backend-manager 5.2.12 → 5.2.14

package/CHANGELOG.md

@@ -14,6 +14,27 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.2.14] - 2026-05-28
+
+### Removed
+
+- **Dropped the `marketing-webhooks` Firestore idempotency ledger.** The marketing-webhook dispatcher (`src/manager/routes/marketing/webhook/post.js`) no longer reads/writes `marketing-webhooks/{eventId}` docs for dedup. Both handler side effects — writing `consent.marketing.status = 'revoked'` and the cross-provider `mailer.remove()` — are naturally idempotent, so a provider retry or duplicate parent fan-out re-runs to the same end state with no extra side effects. (This is the key difference from `payments-webhooks`, where dedup is load-bearing because payment side effects are NOT idempotent.) Events with no `eventId` are now processed instead of skipped, since dedup is no longer required. Removed `marketing-webhooks` from the test runner's pre-test cleanup list (`src/test/test-accounts.js`). Consumers with an existing `marketing-webhooks` collection can safely delete it — nothing reads or writes it anymore.
+
+### Fixed
+
+- **`libraries/infer-contact.js`: guard the optional `assistant` arg.** All log/error calls now use `assistant?.` so `inferContact(email)` works without an assistant. Previously threw a `TypeError` when `BACKEND_MANAGER_OPENAI_API_KEY` was unset and no assistant was passed.
+- **`libraries/email/marketing/index.js`: gate `Marketing.remove()` behind test mode.** `remove()` now short-circuits with `if (assistant.isTesting() && !process.env.TEST_EXTENDED_MODE) return {}`, matching `add()` and `sync()`. Closes a gap where auth `onDelete` (fired ~44× at test startup during user cleanup) could hit the live SendGrid/Beehiiv remove APIs during a normal test run. The gate lives at the library SSOT so every caller (onDelete, webhook processors, contact-delete route) inherits it.
+
+### Changed
+
+- **Signup timestamps stamped from Firebase Auth `creationTime`.** Both write paths — the `onCreate` auth event (`src/manager/events/auth/on-create.js`) and the `user/signup` fallback route (`src/manager/routes/user/signup/post.js`) — now set `metadata.created` and `consent.{legal,marketing}.grantedAt`/`revokedAt` from `user.metadata.creationTime` instead of "now"/request-time. The OMEGA user migration treats Auth's `creationTime` as the SSOT and reconciles every doc against it; the prior few-seconds drift meant every new signup got re-fixed on the next migration run. Stamping from `creationTime` makes new docs match the migration's expected value exactly, ending the recurring churn.
+- **`user/signup`: `flags.signupProcessed` is the sole idempotency gate.** Removed the 5-minute account-age reject (`MAX_ACCOUNT_AGE_MS`). A genuinely-unprocessed account can now complete signup whenever it retries — fixes the failure where a slow/missing `onCreate` plus a retry after 5 minutes caused a legitimate signup to be rejected. The frontend (UJM) gate is being moved to the same doc flag in a parallel change.
+- **CLI: port-conflict prompt auto-confirms after 5s.** The "Kill these processes to free the ports?" prompt in `src/cli/commands/base-command.js` now auto-confirms `Y` after 5 seconds of no input (via `AbortSignal.timeout` → `AbortPromptError` → default `true`), so unattended test/dev loops (`emulator`, `serve`, `test`) no longer hang waiting for input. Manual `y`/`n` and Ctrl+C still work.
+- **`AI` `claude-code` provider rewritten for serverside use** (`src/manager/libraries/ai/providers/claude-code.js`). Was a local-only wrapper around `@anthropic-ai/claude-agent-sdk` that spawned the `claude` binary (`forceLoginMethod: 'claudeai'`, keychain OAuth) — would not run in Cloud Functions. Now calls the Claude Messages API over plain HTTPS via `@anthropic-ai/sdk` using the OAuth token as `Authorization: Bearer` + `anthropic-beta: oauth-2025-04-20`, so it bills the Claude Pro/Max subscription (not API credits) and runs anywhere Node runs. Token resolution: `options.apiKey` → `config.claude_code.oauth_token` → `process.env.CLAUDE_CODE_OAUTH_TOKEN`. Renewal is a manual yearly `claude setup-token` (no auto-refresh). Verified live (text + JSON-schema paths). See `docs/ai-library.md`.
+- **Dependency bumps**: `@anthropic-ai/claude-agent-sdk` ^0.3.152 → ^0.3.153, `stripe` ^22.1.1 → ^22.2.0.
+- **`templates/_.env`**: consolidate OpenAI/Anthropic keys under an "AI" section and add `CLAUDE_CODE_OAUTH_TOKEN`.
+- **Marketing webhook tests** (`test/routes/marketing/webhook.js`): renamed `*-duplicate-event-skipped` → `*-reprocessed-idempotently` (assert re-delivery reprocesses and the user stays revoked); `sendgrid-event-without-eventId-*` now asserts the event is processed; beehiiv idempotency variant skips when no publication is configured. Updated `docs/consent.md` and `docs/testing.md` to describe the no-ledger design.
+
 # [5.2.12] - 2026-05-27
 
 ### Changed

package/docs/ai-library.md

@@ -6,18 +6,32 @@
 |---|---|---|
 | `openai` | `gpt-5-mini` | Better at structured JSON via JSON schema |
 | `anthropic` | `claude-sonnet-4-6` | Better at SVG illustrations and creative output |
+| `claude-code` | `claude-opus-4-7` | Same Claude models as `anthropic`, but bills a Claude Pro/Max **subscription** instead of API credits |
 
 Return shape (same for all providers): `{ content, output, tokens, raw }`.
 
-`options.response: 'json'` triggers JSON parsing — both providers strip fences and parse with JSON5 for robustness. `options.schema` enforces structure on OpenAI (real JSON schema) and is injected into the system prompt on Anthropic.
+`options.response: 'json'` triggers JSON parsing — all providers strip fences and parse with JSON5 for robustness. `options.schema` enforces structure on OpenAI (real JSON schema) and is injected into the system prompt on Anthropic / claude-code.
 
 API keys: `BACKEND_MANAGER_OPENAI_API_KEY`, `BACKEND_MANAGER_ANTHROPIC_API_KEY` (process.env or config).
 
+## `claude-code` provider — subscription billing
+
+The `claude-code` provider hits the same Claude Messages API as `anthropic`, but authenticates with a **Claude Code OAuth token** (`Authorization: Bearer ...` + `anthropic-beta: oauth-2025-04-20`) so usage bills the Claude Pro/Max subscription tied to the token rather than API credits.
+
+It is **pure HTTPS** — no `claude` binary, no subprocess — so it runs in Cloud Functions / CI / anywhere Node runs.
+
+Token resolution (first match wins): `options.apiKey` / constructor key → `config.claude_code.oauth_token` → `process.env.CLAUDE_CODE_OAUTH_TOKEN`.
+
+Mint the token with `claude setup-token` (valid ~1 year). When it expires, requests 401 — re-mint and update the `CLAUDE_CODE_OAUTH_TOKEN` secret. There is no automatic refresh; renewal is a manual yearly step.
+
+> **Caveats:** the Bearer/beta subscription path is undocumented and may change. Usage is subject to the subscription's rate limits (not API-tier limits). For high-volume production traffic, prefer `anthropic` + `BACKEND_MANAGER_ANTHROPIC_API_KEY`.
+
 The legacy `src/manager/libraries/openai.js` is a thin compatibility shim that re-exports the OpenAI provider class — existing callers using `new OpenAI(assistant, key)` still work unchanged.
 
 | File | Purpose |
 |---|---|
 | `src/manager/libraries/ai/index.js` | Unified `AI` class (dispatches by provider) |
 | `src/manager/libraries/ai/providers/openai.js` | OpenAI provider (original `openai.js` content) |
-| `src/manager/libraries/ai/providers/anthropic.js` | Anthropic provider (Claude Messages API) |
+| `src/manager/libraries/ai/providers/anthropic.js` | Anthropic provider (Claude Messages API, x-api-key, API credits) |
+| `src/manager/libraries/ai/providers/claude-code.js` | claude-code provider (Claude Messages API, OAuth Bearer, subscription billing) |
 | `src/manager/libraries/openai.js` | Back-compat shim → providers/openai.js |

package/docs/consent.md

@@ -121,9 +121,9 @@ POST /backend-manager/marketing/webhook?provider=beehiiv&key=<BACKEND_MANAGER_WE
 The dispatcher loads `processors/{provider}.js`, parses the event(s), and for each event:
 
 1. Checks `isSupported(eventType)` — filters out non-revoke events like `delivered` / `open`.
-2. Idempotency lookup in `marketing-webhooks/{eventId}` — skips if already processed.
-3. Calls `handleEvent({ Manager, assistant, parsed })` on the processor.
-4. Marks the idempotency doc `status: 'completed'` (or `'failed'` with error details).
+2. Calls `handleEvent({ Manager, assistant, parsed })` on the processor.
+
+There is **no idempotency ledger**. Both handler side effects — writing `consent.marketing.status = 'revoked'` and calling `mailer.remove()` — are idempotent, so a provider retry (or a duplicate fan-out from the parent) re-runs to the same end state with no extra side effects. This is the key difference from `payments-webhooks`, where dedup is load-bearing because payment side effects are not idempotent.
 
 Each processor's `handleEvent` does the same shape of work:
 
@@ -159,7 +159,7 @@ The parent forwarder:
 2. Reads the `brands` collection from the parent's own Firestore.
 3. For each brand: derives the child API URL by inserting `api.` into the brand's URL (`https://somiibo.com` → `https://api.somiibo.com/backend-manager/marketing/webhook?provider=X&key=Y`).
 4. POSTs the raw provider body to every child in parallel via `Promise.allSettled`.
-5. Returns 200 even if some children fail — child idempotency makes provider retries safe.
+5. Returns 200 even if some children fail — idempotent child handlers make provider retries (and re-fans) safe.
 
 ### Why fan-out instead of central processing
 
@@ -167,7 +167,7 @@ Each brand has its own Firebase project, so its `users` collection is separate.
 
 - **Correct per-brand updates** — only brands where the user actually has an account update their user docs.
 - **Failure isolation** — one child being down doesn't block updates on the others.
-- **Local idempotency** — each child tracks `marketing-webhooks/{eventId}` in its own Firestore.
+- **Idempotent handlers** — re-processing the same event (provider retry or re-fan) produces the same end state, so no dedup ledger is needed.
 - **No new schema** — no need for the parent to maintain a brand → publication map; each child filters on its own.
 
 ### Why self IS in the fan-out

package/docs/testing.md

@@ -19,7 +19,7 @@ What the runner wipes pre-test (in [src/test/test-accounts.js](../src/test/test-
 
 1. **`meta/stats`** doc ensured (required for on-create batch writes).
 2. **`users/_test-*`** Firebase Auth users + Firestore docs (delete).
-3. **Mixed Firestore collections** — `payments-orders`, `payments-webhooks`, `payments-intents`, `payments-disputes`, `marketing-webhooks`. Two-pass cleanup per collection:
+3. **Mixed Firestore collections** — `payments-orders`, `payments-webhooks`, `payments-intents`, `payments-disputes`. Two-pass cleanup per collection:
    - Pass 1 — owner-keyed: `where('owner', 'in', [...testUids])` (batched at 30 uids per `in` query).
    - Pass 2 — id-keyed: any doc whose ID starts with `_test-` (catches ownerless test docs like dispute alerts and raw test webhooks).
 4. **Test-only Firestore collections** — `_test`, `_test_query` — wiped in full.
@@ -52,6 +52,8 @@ The rule: **never put cleanup at the END of a test file or suite for the purpose
 
 Several routes/handlers skip external API calls (SendGrid, Beehiiv, Stripe webhooks, dispute handlers, marketing libraries) when `process.env.TEST_EXTENDED_MODE` is unset, so unit tests don't fire real emails or webhook side effects. Set the flag to opt **in** to those side effects for a full end-to-end run.
 
+The marketing library gates at the SSOT level: `Marketing.add()`, `Marketing.sync()`, and `Marketing.remove()` each short-circuit with `if (assistant.isTesting() && !process.env.TEST_EXTENDED_MODE) return {}` before touching any provider. Callers (auth `onDelete`, webhook processors, contact-delete route) inherit the gate for free — do NOT rely on a per-caller guard for provider safety; add the gate to the library method itself when introducing a new provider-touching method.
+
 **Live sync — no env coordination across terminals.** The flag flows automatically from the test command to the running emulator via a small shared state file at `<projectRoot>/.temp/test-mode.json`. The test command writes the file pre-flight; the emulator's function workers watch it via `fs.watch` and mutate their own `process.env.TEST_EXTENDED_MODE` in place. Effect: you only need to set the flag on **the test command**. The emulator follows.
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.2.12",
+  "version": "5.2.14",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.152",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.153",
     "@anthropic-ai/sdk": "^0.99.0",
     "@firebase/rules-unit-testing": "^5.0.1",
     "@google-cloud/firestore": "^7.11.6",
@@ -86,7 +86,7 @@
     "pushid": "^1.0.0",
     "sanitize-html": "^2.17.4",
     "sharp": "^0.34.5",
-    "stripe": "^22.1.1",
+    "stripe": "^22.2.0",
     "uid-generator": "^2.0.0",
     "uuid": "^14.0.0",
     "wonderful-fetch": "^2.0.5",

package/src/cli/commands/base-command.js

@@ -130,10 +130,25 @@ class BaseCommand {
       }
     }
 
-    const shouldKill = await confirm({
-      message: 'Kill these processes to free the ports?',
-      default: true,
-    });
+    // Auto-confirm (Y) after a few seconds of no input so unattended test/dev loops don't
+    // hang. When the timeout fires the prompt is aborted via AbortSignal and we fall back to
+    // the default (true). inquirer owns the cursor and can't live-update its own message, so
+    // the countdown is shown statically in the prompt.
+    const AUTO_CONFIRM_SECONDS = 5;
+    let shouldKill;
+    try {
+      shouldKill = await confirm(
+        { message: `Kill these processes to free the ports? (auto-Y in ${AUTO_CONFIRM_SECONDS}s)`, default: true },
+        { signal: AbortSignal.timeout(AUTO_CONFIRM_SECONDS * 1000) },
+      );
+    } catch (error) {
+      // AbortPromptError (timeout reached) → take the default (true). Re-throw anything else.
+      if (error?.name !== 'AbortPromptError') {
+        throw error;
+      }
+      this.log(chalk.gray('  No input — auto-confirming (Y).'));
+      shouldKill = true;
+    }
 
     if (!shouldKill) {
       this.log(chalk.gray('\n  Aborting. Free the ports and try again.\n'));

package/src/manager/events/auth/on-create.js

@@ -72,6 +72,18 @@ module.exports = async ({ Manager, assistant, user, context, libraries }) => {
   const meta = Manager.Metadata().set({ tag: 'auth:on-create' });
   userRecord.metadata = { ...userRecord.metadata, ...meta };
 
+  // Stamp metadata.created from Firebase Auth's creationTime (the canonical account-creation
+  // moment) rather than the User schema's "now" — otherwise the doc lands a beat after Auth,
+  // and the OMEGA user migration reconciles every new signup against Auth on its next run.
+  const creationTime = user.metadata?.creationTime;
+  if (creationTime) {
+    const createdDate = new Date(creationTime);
+    userRecord.metadata.created = {
+      timestamp: createdDate.toISOString(),
+      timestampUNIX: Math.round(createdDate.getTime() / 1000),
+    };
+  }
+
   assistant.log(`onCreate: Creating user doc for ${user.uid}`, userRecord);
 
   // Write user doc with retry

package/src/manager/libraries/ai/providers/claude-code.js

@@ -1,30 +1,40 @@
 /**
- * Claude Code provider — uses @anthropic-ai/claude-agent-sdk to call Claude via
- * the local user's Claude Code subscription (no API key, no Anthropic credits).
+ * Claude Code provider — calls Claude over plain HTTPS using a Claude Code /
+ * Claude Pro/Max OAuth token (NOT API credits).
  *
- * Pass `forceLoginMethod: 'claudeai'` so the SDK auths via the OS keychain
- * OAuth session that the user already logged into via the `claude` CLI.
+ * Unlike the Anthropic provider (which authenticates with an x-api-key and bills
+ * API credits), this provider sends the OAuth token as `Authorization: Bearer ...`
+ * plus the `anthropic-beta: oauth-2025-04-20` header, so usage bills against the
+ * Claude subscription tied to the token.
  *
- * This is strictly a local-development provider:
- *   - Requires a logged-in Claude Code session on the host machine
- *   - Will not work in Cloud Functions / CI / production
- *   - Subject to your Claude Pro/Max rate limits (not API-tier limits)
+ * Token resolution (first match wins):
+ *   1. explicit key passed to the constructor / options.apiKey
+ *   2. Manager config: config.claude_code.oauth_token
+ *   3. process.env.CLAUDE_CODE_OAUTH_TOKEN  (from `claude setup-token`)
  *
- * Returns the same { content, output, tokens, raw } shape as the other providers
- * so callers don't care which is in use.
+ * This is pure HTTPS — no `claude` binary, no subprocess — so it runs in Cloud
+ * Functions / CI / anywhere Node runs. It is subject to the token's subscription
+ * rate limits (not API-tier limits).
+ *
+ * The OAuth token is minted with `claude setup-token` (valid ~1 year). When it
+ * expires (requests 401), re-mint and update the CLAUDE_CODE_OAUTH_TOKEN secret.
+ * NOTE: the Bearer/beta subscription path is undocumented and may change.
+ *
+ * Returns the same { content, output, tokens, raw } shape as the other providers.
  */
-const DEFAULT_MODEL = 'claude-opus-4-7';
-
-// Lazy import — only load the SDK if this provider is actually used
-let _query;
-
-function loadQuery() {
-  if (!_query) {
-    _query = require('@anthropic-ai/claude-agent-sdk').query;
-  }
+const _ = require('lodash');
+const JSON5 = require('json5');
 
-  return _query;
-}
+const DEFAULT_MODEL = 'claude-opus-4-7';
+const OAUTH_BETA = 'oauth-2025-04-20';
+
+// Pricing per 1M tokens (USD) — informational only; subscription billing is flat.
+const MODEL_TABLE = {
+  'claude-opus-4-7':   { input: 15.00, output: 75.00 },
+  'claude-opus-4-6':   { input: 15.00, output: 75.00 },
+  'claude-sonnet-4-6': { input: 3.00,  output: 15.00 },
+  'claude-haiku-4-5':  { input: 1.00,  output: 5.00  },
+};
 
 function ClaudeCode(assistant, key) {
   const self = this;
@@ -32,7 +42,9 @@ function ClaudeCode(assistant, key) {
   self.assistant = assistant;
   self.Manager = assistant?.Manager;
   self.user = assistant?.user;
-  // key is ignored — claude-code uses OS keychain OAuth via forceLoginMethod: 'claudeai'
+  self.token = key
+    || self.Manager?.config?.claude_code?.oauth_token
+    || process.env.CLAUDE_CODE_OAUTH_TOKEN;
 
   self.tokens = {
     total:  { count: 0, price: 0 },
@@ -47,121 +59,110 @@ ClaudeCode.prototype.request = async function (options) {
   const self = this;
   const assistant = self.assistant;
 
-  options = options || {};
-  const model = options.model || DEFAULT_MODEL;
+  options = _.merge({}, options);
+  options.model = options.model || DEFAULT_MODEL;
+  options.maxTokens = options.maxTokens || 2048;
+  options.temperature = typeof options.temperature === 'undefined' ? 0.7 : options.temperature;
 
-  // Build prompt + system from the unified options shape
-  const { system, prompt } = extractPromptAndSystem(options);
+  const token = options.apiKey || self.token;
 
-  if (!prompt) {
-    throw new Error('claude-code provider requires options.message.content or options.messages with a user turn');
+  if (!token) {
+    throw new Error('claude-code provider requires a Claude OAuth token (set CLAUDE_CODE_OAUTH_TOKEN via `claude setup-token`)');
   }
 
-  const query = loadQuery();
-  const startTime = Date.now();
+  // Lazy-require the SDK so projects that don't use this provider don't need it.
+  // We use the SDK purely as an HTTP client — `authToken` makes it send
+  // `Authorization: Bearer <token>` instead of `x-api-key`, and the beta header
+  // selects the subscription (OAuth) billing path. No `claude` binary involved.
+  const SDK = require('@anthropic-ai/sdk');
+  const client = new SDK({
+    authToken: token,
+    defaultHeaders: { 'anthropic-beta': OAUTH_BETA },
+  });
 
-  // Build SDK options
-  const sdkOptions = {
-    model,
-    forceLoginMethod: 'claudeai',  // Use Claude Pro/Max subscription, not API key
-    allowedTools: [],               // Disable all built-in tools — we just want text/JSON in/out
-    settingSources: [],             // Don't load .claude/ or ~/.claude/ settings
-    includePartialMessages: false,
+  const { system, messages } = buildMessages(options);
+
+  let systemFinal = system;
+
+  if (options.response === 'json') {
+    systemFinal = `${systemFinal || ''}\n\nYou MUST respond with valid JSON only. No prose, no markdown fences, no explanation — just the JSON object.${options.schema ? `\n\nThe JSON must conform to this schema:\n${JSON.stringify(options.schema)}` : ''}`.trim();
+  }
+
+  const requestBody = {
+    model: options.model,
+    max_tokens: options.maxTokens,
+    messages,
   };
 
-  if (system) {
-    sdkOptions.systemPrompt = system;
+  if (systemFinal) {
+    requestBody.system = systemFinal;
   }
 
-  if (options.response === 'json' && options.schema) {
-    sdkOptions.outputFormat = {
-      type: 'json_schema',
-      schema: options.schema,
-    };
+  if (options.temperature !== undefined) {
+    requestBody.temperature = options.temperature;
   }
 
-  let resultText = '';
-  let structuredOutput = null;
-  let usage = null;
-  let totalCostUSD = 0;
+  let raw;
 
   try {
-    for await (const message of query({ prompt, options: sdkOptions })) {
-      // Collect text from assistant messages
-      if (message.type === 'assistant') {
-        for (const block of message.message?.content || []) {
-          if (block.type === 'text') {
-            resultText += block.text;
-          }
-        }
-      }
-
-      // Capture final result + usage from the result message
-      if (message.type === 'result') {
-        if (message.subtype === 'success') {
-          structuredOutput = message.structured_output || null;
-          resultText = message.result || resultText;
-        }
-
-        usage = message.usage;
-        totalCostUSD = message.total_cost_usd || 0;
-
-        if (message.is_error) {
-          throw new Error(`claude-code: ${resultText || 'unknown error'}`);
-        }
-      }
-    }
+    raw = await client.messages.create(requestBody);
   } catch (e) {
-    assistant?.error?.(`claude-code request failed: ${e.message}`);
+    assistant?.error?.(`claude-code request failed: ${e.message}`, e);
     throw e;
   }
 
-  // Update token counters
-  if (usage) {
-    self.tokens.input.count  += usage.input_tokens  || 0;
-    self.tokens.output.count += usage.output_tokens || 0;
-    self.tokens.total.count   = self.tokens.input.count + self.tokens.output.count;
-    self.tokens.total.price   = totalCostUSD;
-  }
+  const outputText = (raw.content || [])
+    .filter((c) => c.type === 'text')
+    .map((c) => c.text.trim())
+    .join('\n')
+    .trim();
 
-  // Resolve content — prefer structured_output (validated against schema)
-  let content;
+  const modelConfig = MODEL_TABLE[options.model] || MODEL_TABLE[DEFAULT_MODEL];
 
-  if (structuredOutput != null) {
-    content = structuredOutput;
-  } else if (options.response === 'json') {
-    content = parseJsonLoose(resultText);
-  } else {
-    content = resultText;
-  }
+  self.tokens.input.count  += raw.usage?.input_tokens || 0;
+  self.tokens.output.count += raw.usage?.output_tokens || 0;
+  self.tokens.total.count   = self.tokens.input.count + self.tokens.output.count;
+  self.tokens.input.price   = (self.tokens.input.count * modelConfig.input) / 1_000_000;
+  self.tokens.output.price  = (self.tokens.output.count * modelConfig.output) / 1_000_000;
+  self.tokens.total.price   = self.tokens.input.price + self.tokens.output.price;
+
+  let parsed = outputText;
 
-  assistant?.log?.(`claude-code: ${Date.now() - startTime}ms, ${usage?.output_tokens || 0} output tokens, $${totalCostUSD?.toFixed(4) || '0.0000'}`);
+  if (options.response === 'json') {
+    parsed = parseJsonLoose(outputText);
+  }
 
   return {
-    output: [{ type: 'output_text', text: resultText }],
-    content,
+    output: raw.content || [],
+    content: parsed,
     tokens: self.tokens,
-    raw: { usage, totalCostUSD },
+    raw,
   };
 };
 
 /**
- * Map unified options into a system prompt + a single user prompt string.
+ * Build Anthropic system + messages from the unified option shape.
+ *
+ * Accepts either:
+ *   - options.messages: [{ role: 'system'|'user'|'assistant', content: string }]
+ *   - options.prompt.content (system) + options.message.content (user)
  */
-function extractPromptAndSystem(options) {
+function buildMessages(options) {
   if (Array.isArray(options.messages) && options.messages.length) {
     const system = options.messages.find((m) => m.role === 'system')?.content;
-    const lastUser = [...options.messages].reverse().find((m) => m.role !== 'system');
+    const messages = options.messages
+      .filter((m) => m.role !== 'system')
+      .map((m) => ({ role: m.role, content: stringifyContent(m.content) }));
 
-    return {
-      system: stringifyContent(system),
-      prompt: stringifyContent(lastUser?.content),
-    };
+    return { system: stringifyContent(system), messages };
   }
 
+  const system = stringifyContent(options.prompt?.content || '');
+  const userContent = stringifyContent(options.message?.content || '');
+
   return {
-    system: stringifyContent(options.prompt?.content),
-    prompt: stringifyContent(options.message?.content),
+    system,
+    messages: [{ role: 'user', content: userContent }],
   };
 }
 
@@ -185,19 +186,22 @@ function stringifyContent(content) {
 }
 
 function parseJsonLoose(text) {
-  if (!text) return text;
+  let cleaned = (text || '').trim();
+
+  cleaned = cleaned.replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/i, '');
 
-  let cleaned = text.trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/i, '');
-  const firstObj = cleaned.indexOf('{');
-  const firstArr = cleaned.indexOf('[');
-  const start = [firstObj, firstArr].filter((i) => i >= 0).sort((a, b) => a - b)[0];
+  const candidates = [cleaned.indexOf('{'), cleaned.indexOf('[')].filter((i) => i >= 0);
 
-  if (start > 0) {
-    cleaned = cleaned.slice(start);
+  if (candidates.length) {
+    const firstBrace = Math.min(...candidates);
+
+    if (firstBrace > 0) {
+      cleaned = cleaned.slice(firstBrace);
+    }
   }
 
   try {
-    return JSON.parse(cleaned);
+    return JSON5.parse(cleaned);
   } catch {
     return text;
   }

package/src/manager/libraries/email/data/disposable-domains.json

@@ -120,6 +120,7 @@
   "24mail.top",
   "25u.com",
   "2anom.com",
+  "2bd.net",
   "2chmail.net",
   "2ether.net",
   "2fdgdfgdfgdf.tk",
@@ -335,6 +336,7 @@
   "air2token.com",
   "airmailbox.website",
   "airsworld.net",
+  "aisubpro.click",
   "aiworldx.com",
   "aixnv.com",
   "ajaxapp.net",
@@ -1183,6 +1185,7 @@
   "dim-coin.com",
   "dimalk.com",
   "dingbone.com",
+  "dino.icu",
   "diolang.com",
   "directmail24.net",
   "dis.hopto.org",
@@ -2054,6 +2057,7 @@
   "gowikitv.com",
   "grandmamail.com",
   "grandmasmail.com",
+  "graphicenda.site",
   "grassdev.com",
   "gravityengine.cc",
   "great-host.in",
@@ -2709,6 +2713,7 @@
   "laste.ml",
   "lastmail.co",
   "lastmail.com",
+  "launders.money",
   "lawlita.com",
   "laxex.ru",
   "laxex.store",
@@ -2757,11 +2762,13 @@
   "link2mail.net",
   "linkedintuts2016.pw",
   "linkmail.info",
+  "linkpc.net",
   "linlshe.com",
   "linshiyou.com",
   "linshiyouxiang.net",
   "linuxmail.so",
   "liocbrco.com",
+  "liopsacac.shop",
   "lista.cc",
   "litedrop.com",
   "liveradio.tk",
@@ -3418,6 +3425,7 @@
   "newfilm24.ru",
   "newideasfornewpeople.info",
   "newmail.top",
+  "newmano.store",
   "newyork.io.vn",
   "next.ovh",
   "nextmail.info",
@@ -3498,6 +3506,7 @@
   "nospam4.us",
   "nospamfor.us",
   "nospamthanks.info",
+  "nosubcriber.shop",
   "notboxletters.com",
   "nothingtoseehere.ca",
   "notif.me",
@@ -3697,6 +3706,7 @@
   "payspun.com",
   "pazard.com",
   "pazuric.com",
+  "pbhak.dev",
   "pckage.com",
   "pdf-cutter.com",
   "pe.hu",
@@ -3957,6 +3967,7 @@
   "rapidefr.fr.nf",
   "rapt.be",
   "raqid.com",
+  "ravavo.bond",
   "rawr.foo",
   "rax.la",
   "raxtest.com",
@@ -5114,6 +5125,7 @@
   "vuket.org",
   "vulca.sbs",
   "vusra.com",
+  "vutrugay.org",
   "vvatxiy.com",
   "vwhins.com",
   "vxsolar.com",
@@ -5243,6 +5255,7 @@
   "womp-wo.mp",
   "woofidog.fr.nf",
   "woopros.com",
+  "work.gd",
   "workingtall.com",
   "worldlylife.store",
   "worldspace.link",

package/src/manager/libraries/email/marketing/index.js

@@ -230,6 +230,11 @@ Marketing.prototype.remove = async function (email) {
     return {};
   }
 
+  if (assistant.isTesting() && !process.env.TEST_EXTENDED_MODE) {
+    assistant.log('Marketing.remove(): Skipping providers (testing mode)');
+    return {};
+  }
+
   assistant.log('Marketing.remove():', { email });
 
   const results = {};

package/src/manager/libraries/infer-contact.js

@@ -26,9 +26,9 @@ async function inferContact(email, assistant) {
     if (aiResult) {
       return aiResult;
     }
-    assistant.log(`inferContact: AI returned null for ${email} — falling back to empty result`);
+    assistant?.log(`inferContact: AI returned null for ${email} — falling back to empty result`);
   } else {
-    assistant.log(`inferContact: BACKEND_MANAGER_OPENAI_API_KEY not set — skipping AI inference for ${email}`);
+    assistant?.log(`inferContact: BACKEND_MANAGER_OPENAI_API_KEY not set — skipping AI inference for ${email}`);
   }
 
   return { firstName: '', lastName: '', company: '', confidence: 0, method: 'none' };
@@ -68,14 +68,14 @@ async function inferContactWithAI(email, assistant) {
         method: 'ai',
       };
       if (!inferred.firstName && !inferred.lastName && !inferred.company) {
-        assistant.log(`inferContactWithAI: AI parsed response had ALL fields empty for ${email}. Raw:`, parsed);
+        assistant?.log(`inferContactWithAI: AI parsed response had ALL fields empty for ${email}. Raw:`, parsed);
       }
       return inferred;
     }
 
-    assistant.log(`inferContactWithAI: AI response missing firstName for ${email}. Raw result:`, result);
+    assistant?.log(`inferContactWithAI: AI response missing firstName for ${email}. Raw result:`, result);
   } catch (e) {
-    assistant.error('inferContactWithAI: Failed:', e);
+    assistant?.error('inferContactWithAI: Failed:', e);
   }
 
   return null;

package/src/manager/routes/marketing/webhook/post.js

@@ -6,7 +6,7 @@
  *   2. Optionally rejects mismatched brand via ?brand= filter
  *   3. Loads the matching processor module from ./processors/{provider}.js
  *   4. Parses the webhook payload into one or more normalized events
- *   5. For each event: idempotency check via marketing-webhooks/{eventId}, then dispatch
+ *   5. For each supported event: dispatch to the processor's handler
  *   6. Returns 200 immediately so the provider doesn't retry
  *
  * Each processor module defines:
@@ -14,15 +14,13 @@
  *   - isSupported(type)   — returns true if this event should be processed
  *   - handleEvent(ctx)    — does the work for one event (user doc + cross-provider sync)
  *
- * Mirrors the existing payments-webhook pattern. Processes events inline rather than
- * via a Firestore trigger — marketing webhooks are lower volume and lighter work than
- * payments, so the extra async layer isn't justified.
+ * No idempotency ledger: every supported handler (revoke consent + cross-provider
+ * remove) is naturally idempotent — re-processing a provider retry produces the same
+ * end state with no extra side effects, so duplicate suppression buys nothing.
  */
 const path = require('path');
-const powertools = require('node-powertools');
 
-module.exports = async ({ assistant, Manager, libraries }) => {
-  const { admin } = libraries;
+module.exports = async ({ assistant, Manager }) => {
   const query = assistant.request.query;
 
   const provider = query.provider;
@@ -78,7 +76,7 @@ module.exports = async ({ assistant, Manager, libraries }) => {
   // Use Promise.allSettled so we return success only after all events have been
   // attempted.
   const results = await Promise.allSettled(
-    events.map((event) => processOneEvent({ Manager, assistant, admin, provider, event, processorModule }))
+    events.map((event) => processOneEvent({ Manager, assistant, provider, event, processorModule }))
   );
 
   let processed = 0;
@@ -100,81 +98,23 @@ module.exports = async ({ assistant, Manager, libraries }) => {
 };
 
 /**
- * Process a single event end-to-end: idempotency check, support check, dispatch to handler.
+ * Process a single event: support check, then dispatch to the processor's handler.
+ * Handlers are idempotent, so provider retries re-run safely with no dedup ledger.
  * Returns { processed: bool, skipped?: string, error?: any }.
  */
-async function processOneEvent({ Manager, assistant, admin, provider, event, processorModule }) {
-  const { eventId, eventType } = event;
-
-  // No eventId means we can't dedupe — skip rather than risk double-processing
-  if (!eventId) {
-    assistant.log(`marketing webhook: ${provider} event missing eventId (type=${eventType}), skipping`);
-    return { processed: false, skipped: 'missing-event-id' };
-  }
+async function processOneEvent({ Manager, assistant, provider, event, processorModule }) {
+  const { eventType } = event;
 
   // Filter by supported event types
   if (processorModule.isSupported && !processorModule.isSupported(eventType)) {
     return { processed: false, skipped: 'unsupported-event-type' };
   }
 
-  // Idempotency: skip if we've already processed this event
-  const idempotencyRef = admin.firestore().doc(`marketing-webhooks/${eventId}`);
-  const existingDoc = await idempotencyRef.get();
-
-  if (existingDoc.exists) {
-    const existingStatus = existingDoc.data()?.status;
-    if (existingStatus !== 'failed') {
-      assistant.log(`marketing webhook: ${provider} duplicate event ${eventId} (status=${existingStatus}), skipping`);
-      return { processed: false, skipped: 'duplicate' };
-    }
-    assistant.log(`marketing webhook: ${provider} retrying previously failed event ${eventId}`);
-  }
-
-  // Build the audit doc
-  const now = powertools.timestamp(new Date(), { output: 'string' });
-  const nowUNIX = powertools.timestamp(now, { output: 'unix' });
-
-  // Write 'pending' state before dispatching so concurrent deliveries see the lock
-  await idempotencyRef.set({
-    id: eventId,
-    provider,
-    status: 'pending',
-    raw: event.raw || null,
-    event: {
-      type: eventType,
-      email: event.email || null,
-      timestamp: event.timestamp || null,
-    },
-    error: null,
-    metadata: {
-      created: { timestamp: now, timestampUNIX: nowUNIX },
-      completed: { timestamp: null, timestampUNIX: null },
-    },
-  });
-
-  // Dispatch to the processor's event handler
-  let handlerResult;
   try {
-    handlerResult = await processorModule.handleEvent({ Manager, assistant, parsed: event });
-
-    // Mark completed
-    await idempotencyRef.set({
-      status: 'completed',
-      result: handlerResult || null,
-      metadata: {
-        completed: { timestamp: powertools.timestamp(new Date(), { output: 'string' }), timestampUNIX: powertools.timestamp(new Date(), { output: 'unix' }) },
-      },
-    }, { merge: true });
-
+    await processorModule.handleEvent({ Manager, assistant, parsed: event });
     return { processed: true };
   } catch (e) {
-    assistant.error(`marketing webhook: handler failed for ${provider} event ${eventId}:`, e);
-
-    await idempotencyRef.set({
-      status: 'failed',
-      error: { message: e.message || String(e), stack: e.stack || null },
-    }, { merge: true }).catch(() => {});
-
+    assistant.error(`marketing webhook: handler failed for ${provider} event ${event.eventId} (${eventType}):`, e);
     return { processed: false, error: e };
   }
 }

package/src/manager/routes/marketing/webhook/processors/beehiiv.js

@@ -19,7 +19,8 @@
  *   - getPublicationId() reads from config.marketing.beehiiv.publicationId
  *     or fuzzy-matches by brand name against the Beehiiv API.
  *
- * Idempotency is enforced by the dispatcher via marketing-webhooks/{eventId} doc.
+ * No idempotency ledger — the revoke + cross-provider remove are idempotent, so a
+ * provider retry re-runs safely with the same end state.
  */
 
 const REVOKE_EVENT_TYPES = new Set([
@@ -85,7 +86,7 @@ function isSupported(eventType) {
 }
 
 /**
- * Process a single parsed event. Called by the dispatcher AFTER idempotency check passes.
+ * Process a single parsed event. Called by the dispatcher for each supported event.
  * Returns a result object summarizing what happened.
  */
 async function handleEvent({ Manager, assistant, parsed }) {

package/src/manager/routes/marketing/webhook/processors/sendgrid.js

@@ -19,7 +19,8 @@
  * GROUPS.marketing (25928) is account-global across all brands, an unsub from group 25928
  * legitimately removes the user from marketing across the entire SendGrid account.
  *
- * Idempotency is enforced by the dispatcher via marketing-webhooks/{eventId} doc.
+ * No idempotency ledger — the revoke + cross-provider remove are idempotent, so a
+ * provider retry re-runs safely with the same end state.
  */
 
 const REVOKE_EVENT_TYPES = new Set([
@@ -61,7 +62,7 @@ function parseWebhook(req) {
   }
 
   return events.map((event) => {
-    // sg_event_id is SendGrid's per-event unique ID, used for idempotency.
+    // sg_event_id is SendGrid's per-event unique ID, retained for log context.
     // smtp-id is another stable identifier we fall back to.
     const eventId = event.sg_event_id || event['smtp-id'] || event.smtpId || null;
     const eventType = event.event;
@@ -88,7 +89,7 @@ function isSupported(eventType) {
 }
 
 /**
- * Process a single parsed event. Called by the dispatcher AFTER idempotency check passes.
+ * Process a single parsed event. Called by the dispatcher for each supported event.
  *
  * Returns a result object summarizing what happened (for logging/response).
  */

package/src/manager/routes/user/signup/post.js

@@ -4,14 +4,13 @@ const { validate: validateEmail, isDisposable } = require('../../../libraries/em
 
 const MAX_POLL_TIME_MS = 30000;
 const POLL_INTERVAL_MS = 500;
-const MAX_ACCOUNT_AGE_MS = 5 * 60 * 1000; // 5 minutes
 
 /**
  * POST /user/signup - Complete user signup
  *
  * Called by client after account creation to:
  * 1. Poll for user doc to exist (waits for onCreate to complete)
- * 2. Validate (already processed, account age)
+ * 2. Validate (reject only if flags.signupProcessed is already true)
  * 3. Gather all data (client details, inferred contact)
  * 4. Write everything to user doc in one merge
  * 5. Process affiliate referral (writes to referrer's doc)
@@ -49,23 +48,20 @@ module.exports = async ({ assistant, user, settings, libraries }) => {
     return assistant.respond('Signup has already been processed', { code: 400 });
   }
 
-  // 3. Backup check: reject if account is older than 5 minutes
+  // 3. Fetch the Auth user — needed for the canonical creationTime used to stamp
+  //    metadata.created and consent timestamps. flags.signupProcessed (checked above) is
+  //    the sole idempotency gate; there is intentionally no account-age window, so a
+  //    legitimately-unprocessed account can complete signup whenever it retries.
   const authUser = await admin.auth().getUser(uid).catch((e) => e);
 
   if (authUser instanceof Error) {
     return assistant.respond(`Failed to get auth user: ${authUser.message}`, { code: 500 });
   }
 
-  const accountAgeMs = Date.now() - new Date(authUser.metadata.creationTime).getTime();
-
-  if (accountAgeMs > MAX_ACCOUNT_AGE_MS) {
-    return assistant.respond('Account is too old to process signup', { code: 400 });
-  }
-
   // 4. Gather all data, then write once
   const email = user.auth.email;
   const inferred = await inferUserContact(assistant, email);
-  const userRecord = buildUserRecord(assistant, settings, inferred);
+  const userRecord = buildUserRecord(assistant, settings, inferred, authUser.metadata.creationTime);
 
   assistant.log(`signup(): Writing user record for ${uid}`, userRecord);
 
@@ -117,7 +113,7 @@ async function pollForUserDoc(assistant, uid) {
 /**
  * Build the full user record: client details, attribution, and inferred contact
  */
-function buildUserRecord(assistant, settings, inferred) {
+function buildUserRecord(assistant, settings, inferred, creationTime) {
   const Manager = assistant.Manager;
   const attribution = settings.attribution;
 
@@ -142,10 +138,22 @@ function buildUserRecord(assistant, settings, inferred) {
       },
     },
     attribution: attribution || {},
-    consent: buildConsentRecord(assistant, settings.consent),
+    consent: buildConsentRecord(assistant, settings.consent, creationTime),
     metadata: Manager.Metadata().set({ tag: 'user/signup' }),
   };
 
+  // Stamp metadata.created from Firebase Auth's creationTime so it matches Auth's canonical
+  // value. Normally onCreate sets this, but if onCreate didn't fire this merge write is the
+  // doc's first creation — without this the doc lands with no created date and the OMEGA
+  // migration has to backfill it. Idempotent: when onCreate already wrote it, this matches.
+  if (creationTime) {
+    const createdDate = new Date(creationTime);
+    record.metadata.created = {
+      timestamp: createdDate.toISOString(),
+      timestampUNIX: Math.round(createdDate.getTime() / 1000),
+    };
+  }
+
   // Add inferred name/company if available
   if (inferred) {
     record.personal = {
@@ -168,18 +176,24 @@ function buildUserRecord(assistant, settings, inferred) {
  * Client sends: { legal: { granted, text }, marketing: { granted, text } }
  * Server writes: { legal: { status, grantedAt: {...} }, marketing: { status, grantedAt: {...}, revokedAt: {...} } }
  *
- * Server time (not client-supplied) is authoritative — defends against clock manipulation.
+ * Server-derived time (not client-supplied) is authoritative — defends against clock
+ * manipulation. Uses Auth's creationTime so consent timestamps match metadata.created.
  * IP is captured from request geolocation.
  *
  * Legal is REQUIRED — the client must send legal.granted=true. If missing/false we still
  * record what the client sent, but the route will not have reached this point in practice
  * (the signup-form HTML5-requires the legal checkbox).
  */
-function buildConsentRecord(assistant, clientConsent) {
+function buildConsentRecord(assistant, clientConsent, creationTime) {
   const consent = clientConsent || {};
   const ip = assistant.request.geolocation?.ip || null;
-  const timestamp = assistant.meta.startTime.timestamp;
-  const timestampUNIX = assistant.meta.startTime.timestampUNIX;
+
+  // Stamp grantedAt/revokedAt from Auth's creationTime so consent timestamps match
+  // metadata.created (the OMEGA migration treats metadata.created as the SSOT and reconciles
+  // consent.grantedAt against it). Fall back to request start time if creationTime is absent.
+  const createdDate = creationTime ? new Date(creationTime) : null;
+  const timestamp = createdDate ? createdDate.toISOString() : assistant.meta.startTime.timestamp;
+  const timestampUNIX = createdDate ? Math.round(createdDate.getTime() / 1000) : assistant.meta.startTime.timestampUNIX;
 
   // Build empty leaf shape — used wherever grantedAt or revokedAt is "not set"
   const emptyMeta = { timestamp: null, timestampUNIX: null, source: null, ip: null, text: null };

package/src/test/test-accounts.js

@@ -694,7 +694,7 @@ async function deleteTestUsers(admin) {
   // identified solely by an `_test-` doc id prefix (id-keyed). All must be wiped
   // at the start of every run so a test that died mid-execution leaves no
   // ghosts. New collections that participate in tests MUST be added here too.
-  const testDataCollections = ['payments-orders', 'payments-webhooks', 'payments-intents', 'payments-disputes', 'marketing-webhooks'];
+  const testDataCollections = ['payments-orders', 'payments-webhooks', 'payments-intents', 'payments-disputes'];
   // Collections that exist solely for tests — wipe in full. All docs in these
   // collections come from tests, so a single recursive delete handles cleanup.
   const testOnlyCollections = ['_test', '_test_query'];

package/templates/_.env

@@ -9,11 +9,10 @@ BACKEND_MANAGER_ANTHROPIC_API_KEY=""
 # GitHub
 GITHUB_TOKEN=""
 
-# OpenAI
+# AI
 OPENAI_API_KEY=""
-
-# Anthropic
 ANTHROPIC_API_KEY=""
+CLAUDE_CODE_OAUTH_TOKEN=""
 
 # Payment Processors
 PAYPAL_CLIENT_SECRET=""

package/test/routes/marketing/webhook.js

@@ -8,7 +8,7 @@
  *   - Auth via ?key= query param
  *   - Provider validation
  *   - Brand filter (ignore mismatched brand)
- *   - Idempotency via marketing-webhooks/{eventId} doc
+ *   - Idempotent re-delivery (handlers re-run safely; no dedup ledger)
  *
  * SendGrid processor tests:
  *   - Various event types (group_unsubscribe, unsubscribe, spamreport, bounce, dropped)
@@ -120,12 +120,6 @@ module.exports = {
         assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'marketing.status should be revoked');
         assert.equal(userDoc?.consent?.marketing?.revokedAt?.source, 'sendgrid', 'revokedAt.source should be sendgrid');
         assert.equal(userDoc?.consent?.marketing?.revokedAt?.timestampUNIX, eventTimestamp, 'revokedAt.timestampUNIX should match event timestamp');
-
-        // Idempotency doc should exist with status=completed
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.ok(webhookDoc, 'Idempotency doc should exist');
-        assert.equal(webhookDoc?.status, 'completed', 'Idempotency doc should be marked completed');
-        assert.equal(webhookDoc?.provider, 'sendgrid', 'Idempotency doc should record provider');
       },
     },
 
@@ -244,9 +238,9 @@ module.exports = {
           [sgEvent({ id: eventId, type: 'group_unsubscribe', email: '_test.never-existed@example.com' })]
         );
 
-        // Dispatcher still processes the event (idempotency doc written, handler runs and returns
-        // handled:false). From the dispatcher's POV this counts as 'processed=1' since the handler
-        // didn't throw. The handler's internal "user-not-found" branch is silent by design.
+        // Dispatcher still runs the handler (which returns handled:false). From the
+        // dispatcher's POV this counts as 'processed=1' since the handler didn't throw.
+        // The handler's internal "user-not-found" branch is silent by design.
         assert.isSuccess(response, 'Should accept unknown-email gracefully');
         assert.propertyEquals(response, 'data.failed', 0, 'No failures for unknown email');
       },
@@ -277,28 +271,19 @@ module.exports = {
         assert.propertyEquals(response, 'data.processed', 2, '2 supported events should be processed');
         assert.propertyEquals(response, 'data.skipped', 1, '1 unsupported event should be skipped');
 
-        // Each processed event gets its own idempotency doc
-        const doc1 = await firestore.get(`marketing-webhooks/${e1}`);
-        const doc3 = await firestore.get(`marketing-webhooks/${e3}`);
-        assert.ok(doc1 && doc1.status === 'completed', 'First event idempotency doc completed');
-        assert.ok(doc3 && doc3.status === 'completed', 'Third event idempotency doc completed');
-
-        // The skipped event should NOT have an idempotency doc (we filter by isSupported before writing)
-        const doc2 = await firestore.get(`marketing-webhooks/${e2}`);
-        assert.ok(!doc2, 'Unsupported event should NOT have an idempotency doc');
-
         // User doc should be revoked
         const userDoc = await firestore.get(`users/${uid}`);
         assert.equal(userDoc?.consent?.marketing?.status, 'revoked');
       },
     },
 
-    // ─── Idempotency ───
+    // ─── Idempotent re-delivery (no dedup ledger) ───
 
     {
-      name: 'sendgrid-duplicate-event-skipped',
+      name: 'sendgrid-duplicate-event-reprocessed-idempotently',
       auth: 'none',
       async run({ http, firestore, assert, accounts }) {
+        const uid = accounts.basic.uid;
         const email = accounts.basic.email;
         const eventId = sgEventId('duplicate');
 
@@ -310,27 +295,27 @@ module.exports = {
         assert.isSuccess(response1);
         assert.propertyEquals(response1, 'data.processed', 1, 'First delivery should process');
 
-        // Second delivery — same eventId
+        // Second delivery — same eventId. With no dedup ledger the handler runs
+        // again, but the revoke is idempotent so the end state is unchanged.
         const response2 = await http.as('none').post(
           `marketing/webhook?provider=sendgrid&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`,
           [sgEvent({ id: eventId, type: 'group_unsubscribe', email })]
         );
         assert.isSuccess(response2);
-        assert.propertyEquals(response2, 'data.processed', 0, 'Duplicate should NOT reprocess');
-        assert.propertyEquals(response2, 'data.skipped', 1, 'Duplicate should be skipped');
+        assert.propertyEquals(response2, 'data.processed', 1, 'Re-delivery reprocesses (idempotent), not skipped');
 
-        // Idempotency doc should still be there and completed
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.equal(webhookDoc?.status, 'completed');
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'User remains revoked after re-delivery');
       },
     },
 
-    // ─── Missing event ID ───
+    // ─── Missing event ID — still processed (no dedup requirement) ───
 
     {
-      name: 'sendgrid-event-without-eventId-skipped',
+      name: 'sendgrid-event-without-eventId-processed',
       auth: 'none',
-      async run({ http, assert, accounts }) {
+      async run({ http, firestore, assert, accounts }) {
+        const uid = accounts.basic.uid;
         const email = accounts.basic.email;
 
         const response = await http.as('none').post(
@@ -339,8 +324,10 @@ module.exports = {
         );
 
         assert.isSuccess(response, 'Should accept the request');
-        assert.propertyEquals(response, 'data.processed', 0, 'Event without eventId cannot be deduped, so it is skipped');
-        assert.propertyEquals(response, 'data.skipped', 1, 'Event should be skipped');
+        assert.propertyEquals(response, 'data.processed', 1, 'Event without eventId is still processed (no dedup needed)');
+
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'User should be revoked');
       },
     },
 
@@ -351,14 +338,16 @@ module.exports = {
     {
       name: 'beehiiv-subscription-unsubscribed-writes-consent',
       auth: 'none',
-      async run({ http, firestore, assert, accounts, config }) {
+      async run({ http, firestore, assert, accounts, config, skip }) {
         const uid = accounts.basic.uid;
         const email = accounts.basic.email;
         const eventId = `_test-bh-unsub-${Date.now()}`;
         const eventISO = new Date().toISOString();
         const publicationId = config.marketing?.beehiiv?.publicationId;
 
-        assert.ok(publicationId, 'Test brand must have a Beehiiv publication ID configured');
+        if (!publicationId) {
+          return skip('No Beehiiv publication ID configured for this brand');
+        }
 
         const response = await http.as('none').post(
           `marketing/webhook?provider=beehiiv&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`,
@@ -378,12 +367,6 @@ module.exports = {
         assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'marketing.status should be revoked');
         assert.equal(userDoc?.consent?.marketing?.revokedAt?.source, 'beehiiv', 'revokedAt.source should be beehiiv');
         assert.ok(userDoc?.consent?.marketing?.revokedAt?.timestamp, 'revokedAt.timestamp should be set');
-
-        // Idempotency doc should exist
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.ok(webhookDoc, 'Idempotency doc should exist');
-        assert.equal(webhookDoc?.status, 'completed');
-        assert.equal(webhookDoc?.provider, 'beehiiv');
       },
     },
 
@@ -472,8 +455,8 @@ module.exports = {
         );
 
         // The dispatcher counts this as 'processed' from its POV (the handler
-        // ran without error and the idempotency doc was written), but the
-        // handler returned { handled: false, reason: 'publication-mismatch' }.
+        // ran without error), but the handler returned
+        // { handled: false, reason: 'publication-mismatch' }.
         // What matters: the user doc should NOT have been mutated.
         assert.isSuccess(response, 'Pub-mismatch event should be accepted gracefully');
 
@@ -542,13 +525,18 @@ module.exports = {
     },
 
     {
-      name: 'beehiiv-duplicate-event-skipped',
+      name: 'beehiiv-duplicate-event-reprocessed-idempotently',
       auth: 'none',
-      async run({ http, firestore, assert, accounts, config }) {
+      async run({ http, firestore, assert, accounts, config, skip }) {
+        const uid = accounts.basic.uid;
         const email = accounts.basic.email;
         const publicationId = config.marketing?.beehiiv?.publicationId;
         const eventId = `_test-bh-dup-${Date.now()}`;
 
+        if (!publicationId) {
+          return skip('No Beehiiv publication ID configured for this brand');
+        }
+
         const payload = {
           id: eventId,
           event: 'subscription.unsubscribed',
@@ -565,17 +553,17 @@ module.exports = {
         assert.isSuccess(r1);
         assert.propertyEquals(r1, 'data.processed', 1, 'First delivery should process');
 
-        // Second delivery — same id
+        // Second delivery — same id. No dedup ledger, so it reprocesses; the
+        // revoke is idempotent so the end state is unchanged.
         const r2 = await http.as('none').post(
           `marketing/webhook?provider=beehiiv&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`,
           payload
         );
         assert.isSuccess(r2);
-        assert.propertyEquals(r2, 'data.processed', 0, 'Duplicate should NOT reprocess');
-        assert.propertyEquals(r2, 'data.skipped', 1, 'Duplicate should be skipped');
+        assert.propertyEquals(r2, 'data.processed', 1, 'Re-delivery reprocesses (idempotent), not skipped');
 
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.equal(webhookDoc?.status, 'completed');
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'User remains revoked after re-delivery');
       },
     },
   ],

package/test/routes/user/signup.js

@@ -244,8 +244,6 @@ module.exports = {
         };
 
         // Use absurdly-old client timestamp to prove server time wins (defense vs clock skew)
-        const beforeMs = Date.now();
-
         const signupResponse = await http.as('consent-granted').post('user/signup', {
           consent: {
             legal: { granted: true, text: consentText.legal, timestamp: '2000-01-01T00:00:00.000Z' },
@@ -255,7 +253,6 @@ module.exports = {
 
         assert.isSuccess(signupResponse, `Signup should succeed: ${JSON.stringify(signupResponse, null, 2)}`);
 
-        const afterMs = Date.now();
         const userDoc = await firestore.get(`users/${accounts['consent-granted'].uid}`);
 
         // Legal
@@ -265,14 +262,16 @@ module.exports = {
         assert.ok(userDoc?.consent?.legal?.grantedAt?.timestamp, 'legal grantedAt.timestamp should be set');
         assert.equal(typeof userDoc?.consent?.legal?.grantedAt?.timestampUNIX, 'number', 'legal grantedAt.timestampUNIX should be number');
 
-        // Server time MUST be used (the client-supplied 2000-01-01 should NOT appear)
+        // Server-derived time MUST be used (the client-supplied 2000-01-01 should NOT appear).
+        // grantedAt is stamped from Auth's creationTime, the same source as metadata.created,
+        // so the two must be equal — and the client's 2000-01-01 (UNIX 946684800) is rejected.
         const legalUNIX = userDoc.consent.legal.grantedAt.timestampUNIX;
-        const beforeUNIX = Math.floor(beforeMs / 1000);
-        const afterUNIX = Math.floor(afterMs / 1000);
-        assert.ok(
-          legalUNIX >= beforeUNIX && legalUNIX <= afterUNIX,
-          `legal grantedAt.timestampUNIX (${legalUNIX}) must be server time, not client time. expected between ${beforeUNIX} and ${afterUNIX}`
+        const createdUNIX = userDoc.metadata.created.timestampUNIX;
+        assert.equal(
+          legalUNIX, createdUNIX,
+          `legal grantedAt.timestampUNIX (${legalUNIX}) should match metadata.created (${createdUNIX}) — both from Auth creationTime`
         );
+        assert.notEqual(legalUNIX, 946684800, 'legal grantedAt must NOT be the client-supplied 2000-01-01 time');
 
         // Marketing
         assert.equal(userDoc?.consent?.marketing?.status, 'granted', 'consent.marketing.status should be granted');