@exposify/firebase 0.0.0-stage → 0.0.2

package/dist/index.cjs

@@ -0,0 +1,874 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  aiReady: () => aiReady,
+  callableUrl: () => callableUrl,
+  completeMcpLogin: () => import_core3.completeMcpLogin,
+  createFirebaseMcpHandler: () => createFirebaseMcpHandler,
+  createHostedAuthResolver: () => import_core3.createHostedAuthResolver,
+  firebaseToolsPhrase: () => firebaseToolsPhrase,
+  functionPublicUrl: () => functionPublicUrl,
+  hostedBroker: () => import_core3.hostedBroker,
+  parseCollectionKey: () => parseCollectionKey,
+  toNodeHandler: () => toNodeHandler
+});
+module.exports = __toCommonJS(index_exports);
+var import_core2 = require("@exposify/core");
+var import_node = require("@exposify/core/node");
+
+// src/path.ts
+var PARAM = /^\{([A-Za-z_][A-Za-z0-9_]*)\}$/;
+function parseCollectionKey(key) {
+  const segments = key.replace(/^\/+|\/+$/g, "").split("/");
+  if (segments.some((s) => s === "")) throw new Error("empty path segment");
+  if (segments.length % 2 === 0) {
+    throw new Error("names a document, not a collection (a collection path has an odd number of segments)");
+  }
+  const params = [];
+  segments.forEach((seg, i) => {
+    const param = seg.match(PARAM);
+    if (i % 2 === 0) {
+      if (seg.includes("{") || seg.includes("}")) throw new Error(`collection id "${seg}" can't be a placeholder`);
+      checkSegment(seg);
+    } else if (param) {
+      if (params.includes(param[1])) throw new Error(`placeholder {${param[1]}} appears twice`);
+      if (param[1] === "id") throw new Error("{id} is reserved for the document id argument; rename the placeholder");
+      params.push(param[1]);
+    } else {
+      if (seg.includes("{") || seg.includes("}")) throw new Error(`"${seg}" is not a valid {placeholder}`);
+      checkSegment(seg);
+    }
+  });
+  const suffix = sanitize(segments.filter((_, i) => i % 2 === 0).join("_"));
+  if (!suffix) throw new Error("collection ids produce an empty tool name");
+  return { segments, params, suffix };
+}
+function checkSegment(value) {
+  if (value.length === 0) throw new Error("must not be empty");
+  if (value.includes("/")) throw new Error("must not contain '/'");
+  if (value === "." || value === "..") throw new Error("must not be '.' or '..'");
+  if (/^__.*__$/.test(value)) throw new Error("must not match __.*__ (reserved by Firestore)");
+  if (new TextEncoder().encode(value).length > 1500) throw new Error("must be at most 1500 bytes");
+}
+function collectionPath(segments, args) {
+  return segments.map((seg) => {
+    const param = seg.match(PARAM);
+    if (!param) return encodeURIComponent(seg);
+    const value = args[param[1]];
+    if (typeof value !== "string") throw new Error(`${param[1]} is required`);
+    try {
+      checkSegment(value);
+    } catch (err) {
+      throw new Error(`${param[1]} ${err.message}`);
+    }
+    return encodeURIComponent(value);
+  }).join("/");
+}
+function documentPath(segments, args, id) {
+  try {
+    checkSegment(id);
+  } catch (err) {
+    throw new Error(`id ${err.message}`);
+  }
+  return `${collectionPath(segments, args)}/${encodeURIComponent(id)}`;
+}
+function sanitize(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "");
+}
+function toolName(prefix, suffix, taken) {
+  const base = `${prefix}_${sanitize(suffix)}`;
+  let candidate = base;
+  let i = 2;
+  while (taken.has(candidate)) candidate = `${base}_${i++}`;
+  taken.add(candidate);
+  return candidate;
+}
+
+// src/config.ts
+var LOG_PREFIX = "[exposify-firebase]";
+var WRITE_OPS = ["create", "update", "delete"];
+function parseWrites(writes = []) {
+  const grants = /* @__PURE__ */ new Map();
+  for (const entry of writes) {
+    const dot = entry.lastIndexOf(".");
+    const key = dot > 0 ? entry.slice(0, dot) : "";
+    const op = dot > 0 ? entry.slice(dot + 1) : "";
+    if (!key || !op) {
+      warnOnce(`ignoring malformed writes entry "${entry}" (expected "<collection>.create|update|delete|*")`);
+      continue;
+    }
+    const ops = op === "*" ? WRITE_OPS : WRITE_OPS.includes(op) ? [op] : null;
+    if (!ops) {
+      warnOnce(`ignoring writes entry "${entry}": "${op}" is not create, update, delete, or *`);
+      continue;
+    }
+    const set = grants.get(normalizeKey(key)) ?? /* @__PURE__ */ new Set();
+    for (const o of ops) set.add(o);
+    grants.set(normalizeKey(key), set);
+  }
+  return grants;
+}
+function normalizeKey(key) {
+  return key.replace(/^\/+|\/+$/g, "");
+}
+function resolveFirebaseConfig(options = {}, hostedBroker2 = false) {
+  const entries = Array.isArray(options.collections) ? options.collections.map((name) => [name, {}]) : Object.entries(options.collections ?? {});
+  const grants = parseWrites(options.writes);
+  const collections = [];
+  for (const [rawKey, config] of entries) {
+    const key = normalizeKey(rawKey);
+    let parsed;
+    try {
+      parsed = parseCollectionKey(key);
+    } catch (err) {
+      warnOnce(`ignoring collection "${rawKey}": ${err.message}`);
+      continue;
+    }
+    if (config.owner && parsed.params.includes(config.owner)) {
+      warnOnce(`collection "${rawKey}": owner "${config.owner}" is also a path placeholder; it is treated as a document field`);
+    }
+    collections.push({ key, ...parsed, config: config ?? {}, writes: grants.get(key) ?? /* @__PURE__ */ new Set() });
+  }
+  const known = new Set(collections.map((c) => c.key));
+  for (const key of grants.keys()) {
+    if (!known.has(key)) warnOnce(`writes names "${key}", which is not in collections; add it there to expose it`);
+  }
+  return {
+    collections,
+    functions: options.functions ?? {},
+    docs: options.docs ?? ["docs/**/*.md"],
+    docsAuth: options.docsAuth ?? (hostedBroker2 ? "required" : "public"),
+    maxDocs: options.maxDocs ?? 100,
+    databaseId: options.databaseId ?? "(default)",
+    functionsRegion: options.functionsRegion ?? "us-central1",
+    rateLimit: options.rateLimit,
+    rateWindowMs: options.rateWindowMs
+  };
+}
+function projectIdFromEnv(env) {
+  if (env.GCLOUD_PROJECT) return env.GCLOUD_PROJECT;
+  if (env.GOOGLE_CLOUD_PROJECT) return env.GOOGLE_CLOUD_PROJECT;
+  if (env.FIREBASE_CONFIG) {
+    try {
+      const parsed = JSON.parse(env.FIREBASE_CONFIG);
+      if (typeof parsed.projectId === "string") return parsed.projectId;
+    } catch {
+    }
+  }
+  return void 0;
+}
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(message) {
+  if (warned.has(message)) return;
+  warned.add(message);
+  try {
+    console.warn(`${LOG_PREFIX} ${message}`);
+  } catch {
+  }
+}
+
+// src/values.ts
+function encodeValue(value, schema) {
+  if (value === null || value === void 0) return { nullValue: null };
+  if (typeof value === "boolean") return { booleanValue: value };
+  if (typeof value === "number") {
+    if (Number.isInteger(value) && schema?.type !== "number") return { integerValue: String(value) };
+    return { doubleValue: value };
+  }
+  if (typeof value === "string") {
+    if (schema?.format === "date-time") {
+      const ms = Date.parse(value);
+      if (Number.isNaN(ms)) throw new Error(`"${value}" is not a date-time`);
+      return { timestampValue: new Date(ms).toISOString() };
+    }
+    return { stringValue: value };
+  }
+  if (Array.isArray(value)) {
+    return { arrayValue: { values: value.map((v) => encodeValue(v, schema?.items)) } };
+  }
+  if (typeof value === "object") {
+    return { mapValue: { fields: encodeFields(value, schema?.properties) } };
+  }
+  throw new Error(`unsupported value of type ${typeof value}`);
+}
+function encodeFields(data, schema) {
+  const fields = {};
+  for (const [key, v] of Object.entries(data)) {
+    if (v === void 0) continue;
+    fields[key] = encodeValue(v, schema?.[key]);
+  }
+  return fields;
+}
+function decodeValue(value) {
+  if ("nullValue" in value) return null;
+  if ("booleanValue" in value) return value.booleanValue;
+  if ("integerValue" in value) {
+    const n = Number(value.integerValue);
+    return Number.isSafeInteger(n) ? n : value.integerValue;
+  }
+  if ("doubleValue" in value) return Number(value.doubleValue);
+  if ("timestampValue" in value) return value.timestampValue;
+  if ("stringValue" in value) return value.stringValue;
+  if ("bytesValue" in value) return value.bytesValue;
+  if ("referenceValue" in value) return relativeDocPath(value.referenceValue);
+  if ("geoPointValue" in value) {
+    return { latitude: value.geoPointValue.latitude ?? 0, longitude: value.geoPointValue.longitude ?? 0 };
+  }
+  if ("arrayValue" in value) return (value.arrayValue.values ?? []).map(decodeValue);
+  if ("mapValue" in value) return decodeFields(value.mapValue.fields);
+  return null;
+}
+function decodeFields(fields) {
+  const out = {};
+  for (const [key, v] of Object.entries(fields ?? {})) out[key] = decodeValue(v);
+  return out;
+}
+function relativeDocPath(name) {
+  const marker = "/documents/";
+  const i = name.indexOf(marker);
+  return i === -1 ? name : name.slice(i + marker.length);
+}
+function decodeDocument(doc) {
+  const path = relativeDocPath(doc.name);
+  return {
+    id: path.slice(path.lastIndexOf("/") + 1),
+    path,
+    data: decodeFields(doc.fields),
+    createTime: doc.createTime,
+    updateTime: doc.updateTime
+  };
+}
+
+// src/firestore-client.ts
+function documentsBaseUrl(projectId, databaseId, emulatorHost) {
+  const origin = emulatorHost ? `http://${emulatorHost.replace(/^https?:\/\//, "")}` : "https://firestore.googleapis.com";
+  return `${origin}/v1/projects/${encodeURIComponent(projectId)}/databases/${encodeURIComponent(databaseId)}/documents`;
+}
+function createFirestoreClient(baseUrl, authorization, fetchImpl) {
+  const headers = { "content-type": "application/json" };
+  if (authorization) headers.authorization = authorization;
+  const call = async (url, init, decode) => {
+    const res = await fetchImpl(url, { ...init, headers });
+    const text = await res.text();
+    if (!res.ok) return { status: res.status, bodyText: text };
+    return { status: res.status, bodyText: JSON.stringify(decode(text ? JSON.parse(text) : {})) };
+  };
+  return {
+    runQuery: (parent, structuredQuery) => call(
+      `${baseUrl}${parent ? `/${parent}` : ""}:runQuery`,
+      { method: "POST", body: JSON.stringify({ structuredQuery }) },
+      (body) => body.filter((r) => r.document).map((r) => decodeDocument(r.document))
+    ),
+    get: (docPath) => call(`${baseUrl}/${docPath}`, { method: "GET" }, (body) => decodeDocument(body)),
+    create: (collectionPath2, id, fields) => call(
+      `${baseUrl}/${collectionPath2}${id ? `?documentId=${encodeURIComponent(id)}` : ""}`,
+      { method: "POST", body: JSON.stringify({ fields }) },
+      (body) => decodeDocument(body)
+    ),
+    update: (docPath, fields) => {
+      const params = new URLSearchParams();
+      for (const key of Object.keys(fields)) params.append("updateMask.fieldPaths", quoteSegment(key));
+      params.set("currentDocument.exists", "true");
+      return call(
+        `${baseUrl}/${docPath}?${params}`,
+        { method: "PATCH", body: JSON.stringify({ fields }) },
+        (body) => decodeDocument(body)
+      );
+    },
+    delete: (docPath) => call(`${baseUrl}/${docPath}?currentDocument.exists=true`, { method: "DELETE" }, () => ({ deleted: decodeURIComponent(docPath) }))
+  };
+}
+function quoteSegment(name) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? name : `\`${name.replace(/\\/g, "\\\\").replace(/`/g, "\\`")}\``;
+}
+
+// src/server.ts
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_zod2 = require("zod");
+var import_core = require("@exposify/core");
+
+// src/query.ts
+var WHERE_OPS = [
+  "==",
+  "!=",
+  "<",
+  "<=",
+  ">",
+  ">=",
+  "array-contains",
+  "in",
+  "not-in",
+  "array-contains-any"
+];
+var REST_OPS = {
+  "==": "EQUAL",
+  "!=": "NOT_EQUAL",
+  "<": "LESS_THAN",
+  "<=": "LESS_THAN_OR_EQUAL",
+  ">": "GREATER_THAN",
+  ">=": "GREATER_THAN_OR_EQUAL",
+  "array-contains": "ARRAY_CONTAINS",
+  in: "IN",
+  "not-in": "NOT_IN",
+  "array-contains-any": "ARRAY_CONTAINS_ANY"
+};
+var LIST_OPS = /* @__PURE__ */ new Set(["in", "not-in", "array-contains-any"]);
+function buildStructuredQuery(collectionId, args, maxDocs, fields) {
+  const filters = (args.where ?? []).map((w) => {
+    const schema = fields?.[w.field];
+    if (LIST_OPS.has(w.op) && !Array.isArray(w.value)) {
+      throw new Error(`"${w.op}" needs an array value`);
+    }
+    const valueSchema = w.op === "array-contains" ? schema?.items : LIST_OPS.has(w.op) && schema?.type !== "array" ? { type: "array", items: schema } : schema;
+    return {
+      fieldFilter: {
+        field: { fieldPath: fieldPath(w.field) },
+        op: REST_OPS[w.op],
+        value: encodeValue(w.value, valueSchema)
+      }
+    };
+  });
+  const query = {
+    from: [{ collectionId }],
+    limit: Math.min(args.limit ?? maxDocs, maxDocs)
+  };
+  if (filters.length === 1) query.where = filters[0];
+  if (filters.length > 1) query.where = { compositeFilter: { op: "AND", filters } };
+  if (args.orderBy?.length) {
+    query.orderBy = args.orderBy.map((o) => ({
+      field: { fieldPath: fieldPath(o.field) },
+      direction: o.direction === "desc" ? "DESCENDING" : "ASCENDING"
+    }));
+  }
+  if (args.select?.length) {
+    query.select = { fields: args.select.map((f) => ({ fieldPath: fieldPath(f) })) };
+  }
+  return query;
+}
+function fieldPath(path) {
+  return path.split(".").map((seg) => {
+    if (seg === "") throw new Error(`invalid field path "${path}"`);
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(seg) ? seg : `\`${seg.replace(/\\/g, "\\\\").replace(/`/g, "\\`")}\``;
+  }).join(".");
+}
+
+// src/jsonschema-to-zod.ts
+var import_zod = require("zod");
+function jsonSchemaToZodShape(schema) {
+  if (!schema?.properties) return {};
+  const required = new Set(schema.required ?? []);
+  const shape = {};
+  for (const [name, prop] of Object.entries(schema.properties)) {
+    let field = propertyToZod(prop);
+    if (!required.has(name)) field = field.optional();
+    shape[name] = field;
+  }
+  return shape;
+}
+function propertyToZod(prop) {
+  let base;
+  switch (prop.type) {
+    case "string":
+      base = prop.enum ? import_zod.z.enum(prop.enum) : import_zod.z.string();
+      break;
+    case "number":
+      base = import_zod.z.number();
+      break;
+    case "integer":
+      base = import_zod.z.number().int();
+      break;
+    case "boolean":
+      base = import_zod.z.boolean();
+      break;
+    case "array":
+      base = import_zod.z.array(prop.items ? propertyToZod(prop.items) : import_zod.z.unknown());
+      break;
+    case "object":
+      base = prop.properties ? import_zod.z.object(jsonSchemaToZodShape({ properties: prop.properties, required: prop.required })) : import_zod.z.record(import_zod.z.unknown());
+      break;
+    default:
+      base = import_zod.z.unknown();
+  }
+  return prop.description ? base.describe(prop.description) : base;
+}
+
+// src/server.ts
+function buildFirebaseMcpServer(deps) {
+  const { cfg, client, kb, incoming } = deps;
+  const server = new import_mcp.McpServer({ name: deps.appName, version: deps.appVersion });
+  const taken = /* @__PURE__ */ new Set(["search_docs"]);
+  for (const coll of cfg.collections) {
+    registerListTool(server, coll, deps, taken);
+    registerGetTool(server, coll, client, taken);
+    if (coll.writes.has("create")) registerCreateTool(server, coll, deps, taken);
+    if (coll.writes.has("update")) registerUpdateTool(server, coll, deps, taken);
+    if (coll.writes.has("delete")) registerDeleteTool(server, coll, client, taken);
+  }
+  for (const [name, config] of Object.entries(cfg.functions)) {
+    registerCallableTool(server, name, config, deps.invokeCallable, taken);
+  }
+  registerDocsTool(server, kb, cfg, incoming);
+  return server;
+}
+function paramShape(coll) {
+  const shape = {};
+  for (const p of coll.params) shape[p] = import_zod2.z.string().describe(`Path segment {${p}} of ${coll.key}`);
+  return shape;
+}
+function fieldNames(coll) {
+  return Object.keys(coll.config.fields ?? {});
+}
+function fieldArg(coll) {
+  const names = fieldNames(coll);
+  if (names.length === 0) return import_zod2.z.string().describe("Field name; dots address nested fields (address.city)");
+  return import_zod2.z.enum(names);
+}
+function describeCollection(coll) {
+  return coll.config.description ? ` ${coll.config.description.trim()}` : "";
+}
+function registerListTool(server, coll, deps, taken) {
+  const { cfg, client, uid } = deps;
+  const owner = coll.config.owner;
+  const name = toolName("list", coll.suffix, taken);
+  const ownerNote = owner ? ` Only returns documents whose ${owner} is the signed-in user.` : "";
+  server.registerTool(
+    name,
+    {
+      description: `List documents in ${coll.key}.${describeCollection(coll)}${ownerNote}`,
+      inputSchema: {
+        ...paramShape(coll),
+        where: import_zod2.z.array(
+          import_zod2.z.object({
+            field: fieldArg(coll),
+            op: import_zod2.z.enum(WHERE_OPS),
+            value: import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number(), import_zod2.z.boolean(), import_zod2.z.null(), import_zod2.z.array(import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number(), import_zod2.z.boolean()]))])
+          })
+        ).optional().describe("Filters, ANDed together. Firestore may ask for a composite index; the error links to create it."),
+        orderBy: import_zod2.z.array(import_zod2.z.object({ field: fieldArg(coll), direction: import_zod2.z.enum(["asc", "desc"]).optional() })).optional(),
+        limit: import_zod2.z.number().int().min(1).max(cfg.maxDocs).optional().describe(`Max documents (capped at ${cfg.maxDocs})`),
+        select: import_zod2.z.array(fieldArg(coll)).optional().describe("Fields to return; default all")
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async (args) => {
+      let parent;
+      let query;
+      try {
+        if (owner && !uid) return errorResult(`${coll.key} is scoped to the signed-in user; connect with a Firebase ID token.`);
+        const where = [...args.where ?? []];
+        if (owner) where.push({ field: owner, op: "==", value: uid });
+        const path = collectionPath(coll.segments, args);
+        parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+        query = buildStructuredQuery(coll.segments[coll.segments.length - 1], { ...args, where }, cfg.maxDocs, coll.config.fields);
+      } catch (err) {
+        return errorResult(err.message);
+      }
+      const result = await toResult(() => client.runQuery(parent, query));
+      if (result.isError && result.content[0].text.startsWith("HTTP 403") && !owner) {
+        result.content[0].text += "\nIf this collection's rules only allow reading your own documents, filter on the field that holds your uid.";
+      }
+      return result;
+    }
+  );
+}
+function registerGetTool(server, coll, client, taken) {
+  const name = toolName("get", coll.suffix, taken);
+  server.registerTool(
+    name,
+    {
+      description: `Get one document from ${coll.key} by id.${describeCollection(coll)}`,
+      inputSchema: { ...paramShape(coll), id: import_zod2.z.string().describe("Document id") },
+      annotations: { readOnlyHint: true }
+    },
+    async (args) => {
+      let path;
+      try {
+        path = documentPath(coll.segments, args, args.id);
+      } catch (err) {
+        return errorResult(err.message);
+      }
+      return toResult(() => client.get(path));
+    }
+  );
+}
+function dataShape(coll, partial) {
+  const fields = coll.config.fields;
+  if (!fields || Object.keys(fields).length === 0) return import_zod2.z.record(import_zod2.z.unknown()).describe("Document fields");
+  const required = new Set(partial ? [] : coll.config.required ?? []);
+  const shape = {};
+  for (const [field, prop] of Object.entries(fields)) {
+    if (field === coll.config.owner) continue;
+    const base = propertyToZod(prop);
+    shape[field] = required.has(field) ? base : base.optional();
+  }
+  return import_zod2.z.object(shape);
+}
+function registerCreateTool(server, coll, deps, taken) {
+  const { client, uid } = deps;
+  const owner = coll.config.owner;
+  const name = toolName("create", coll.suffix, taken);
+  server.registerTool(
+    name,
+    {
+      description: `Create a document in ${coll.key}.${describeCollection(coll)}${owner ? ` ${owner} is set to the signed-in user.` : ""}`,
+      inputSchema: {
+        ...paramShape(coll),
+        id: import_zod2.z.string().optional().describe("Document id; omit to let Firestore generate one"),
+        data: dataShape(coll, false)
+      },
+      annotations: { readOnlyHint: false, destructiveHint: false }
+    },
+    async (args) => {
+      let path;
+      let fields;
+      try {
+        if (owner && !uid) return errorResult(`${coll.key} is scoped to the signed-in user; connect with a Firebase ID token.`);
+        path = collectionPath(coll.segments, args);
+        if (args.id !== void 0) documentPath(coll.segments, args, args.id);
+        fields = encodeFields(owner ? { ...args.data, [owner]: uid } : args.data, coll.config.fields);
+      } catch (err) {
+        return errorResult(err.message);
+      }
+      return toResult(() => client.create(path, args.id, fields));
+    }
+  );
+}
+function registerUpdateTool(server, coll, deps, taken) {
+  const { client, uid } = deps;
+  const owner = coll.config.owner;
+  const name = toolName("update", coll.suffix, taken);
+  server.registerTool(
+    name,
+    {
+      description: `Update fields of one existing document in ${coll.key}. Only the given fields change.${describeCollection(coll)}`,
+      inputSchema: { ...paramShape(coll), id: import_zod2.z.string().describe("Document id"), data: dataShape(coll, true) },
+      annotations: { readOnlyHint: false, destructiveHint: true }
+    },
+    async (args) => {
+      let path;
+      let fields;
+      try {
+        if (Object.keys(args.data).length === 0) return errorResult("data must contain at least one field to update.");
+        if (owner && owner in args.data && args.data[owner] !== uid) {
+          return errorResult(`${owner} can't be changed: it holds the owning user's uid.`);
+        }
+        path = documentPath(coll.segments, args, args.id);
+        fields = encodeFields(args.data, coll.config.fields);
+      } catch (err) {
+        return errorResult(err.message);
+      }
+      return toResult(() => client.update(path, fields));
+    }
+  );
+}
+function registerDeleteTool(server, coll, client, taken) {
+  const name = toolName("delete", coll.suffix, taken);
+  server.registerTool(
+    name,
+    {
+      description: `Delete one document from ${coll.key} by id.${describeCollection(coll)}`,
+      inputSchema: { ...paramShape(coll), id: import_zod2.z.string().describe("Document id") },
+      annotations: { readOnlyHint: false, destructiveHint: true }
+    },
+    async (args) => {
+      let path;
+      try {
+        path = documentPath(coll.segments, args, args.id);
+      } catch (err) {
+        return errorResult(err.message);
+      }
+      return toResult(() => client.delete(path));
+    }
+  );
+}
+function registerCallableTool(server, name, config, invokeCallable, taken) {
+  server.registerTool(
+    toolName("call", name, taken),
+    { description: config.description, inputSchema: jsonSchemaToZodShape(config.input) },
+    async (args) => toResult(() => invokeCallable(name, args))
+  );
+}
+function registerDocsTool(server, kb, cfg, incoming) {
+  const docsAllowed = cfg.docsAuth === "public" || incoming.has("authorization");
+  if (!docsAllowed || kb.isEmpty) return;
+  server.registerTool(
+    "search_docs",
+    {
+      description: "Search this app's documentation and product knowledge.",
+      inputSchema: { query: import_zod2.z.string().describe("Search query"), limit: import_zod2.z.number().int().min(1).max(20).optional() },
+      annotations: { readOnlyHint: true }
+    },
+    async ({ query, limit }) => {
+      const hits = kb.search(query, limit ?? 5);
+      const text = hits.length ? hits.map((h) => `[${h.chunk.source} \u2014 ${h.chunk.heading}]
+${h.chunk.text}`).join("\n\n---\n\n") : "No matching documentation found.";
+      return { content: [{ type: "text", text }] };
+    }
+  );
+}
+function errorResult(text) {
+  return { content: [{ type: "text", text }], isError: true };
+}
+async function toResult(run) {
+  let timer;
+  try {
+    const outcome = await Promise.race([
+      run(),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("timeout")), import_core.DISPATCH_TIMEOUT_MS);
+      })
+    ]);
+    const result = (0, import_core.toToolResult)(outcome);
+    return { content: [{ type: "text", text: result.text }], isError: result.isError };
+  } catch (err) {
+    const message = err.message === "timeout" ? `Tool call timed out after ${import_core.DISPATCH_TIMEOUT_MS / 1e3}s` : "Tool call failed reaching Firebase.";
+    return { content: [{ type: "text", text: message }], isError: true };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/node-bridge.ts
+function toNodeHandler(handle) {
+  return async (req, res) => {
+    let response;
+    try {
+      response = await handle(await toWebRequest(req));
+    } catch (err) {
+      console.error("[exposify-firebase] MCP request failed", err);
+      response = Response.json({ error: "internal MCP server error" }, { status: 503 });
+    }
+    res.statusCode = response.status;
+    response.headers.forEach((value, name) => res.setHeader(name, value));
+    if (!response.body) {
+      res.end();
+      return;
+    }
+    const reader = response.body.getReader();
+    res.on("close", () => void reader.cancel().catch(() => {
+    }));
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        res.write(value);
+      }
+    } catch {
+    } finally {
+      res.end();
+    }
+  };
+}
+async function toWebRequest(req) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (typeof value === "string") headers.set(name, value);
+    else if (Array.isArray(value)) headers.set(name, value.join(", "));
+  }
+  const url = new URL(req.originalUrl ?? req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  const method = req.method ?? "GET";
+  if (method === "GET" || method === "HEAD") return new Request(url, { method, headers });
+  let body;
+  if (req.rawBody) body = new Uint8Array(req.rawBody);
+  else if (req.body !== void 0) body = typeof req.body === "string" ? req.body : JSON.stringify(req.body);
+  else body = await readStream(req);
+  headers.delete("content-length");
+  headers.delete("transfer-encoding");
+  return new Request(url, { method, headers, body });
+}
+async function readStream(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  return new Uint8Array(Buffer.concat(chunks));
+}
+
+// src/token.ts
+function uidFromAuthorization(authorization) {
+  const match = authorization?.match(/^Bearer\s+([^.\s]+)\.([^.\s]+)\.[^.\s]*$/i);
+  if (!match) return null;
+  try {
+    const payload = JSON.parse(base64UrlDecode(match[2]));
+    const uid = typeof payload.user_id === "string" ? payload.user_id : payload.sub;
+    return typeof uid === "string" && uid.length > 0 ? uid : null;
+  } catch {
+    return null;
+  }
+}
+function base64UrlDecode(segment) {
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(segment.length / 4) * 4, "=");
+  const binary = atob(b64);
+  return new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+}
+
+// src/index.ts
+var import_core3 = require("@exposify/core");
+function aiReady(options = {}) {
+  return toNodeHandler(createFirebaseMcpHandler(options));
+}
+function createFirebaseMcpHandler(options = {}) {
+  const env = options.env ?? globalThis.process?.env ?? {};
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const projectId = options.projectId ?? projectIdFromEnv(env);
+  const logReady = (0, import_core2.startupLogEnabled)(options.startupLog);
+  const functionName = env.K_SERVICE ?? env.FUNCTION_TARGET;
+  const endpoint = functionName ? `function ${functionName}` : "this function";
+  const envAuth = options.auth ? void 0 : (0, import_core2.hostedResolverFromEnv)();
+  const auth = options.auth ?? envAuth;
+  const authRequired = options.authRequired ?? (envAuth !== void 0 || (0, import_core2.isHostedResolver)(auth));
+  const cfg = resolveFirebaseConfig(options, (0, import_core2.isHostedResolver)(auth));
+  const authLabel = (0, import_core2.isHostedResolver)(auth) ? "hosted broker (EXPOSIFY_KEY)" : auth ? "custom resolver" : "passthrough (caller's Firebase ID token)";
+  if (!projectId) {
+    console.error((0, import_core2.formatFailed)(LOG_PREFIX, "no Firebase project id", "deployed functions get GCLOUD_PROJECT automatically; elsewhere pass { projectId }"));
+  } else if (cfg.collections.length === 0 && Object.keys(cfg.functions).length === 0) {
+    console.warn((0, import_core2.formatWarning)(LOG_PREFIX, "no collections or functions configured, so agents only get search_docs", "list collections in aiReady({ collections })"));
+  }
+  const baseUrl = projectId ? documentsBaseUrl(projectId, cfg.databaseId, env.FIRESTORE_EMULATOR_HOST) : "";
+  let kbPromise = null;
+  let docCount = 0;
+  const getKb = () => {
+    kbPromise ??= (async () => {
+      try {
+        const cwd = options.docsRoot ?? globalThis.process?.cwd() ?? ".";
+        const docs = await (0, import_node.loadDocsFromFs)(cfg.docs, cwd);
+        docCount = docs.length;
+        return import_core2.KnowledgeBase.build(docs);
+      } catch {
+        return import_core2.KnowledgeBase.build([]);
+      }
+    })();
+    return kbPromise;
+  };
+  let coldStartLogged = false;
+  const resolvedAuth = /* @__PURE__ */ new WeakMap();
+  const core = (0, import_core2.createWebMcpHandler)(
+    {
+      getServer: async (req) => {
+        if (!projectId) throw new Error("No Firebase project id: set GCLOUD_PROJECT or pass { projectId }.");
+        const incoming = req.headers;
+        const authorization = (resolvedAuth.get(req) ?? incoming).get("authorization");
+        const kb = await getKb();
+        if (!coldStartLogged) {
+          coldStartLogged = true;
+          if (logReady) {
+            try {
+              console.log((0, import_core2.formatReady)(LOG_PREFIX, { endpoint, tools: firebaseToolsPhrase(cfg, docCount > 0), docs: docCount, auth: authLabel }));
+            } catch {
+            }
+          }
+        }
+        const invokeCallable = async (name, data) => {
+          const url = cfg.functions[name]?.url ?? callableUrl(name, projectId, cfg.functionsRegion, env);
+          const res = await fetchImpl(url, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...authorization ? { authorization } : {} },
+            body: JSON.stringify({ data: data ?? {} })
+          });
+          const text = await res.text();
+          if (!res.ok) return { status: res.status, bodyText: text };
+          try {
+            return { status: res.status, bodyText: JSON.stringify(JSON.parse(text).result ?? null) };
+          } catch {
+            return { status: res.status, bodyText: text };
+          }
+        };
+        return buildFirebaseMcpServer({
+          appName: "exposify-firebase",
+          appVersion: "0.0.0",
+          cfg,
+          client: createFirestoreClient(baseUrl, authorization, fetchImpl),
+          kb,
+          incoming,
+          uid: uidFromAuthorization(authorization),
+          invokeCallable
+        });
+      }
+    },
+    { rateLimit: cfg.rateLimit, rateWindowMs: cfg.rateWindowMs }
+  );
+  if (!auth) return core;
+  const brokerGate = authRequired ? (0, import_core2.createBrokerGate)(auth) : null;
+  return async (req) => {
+    let open = false;
+    if (brokerGate) {
+      const own = (0, import_core2.publicRequestUrl)(req.url, req.headers);
+      const isPrm = own.endsWith(import_core2.PRM_PATH);
+      const resource = brokerGate.resourceFor(functionPublicUrl(isPrm ? own.slice(0, -import_core2.PRM_PATH.length) : own, functionName));
+      open = await (0, import_core2.reportAppLogin)(auth, resource, null, { stacks: ["firebase-admin"], why: "Firebase Auth sign-in for agents is the Firebase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      if (open) {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        const result = await brokerGate.check(req.headers, resource, `${resource}${import_core2.PRM_PATH}`);
+        if (!result.ok) return result.response;
+      }
+    }
+    let resolved;
+    try {
+      resolved = await auth(req.headers, {});
+    } catch (err) {
+      console.error(`${LOG_PREFIX} auth resolver failed`, err);
+      return Response.json({ error: "internal MCP server error" }, { status: 503 });
+    }
+    if (authRequired && !open && !resolved.get("authorization")) {
+      return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
+    }
+    resolvedAuth.set(req, resolved);
+    return core(req);
+  };
+}
+function functionPublicUrl(own, functionName) {
+  const url = new URL(own);
+  const path = url.pathname.replace(/\/+$/, "");
+  if (functionName && url.hostname.endsWith(".cloudfunctions.net") && path !== `/${functionName}` && !path.startsWith(`/${functionName}/`)) {
+    url.pathname = `/${functionName}${path}`;
+  }
+  return url.toString();
+}
+function callableUrl(name, projectId, region, env) {
+  const emulator = env.FUNCTIONS_EMULATOR_HOST;
+  if (emulator) return `http://${emulator.replace(/^https?:\/\//, "")}/${projectId}/${region}/${name}`;
+  return `https://${region}-${projectId}.cloudfunctions.net/${name}`;
+}
+function firebaseToolsPhrase(cfg, hasDocs) {
+  const reads = cfg.collections.length;
+  const writes = cfg.collections.reduce((n, c) => n + c.writes.size, 0);
+  const callables = Object.keys(cfg.functions).length;
+  const parts = [`${reads} list`, `${reads} get`];
+  if (writes) parts.push(`${writes} write`);
+  if (callables) parts.push(`${callables} callable`);
+  if (hasDocs) parts.push("search_docs");
+  const total = reads * 2 + writes + callables + (hasDocs ? 1 : 0);
+  return `${total} tool${total === 1 ? "" : "s"} (${parts.join(", ")})`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  aiReady,
+  callableUrl,
+  completeMcpLogin,
+  createFirebaseMcpHandler,
+  createHostedAuthResolver,
+  firebaseToolsPhrase,
+  functionPublicUrl,
+  hostedBroker,
+  parseCollectionKey,
+  toNodeHandler
+});