,
+ * and a remaining count.
+ */
+
+// Where a user's counters and overrides live on the account document.
+const USAGE_KEY = 'usage';
+const OVERRIDES_KEY = 'overrides';
+
+/**
+ * Is this catalog entry COUNTED? A `usage` block is what meters a feature;
+ * everything else is a perk the plan either includes or does not.
+ * @param {object} entry - a top-level `features` catalog entry
+ * @returns {boolean}
+ */
+function isCountedFeature(entry) {
+  return !!(entry && typeof entry === 'object' && entry.usage && typeof entry.usage === 'object' && !Array.isArray(entry.usage));
+}
+
+/**
+ * Is this feature paced by day? Pacing is the DEFAULT on every counted
+ * feature; `usage: { pace: false }` opts out to a plain monthly counter.
+ * @param {object} entry - a catalog entry
+ * @returns {boolean}
+ */
+function isPacedFeature(entry) {
+  return isCountedFeature(entry) && entry.usage.pace !== false;
+}
+
+/**
+ * The document kinds a counted feature's counters mirror onto, declared in the
+ * catalog rather than at the call site.
+ * @param {object} entry - a catalog entry
+ * @returns {string[]} the declared kinds, or []
+ */
+function featureMirrors(entry) {
+  return isCountedFeature(entry) && Array.isArray(entry.usage.mirror) ? entry.usage.mirror : [];
+}
+
+/**
+ * Days in the month the given date falls in.
+ * @param {Date} [date] - defaults to now
+ * @returns {number}
+ */
+function daysInMonth(date) {
+  const d = date || new Date();
+  return new Date(d.getFullYear(), d.getMonth() + 1, 0).getDate();
+}
+
+/**
+ * A month limit's share of ONE day: ceil(limit / days in this month), so a
+ * quota of 100 in a 31-day month allows 4 a day and never 100 on the 1st.
+ * Unlimited stays unlimited; nothing stays nothing.
+ * @param {number} limit - the effective MONTHLY limit (-1 unlimited)
+ * @param {Date} [date] - the day being paced, defaults to now
+ * @returns {number} the day's share (-1 unlimited)
+ */
+function dayShare(limit, date) {
+  if (!Number.isFinite(limit) || limit === 0) return 0;
+  if (limit < 0) return -1;
+  return Math.ceil(limit / daysInMonth(date));
+}
+
+/**
+ * The per-user override for a feature, when the account carries one. Written
+ * by admins only (the user doc's `usage` key is a framework field the security
+ * rules deny a client), and it WINS over the plan's number — extra credits
+ * granted to one account, not a second pricing tier.
+ * @param {object} account - the user document
+ * @param {string} id - feature id
+ * @returns {number|null} the override, or null when there is none
+ */
+function featureOverride(account, id) {
+  const value = account && account[USAGE_KEY] && account[USAGE_KEY][OVERRIDES_KEY]
+    ? account[USAGE_KEY][OVERRIDES_KEY][id]
+    : undefined;
+
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+/**
+ * What a product promises for one feature: its raw value from the product's
+ * `features` map. A product that never names the feature promises nothing.
+ * @param {object} product - a `payment.products` entry
+ * @param {string} id - feature id
+ * @returns {*} the value, or undefined
+ */
+function productFeatureValue(product, id) {
+  const values = product && product.features;
+  return values && typeof values === 'object' && !Array.isArray(values) ? values[id] : undefined;
+}
+
+/**
+ * The counters a user carries for one feature. The stored shape is
+ * `usage.<id>.{ monthly, daily, total, last }` — monthly and daily are the two
+ * the gate reads, total never resets, last records when it moved.
+ * @param {object} account - the user document
+ * @param {string} id - feature id
+ * @returns {{ monthly: number, daily: number, total: number }}
+ */
+function featureCounters(account, id) {
+  const stored = (account && account[USAGE_KEY] && account[USAGE_KEY][id]) || {};
+  const read = (key) => (typeof stored[key] === 'number' && Number.isFinite(stored[key]) ? stored[key] : 0);
+
+  return { monthly: read('monthly'), daily: read('daily'), total: read('total') };
+}
+
+/**
+ * How many of a limit are left, given what is used. Unlimited stays unlimited.
+ * @param {number} limit - the limit (-1 unlimited)
+ * @param {number} used - the counter
+ * @returns {number} what remains (-1 unlimited), never below zero
+ */
+function remaining(limit, used) {
+  if (limit < 0) return -1;
+  return Math.max(0, limit - used);
+}
+
+/**
+ * Resolve ONE feature against a catalog, a product and an account: everything
+ * a gate or an account page needs to speak about it in one object.
+ *
+ * @param {string} id - feature id
+ * @param {object} options
+ * @param {object} [options.catalog] - the top-level `features` catalog
+ * @param {object} [options.product] - the account's resolved product
+ * @param {object} [options.account] - the user document (counters + overrides)
+ * @param {Date} [options.now] - the day being paced, defaults to now
+ * @returns {object} { id, name, icon, definition, counted, paced, mirror,
+ *   value, limit, planLimit, override, used, left, total,
+ *   day: { limit, used, left } }
+ */
+function resolveFeature(id, options) {
+  options = options || {};
+
+  const entry = (options.catalog || {})[id] || null;
+  const counted = isCountedFeature(entry);
+  const value = productFeatureValue(options.product, id);
+  const counters = featureCounters(options.account, id);
+  const override = featureOverride(options.account, id);
+
+  const planLimit = counted && typeof value === 'number' ? value : 0;
+  const limit = counted && override !== null ? override : planLimit;
+  const paced = isPacedFeature(entry);
+  const dayLimit = paced ? dayShare(limit, options.now) : -1;
+
+  return {
+    id: id,
+    name: (entry && entry.name) || id,
+    icon: (entry && entry.icon) || null,
+    definition: (entry && entry.definition) || null,
+    counted: counted,
+    paced: paced,
+    mirror: featureMirrors(entry),
+    value: counted ? limit : value,
+    limit: limit,
+    planLimit: planLimit,
+    override: override,
+    used: counters.monthly,
+    left: remaining(limit, counters.monthly),
+    total: counters.total,
+    day: {
+      limit: dayLimit,
+      used: counters.daily,
+      left: remaining(dayLimit, counters.daily),
+    },
+  };
+}
+
+/**
+ * Resolve every feature the catalog defines, in CATALOG order — the row order
+ * every surface renders (pricing rows, account bars).
+ * @param {object} options - same options as resolveFeature
+ * @returns {object[]} one resolved feature per catalog entry
+ */
+function resolveFeatures(options) {
+  options = options || {};
+
+  return Object.keys(options.catalog || {}).map((id) => resolveFeature(id, options));
+}
+
+module.exports = {
+  isCountedFeature,
+  isPacedFeature,
+  featureMirrors,
+  featureOverride,
+  featureCounters,
+  productFeatureValue,
+  daysInMonth,
+  dayShare,
+  resolveFeature,
+  resolveFeatures,
+};

package/dist/vendor/account/index.js

@@ -0,0 +1,53 @@
+/**
+ * @omega.js/account — the single source of truth for the OMEGA user/account schema.
+ *
+ * Today the account shape lives in two drifted places: @omega.js/backend's
+ * src/manager/helpers/user.js (canonical — schema engine + tokens) and
+ * @omega.js/client's DEFAULT_ACCOUNT in modules/auth.js (hand-rolled deep-merge,
+ * missing flags/activity/personal branches and `everPaid`). This package
+ * unifies them; each framework becomes a thin wrapper (@omega.js/backend keeps its
+ * `new User(Manager, settings).properties` API, @omega.js/client keeps
+ * `resolveAccount(rawData, firebaseUser)`).
+ *
+ * resolveAccount(data, options):
+ *   options.generators — { uuid, randomId, apiKey } value generators for the
+ *     '$uuid'/'$randomId'/'$apiKey' schema tokens. @omega.js/backend injects real ones
+ *     (uuid v4, Utilities().randomId, uid-generator); the frontend passes none
+ *     and the fields resolve to null (real values always come from the backend).
+ *   options.user — optional auth-user overlay ({ uid, email }): fills
+ *     account.auth identity when the doc doesn't carry it (@omega.js/client's
+ *     resolveAccount(rawData, firebaseUser) semantic).
+ */
+const USER_SCHEMA = require('./schema.js');
+const { resolve } = require('./engine.js');
+const resolveSubscription = require('./subscription.js');
+const features = require('./features.js');
+
+function resolveAccount(data, options) {
+  options = options || {};
+
+  // Time context — byte-identical to @omega.js/backend's node-powertools timestamps:
+  // powertools.timestamp(d, { output: 'string' }) === d.toISOString(),
+  // powertools.timestamp(d, { output: 'unix' }) === floor(ms / 1000).
+  const now = new Date();
+  const ctx = {
+    generators: options.generators || {},
+    now: now.toISOString(),
+    nowUNIX: Math.floor(now.getTime() / 1000),
+    oldDate: new Date(0).toISOString(),
+    oldDateUNIX: 0,
+  };
+
+  const account = resolve(USER_SCHEMA, data || {}, ctx);
+
+  // Auth-user overlay (frontend semantic): identity from the signed-in Firebase
+  // user when the stored doc doesn't already carry it
+  if (options.user) {
+    account.auth.uid = account.auth.uid || options.user.uid || null;
+    account.auth.email = account.auth.email || options.user.email || null;
+  }
+
+  return account;
+}
+
+module.exports = { USER_SCHEMA, resolveAccount, resolveSubscription, ...features };