@omega.js/manager 0.1.0

package/dist/services/account/ensure/users.js

@@ -0,0 +1,259 @@
+/**
+ * Ensure the configured admin accounts exist in Firebase Auth with the
+ * resolved passwords (env var → owner hook → seed derivation, see
+ * lib/resolve-password.js), carry roles.admin + the highest plan on their
+ * Firestore user doc, and — the audit — that NO other user holds
+ * roles.admin. Unauthorized admins fail the service.
+ *
+ * Per entry:
+ *   account: true  → create if missing (then POST /user/signup to complete
+ *                    the flow), else converge the password; admin role +
+ *                    plan on the user doc; marketing sync when flagged
+ *   marketing: true (only) → push the contact to marketing providers when
+ *                    the auth user exists, skip quietly when not
+ */
+const chalk = require('chalk').default;
+
+module.exports = async function ensureUsers(context) {
+  const { authAdmin, firestore, accountBackend, admins, domain, apiKey, resolvePassword, brandConfig, options } = context;
+  const dryRun = options?.dryRun || false;
+
+  const counts = { ok: 0, created: 0, updated: 0, adminUpdated: 0, planned: 0, marketingSynced: 0 };
+  let warnings = 0;
+
+  for (const [index, entry] of admins.entries()) {
+    const { email } = entry;
+    const label = `[${index + 1}/${admins.length}]`;
+
+    if (!entry.account) {
+      if (!entry.marketing) {
+        console.log(`    ${label} ${chalk.dim(`⊘ ${email} — nothing to manage (account: false, marketing: false)`)}`);
+        continue;
+      }
+
+      // Marketing-only — sync if the auth user exists, skip if not
+      const user = await authAdmin.getUserByEmail(email);
+      if (!user) {
+        console.log(`    ${label} ${chalk.dim(`⊘ ${email} — no account (marketing-only, skipped)`)}`);
+        continue;
+      }
+
+      console.log(`    ${label} ${chalk.cyan(email)} ${chalk.dim(user.uid)} — marketing-only`);
+      warnings += await syncMarketing(accountBackend, apiKey, user.uid, dryRun, counts);
+      continue;
+    }
+
+    // password null only in a dry run whose seed doesn't exist yet; the
+    // via-marker calls out the non-default channels (env pin, owner hook)
+    const { password, source } = await resolvePassword(email);
+    const via = source && source !== 'seed' ? ` ${chalk.dim(`· via ${source}`)}` : '';
+    const user = await authAdmin.getUserByEmail(email);
+
+    if (!user) {
+      if (dryRun) {
+        console.log(`    ${label} ${chalk.cyan('[DRY RUN]')} Would create ${chalk.cyan(email)} + admin role + signup call${via}`);
+        counts.planned++;
+        continue;
+      }
+
+      const created = await authAdmin.createUser({ email, password });
+      console.log(`    ${label} ${chalk.green('✓')} ${chalk.cyan(email)} ${chalk.dim(created.uid)} — account created${via}`);
+      console.log(`      ${chalk.red('✗')} Google provider not linked`);
+      counts.created++;
+
+      const adminResult = await ensureAdmin(firestore, created.uid, brandConfig, dryRun);
+      if (adminResult === 'updated') counts.adminUpdated++;
+
+      // Complete the signup flow (welcome email, marketing lists, contact inference)
+      if (!apiKey) {
+        console.log(`      ${chalk.yellow('⚠')} Skipping signup call — no Firebase API key in firebase state`);
+        warnings++;
+      } else {
+        try {
+          await accountBackend.signup(created.uid);
+          console.log(`      ${chalk.green('✓')} Signup completed`);
+        } catch (error) {
+          console.log(`      ${chalk.yellow('⚠')} Signup call failed: ${chalk.dim(error.message)}`);
+          warnings++;
+        }
+      }
+      continue;
+    }
+
+    // Existing account — converge the password
+    if (!password) {
+      // Dry run before the seed exists: it will be generated on the first real run
+      console.log(`    ${label} ${chalk.cyan('[DRY RUN]')} ${chalk.cyan(email)} ${chalk.dim(user.uid)} — would set password (seed pending)`);
+      counts.planned++;
+    } else if (await accountBackend.verifyPassword(email, password)) {
+      console.log(`    ${label} ${chalk.green('✓')} ${chalk.cyan(email)} ${chalk.dim(user.uid)} — password OK${via}`);
+      counts.ok++;
+    } else if (dryRun) {
+      console.log(`    ${label} ${chalk.cyan('[DRY RUN]')} ${chalk.cyan(email)} ${chalk.dim(user.uid)} — would update password${via}`);
+      counts.planned++;
+    } else {
+      await authAdmin.updateUser(user.uid, { password });
+      console.log(`    ${label} ${chalk.green('✓')} ${chalk.cyan(email)} ${chalk.dim(user.uid)} — password updated${via}`);
+      counts.updated++;
+    }
+
+    logGoogleProvider(user);
+
+    const adminResult = await ensureAdmin(firestore, user.uid, brandConfig, dryRun);
+    if (adminResult === 'planned') counts.planned++;
+    if (adminResult === 'updated') counts.adminUpdated++;
+
+    if (entry.marketing) {
+      warnings += await syncMarketing(accountBackend, apiKey, user.uid, dryRun, counts);
+    }
+  }
+
+  // Audit: only account entries may hold roles.admin
+  const allowedEmails = new Set(admins.filter((e) => e.account).map((e) => e.email));
+  const unauthorized = await auditAdmins(firestore, authAdmin, allowedEmails);
+
+  const output = { users: counts };
+
+  if (unauthorized.length > 0) {
+    return { output, status: 'error', error: `Unauthorized admin accounts found: ${unauthorized.join(', ')}` };
+  }
+  if (warnings > 0) {
+    return { output, status: 'warned', reason: `${warnings} account(s) had a signup or marketing warning` };
+  }
+  return { output };
+};
+
+/**
+ * roles.admin + the highest-tier plan (last entry in payment.products) on
+ * the Firestore user doc. Leaf-path merge write, so sibling fields survive.
+ * Brands with no products manage only the role (omega-manager issued an
+ * empty merge write every run in that case).
+ *
+ * @returns {'ok'|'planned'|'updated'}
+ */
+async function ensureAdmin(firestore, uid, brandConfig, dryRun) {
+  const doc = await firestore.getDoc(`users/${uid}`) || {};
+
+  const products = brandConfig.payment?.products || [];
+  const maxProduct = products[products.length - 1];
+
+  const hasAdmin = doc.roles?.admin === true;
+  const hasPlan = !maxProduct || doc.subscription?.product?.id === maxProduct.id;
+
+  if (hasAdmin && hasPlan) {
+    console.log(`      ${chalk.green('✓')} Admin role set${maxProduct ? `, plan: ${chalk.cyan(maxProduct.id)}` : ''}`);
+    return 'ok';
+  }
+
+  if (dryRun) {
+    const changes = [
+      ...(!hasAdmin ? ['admin role'] : []),
+      ...(!hasPlan ? [`plan ${maxProduct.id}`] : []),
+    ];
+    console.log(`      ${chalk.cyan('[DRY RUN]')} Would set ${changes.join(' + ')}`);
+    return 'planned';
+  }
+
+  const data = {};
+  const fieldPaths = [];
+
+  if (!hasAdmin) {
+    data.roles = { admin: true };
+    fieldPaths.push('roles.admin');
+  }
+  if (!hasPlan) {
+    data.subscription = {
+      product: { id: maxProduct.id, name: maxProduct.name },
+      status: 'active',
+    };
+    fieldPaths.push('subscription.product.id', 'subscription.product.name', 'subscription.status');
+  }
+
+  await firestore.patchDoc(`users/${uid}`, data, fieldPaths);
+
+  if (!hasAdmin) {
+    console.log(`      ${chalk.green('✓')} Admin role set`);
+  }
+  if (!hasPlan) {
+    console.log(`      ${chalk.green('✓')} Plan set to ${chalk.cyan(maxProduct.id)}`);
+  }
+  return 'updated';
+}
+
+/**
+ * All users with roles.admin == true, checked against the allowed emails.
+ *
+ * @returns {Promise<string[]>} Unauthorized admin descriptions (empty = clean)
+ */
+async function auditAdmins(firestore, authAdmin, allowedEmails) {
+  const docs = await firestore.runQuery({
+    from: [{ collectionId: 'users' }],
+    where: {
+      fieldFilter: {
+        field: { fieldPath: 'roles.admin' },
+        op: 'EQUAL',
+        value: { booleanValue: true },
+      },
+    },
+  });
+
+  const unauthorized = [];
+
+  for (const doc of docs) {
+    const user = await authAdmin.getUser(doc.id);
+
+    if (user && allowedEmails.has(user.email)) {
+      console.log(`    ${chalk.green('✓')} Admin: ${chalk.cyan(user.email)} ${chalk.dim(doc.id)}`);
+    } else if (user) {
+      unauthorized.push(`${user.email || '?'} (${doc.id})`);
+      console.log(`    ${chalk.red('✗')} Unauthorized admin: ${chalk.red(user.email || '?')} ${chalk.dim(doc.id)}`);
+    } else {
+      unauthorized.push(doc.id);
+      console.log(`    ${chalk.red('✗')} Unauthorized admin (no auth record): ${chalk.red(doc.id)}`);
+    }
+  }
+
+  return unauthorized;
+}
+
+/**
+ * Whether the user has Google sign-in linked (informational — linking is a
+ * manual browser step).
+ */
+function logGoogleProvider(user) {
+  const hasGoogle = user.providerData.some((p) => p.providerId === 'google.com');
+
+  if (hasGoogle) {
+    console.log(`      ${chalk.green('✓')} Google provider linked`);
+  } else {
+    console.log(`      ${chalk.red('✗')} Google provider not linked`);
+  }
+}
+
+/**
+ * Push the user's contact to the marketing providers via the backend.
+ *
+ * @returns {Promise<number>} Warning count contribution (0 or 1)
+ */
+async function syncMarketing(accountBackend, apiKey, uid, dryRun, counts) {
+  if (!apiKey) {
+    console.log(`      ${chalk.dim('⊘ Marketing sync skipped (no Firebase API key in firebase state)')}`);
+    return 0;
+  }
+
+  if (dryRun) {
+    console.log(`      ${chalk.cyan('[DRY RUN]')} Would sync marketing contact`);
+    counts.planned++;
+    return 0;
+  }
+
+  try {
+    await accountBackend.syncMarketingContact(uid);
+    console.log(`      ${chalk.green('✓')} Marketing contact synced`);
+    counts.marketingSynced++;
+    return 0;
+  } catch (error) {
+    console.log(`      ${chalk.yellow('⚠')} Marketing sync failed: ${chalk.dim(error.message)}`);
+    return 1;
+  }
+}

package/dist/services/account/index.js

@@ -0,0 +1,97 @@
+/**
+ * Account service — required accounts exist in the brand's Firebase Auth
+ * with the expected (derived) passwords, carry the admin role + highest
+ * plan on their Firestore user doc, and no one else holds the admin role.
+ * Runs after update (deploy) because signup/marketing calls hit the live
+ * brand backend.
+ *
+ * De-ITW'd from omega-manager: the account list was the hardcoded company
+ * ADMIN_EMAILS in config.js (personal Gmail addresses) — the port reads
+ * account.admins from config, defaulting to support@{domain} only (a
+ * company's own list lives in its company omega.json5 and replaces the
+ * default whole). The password formula was a company-specific scheme in
+ * code — passwords now resolve per account through the owner channels
+ * (OMEGA_ACCOUNT_PASSWORD__* env var → config/hooks/account/password.js →
+ * lazy ACCOUNT_PASSWORD_SEED derivation; see lib/resolve-password.js).
+ * firebase-admin is replaced by the Identity Toolkit REST API +
+ * FirestoreREST over the brand's own service account.
+ */
+const { join } = require('node:path');
+const jetpack = require('fs-jetpack');
+
+const { createServiceRunner } = require('../../lib/service-runner.js');
+const { FirestoreREST, loadServiceAccount } = require('../../lib/firestore-rest.js');
+const { createAuthAdmin } = require('../../lib/auth-admin.js');
+const { createBackendClient } = require('./lib/backend-client.js');
+const { createPasswordResolver } = require('./lib/resolve-password.js');
+
+const SERVICE_ACCOUNT_PATH = join('.omega', 'secrets', 'service-account.json');
+
+module.exports.run = createServiceRunner({
+  serviceDir: __dirname,
+  setup: (context) => {
+    const config = context.brandConfig.account;
+
+    if (config === false || config?.enabled === false) {
+      return { skip: true, reason: 'account.enabled = false' };
+    }
+
+    const targets = context.brandConfig.targets || {};
+    if (!targets.backend) {
+      return { skip: true, reason: 'no backend target' };
+    }
+
+    // Shared Firebase project — the owning brand manages accounts
+    if (context.brandConfig.cloud?.shared === true) {
+      return { skip: true, reason: 'shared Firebase project' };
+    }
+
+    const domain = (context.brandConfig.brand?.url || '').replace(/^https?:\/\//, '').replace(/\/$/, '');
+    if (!domain) {
+      return { skip: true, reason: 'no brand.url configured' };
+    }
+
+    // Resolve {domain} templates in the configured admin list
+    const admins = (config?.admins || []).map((entry) => ({
+      ...entry,
+      email: entry.email.replace(/\{\s*domain\s*\}/g, domain),
+    }));
+    if (admins.length === 0) {
+      return { skip: true, reason: 'no account.admins configured' };
+    }
+
+    // Firebase web API key from config (the cloud service lands it there) —
+    // without it, password verification and backend calls degrade (handled
+    // per-operation)
+    const apiKey = context.brandConfig.cloud?.config?.apiKey || null;
+    const apiBaseUrl = `https://api.${domain}`;
+
+    // Tests inject fakes via context
+    let authAdmin = context.authAdmin;
+    let firestore = context.firestore;
+    let accountBackend = context.accountBackend;
+    if (!authAdmin) {
+      if (!jetpack.exists(join(context.brandRoot, SERVICE_ACCOUNT_PATH))) {
+        return { skip: true, reason: `no service account at ${SERVICE_ACCOUNT_PATH} (run the cloud service first)` };
+      }
+
+      const serviceAccount = loadServiceAccount(SERVICE_ACCOUNT_PATH, context.brandRoot);
+      authAdmin = createAuthAdmin(serviceAccount);
+      firestore = new FirestoreREST(serviceAccount);
+      accountBackend = createBackendClient({ authAdmin, apiKey, apiBaseUrl });
+    }
+
+    // Lazy channels: nothing (hook load, seed generation) happens until an
+    // account actually needs a password — a skipped or fully env/hook-covered
+    // brand never grows a seed in its .env
+    const dryRun = context.options?.dryRun || false;
+    const resolvePassword = createPasswordResolver({
+      brandRoot: context.brandRoot,
+      domain,
+      brand: context.brandConfig.brand,
+      dryRun,
+    });
+
+    return { authAdmin, firestore, accountBackend, admins, domain, apiKey, resolvePassword };
+  },
+});

package/dist/services/account/lib/backend-client.js

@@ -0,0 +1,107 @@
+/**
+ * Brand-backend calls made AS a managed user — password verification plus
+ * the two @omega.js/backend endpoints the account service drives after auth changes:
+ * POST /user/signup (completes the signup flow: welcome email, marketing
+ * lists, contact inference) and PUT /marketing/contact (pushes the contact
+ * to every marketing provider in one call).
+ *
+ * Auth model: mint a custom token with the Admin credentials, exchange it
+ * for an ID token at the public Firebase Auth REST API (needs the web
+ * apiKey from firebase state), then call the backend as that user. Methods
+ * throw on failure; the handler downgrades failures to warnings because
+ * the backend may simply not be deployed yet on a fresh brand.
+ */
+const AUTH_API_BASE = 'https://identitytoolkit.googleapis.com/v1';
+
+/**
+ * Create the backend client.
+ *
+ * @param {Object} deps
+ * @param {Object} deps.authAdmin - Auth admin client (for custom tokens)
+ * @param {string|null} deps.apiKey - Firebase web API key (null → verify
+ *   always false, signup/sync throw)
+ * @param {string} deps.apiBaseUrl - e.g. 'https://api.mybrand.com'
+ * @returns {Object} { verifyPassword, signup, syncMarketingContact }
+ */
+function createBackendClient({ authAdmin, apiKey, apiBaseUrl }) {
+  /**
+   * Exchange a custom token for an ID token.
+   */
+  async function getIdToken(uid) {
+    const customToken = await authAdmin.createCustomToken(uid);
+
+    const response = await fetch(
+      `${AUTH_API_BASE}/accounts:signInWithCustomToken?key=${apiKey}`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: customToken, returnSecureToken: true }),
+        signal: AbortSignal.timeout(30000),
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error(`Token exchange failed (${response.status})`);
+    }
+
+    const { idToken } = await response.json();
+    return idToken;
+  }
+
+  async function callBackend(method, path, uid) {
+    const idToken = await getIdToken(uid);
+
+    const response = await fetch(`${apiBaseUrl}${path}`, {
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${idToken}`,
+      },
+      body: JSON.stringify({ uid }),
+      signal: AbortSignal.timeout(60000),
+    });
+
+    if (!response.ok) {
+      throw new Error(`${method} ${path} failed (${response.status})`);
+    }
+  }
+
+  return {
+    /**
+     * True when the password signs in successfully (non-mutating check).
+     */
+    async verifyPassword(email, password) {
+      if (!apiKey) {
+        return false;
+      }
+
+      try {
+        const response = await fetch(
+          `${AUTH_API_BASE}/accounts:signInWithPassword?key=${apiKey}`,
+          {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email, password, returnSecureToken: false }),
+            signal: AbortSignal.timeout(30000),
+          },
+        );
+
+        return response.ok;
+      } catch {
+        return false;
+      }
+    },
+
+    /** Complete the signup flow for a freshly created user. */
+    signup(uid) {
+      return callBackend('POST', '/omega/user/signup', uid);
+    },
+
+    /** Push the user's contact data to all marketing providers. */
+    syncMarketingContact(uid) {
+      return callBackend('PUT', '/omega/marketing/contact', uid);
+    },
+  };
+}
+
+module.exports = { createBackendClient };

package/dist/services/account/lib/password.js

@@ -0,0 +1,36 @@
+/**
+ * Deterministic admin-account passwords — HMAC-SHA256 of the account email +
+ * the brand's apex domain, keyed by the brand-local ACCOUNT_PASSWORD_SEED.
+ * Same inputs → same password on every run (the service converges Firebase
+ * Auth to it), different per account and per brand, and nothing stored
+ * anywhere but the seed in the gitignored brand .env.
+ *
+ * De-ITW'd from omega-manager, whose generate-password.js encoded the
+ * company's personal keyboard-column formula in code. Rotating the seed is
+ * safe but noisy: the next run updates every managed account's password.
+ */
+const { createHmac } = require('node:crypto');
+
+const { getApexDomain } = require('../../../lib/domain-utils.js');
+
+/**
+ * Derive the password for a managed account.
+ *
+ * The static prefix guarantees the uppercase/digit/symbol character classes
+ * regardless of what the digest contains; the 20 base64url chars carry the
+ * entropy.
+ *
+ * @param {string} seed - ACCOUNT_PASSWORD_SEED from the brand .env
+ * @param {string} email - Account email address
+ * @param {string} domain - Brand domain (e.g. 'mybrand.com'); apex is used
+ *   so subdomain changes in brand.url don't rotate passwords
+ * @returns {string} Derived password
+ */
+function derivePassword(seed, email, domain) {
+  const apex = getApexDomain(domain);
+  const digest = createHmac('sha256', seed).update(`${email}:${apex}`).digest('base64url');
+
+  return `A1!${digest.slice(0, 20)}`;
+}
+
+module.exports = { derivePassword };

package/dist/services/account/lib/resolve-password.js

@@ -0,0 +1,100 @@
+/**
+ * Per-account password resolution — the owner-controlled channels, strongest
+ * first (brand-account provisioning ownership, Ian 2026-07-10):
+ *
+ *   1. env    — OMEGA_ACCOUNT_PASSWORD__<EMAIL> (email uppercased, runs of
+ *               non-alphanumerics → _), e.g. support@acme.com →
+ *               OMEGA_ACCOUNT_PASSWORD__SUPPORT_ACME_COM. Rides the D15
+ *               cascade, so a fixed password can live in the brand or
+ *               company .env.
+ *   2. hook   — config/hooks/account/password.js (brand root, else company
+ *               root via the company stamp): ({ email, domain, apex, brand })
+ *               → password. A company-wide formula lives in the OWNER'S tree,
+ *               never in framework source. A broken hook throws — an owner
+ *               who wrote one never gets silent fallback.
+ *   3. seed   — derivePassword(ACCOUNT_PASSWORD_SEED, email, domain), the
+ *               generated default. The seed is resolved LAZILY: only when
+ *               some account actually falls through to this channel does it
+ *               get generated + persisted to the brand .env — a brand fully
+ *               covered by env/hook never grows a seed.
+ */
+const { randomBytes } = require('node:crypto');
+const chalk = require('chalk').default;
+
+const { loadHook } = require('../../../vendor/config/index.js');
+
+const { writeEnvValue } = require('../../../lib/env-secret.js');
+const { getApexDomain } = require('../../../lib/domain-utils.js');
+const { derivePassword } = require('./password.js');
+
+const HOOK_POINT = 'account/password';
+
+// Firebase Auth's own minimum — catch a broken hook here, not as an opaque
+// Identity Toolkit 400 later.
+const MIN_PASSWORD_LENGTH = 6;
+
+/**
+ * The env var that pins a specific account's password.
+ * @param {string} email - Resolved account email (templates already applied)
+ * @returns {string} e.g. 'OMEGA_ACCOUNT_PASSWORD__SUPPORT_ACME_COM'
+ */
+function passwordEnvVar(email) {
+  const key = email.toUpperCase().replace(/[^A-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');
+  return `OMEGA_ACCOUNT_PASSWORD__${key}`;
+}
+
+/**
+ * Build the per-account password resolver for one brand run.
+ *
+ * @param {Object} spec
+ * @param {string} spec.brandRoot - Brand-monorepo root (hook + seed home)
+ * @param {string} spec.domain - Brand domain (hook context + seed derivation)
+ * @param {Object} spec.brand - brandConfig.brand (hook context: id, name, url)
+ * @param {boolean} spec.dryRun - Dry runs never generate/persist a seed
+ * @returns {(email: string) => Promise<{ password: string|null, source: string|null }>}
+ *   password null only in a dry run that fell through to a not-yet-existing
+ *   seed (the caller's "seed pending" path); source is 'env <VAR>',
+ *   'hook <file>', or 'seed'.
+ */
+function createPasswordResolver({ brandRoot, domain, brand, dryRun }) {
+  let hook; // undefined = not looked up yet; null = no hook file
+  let seed; // undefined = not resolved yet; null = dry run without one
+
+  return async function resolvePassword(email) {
+    // 1. Explicit env pin
+    const envVar = passwordEnvVar(email);
+    if (process.env[envVar]) {
+      return { password: process.env[envVar], source: `env ${envVar}` };
+    }
+
+    // 2. Owner hook (loaded once; a broken hook throws out of the service)
+    if (hook === undefined) {
+      hook = loadHook(brandRoot, HOOK_POINT);
+    }
+    if (hook) {
+      const password = await hook.fn({ email, domain, apex: getApexDomain(domain), brand });
+      if (typeof password !== 'string' || password.length < MIN_PASSWORD_LENGTH) {
+        throw new Error(`Hook ${HOOK_POINT} (${hook.file}) returned an invalid password for ${email} — must be a string of at least ${MIN_PASSWORD_LENGTH} characters`);
+      }
+      return { password, source: `hook ${hook.file}` };
+    }
+
+    // 3. Seed derivation — the seed materializes on first need
+    if (seed === undefined) {
+      seed = process.env.ACCOUNT_PASSWORD_SEED || null;
+
+      if (!seed && dryRun) {
+        console.log(`      ${chalk.cyan('[DRY RUN]')} Would generate ACCOUNT_PASSWORD_SEED and save it to the brand .env`);
+      } else if (!seed) {
+        seed = randomBytes(24).toString('base64url');
+        writeEnvValue(brandRoot, 'ACCOUNT_PASSWORD_SEED', seed);
+        process.env.ACCOUNT_PASSWORD_SEED = seed;
+        console.log(`      ${chalk.green('✓')} Generated ACCOUNT_PASSWORD_SEED and saved to the brand .env`);
+      }
+    }
+
+    return { password: seed ? derivePassword(seed, email, domain) : null, source: 'seed' };
+  };
+}
+
+module.exports = { createPasswordResolver, passwordEnvVar };