backend-manager 5.2.13 → 5.2.14

package/CHANGELOG.md

@@ -14,7 +14,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
-# [5.2.13] - 2026-05-28
+# [5.2.14] - 2026-05-28
 
 ### Removed
 
@@ -27,6 +27,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ### Changed
 
+- **Signup timestamps stamped from Firebase Auth `creationTime`.** Both write paths — the `onCreate` auth event (`src/manager/events/auth/on-create.js`) and the `user/signup` fallback route (`src/manager/routes/user/signup/post.js`) — now set `metadata.created` and `consent.{legal,marketing}.grantedAt`/`revokedAt` from `user.metadata.creationTime` instead of "now"/request-time. The OMEGA user migration treats Auth's `creationTime` as the SSOT and reconciles every doc against it; the prior few-seconds drift meant every new signup got re-fixed on the next migration run. Stamping from `creationTime` makes new docs match the migration's expected value exactly, ending the recurring churn.
+- **`user/signup`: `flags.signupProcessed` is the sole idempotency gate.** Removed the 5-minute account-age reject (`MAX_ACCOUNT_AGE_MS`). A genuinely-unprocessed account can now complete signup whenever it retries — fixes the failure where a slow/missing `onCreate` plus a retry after 5 minutes caused a legitimate signup to be rejected. The frontend (UJM) gate is being moved to the same doc flag in a parallel change.
+- **CLI: port-conflict prompt auto-confirms after 5s.** The "Kill these processes to free the ports?" prompt in `src/cli/commands/base-command.js` now auto-confirms `Y` after 5 seconds of no input (via `AbortSignal.timeout` → `AbortPromptError` → default `true`), so unattended test/dev loops (`emulator`, `serve`, `test`) no longer hang waiting for input. Manual `y`/`n` and Ctrl+C still work.
+- **`AI` `claude-code` provider rewritten for serverside use** (`src/manager/libraries/ai/providers/claude-code.js`). Was a local-only wrapper around `@anthropic-ai/claude-agent-sdk` that spawned the `claude` binary (`forceLoginMethod: 'claudeai'`, keychain OAuth) — would not run in Cloud Functions. Now calls the Claude Messages API over plain HTTPS via `@anthropic-ai/sdk` using the OAuth token as `Authorization: Bearer` + `anthropic-beta: oauth-2025-04-20`, so it bills the Claude Pro/Max subscription (not API credits) and runs anywhere Node runs. Token resolution: `options.apiKey` → `config.claude_code.oauth_token` → `process.env.CLAUDE_CODE_OAUTH_TOKEN`. Renewal is a manual yearly `claude setup-token` (no auto-refresh). Verified live (text + JSON-schema paths). See `docs/ai-library.md`.
 - **Dependency bumps**: `@anthropic-ai/claude-agent-sdk` ^0.3.152 → ^0.3.153, `stripe` ^22.1.1 → ^22.2.0.
 - **`templates/_.env`**: consolidate OpenAI/Anthropic keys under an "AI" section and add `CLAUDE_CODE_OAUTH_TOKEN`.
 - **Marketing webhook tests** (`test/routes/marketing/webhook.js`): renamed `*-duplicate-event-skipped` → `*-reprocessed-idempotently` (assert re-delivery reprocesses and the user stays revoked); `sendgrid-event-without-eventId-*` now asserts the event is processed; beehiiv idempotency variant skips when no publication is configured. Updated `docs/consent.md` and `docs/testing.md` to describe the no-ledger design.

package/docs/ai-library.md

@@ -6,18 +6,32 @@
 |---|---|---|
 | `openai` | `gpt-5-mini` | Better at structured JSON via JSON schema |
 | `anthropic` | `claude-sonnet-4-6` | Better at SVG illustrations and creative output |
+| `claude-code` | `claude-opus-4-7` | Same Claude models as `anthropic`, but bills a Claude Pro/Max **subscription** instead of API credits |
 
 Return shape (same for all providers): `{ content, output, tokens, raw }`.
 
-`options.response: 'json'` triggers JSON parsing — both providers strip fences and parse with JSON5 for robustness. `options.schema` enforces structure on OpenAI (real JSON schema) and is injected into the system prompt on Anthropic.
+`options.response: 'json'` triggers JSON parsing — all providers strip fences and parse with JSON5 for robustness. `options.schema` enforces structure on OpenAI (real JSON schema) and is injected into the system prompt on Anthropic / claude-code.
 
 API keys: `BACKEND_MANAGER_OPENAI_API_KEY`, `BACKEND_MANAGER_ANTHROPIC_API_KEY` (process.env or config).
 
+## `claude-code` provider — subscription billing
+
+The `claude-code` provider hits the same Claude Messages API as `anthropic`, but authenticates with a **Claude Code OAuth token** (`Authorization: Bearer ...` + `anthropic-beta: oauth-2025-04-20`) so usage bills the Claude Pro/Max subscription tied to the token rather than API credits.
+
+It is **pure HTTPS** — no `claude` binary, no subprocess — so it runs in Cloud Functions / CI / anywhere Node runs.
+
+Token resolution (first match wins): `options.apiKey` / constructor key → `config.claude_code.oauth_token` → `process.env.CLAUDE_CODE_OAUTH_TOKEN`.
+
+Mint the token with `claude setup-token` (valid ~1 year). When it expires, requests 401 — re-mint and update the `CLAUDE_CODE_OAUTH_TOKEN` secret. There is no automatic refresh; renewal is a manual yearly step.
+
+> **Caveats:** the Bearer/beta subscription path is undocumented and may change. Usage is subject to the subscription's rate limits (not API-tier limits). For high-volume production traffic, prefer `anthropic` + `BACKEND_MANAGER_ANTHROPIC_API_KEY`.
+
 The legacy `src/manager/libraries/openai.js` is a thin compatibility shim that re-exports the OpenAI provider class — existing callers using `new OpenAI(assistant, key)` still work unchanged.
 
 | File | Purpose |
 |---|---|
 | `src/manager/libraries/ai/index.js` | Unified `AI` class (dispatches by provider) |
 | `src/manager/libraries/ai/providers/openai.js` | OpenAI provider (original `openai.js` content) |
-| `src/manager/libraries/ai/providers/anthropic.js` | Anthropic provider (Claude Messages API) |
+| `src/manager/libraries/ai/providers/anthropic.js` | Anthropic provider (Claude Messages API, x-api-key, API credits) |
+| `src/manager/libraries/ai/providers/claude-code.js` | claude-code provider (Claude Messages API, OAuth Bearer, subscription billing) |
 | `src/manager/libraries/openai.js` | Back-compat shim → providers/openai.js |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.2.13",
+  "version": "5.2.14",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/cli/commands/base-command.js

@@ -130,10 +130,25 @@ class BaseCommand {
       }
     }
 
-    const shouldKill = await confirm({
-      message: 'Kill these processes to free the ports?',
-      default: true,
-    });
+    // Auto-confirm (Y) after a few seconds of no input so unattended test/dev loops don't
+    // hang. When the timeout fires the prompt is aborted via AbortSignal and we fall back to
+    // the default (true). inquirer owns the cursor and can't live-update its own message, so
+    // the countdown is shown statically in the prompt.
+    const AUTO_CONFIRM_SECONDS = 5;
+    let shouldKill;
+    try {
+      shouldKill = await confirm(
+        { message: `Kill these processes to free the ports? (auto-Y in ${AUTO_CONFIRM_SECONDS}s)`, default: true },
+        { signal: AbortSignal.timeout(AUTO_CONFIRM_SECONDS * 1000) },
+      );
+    } catch (error) {
+      // AbortPromptError (timeout reached) → take the default (true). Re-throw anything else.
+      if (error?.name !== 'AbortPromptError') {
+        throw error;
+      }
+      this.log(chalk.gray('  No input — auto-confirming (Y).'));
+      shouldKill = true;
+    }
 
     if (!shouldKill) {
       this.log(chalk.gray('\n  Aborting. Free the ports and try again.\n'));

package/src/manager/events/auth/on-create.js

@@ -72,6 +72,18 @@ module.exports = async ({ Manager, assistant, user, context, libraries }) => {
   const meta = Manager.Metadata().set({ tag: 'auth:on-create' });
   userRecord.metadata = { ...userRecord.metadata, ...meta };
 
+  // Stamp metadata.created from Firebase Auth's creationTime (the canonical account-creation
+  // moment) rather than the User schema's "now" — otherwise the doc lands a beat after Auth,
+  // and the OMEGA user migration reconciles every new signup against Auth on its next run.
+  const creationTime = user.metadata?.creationTime;
+  if (creationTime) {
+    const createdDate = new Date(creationTime);
+    userRecord.metadata.created = {
+      timestamp: createdDate.toISOString(),
+      timestampUNIX: Math.round(createdDate.getTime() / 1000),
+    };
+  }
+
   assistant.log(`onCreate: Creating user doc for ${user.uid}`, userRecord);
 
   // Write user doc with retry

package/src/manager/libraries/ai/providers/claude-code.js

@@ -1,30 +1,40 @@
 /**
- * Claude Code provider — uses @anthropic-ai/claude-agent-sdk to call Claude via
- * the local user's Claude Code subscription (no API key, no Anthropic credits).
+ * Claude Code provider — calls Claude over plain HTTPS using a Claude Code /
+ * Claude Pro/Max OAuth token (NOT API credits).
  *
- * Pass `forceLoginMethod: 'claudeai'` so the SDK auths via the OS keychain
- * OAuth session that the user already logged into via the `claude` CLI.
+ * Unlike the Anthropic provider (which authenticates with an x-api-key and bills
+ * API credits), this provider sends the OAuth token as `Authorization: Bearer ...`
+ * plus the `anthropic-beta: oauth-2025-04-20` header, so usage bills against the
+ * Claude subscription tied to the token.
  *
- * This is strictly a local-development provider:
- *   - Requires a logged-in Claude Code session on the host machine
- *   - Will not work in Cloud Functions / CI / production
- *   - Subject to your Claude Pro/Max rate limits (not API-tier limits)
+ * Token resolution (first match wins):
+ *   1. explicit key passed to the constructor / options.apiKey
+ *   2. Manager config: config.claude_code.oauth_token
+ *   3. process.env.CLAUDE_CODE_OAUTH_TOKEN  (from `claude setup-token`)
  *
- * Returns the same { content, output, tokens, raw } shape as the other providers
- * so callers don't care which is in use.
+ * This is pure HTTPS — no `claude` binary, no subprocess — so it runs in Cloud
+ * Functions / CI / anywhere Node runs. It is subject to the token's subscription
+ * rate limits (not API-tier limits).
+ *
+ * The OAuth token is minted with `claude setup-token` (valid ~1 year). When it
+ * expires (requests 401), re-mint and update the CLAUDE_CODE_OAUTH_TOKEN secret.
+ * NOTE: the Bearer/beta subscription path is undocumented and may change.
+ *
+ * Returns the same { content, output, tokens, raw } shape as the other providers.
  */
-const DEFAULT_MODEL = 'claude-opus-4-7';
-
-// Lazy import — only load the SDK if this provider is actually used
-let _query;
-
-function loadQuery() {
-  if (!_query) {
-    _query = require('@anthropic-ai/claude-agent-sdk').query;
-  }
+const _ = require('lodash');
+const JSON5 = require('json5');
 
-  return _query;
-}
+const DEFAULT_MODEL = 'claude-opus-4-7';
+const OAUTH_BETA = 'oauth-2025-04-20';
+
+// Pricing per 1M tokens (USD) — informational only; subscription billing is flat.
+const MODEL_TABLE = {
+  'claude-opus-4-7':   { input: 15.00, output: 75.00 },
+  'claude-opus-4-6':   { input: 15.00, output: 75.00 },
+  'claude-sonnet-4-6': { input: 3.00,  output: 15.00 },
+  'claude-haiku-4-5':  { input: 1.00,  output: 5.00  },
+};
 
 function ClaudeCode(assistant, key) {
   const self = this;
@@ -32,7 +42,9 @@ function ClaudeCode(assistant, key) {
   self.assistant = assistant;
   self.Manager = assistant?.Manager;
   self.user = assistant?.user;
-  // key is ignored — claude-code uses OS keychain OAuth via forceLoginMethod: 'claudeai'
+  self.token = key
+    || self.Manager?.config?.claude_code?.oauth_token
+    || process.env.CLAUDE_CODE_OAUTH_TOKEN;
 
   self.tokens = {
     total:  { count: 0, price: 0 },
@@ -47,121 +59,110 @@ ClaudeCode.prototype.request = async function (options) {
   const self = this;
   const assistant = self.assistant;
 
-  options = options || {};
-  const model = options.model || DEFAULT_MODEL;
+  options = _.merge({}, options);
+  options.model = options.model || DEFAULT_MODEL;
+  options.maxTokens = options.maxTokens || 2048;
+  options.temperature = typeof options.temperature === 'undefined' ? 0.7 : options.temperature;
 
-  // Build prompt + system from the unified options shape
-  const { system, prompt } = extractPromptAndSystem(options);
+  const token = options.apiKey || self.token;
 
-  if (!prompt) {
-    throw new Error('claude-code provider requires options.message.content or options.messages with a user turn');
+  if (!token) {
+    throw new Error('claude-code provider requires a Claude OAuth token (set CLAUDE_CODE_OAUTH_TOKEN via `claude setup-token`)');
   }
 
-  const query = loadQuery();
-  const startTime = Date.now();
+  // Lazy-require the SDK so projects that don't use this provider don't need it.
+  // We use the SDK purely as an HTTP client — `authToken` makes it send
+  // `Authorization: Bearer <token>` instead of `x-api-key`, and the beta header
+  // selects the subscription (OAuth) billing path. No `claude` binary involved.
+  const SDK = require('@anthropic-ai/sdk');
+  const client = new SDK({
+    authToken: token,
+    defaultHeaders: { 'anthropic-beta': OAUTH_BETA },
+  });
 
-  // Build SDK options
-  const sdkOptions = {
-    model,
-    forceLoginMethod: 'claudeai',  // Use Claude Pro/Max subscription, not API key
-    allowedTools: [],               // Disable all built-in tools — we just want text/JSON in/out
-    settingSources: [],             // Don't load .claude/ or ~/.claude/ settings
-    includePartialMessages: false,
+  const { system, messages } = buildMessages(options);
+
+  let systemFinal = system;
+
+  if (options.response === 'json') {
+    systemFinal = `${systemFinal || ''}\n\nYou MUST respond with valid JSON only. No prose, no markdown fences, no explanation — just the JSON object.${options.schema ? `\n\nThe JSON must conform to this schema:\n${JSON.stringify(options.schema)}` : ''}`.trim();
+  }
+
+  const requestBody = {
+    model: options.model,
+    max_tokens: options.maxTokens,
+    messages,
   };
 
-  if (system) {
-    sdkOptions.systemPrompt = system;
+  if (systemFinal) {
+    requestBody.system = systemFinal;
   }
 
-  if (options.response === 'json' && options.schema) {
-    sdkOptions.outputFormat = {
-      type: 'json_schema',
-      schema: options.schema,
-    };
+  if (options.temperature !== undefined) {
+    requestBody.temperature = options.temperature;
   }
 
-  let resultText = '';
-  let structuredOutput = null;
-  let usage = null;
-  let totalCostUSD = 0;
+  let raw;
 
   try {
-    for await (const message of query({ prompt, options: sdkOptions })) {
-      // Collect text from assistant messages
-      if (message.type === 'assistant') {
-        for (const block of message.message?.content || []) {
-          if (block.type === 'text') {
-            resultText += block.text;
-          }
-        }
-      }
-
-      // Capture final result + usage from the result message
-      if (message.type === 'result') {
-        if (message.subtype === 'success') {
-          structuredOutput = message.structured_output || null;
-          resultText = message.result || resultText;
-        }
-
-        usage = message.usage;
-        totalCostUSD = message.total_cost_usd || 0;
-
-        if (message.is_error) {
-          throw new Error(`claude-code: ${resultText || 'unknown error'}`);
-        }
-      }
-    }
+    raw = await client.messages.create(requestBody);
   } catch (e) {
-    assistant?.error?.(`claude-code request failed: ${e.message}`);
+    assistant?.error?.(`claude-code request failed: ${e.message}`, e);
     throw e;
   }
 
-  // Update token counters
-  if (usage) {
-    self.tokens.input.count  += usage.input_tokens  || 0;
-    self.tokens.output.count += usage.output_tokens || 0;
-    self.tokens.total.count   = self.tokens.input.count + self.tokens.output.count;
-    self.tokens.total.price   = totalCostUSD;
-  }
+  const outputText = (raw.content || [])
+    .filter((c) => c.type === 'text')
+    .map((c) => c.text.trim())
+    .join('\n')
+    .trim();
 
-  // Resolve content — prefer structured_output (validated against schema)
-  let content;
+  const modelConfig = MODEL_TABLE[options.model] || MODEL_TABLE[DEFAULT_MODEL];
 
-  if (structuredOutput != null) {
-    content = structuredOutput;
-  } else if (options.response === 'json') {
-    content = parseJsonLoose(resultText);
-  } else {
-    content = resultText;
-  }
+  self.tokens.input.count  += raw.usage?.input_tokens || 0;
+  self.tokens.output.count += raw.usage?.output_tokens || 0;
+  self.tokens.total.count   = self.tokens.input.count + self.tokens.output.count;
+  self.tokens.input.price   = (self.tokens.input.count * modelConfig.input) / 1_000_000;
+  self.tokens.output.price  = (self.tokens.output.count * modelConfig.output) / 1_000_000;
+  self.tokens.total.price   = self.tokens.input.price + self.tokens.output.price;
+
+  let parsed = outputText;
 
-  assistant?.log?.(`claude-code: ${Date.now() - startTime}ms, ${usage?.output_tokens || 0} output tokens, $${totalCostUSD?.toFixed(4) || '0.0000'}`);
+  if (options.response === 'json') {
+    parsed = parseJsonLoose(outputText);
+  }
 
   return {
-    output: [{ type: 'output_text', text: resultText }],
-    content,
+    output: raw.content || [],
+    content: parsed,
     tokens: self.tokens,
-    raw: { usage, totalCostUSD },
+    raw,
   };
 };
 
 /**
- * Map unified options into a system prompt + a single user prompt string.
+ * Build Anthropic system + messages from the unified option shape.
+ *
+ * Accepts either:
+ *   - options.messages: [{ role: 'system'|'user'|'assistant', content: string }]
+ *   - options.prompt.content (system) + options.message.content (user)
  */
-function extractPromptAndSystem(options) {
+function buildMessages(options) {
   if (Array.isArray(options.messages) && options.messages.length) {
     const system = options.messages.find((m) => m.role === 'system')?.content;
-    const lastUser = [...options.messages].reverse().find((m) => m.role !== 'system');
+    const messages = options.messages
+      .filter((m) => m.role !== 'system')
+      .map((m) => ({ role: m.role, content: stringifyContent(m.content) }));
 
-    return {
-      system: stringifyContent(system),
-      prompt: stringifyContent(lastUser?.content),
-    };
+    return { system: stringifyContent(system), messages };
   }
 
+  const system = stringifyContent(options.prompt?.content || '');
+  const userContent = stringifyContent(options.message?.content || '');
+
   return {
-    system: stringifyContent(options.prompt?.content),
-    prompt: stringifyContent(options.message?.content),
+    system,
+    messages: [{ role: 'user', content: userContent }],
   };
 }
 
@@ -185,19 +186,22 @@ function stringifyContent(content) {
 }
 
 function parseJsonLoose(text) {
-  if (!text) return text;
+  let cleaned = (text || '').trim();
+
+  cleaned = cleaned.replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/i, '');
 
-  let cleaned = text.trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/i, '');
-  const firstObj = cleaned.indexOf('{');
-  const firstArr = cleaned.indexOf('[');
-  const start = [firstObj, firstArr].filter((i) => i >= 0).sort((a, b) => a - b)[0];
+  const candidates = [cleaned.indexOf('{'), cleaned.indexOf('[')].filter((i) => i >= 0);
 
-  if (start > 0) {
-    cleaned = cleaned.slice(start);
+  if (candidates.length) {
+    const firstBrace = Math.min(...candidates);
+
+    if (firstBrace > 0) {
+      cleaned = cleaned.slice(firstBrace);
+    }
   }
 
   try {
-    return JSON.parse(cleaned);
+    return JSON5.parse(cleaned);
   } catch {
     return text;
   }

package/src/manager/routes/user/signup/post.js

@@ -4,14 +4,13 @@ const { validate: validateEmail, isDisposable } = require('../../../libraries/em
 
 const MAX_POLL_TIME_MS = 30000;
 const POLL_INTERVAL_MS = 500;
-const MAX_ACCOUNT_AGE_MS = 5 * 60 * 1000; // 5 minutes
 
 /**
  * POST /user/signup - Complete user signup
  *
  * Called by client after account creation to:
  * 1. Poll for user doc to exist (waits for onCreate to complete)
- * 2. Validate (already processed, account age)
+ * 2. Validate (reject only if flags.signupProcessed is already true)
  * 3. Gather all data (client details, inferred contact)
  * 4. Write everything to user doc in one merge
  * 5. Process affiliate referral (writes to referrer's doc)
@@ -49,23 +48,20 @@ module.exports = async ({ assistant, user, settings, libraries }) => {
     return assistant.respond('Signup has already been processed', { code: 400 });
   }
 
-  // 3. Backup check: reject if account is older than 5 minutes
+  // 3. Fetch the Auth user — needed for the canonical creationTime used to stamp
+  //    metadata.created and consent timestamps. flags.signupProcessed (checked above) is
+  //    the sole idempotency gate; there is intentionally no account-age window, so a
+  //    legitimately-unprocessed account can complete signup whenever it retries.
   const authUser = await admin.auth().getUser(uid).catch((e) => e);
 
   if (authUser instanceof Error) {
     return assistant.respond(`Failed to get auth user: ${authUser.message}`, { code: 500 });
   }
 
-  const accountAgeMs = Date.now() - new Date(authUser.metadata.creationTime).getTime();
-
-  if (accountAgeMs > MAX_ACCOUNT_AGE_MS) {
-    return assistant.respond('Account is too old to process signup', { code: 400 });
-  }
-
   // 4. Gather all data, then write once
   const email = user.auth.email;
   const inferred = await inferUserContact(assistant, email);
-  const userRecord = buildUserRecord(assistant, settings, inferred);
+  const userRecord = buildUserRecord(assistant, settings, inferred, authUser.metadata.creationTime);
 
   assistant.log(`signup(): Writing user record for ${uid}`, userRecord);
 
@@ -117,7 +113,7 @@ async function pollForUserDoc(assistant, uid) {
 /**
  * Build the full user record: client details, attribution, and inferred contact
  */
-function buildUserRecord(assistant, settings, inferred) {
+function buildUserRecord(assistant, settings, inferred, creationTime) {
   const Manager = assistant.Manager;
   const attribution = settings.attribution;
 
@@ -142,10 +138,22 @@ function buildUserRecord(assistant, settings, inferred) {
       },
     },
     attribution: attribution || {},
-    consent: buildConsentRecord(assistant, settings.consent),
+    consent: buildConsentRecord(assistant, settings.consent, creationTime),
     metadata: Manager.Metadata().set({ tag: 'user/signup' }),
   };
 
+  // Stamp metadata.created from Firebase Auth's creationTime so it matches Auth's canonical
+  // value. Normally onCreate sets this, but if onCreate didn't fire this merge write is the
+  // doc's first creation — without this the doc lands with no created date and the OMEGA
+  // migration has to backfill it. Idempotent: when onCreate already wrote it, this matches.
+  if (creationTime) {
+    const createdDate = new Date(creationTime);
+    record.metadata.created = {
+      timestamp: createdDate.toISOString(),
+      timestampUNIX: Math.round(createdDate.getTime() / 1000),
+    };
+  }
+
   // Add inferred name/company if available
   if (inferred) {
     record.personal = {
@@ -168,18 +176,24 @@ function buildUserRecord(assistant, settings, inferred) {
  * Client sends: { legal: { granted, text }, marketing: { granted, text } }
  * Server writes: { legal: { status, grantedAt: {...} }, marketing: { status, grantedAt: {...}, revokedAt: {...} } }
  *
- * Server time (not client-supplied) is authoritative — defends against clock manipulation.
+ * Server-derived time (not client-supplied) is authoritative — defends against clock
+ * manipulation. Uses Auth's creationTime so consent timestamps match metadata.created.
  * IP is captured from request geolocation.
  *
  * Legal is REQUIRED — the client must send legal.granted=true. If missing/false we still
  * record what the client sent, but the route will not have reached this point in practice
  * (the signup-form HTML5-requires the legal checkbox).
  */
-function buildConsentRecord(assistant, clientConsent) {
+function buildConsentRecord(assistant, clientConsent, creationTime) {
   const consent = clientConsent || {};
   const ip = assistant.request.geolocation?.ip || null;
-  const timestamp = assistant.meta.startTime.timestamp;
-  const timestampUNIX = assistant.meta.startTime.timestampUNIX;
+
+  // Stamp grantedAt/revokedAt from Auth's creationTime so consent timestamps match
+  // metadata.created (the OMEGA migration treats metadata.created as the SSOT and reconciles
+  // consent.grantedAt against it). Fall back to request start time if creationTime is absent.
+  const createdDate = creationTime ? new Date(creationTime) : null;
+  const timestamp = createdDate ? createdDate.toISOString() : assistant.meta.startTime.timestamp;
+  const timestampUNIX = createdDate ? Math.round(createdDate.getTime() / 1000) : assistant.meta.startTime.timestampUNIX;
 
   // Build empty leaf shape — used wherever grantedAt or revokedAt is "not set"
   const emptyMeta = { timestamp: null, timestampUNIX: null, source: null, ip: null, text: null };

package/test/routes/user/signup.js

@@ -244,8 +244,6 @@ module.exports = {
         };
 
         // Use absurdly-old client timestamp to prove server time wins (defense vs clock skew)
-        const beforeMs = Date.now();
-
         const signupResponse = await http.as('consent-granted').post('user/signup', {
           consent: {
             legal: { granted: true, text: consentText.legal, timestamp: '2000-01-01T00:00:00.000Z' },
@@ -255,7 +253,6 @@ module.exports = {
 
         assert.isSuccess(signupResponse, `Signup should succeed: ${JSON.stringify(signupResponse, null, 2)}`);
 
-        const afterMs = Date.now();
         const userDoc = await firestore.get(`users/${accounts['consent-granted'].uid}`);
 
         // Legal
@@ -265,14 +262,16 @@ module.exports = {
         assert.ok(userDoc?.consent?.legal?.grantedAt?.timestamp, 'legal grantedAt.timestamp should be set');
         assert.equal(typeof userDoc?.consent?.legal?.grantedAt?.timestampUNIX, 'number', 'legal grantedAt.timestampUNIX should be number');
 
-        // Server time MUST be used (the client-supplied 2000-01-01 should NOT appear)
+        // Server-derived time MUST be used (the client-supplied 2000-01-01 should NOT appear).
+        // grantedAt is stamped from Auth's creationTime, the same source as metadata.created,
+        // so the two must be equal — and the client's 2000-01-01 (UNIX 946684800) is rejected.
         const legalUNIX = userDoc.consent.legal.grantedAt.timestampUNIX;
-        const beforeUNIX = Math.floor(beforeMs / 1000);
-        const afterUNIX = Math.floor(afterMs / 1000);
-        assert.ok(
-          legalUNIX >= beforeUNIX && legalUNIX <= afterUNIX,
-          `legal grantedAt.timestampUNIX (${legalUNIX}) must be server time, not client time. expected between ${beforeUNIX} and ${afterUNIX}`
+        const createdUNIX = userDoc.metadata.created.timestampUNIX;
+        assert.equal(
+          legalUNIX, createdUNIX,
+          `legal grantedAt.timestampUNIX (${legalUNIX}) should match metadata.created (${createdUNIX}) — both from Auth creationTime`
         );
+        assert.notEqual(legalUNIX, 946684800, 'legal grantedAt must NOT be the client-supplied 2000-01-01 time');
 
         // Marketing
         assert.equal(userDoc?.consent?.marketing?.status, 'granted', 'consent.marketing.status should be granted');