@omega.js/manager 0.1.0

package/dist/services/workspace/ensure/scripts.js

@@ -0,0 +1,126 @@
+/**
+ * Ensure the brand's package.json scripts convention — the root AND each
+ * framework target's (npm scripts put node_modules/.bin on PATH, so plain
+ * `omega` resolves there). Script VALUES only — no other key or consumer
+ * content is ever touched. Idempotent: a converged file rewrites nothing.
+ *
+ * Root: `deploy: 'omega deploy'` guaranteed plus the start/manage migration
+ * (package-scripts.js). Targets: every key the framework declares in its own
+ * `projectScripts` is FRAMEWORK-owned and is rewritten to the default here,
+ * exactly as that framework's ensureTarget does on every verb run (#689) —
+ * one policy, two writers, so a consumer customizes behavior through hook
+ * points and never by editing a standard script. The walk running it at all
+ * is the onboard→dev cycle break (#675): the dev fan-out reaches those verbs
+ * THROUGH these scripts, so a freshly scaffolded target needs them before any
+ * verb has ever run. Keys the consumer added are never touched.
+ *
+ * The exceptions: a custom TARGET maps to no framework at all (#603), so it
+ * is skipped whole; a custom-server backend is skipped PER KEY (#584) — the
+ * verbs its mode refuses are the brand's own, named by the framework's
+ * `projectScriptsCustomOwned` declaration.
+ */
+const { join } = require('node:path');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+
+const { healPackageScripts, syncTargetScripts } = require('../../../lib/package-scripts.js');
+const { resolveFrameworkPackage } = require('../../../lib/framework-bin.js');
+const { TARGET_FRAMEWORKS } = require('../../../config.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+module.exports = async ({ brandRoot, targets = [], options = {} }) => {
+  const pkgPath = join(brandRoot, 'package.json');
+  const raw = jetpack.read(pkgPath);
+  if (!raw) {
+    console.log(`      ${chalk.dim('⊘ no root package.json yet (the structure operation scaffolds it)')}`);
+    return { output: { scripts: 'missing' } };
+  }
+
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch (e) {
+    console.log(`      ${chalk.yellow('⚠')} Root package.json doesn't parse (${e.message}) — fix it by hand`);
+    return { status: 'warned', reason: "root package.json doesn't parse", output: { scripts: 'unparseable' } };
+  }
+
+  const { scripts, changes } = healPackageScripts(pkg);
+
+  const targetWork = [];
+  const warnings = [];
+  for (const entry of targets) {
+    // A custom target's scripts are the brand's own contract (#603) — no
+    // framework declares them, so there is nothing to sync against
+    if (!entry.target) continue;
+
+    const framework = TARGET_FRAMEWORKS[entry.target];
+    const resolved = framework ? resolveFrameworkPackage(entry.path, framework) : null;
+    // Not installed yet (pre-`npm install`), or a framework that declares no
+    // projectScripts — nothing to fill from; the next walk heals it
+    if (!resolved || !resolved.pkg.projectScripts) continue;
+
+    const manifestPath = join(entry.path, 'package.json');
+    const targetRaw = jetpack.read(manifestPath);
+    if (!targetRaw) continue;
+
+    let targetPkg;
+    try {
+      targetPkg = JSON.parse(targetRaw);
+    } catch (e) {
+      console.log(`      ${chalk.yellow('⚠')} ${entry.dir}/package.json doesn't parse (${e.message}) — fix it by hand`);
+      warnings.push(`${entry.dir}/package.json doesn't parse`);
+      continue;
+    }
+
+    // A custom-server backend owns the keys whose verbs its mode refuses
+    // (#584) — the framework declares WHICH, so no list lives here (#689)
+    const brandOwnedKeys = entry.projectType === 'custom' ? (resolved.pkg.projectScriptsCustomOwned || []) : [];
+
+    const synced = syncTargetScripts(targetPkg, resolved.pkg.projectScripts, brandOwnedKeys);
+    if (synced.changes.length) targetWork.push({ entry, manifestPath, targetPkg, synced });
+  }
+
+  if (!changes.length && !targetWork.length && !warnings.length) {
+    console.log(`      ${chalk.green('✓')} Root + target scripts present`);
+    return null;
+  }
+
+  if (options.dryRun) {
+    const parts = [];
+    if (changes.length) parts.push(`heal root scripts (${changes.join(', ')})`);
+    for (const work of targetWork) {
+      parts.push(`sync ${work.entry.dir} scripts (${work.synced.changes.join(', ')})`);
+    }
+    return dryRunPlan(parts.join('; '), {
+      output: {
+        ...(changes.length ? { scripts: 'planned' } : {}),
+        ...(targetWork.length ? { targetScripts: 'planned' } : {}),
+      },
+    });
+  }
+
+  const output = {};
+
+  if (changes.length) {
+    pkg.scripts = scripts;
+    jetpack.write(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+    console.log(`      ${chalk.green('✓')} Healed root scripts \`${changes.join('`, `')}\``);
+    output.scripts = { changed: changes };
+  }
+
+  for (const work of targetWork) {
+    work.targetPkg.scripts = work.synced.scripts;
+    jetpack.write(work.manifestPath, `${JSON.stringify(work.targetPkg, null, 2)}\n`);
+    // The skipped keys are named per key: a custom-server backend's own verbs
+    // are absent by design, not by omission
+    const brandOwned = work.synced.skipped.length ? chalk.dim(` (brand-owned, untouched: ${work.synced.skipped.join(', ')})`) : '';
+    console.log(`      ${chalk.green('✓')} Synced ${work.entry.dir} scripts \`${work.synced.changes.join('`, `')}\`${brandOwned}`);
+    output.targetScripts = output.targetScripts || {};
+    output.targetScripts[work.entry.name] = work.synced.changes;
+  }
+
+  return {
+    ...(warnings.length ? { status: 'warned', reason: warnings.join('; ') } : {}),
+    output,
+  };
+};

package/dist/services/workspace/ensure/structure.js

@@ -0,0 +1,97 @@
+/**
+ * Ensure the brand-monorepo structure: a root package.json with targets/*
+ * workspaces, and a target directory for every enabled target. Dirs that map
+ * to no target are warned (never silently skipped); enabled targets with no
+ * dir are errors with the exact dir to create.
+ *
+ * Multi-instance targets: an ARRAY-form target expects one dir PER
+ * instance (`main` → the canonical dir, any other id → `<canonical>-<id>`) —
+ * an enabled instance without its dir is the same create-this-dir error. The
+ * single-object form keeps today's any-dir-of-the-type check untouched.
+ *
+ * Custom targets (#603) map to no framework by design, so they are checked BY
+ * DIR (the declaration names it) and never counted among the unmapped — this
+ * service is one of the two ops that see them at all.
+ */
+const { join } = require('node:path');
+const chalk = require('chalk').default;
+const jetpack = require('fs-jetpack');
+
+const { normalizeTargetInstances, instanceTargetDir, isCustomTargetEntry } = require('../../../vendor/config/index.js');
+const { TARGET_DIRS } = require('../../../config.js');
+const { customTargetDirs } = require('../../../lib/custom-target.js');
+
+module.exports = async ({ brandRoot, brand, targets }) => {
+  const problems = [];
+  const findings = [];
+
+  // Root package.json must exist and declare targets/* workspaces
+  const pkg = jetpack.read(join(brandRoot, 'package.json'), 'json');
+  if (!pkg) {
+    problems.push('no package.json at the brand root');
+  } else {
+    const workspaces = Array.isArray(pkg.workspaces) ? pkg.workspaces : [];
+    if (!workspaces.includes('targets/*')) {
+      problems.push(`root package.json workspaces must include "targets/*" (found: ${JSON.stringify(workspaces)})`);
+    }
+  }
+
+  // Every enabled target needs at least one dir; the multi-instance array
+  // form needs every instance's exact dir (the config validator owns id
+  // sanity — malformed entries are its errors, never doubled here)
+  for (const target of brand.enabledTargets) {
+    const declared = brand.config?.targets?.[target];
+
+    // A custom target's dirs are named by its own declaration, one per
+    // instance — the same create-this-dir error, checked by name
+    if (isCustomTargetEntry(declared)) {
+      for (const dir of customTargetDirs({ targets: { [target]: declared } })) {
+        if (!targets.some((entry) => entry.name === dir)) {
+          problems.push(`enabled custom target "${target}" has no dir — create targets/${dir}/`);
+        }
+      }
+      continue;
+    }
+
+    if (Array.isArray(declared)) {
+      for (const instance of normalizeTargetInstances(declared)) {
+        if (typeof instance?.id !== 'string') continue;
+        const dir = instanceTargetDir(target, instance.id);
+        if (!targets.some((entry) => entry.name === dir)) {
+          problems.push(`enabled target "${target}" instance "${instance.id}" has no dir — create targets/${dir}/`);
+        }
+      }
+      continue;
+    }
+
+    if (!targets.some((entry) => entry.target === target)) {
+      const suggested = TARGET_DIRS[target] || target;
+      problems.push(`enabled target "${target}" has no dir — create targets/${suggested}/`);
+    }
+  }
+
+  // Dirs that resolve to no target are suspicious but not fatal — a DECLARED
+  // custom dir is neither: the brand said what it is
+  const unmapped = targets.filter((entry) => !entry.target && !entry.custom);
+  for (const entry of unmapped) {
+    findings.push(`${entry.dir} maps to no target — declare one in its omega.json5, use a conventional dir name, or declare it \`type: 'custom'\``);
+  }
+
+  if (problems.length > 0) {
+    for (const problem of problems) {
+      console.log(`      ${chalk.red('✗')} ${problem}`);
+    }
+    return { status: 'error', error: problems.join('; '), output: { problems } };
+  }
+
+  console.log(`      ${chalk.green('✓')} ${targets.length} target(s): ${targets.map((entry) => `${entry.name}→${entry.target || (entry.custom ? 'custom' : '?')}`).join(', ')}`);
+
+  if (findings.length > 0) {
+    for (const finding of findings) {
+      console.log(`      ${chalk.yellow('⚠')} ${finding}`);
+    }
+    return { status: 'warned', reason: findings.join('; '), output: { findings } };
+  }
+
+  return { output: { targets: targets.map((entry) => ({ name: entry.name, target: entry.target })) } };
+};

package/dist/services/workspace/ensure/translation-sdk.js

@@ -0,0 +1,148 @@
+/**
+ * Ensure a translating web target declares the Claude translation SDK (#168).
+ *
+ * `@omega.js/web` is the only framework that leaves `@anthropic-ai/claude-agent-sdk`
+ * to the consumer (#37: translation is opt-in and the SDK is heavy, so web
+ * declares it as an OPTIONAL PEER; backend and extension declare it as a real
+ * dependency). Every brand ends up translating (Ian 2026-08-03), so the manage
+ * cycle owns that install instead of a human typing it per brand: a web target
+ * whose resolved config turns translation on with the `claude` provider gets
+ * the dep written into its package.json and installed.
+ *
+ * Converge-to-config, same as every other workspace op: declared already =
+ * zero-mutation no-op (a consumer-chosen spec is never overwritten), dry run
+ * plans without writing, translation off or provider `chatgpt` = untouched.
+ * Disabling translation never REMOVES the dep (#168: uninstalling on a config
+ * flip is riskier than leaving it), and devkit's loud missing-SDK error stays
+ * the backstop for hand-managed brands.
+ */
+const path = require('node:path');
+const chalk = require('chalk').default;
+const jetpack = require('fs-jetpack');
+
+const { loadConfig } = require('../../../vendor/config/index.js');
+const { resolveTranslationSettings } = require('../../../vendor/devkit/translate/index.js');
+const { runCommand } = require('../../../lib/run-command.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+const SDK = '@anthropic-ai/claude-agent-sdk';
+
+// Bootstrap range for a brand whose @omega.js/web isn't installed yet (a fresh
+// clone's first manage). The authoritative copy is web's own optional peer
+// (packages/web/package.json `peerDependencies`), read off the INSTALLED web
+// package whenever it resolves, so the range always matches that version.
+const FALLBACK_RANGE = '>=0.2';
+
+/**
+ * The SDK range `@omega.js/web` declares as its optional peer, read from the
+ * target's installed copy via the node_modules climb (a manual walk, not
+ * require.resolve, because web's exports map doesn't expose its package.json).
+ *
+ * @param {string} targetPath - Absolute target root
+ * @returns {string} The declared peer range, or FALLBACK_RANGE when web isn't installed
+ */
+function sdkRange(targetPath) {
+  let dir = path.resolve(targetPath);
+
+  while (true) {
+    const pkg = jetpack.read(path.join(dir, 'node_modules', '@omega.js', 'web', 'package.json'), 'json');
+    const range = pkg?.peerDependencies?.[SDK];
+    if (range) return range;
+
+    const parent = path.dirname(dir);
+    if (parent === dir) return FALLBACK_RANGE;
+    dir = parent;
+  }
+}
+
+/**
+ * Does this target's resolved config ask for the claude translation provider?
+ * devkit's resolver is the SSOT for the section's defaults (absent `enabled`
+ * is on, an absent `providers` block is claude, no languages is off).
+ *
+ * @param {object} entry - Discovered target dir ({ path, target, ... })
+ * @returns {boolean}
+ */
+function wantsClaudeTranslation(entry) {
+  const { config } = loadConfig(entry.path, entry.target);
+  const settings = resolveTranslationSettings(config);
+
+  return settings.enabled && settings.provider === 'claude';
+}
+
+module.exports = async ({ brandRoot, targets, options = {}, runCommand: run = runCommand }) => {
+  const drifted = [];
+  const findings = [];
+
+  for (const entry of targets.filter((item) => item.target === 'web')) {
+    let wanted;
+    try {
+      wanted = wantsClaudeTranslation(entry);
+    } catch (error) {
+      // An unreadable translation section (an unknown language code, say) is an
+      // TARGET-level finding, so it warns and leaves that target alone rather than
+      // halting the whole manage walk (the sibling convention stated in
+      // ensure/config.js). The web target's own translate run is the hard gate.
+      const finding = `${entry.name}: ${error.message}`;
+      console.log(`      ${chalk.yellow('⚠')} ${finding}`);
+      findings.push(finding);
+      continue;
+    }
+
+    if (!wanted) continue;
+
+    const pkgPath = path.join(entry.path, 'package.json');
+    const pkg = jetpack.read(pkgPath, 'json');
+    if (!pkg) {
+      console.log(`      ${chalk.dim(`⊘ ${entry.name}: no package.json yet`)}`);
+      continue;
+    }
+
+    if (pkg.dependencies?.[SDK] || pkg.devDependencies?.[SDK]) continue;
+
+    drifted.push({ entry, pkgPath, pkg, range: sdkRange(entry.path) });
+  }
+
+  // Any finding warns the operation, whatever the drift work on the readable
+  // targets returned
+  const withFindings = (result) => (findings.length === 0
+    ? result
+    : { ...result, status: 'warned', reason: result?.reason || findings.join('; '), output: { ...result?.output, findings } });
+
+  if (drifted.length === 0) {
+    if (findings.length === 0) console.log(`      ${chalk.green('✓')} Translation SDK converged`);
+    return withFindings(null);
+  }
+
+  const summary = drifted.map(({ entry, range }) => `${entry.name}: ${SDK}@${range}`).join(', ');
+
+  if (options.dryRun) {
+    return withFindings(dryRunPlan(
+      `add the translation SDK (${summary}) and run npm install`,
+      { output: { translationSdk: 'planned' } },
+    ));
+  }
+
+  for (const { entry, pkgPath, pkg, range } of drifted) {
+    pkg.dependencies = { ...pkg.dependencies, [SDK]: range };
+    jetpack.write(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+    console.log(`      ${chalk.green('✓')} ${entry.name}: added ${SDK}@${range} (translation.providers.claude)`);
+  }
+
+  // One install at the brand root, since npm workspaces cover every target (the
+  // same shape the update service's install phase uses)
+  console.log(`      ${chalk.dim('→')} npm install ${chalk.dim(`(${SDK})`)}`);
+  const result = await run('npm', ['install', '--no-audit', '--no-fund'], brandRoot);
+
+  const added = drifted.map(({ entry }) => entry.name);
+
+  if (!result.success) {
+    console.log(`      ${chalk.yellow('⚠')} npm install failed (${result.error}); the dep is declared, so install it by hand`);
+    return withFindings({ status: 'warned', reason: 'npm install failed — install the SDK by hand', output: { translationSdk: { added, installed: false, error: result.error } } });
+  }
+
+  return withFindings({ output: { translationSdk: { added, installed: true } } });
+};
+
+// Exported for the drift-pin test: the bootstrap range must track web's peer
+module.exports.FALLBACK_RANGE = FALLBACK_RANGE;

package/dist/services/workspace/ensure/workflows.js

@@ -0,0 +1,54 @@
+/**
+ * Reconcile the brand root's composed CI workflows (#636) — the ratified
+ * example of a dropped config key becoming a real removal: take
+ * `targets.extension` out of omega.json5 and the `extension-*.yml` files a
+ * previous manage composed at the brand root are DELETED on the next walk.
+ *
+ * The compose itself stays where it is, in each framework's own scaffold
+ * (`@omega.js/devkit/ci-workflows`), which is per-target by construction — and
+ * a dropped target's framework never runs again, so nothing there could ever
+ * clean up after it. The full enabled-target set is knowable in exactly one
+ * place, HERE: the workspace service already owns the brand root's own files
+ * and runs first in every walk, boot lane included.
+ *
+ * LIVE means the config still enables it, not that the dir is still on disk:
+ * removing `targets/<dir>` wholesale is deliberately out of scope (the dir
+ * mixes human app code), so the dir outlives the key and only the generated
+ * files go. Custom targets (`type: 'custom'`) are live whenever declared —
+ * they have no framework, so they compose nothing anyway.
+ *
+ * The deletion's own safety is devkit's double lock (the GENERATED header plus
+ * the composed naming): the brand's own hand-written workflows live in that
+ * same dir and are never candidates.
+ */
+const chalk = require('chalk').default;
+
+const { reconcileComposedWorkflows } = require('../../../vendor/devkit/ci-workflows.js');
+
+module.exports = async ({ brandRoot, brand, targets, options }) => {
+  const dryRun = options?.dryRun || false;
+
+  const liveTargets = targets
+    .filter((entry) => entry.custom || (entry.target && brand.enabledTargets.includes(entry.target)))
+    .map((entry) => entry.name);
+
+  const { removed } = reconcileComposedWorkflows({
+    brandRoot,
+    liveTargets,
+    dryRun,
+    logger: { log: () => {}, warn: () => {} },
+  });
+
+  if (removed.length === 0) {
+    console.log(`      ${chalk.green('✓')} Composed workflows match the enabled targets`);
+    return null;
+  }
+
+  if (dryRun) {
+    console.log(`      ${chalk.yellow('[DRY RUN]')} Would remove ${chalk.cyan(removed.length)} composed workflow(s) for dropped targets: ${removed.join(', ')}`);
+    return { output: { workflows: { planned: removed.length } } };
+  }
+
+  console.log(`      ${chalk.yellow('↺')} Removed ${chalk.bold(removed.length)} composed workflow(s) for dropped targets ${chalk.dim(`(${removed.join(', ')})`)}`);
+  return { output: { workflows: { removed: removed.length } } };
+};

package/dist/services/workspace/index.js

@@ -0,0 +1,8 @@
+/**
+ * Workspace service — the brand monorepo itself is the first thing the
+ * manager reconciles: root workspaces wiring, omega.json5 health, and the
+ * .omega/ gitignore entry. Everything downstream assumes a sane workspace.
+ */
+const { createServiceRunner } = require('../../lib/service-runner.js');
+
+module.exports.run = createServiceRunner({ serviceDir: __dirname });

package/dist/vendor/account/engine.js

@@ -0,0 +1,182 @@
+/**
+ * Schema resolution engine — extracted verbatim from @omega.js/backend's
+ * src/manager/helpers/user.js, with ONE change: the '$uuid'/'$randomId'/'$apiKey'
+ * value generators are injected via ctx.generators instead of being required
+ * in-module. Hosts that can generate them (@omega.js/backend, Node) inject real generators;
+ * hosts that can't (@omega.js/client, browser) pass none and the fields resolve to
+ * null — the doc's real values always come from the backend.
+ *
+ * The engine is environment-agnostic: no dependencies, no Node APIs.
+ */
+
+/**
+ * Check if a schema node is a leaf field definition (has 'type' and 'default')
+ */
+function isLeaf(node) {
+  return node !== null
+    && typeof node === 'object'
+    && typeof node.type === 'string'
+    && 'default' in node;
+}
+
+/**
+ * Coerce a value to the expected type. Returns the coerced value or undefined if coercion fails.
+ */
+function coerce(value, type) {
+  if (typeof value === type) {
+    return value;
+  }
+
+  switch (type) {
+    case 'number': {
+      const n = Number(value);
+      return Number.isNaN(n) ? undefined : n;
+    }
+    case 'boolean': {
+      if (value === 'true' || value === 1) return true;
+      if (value === 'false' || value === 0) return false;
+      return Boolean(value);
+    }
+    case 'string': {
+      return String(value);
+    }
+    default: {
+      return undefined;
+    }
+  }
+}
+
+/**
+ * Resolve a single leaf field value
+ */
+function resolveLeaf(leaf, value, ctx) {
+  // Null handling
+  if (value === null) {
+    return leaf.nullable ? null : resolveDefault(leaf.default, ctx);
+  }
+
+  // Undefined → apply default
+  if (value === undefined) {
+    return resolveDefault(leaf.default, ctx);
+  }
+
+  // Array type — just check it's an array, don't coerce
+  if (leaf.type === 'array') {
+    return Array.isArray(value) ? value : resolveDefault(leaf.default, ctx);
+  }
+
+  // Type coercion
+  if (typeof value !== leaf.type) {
+    const coerced = coerce(value, leaf.type);
+    return coerced !== undefined ? coerced : resolveDefault(leaf.default, ctx);
+  }
+
+  return value;
+}
+
+/**
+ * Resolve a default value, handling special tokens
+ */
+function resolveDefault(def, ctx) {
+  if (typeof def !== 'string' || !def.startsWith('$')) {
+    // For arrays, return a fresh copy to avoid shared references
+    if (Array.isArray(def)) {
+      return [...def];
+    }
+    return def;
+  }
+
+  switch (def) {
+    case '$uuid':
+      return ctx.generators.uuid ? ctx.generators.uuid() : null;
+    case '$randomId':
+      return ctx.generators.randomId ? ctx.generators.randomId() : null;
+    case '$apiKey':
+      return ctx.generators.apiKey ? ctx.generators.apiKey() : null;
+    case '$oldDate':
+      return ctx.oldDate;
+    case '$oldDateUNIX':
+      return ctx.oldDateUNIX;
+    case '$now':
+      return ctx.now;
+    case '$nowUNIX':
+      return ctx.nowUNIX;
+    default:
+      return def;
+  }
+}
+
+/**
+ * Expand $timestamp shorthand into a schema branch
+ */
+function expandTimestamp(variant) {
+  const useNow = variant === '$timestamp:now';
+
+  return {
+    timestamp: { type: 'string', default: useNow ? '$now' : '$oldDate' },
+    timestampUNIX: { type: 'number', default: useNow ? '$nowUNIX' : 0 },
+  };
+}
+
+/**
+ * Recursively resolve a schema node against input data
+ */
+function resolve(schema, data, ctx) {
+  data = data || {};
+  const result = {};
+
+  // If $passthrough, start by copying all existing keys from data
+  const isPassthrough = schema.$passthrough === true;
+  const template = schema.$template || null;
+
+  if (isPassthrough) {
+    // Copy all data keys first (they'll be overwritten by defined schema fields below)
+    for (const key of Object.keys(data)) {
+      if (template && !key.startsWith('$') && !(key in schema)) {
+        // Dynamic key — resolve against template
+        result[key] = resolve(template, data[key], ctx);
+      } else if (!(key in schema) || key.startsWith('$')) {
+        // Unknown key not in schema — passthrough as-is
+        result[key] = data[key];
+      }
+    }
+  }
+
+  // Now resolve each defined schema field
+  for (const [key, node] of Object.entries(schema)) {
+    // Skip meta keys
+    if (key.startsWith('$')) {
+      continue;
+    }
+
+    // Handle string shorthands
+    if (typeof node === 'string') {
+      if (node === '$template') {
+        // Resolve against parent's $template
+        result[key] = resolve(template, data[key], ctx);
+        continue;
+      }
+      if (node.startsWith('$timestamp')) {
+        // Expand timestamp shorthand and recurse
+        result[key] = resolve(expandTimestamp(node), data[key], ctx);
+        continue;
+      }
+    }
+
+    // Leaf field
+    if (isLeaf(node)) {
+      result[key] = resolveLeaf(node, data[key], ctx);
+      continue;
+    }
+
+    // Nested branch (plain object)
+    if (node !== null && typeof node === 'object') {
+      result[key] = resolve(node, data[key], ctx);
+      continue;
+    }
+  }
+
+  return result;
+}
+
+module.exports = { resolve };