@corgelabs/corge 0.0.1 → 1.0.1

package/src/chat/utils.ts

@@ -0,0 +1,370 @@
+import { FieldValue, Timestamp, type DocumentReference, type Firestore } from 'firebase-admin/firestore'
+import { createUIMessageStreamResponse, toUIMessageStream, type LanguageModelUsage, type ModelMessage, type streamText } from 'ai'
+import { z } from 'zod'
+import type { ProcessedAttachment } from '../attachments'
+import type { EntryId } from '../db'
+import type { FileRef } from '../files'
+import type {
+  ChatMessagePublic,
+  ChatMessageRole,
+  ContextEntry,
+  ContextItemSpec,
+  DynamicContextBlockInput,
+  RawAttachmentPart,
+  UserContext,
+  streamChatBody
+} from './schema'
+
+export const FORBIDDEN_TOOL_SCHEMA_KEYS = new Set([
+  'userId',
+  'chatId',
+  'role',
+  'userRole',
+  'token',
+  'idToken',
+  'apiKey',
+  'session'
+])
+
+export const sanitizeToolInputSchema = (schema: z.ZodType<any>): z.ZodType<any> => {
+  if (schema instanceof z.ZodObject) {
+    const shape = schema.shape as Record<string, z.ZodType<any>>
+    const keysToOmit: Record<string, true> = {}
+    let hasForbidden = false
+    for (const key of Object.keys(shape)) {
+      if (FORBIDDEN_TOOL_SCHEMA_KEYS.has(key)) {
+        keysToOmit[key] = true
+        hasForbidden = true
+      }
+    }
+    if (hasForbidden) {
+      return schema.omit(keysToOmit)
+    }
+  }
+  return schema
+}
+
+export const isUserContextShape = (value: unknown): value is UserContext =>
+  Boolean(value) &&
+  typeof value === 'object' &&
+  typeof (value as UserContext).state === 'object' &&
+  (value as UserContext).state !== null
+
+export const formatAttachmentLine = (filename: string, item: ProcessedAttachment): string =>
+  'error' in item
+    ? `[attached ${filename} (ref: ${item.ref}) (error: ${item.error})]\n`
+    : `[attached ${filename} (ref: ${item.ref}) (type: ${item.scan.type}) (fields: ${JSON.stringify(item.scan.fields ?? {})}) (markdown: ${item.scan.markdown ?? ''})]\n`
+
+export const isSafePublicUrl = (raw?: string): boolean => {
+  if (!raw) return false
+  try {
+    const u = new URL(raw)
+    const host = u.hostname.toLowerCase()
+    return (
+      (u.protocol === 'https:' || u.protocol === 'http:') &&
+      !/^(\d+|0x[0-9a-f]+)$/i.test(host) &&
+      !/^(localhost|127\.|10\.|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|0\.|metadata\.|\[(::1?|fc|fd|fe80:|::ffff:))/i.test(
+        host
+      ) &&
+      !/(\.internal|\.local|\.nip\.io|\.sslip\.io)\.?$/i.test(host)
+    )
+  } catch {
+    return false
+  }
+}
+
+export const extractPart = (p: Record<string, unknown>): RawAttachmentPart | undefined => {
+  if (!p || typeof p !== 'object' || (p.type !== 'file' && !('url' in p))) return undefined
+  const url = String(p.url ?? '')
+  const dataUrl = url.startsWith('data:') ? url : undefined
+  const ref = url.match(/^\/api\/files\/([A-Za-z0-9_-]+_[a-f0-9]{24})$/)?.[1]
+  return dataUrl || ref ? { dataUrl, ref, filename: typeof p.filename === 'string' ? p.filename : 'file' } : undefined
+}
+
+export const extractTurnAttachmentParts = (msg: z.infer<typeof streamChatBody>['message']): RawAttachmentPart[] => {
+  const fromParts = (msg.parts ?? [])
+    .map((p) => extractPart(p))
+    .filter((p): p is RawAttachmentPart => Boolean(p))
+  const seenRefs = new Set(fromParts.map((p) => p.ref).filter(Boolean))
+  const fromRefs: RawAttachmentPart[] = (msg.attachments ?? [])
+    .filter((ref) => !seenRefs.has(ref))
+    .map((ref) => ({ ref, filename: ref }))
+  return [...fromParts, ...fromRefs]
+}
+
+export const extractMessageText = (msg: { content?: unknown; parts?: readonly unknown[] }): string => {
+  if (typeof msg.content === 'string' && msg.content.trim()) return msg.content.trim()
+  const items = (Array.isArray(msg.content) ? msg.content : Array.isArray(msg.parts) ? msg.parts : []) as Record<
+    string,
+    unknown
+  >[]
+  return items
+    .filter((p) => p && typeof p === 'object' && p.type === 'text' && typeof p.text === 'string')
+    .map((p) => (p.text as string).trim())
+    .filter(Boolean)
+    .join('\n')
+}
+
+export const deriveTitle = (
+  msgOrList: { content?: unknown; parts?: readonly unknown[]; role?: string } | readonly Record<string, unknown>[]
+): string => {
+  const list = Array.isArray(msgOrList) ? msgOrList : [msgOrList]
+  for (const m of list) {
+    if (m.role && m.role !== 'user') continue
+    const text = extractMessageText(m as { content?: unknown; parts?: readonly unknown[] })
+    if (text) return text.slice(0, 80)
+  }
+  return 'New Chat'
+}
+
+export const extractLatestUserPrompt = (messages: readonly (Record<string, unknown> | ModelMessage)[]): string => {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i] as Record<string, unknown>
+    if (m?.role !== 'user') continue
+    const text = extractMessageText(m as { content?: unknown; parts?: readonly unknown[] })
+    if (text) return text
+  }
+  return ''
+}
+
+export const formatUsage = (usage: LanguageModelUsage | null) => ({
+  prompt_tokens: usage?.inputTokens ?? 0,
+  completion_tokens: usage?.outputTokens ?? 0,
+  total_tokens: usage?.totalTokens ?? (usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0)
+})
+
+export const isContextItemVisible = (item: ContextItemSpec, audiences?: readonly string[]): boolean =>
+  !audiences || !item.audiences || item.audiences.some((a) => audiences.includes(a))
+
+export const formatContextBlock = (entries: readonly ContextEntry[]): string => {
+  if (entries.length === 0) return ''
+  const sources = entries
+    .map(
+      (entry) =>
+        `<source path=${JSON.stringify(entry.path)} description=${JSON.stringify(entry.description)}>\n${entry.markdown.trim()}\n</source>`
+    )
+    .join('\n')
+  return `<infobase_context>\n${sources}\n</infobase_context>`
+}
+
+export const buildDynamicContextBlock = (input: DynamicContextBlockInput): string => {
+  const sections: string[] = [`Current UTC Date: ${input.currentTimeIso ?? new Date().toISOString()}`]
+
+  if (input.userContext) {
+    sections.push(`<user_state>\n${JSON.stringify(input.userContext.state)}\n</user_state>`)
+    if (input.userContext.details && Object.keys(input.userContext.details).length > 0) {
+      sections.push(`<user_records>\n${JSON.stringify(input.userContext.details)}\n</user_records>`)
+    }
+  }
+
+  if (input.recalledMemories && input.recalledMemories.length > 0) {
+    const items = input.recalledMemories
+      .map(
+        (m) =>
+          `<memory scope=${JSON.stringify(m.scope)} chatId=${JSON.stringify(m.chatId)} role=${JSON.stringify(m.role)}>\n${m.content.trim()}\n</memory>`
+      )
+      .join('\n')
+    sections.push(`<recalled_memory>\n${items}\n</recalled_memory>`)
+  }
+
+  if (input.infobaseContextEntries && input.infobaseContextEntries.length > 0) {
+    const block = formatContextBlock(input.infobaseContextEntries)
+    if (block) sections.push(block)
+  }
+
+  if (input.stagedAttachmentSummaries && input.stagedAttachmentSummaries.length > 0) {
+    sections.push(`<staged_attachments>\n${input.stagedAttachmentSummaries.join('\n').trim()}\n</staged_attachments>`)
+  }
+
+  return sections.join('\n\n')
+}
+
+export const PUBLIC_MESSAGE_FIELDS = [
+  'id',
+  'chatId',
+  'userId',
+  'role',
+  'content',
+  'parts',
+  'toolInvocations',
+  'attachments',
+  'tokenCount',
+  'cancelled',
+  'createdAt'
+] as const
+
+export const RECALL_MESSAGE_FIELDS = ['id', 'chatId', 'role', 'content'] as const
+
+export const mapFirestoreMessageDoc = (
+  id: string,
+  raw: Record<string, unknown>
+): ChatMessagePublic => {
+  const createdRaw = raw.createdAt
+  const createdAt =
+    createdRaw instanceof Timestamp
+      ? createdRaw.toDate()
+      : createdRaw instanceof Date
+        ? createdRaw
+        : typeof createdRaw === 'string' || typeof createdRaw === 'number'
+          ? new Date(createdRaw)
+          : new Date()
+
+  const role: ChatMessageRole =
+    raw.role === 'assistant' || raw.role === 'system' || raw.role === 'tool' ? raw.role : 'user'
+  const content = typeof raw.content === 'string' ? raw.content : ''
+  const parts = Array.isArray(raw.parts) ? raw.parts : content ? [{ type: 'text', text: content }] : []
+
+  return {
+    id,
+    chatId: typeof raw.chatId === 'string' ? raw.chatId : '',
+    userId: typeof raw.userId === 'string' ? raw.userId : '',
+    role,
+    content,
+    parts,
+    ...(Array.isArray(raw.toolInvocations) ? { toolInvocations: raw.toolInvocations } : {}),
+    ...(Array.isArray(raw.attachments) ? { attachments: raw.attachments as string[] } : {}),
+    ...(typeof raw.tokenCount === 'number' ? { tokenCount: raw.tokenCount } : {}),
+    ...(typeof raw.cancelled === 'boolean' ? { cancelled: raw.cancelled } : {}),
+    createdAt
+  }
+}
+
+export const toModelMessageFromDoc = (doc: ChatMessagePublic): ModelMessage | undefined => {
+  const text = doc.content.trim()
+  if (!text) return undefined
+  if (doc.role === 'assistant') {
+    return { role: 'assistant', content: [{ type: 'text', text }] }
+  }
+  if (doc.role === 'user') {
+    return { role: 'user', content: [{ type: 'text', text }] }
+  }
+  return undefined
+}
+
+export const extractToolInvocations = (messages: readonly { content: unknown }[]): unknown[] => {
+  const toolInvocations: unknown[] = []
+  for (const m of messages) {
+    if (!Array.isArray(m.content)) continue
+    for (const part of m.content) {
+      if (part && typeof part === 'object' && 'type' in part && (part.type === 'tool-call' || part.type === 'tool-result')) {
+        toolInvocations.push(part)
+      }
+    }
+  }
+  return toolInvocations
+}
+
+export const buildUIMessageResponse = (
+  turn: ReturnType<typeof streamText>,
+  chatId: string,
+  generationId: string,
+  completionPromise: Promise<void>,
+  onDelta: (delta: string) => void
+): Response => {
+  const baseRes = createUIMessageStreamResponse({ stream: toUIMessageStream({ stream: turn.stream }) })
+  const headers = new Headers(baseRes.headers)
+  headers.set('x-chat-id', chatId)
+  headers.set('x-generation-id', generationId)
+
+  const decoder = new TextDecoder()
+  const [clientBranch, monitorBranch] = baseRes.body!.tee()
+
+  void (async () => {
+    const reader = monitorBranch.getReader()
+    try {
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        for (const line of decoder.decode(value, { stream: true }).split('\n')) {
+          if (!line.startsWith('data: ')) continue
+          try {
+            const payload = JSON.parse(line.slice(6)) as { type?: string; delta?: string; textDelta?: string }
+            if (payload.type === 'text-delta') onDelta(payload.delta ?? payload.textDelta ?? '')
+          } catch {}
+        }
+      }
+    } catch {
+    } finally {
+      reader.releaseLock()
+    }
+  })()
+
+  const syncedClientStream = clientBranch.pipeThrough(
+    new TransformStream<Uint8Array, Uint8Array>({
+      async flush() {
+        await completionPromise.catch(() => {})
+      }
+    })
+  )
+
+  return new Response(syncedClientStream, { status: baseRes.status, headers })
+}
+
+export const buildCompletedTurnWriteBatch = (
+  db: Firestore,
+  opts: {
+    chatDocRef: DocumentReference
+    chatId: string
+    userId: EntryId
+    resolvedAgentId: string
+    title: string
+    selectedModel: string
+    userMsgId: string
+    assistantMsgId: string
+    userCreatedAtMs: number
+    finalUserText: string
+    userPartsForStorage: unknown[]
+    stagedRefs: FileRef[]
+    finalAssistantText: string
+    toolInvocations: unknown[]
+    totalTokens?: number
+    cancelled: boolean
+    userVector: number[] | null
+    assistantVector: number[] | null
+  }
+) => {
+  const messagesCol = opts.chatDocRef.collection('messages')
+  const batch = db.batch()
+  batch.set(messagesCol.doc(opts.userMsgId), {
+    id: opts.userMsgId,
+    chatId: opts.chatId,
+    userId: opts.userId,
+    role: 'user',
+    content: opts.finalUserText,
+    parts: opts.userPartsForStorage,
+    ...(opts.stagedRefs.length > 0 ? { attachments: opts.stagedRefs } : {}),
+    createdAt: Timestamp.fromMillis(opts.userCreatedAtMs),
+    ...(opts.userVector ? { embedding: FieldValue.vector(opts.userVector) } : {})
+  })
+
+  batch.set(messagesCol.doc(opts.assistantMsgId), {
+    id: opts.assistantMsgId,
+    chatId: opts.chatId,
+    userId: opts.userId,
+    role: 'assistant',
+    content: opts.finalAssistantText,
+    parts: opts.finalAssistantText ? [{ type: 'text', text: opts.finalAssistantText }] : [],
+    ...(opts.toolInvocations.length > 0 ? { toolInvocations: opts.toolInvocations } : {}),
+    ...(opts.totalTokens !== undefined ? { tokenCount: opts.totalTokens } : {}),
+    cancelled: opts.cancelled,
+    createdAt: Timestamp.fromMillis(Math.max(opts.userCreatedAtMs + 1, Date.now())),
+    ...(opts.assistantVector ? { embedding: FieldValue.vector(opts.assistantVector) } : {})
+  })
+
+  batch.set(
+    opts.chatDocRef,
+    {
+      id: opts.chatId,
+      userId: opts.userId,
+      agentId: opts.resolvedAgentId,
+      title: opts.title,
+      model: opts.selectedModel,
+      deleted: false,
+      activeGenerationId: null,
+      messageCount: FieldValue.increment(2),
+      updatedAt: FieldValue.serverTimestamp()
+    },
+    { merge: true }
+  )
+  return batch
+}

package/src/cli/builder.ts

@@ -0,0 +1,93 @@
+import { existsSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { build, type Plugin } from 'esbuild'
+
+export const getCorgeRootDir = (): string => {
+  const currentFile = fileURLToPath(import.meta.url)
+  const currentDir = dirname(currentFile)
+  for (const candidate of [
+    resolve(currentDir, '../..'),
+    resolve(currentDir, '..')
+  ]) {
+    if (existsSync(join(candidate, 'package.json')) && existsSync(join(candidate, 'tsconfig.base.json'))) {
+      return candidate
+    }
+  }
+  return resolve(currentDir, '../..')
+}
+
+export const resolveCorgeEntrypoint = (cwd = process.cwd()): string => {
+  try {
+    const req = createRequire(join(cwd, 'package.json'))
+    return req.resolve('@corgelabs/corge')
+  } catch {
+    const root = getCorgeRootDir()
+    const distEntry = join(root, 'dist/index.js')
+    return existsSync(distEntry) ? distEntry : join(root, 'src/index.ts')
+  }
+}
+
+const resolveWithExtensions = (basePath: string): string | undefined => {
+  for (const candidate of [
+    basePath,
+    `${basePath}.ts`,
+    `${basePath}.js`,
+    join(basePath, 'index.ts'),
+    join(basePath, 'index.js')
+  ]) {
+    if (existsSync(candidate)) return candidate
+  }
+  return undefined
+}
+
+export const corgeAliasPlugin = (cwd = process.cwd()): Plugin => ({
+  name: 'corge-alias',
+  setup(b) {
+    b.onResolve({ filter: /^(@core|@corgelabs\/corge)$/ }, () => ({
+      path: resolveCorgeEntrypoint(cwd),
+      external: false
+    }))
+
+    b.onResolve({ filter: /^@(config|routes|services|utils)\/(.+)$/ }, (args) => {
+      const match = /^@(config|routes|services|utils)\/(.+)$/.exec(args.path)
+      if (!match) return undefined
+      const [, folder, rest] = match
+      const target = resolveWithExtensions(join(cwd, 'src', folder!, rest!))
+      if (target) return { path: target, external: false }
+      return undefined
+    })
+
+    b.onResolve({ filter: /^@app-entry$/ }, () => {
+      const target = resolveWithExtensions(join(cwd, 'src/index'))
+      if (target) return { path: target, external: false }
+      return { path: 'corge-fallback-app', namespace: 'corge-virtual' }
+    })
+
+    b.onLoad({ filter: /.*/, namespace: 'corge-virtual' }, () => ({
+      contents: [
+        "import { core } from '@core'",
+        'export const { devApp, app, functions } = core.createApp({})'
+      ].join('\n'),
+      loader: 'ts',
+      resolveDir: cwd
+    }))
+  }
+})
+
+export const buildConsumerApp = async (cwd = process.cwd()): Promise<void> => {
+  await build({
+    absWorkingDir: cwd,
+    entryPoints: ['src/index.ts'],
+    bundle: true,
+    platform: 'node',
+    target: 'node24',
+    format: 'cjs',
+    packages: 'external',
+    plugins: [corgeAliasPlugin(cwd)],
+    footer: { js: 'module.exports = functions;' },
+    outfile: 'dist/index.cjs',
+    sourcemap: true
+  })
+}

package/src/cli/deployer.ts

@@ -0,0 +1,184 @@
+import { execSync, spawnSync } from 'node:child_process'
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { buildConsumerApp, getCorgeRootDir } from './builder'
+
+interface FirestoreIndexesFile {
+  indexes?: unknown[]
+  fieldOverrides?: unknown[]
+}
+
+const mergeFirestoreIndexes = (base: FirestoreIndexesFile, custom: FirestoreIndexesFile): FirestoreIndexesFile => {
+  const seenIndexes = new Set<string>()
+  const mergedIndexes: unknown[] = []
+  for (const item of [...(base.indexes ?? []), ...(custom.indexes ?? [])]) {
+    const key = JSON.stringify(item)
+    if (!seenIndexes.has(key)) {
+      seenIndexes.add(key)
+      mergedIndexes.push(item)
+    }
+  }
+
+  const seenOverrides = new Set<string>()
+  const mergedOverrides: unknown[] = []
+  for (const item of [...(base.fieldOverrides ?? []), ...(custom.fieldOverrides ?? [])]) {
+    const key = JSON.stringify(item)
+    if (!seenOverrides.has(key)) {
+      seenOverrides.add(key)
+      mergedOverrides.push(item)
+    }
+  }
+
+  return {
+    indexes: mergedIndexes,
+    fieldOverrides: mergedOverrides
+  }
+}
+
+export const deployConsumerApp = async (
+  target: 'prod' | 'dev' | undefined,
+  cwd = process.cwd()
+): Promise<void> => {
+  try {
+    process.loadEnvFile(join(cwd, '.env'))
+  } catch {}
+
+  if (target !== 'prod' && target !== 'dev') {
+    console.error('Usage: corge deploy <prod|dev>')
+    process.exit(1)
+  }
+
+  const requiredBranch = target === 'prod' ? 'main' : 'dev'
+  const currentBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd, encoding: 'utf8' }).trim()
+
+  if (currentBranch !== requiredBranch) {
+    console.error(
+      `Deploy blocked: "deploy ${target}" can only run on branch "${requiredBranch}" (current branch: "${currentBranch}").`
+    )
+    process.exit(1)
+  }
+
+  const project = process.env.GCP_PROJECT
+  if (!project) {
+    console.error('Missing GCP_PROJECT in .env')
+    process.exit(1)
+  }
+
+  await buildConsumerApp(cwd)
+
+  const corgeRoot = getCorgeRootDir()
+  const firebaseJsonPath = join(cwd, 'firebase.json')
+  const pkgJsonPath = join(cwd, 'package.json')
+  const firestoreRulesPath = join(cwd, 'firestore.rules')
+  const firestoreIndexesPath = join(cwd, 'firestore.indexes.json')
+  const storageRulesPath = join(cwd, 'storage.rules')
+
+  const rawFirebaseJson = readFileSync(firebaseJsonPath, 'utf8')
+  const rawPkgJson = readFileSync(pkgJsonPath, 'utf8')
+  const hadFirestoreRules = existsSync(firestoreRulesPath)
+  const rawFirestoreRules = hadFirestoreRules ? readFileSync(firestoreRulesPath, 'utf8') : null
+  const hadFirestoreIndexes = existsSync(firestoreIndexesPath)
+  const rawFirestoreIndexes = hadFirestoreIndexes ? readFileSync(firestoreIndexesPath, 'utf8') : null
+  const hadStorageRules = existsSync(storageRulesPath)
+  const rawStorageRules = hadStorageRules ? readFileSync(storageRulesPath, 'utf8') : null
+
+  const restoreFiles = () => {
+    try {
+      writeFileSync(firebaseJsonPath, rawFirebaseJson, 'utf8')
+    } catch {}
+    try {
+      writeFileSync(pkgJsonPath, rawPkgJson, 'utf8')
+    } catch {}
+    try {
+      if (hadFirestoreRules && rawFirestoreRules !== null) {
+        writeFileSync(firestoreRulesPath, rawFirestoreRules, 'utf8')
+      } else if (!hadFirestoreRules && existsSync(firestoreRulesPath)) {
+        unlinkSync(firestoreRulesPath)
+      }
+    } catch {}
+    try {
+      if (hadFirestoreIndexes && rawFirestoreIndexes !== null) {
+        writeFileSync(firestoreIndexesPath, rawFirestoreIndexes, 'utf8')
+      } else if (!hadFirestoreIndexes && existsSync(firestoreIndexesPath)) {
+        unlinkSync(firestoreIndexesPath)
+      }
+    } catch {}
+    try {
+      if (hadStorageRules && rawStorageRules !== null) {
+        writeFileSync(storageRulesPath, rawStorageRules, 'utf8')
+      } else if (!hadStorageRules && existsSync(storageRulesPath)) {
+        unlinkSync(storageRulesPath)
+      }
+    } catch {}
+  }
+
+  process.once('SIGINT', () => {
+    restoreFiles()
+    process.exit(130)
+  })
+  process.once('SIGTERM', () => {
+    restoreFiles()
+    process.exit(143)
+  })
+
+  try {
+    // 1. Provision or merge base Firestore/Storage rules & composite indexes from @corgelabs/corge/infra
+    const baseFirestoreRules = readFileSync(join(corgeRoot, 'infra/firestore.base.rules'), 'utf8')
+    const baseStorageRules = readFileSync(join(corgeRoot, 'infra/storage.base.rules'), 'utf8')
+    const baseIndexes = JSON.parse(
+      readFileSync(join(corgeRoot, 'infra/firestore.base.indexes.json'), 'utf8')
+    ) as FirestoreIndexesFile
+
+    if (!hadFirestoreRules) {
+      writeFileSync(firestoreRulesPath, baseFirestoreRules, 'utf8')
+    }
+    if (!hadStorageRules) {
+      writeFileSync(storageRulesPath, baseStorageRules, 'utf8')
+    }
+
+    const customIndexes = hadFirestoreIndexes && rawFirestoreIndexes
+      ? (JSON.parse(rawFirestoreIndexes) as FirestoreIndexesFile)
+      : {}
+    const mergedIndexes = mergeFirestoreIndexes(baseIndexes, customIndexes)
+    writeFileSync(firestoreIndexesPath, JSON.stringify(mergedIndexes, null, 2) + '\n', 'utf8')
+
+    // 2. Rewrite firebase.json for target environment
+    const cfg = JSON.parse(rawFirebaseJson) as Record<string, unknown>
+    const prodDb = { database: project, rules: 'firestore.rules', indexes: 'firestore.indexes.json' }
+    const devDb = { database: `${project}-dev`, rules: 'firestore.rules', indexes: 'firestore.indexes.json' }
+    const prodBucket = { bucket: `${project}.firebasestorage.app`, rules: 'storage.rules' }
+    const devBucket = { bucket: `${project}-dev`, rules: 'storage.rules' }
+
+    cfg.firestore = target === 'prod' ? [prodDb] : [devDb]
+    cfg.storage = target === 'prod' ? [prodBucket] : [devBucket]
+    writeFileSync(firebaseJsonPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8')
+
+    // 3. Expand @corgelabs/corge runtime dependencies into consumer package.json so Cloud Build needs zero npm auth
+    const corgePkg = JSON.parse(readFileSync(join(corgeRoot, 'package.json'), 'utf8')) as {
+      dependencies?: Record<string, string>
+    }
+    const consumerPkg = JSON.parse(rawPkgJson) as {
+      dependencies?: Record<string, string>
+      [k: string]: unknown
+    }
+    const expandedDeps: Record<string, string> = { ...(corgePkg.dependencies ?? {}), ...(consumerPkg.dependencies ?? {}) }
+    delete expandedDeps['@corgelabs/corge']
+    delete expandedDeps.esbuild
+    consumerPkg.dependencies = expandedDeps
+    writeFileSync(pkgJsonPath, JSON.stringify(consumerPkg, null, 2) + '\n', 'utf8')
+
+    const onlyTargets =
+      target === 'prod'
+        ? `functions:${project},functions:${project}-tasks,firestore:${project},storage`
+        : `functions:${project}-dev,functions:${project}-tasks-dev,firestore:${project}-dev,storage`
+
+    const deployRes = spawnSync(
+      'npx',
+      ['-y', 'firebase-tools@latest', 'deploy', '-P', project, '--only', onlyTargets],
+      { cwd, stdio: 'inherit' }
+    )
+    process.exitCode = deployRes.status ?? 1
+  } finally {
+    restoreFiles()
+  }
+}