firebase-tools 13.7.3 → 13.7.5

package/lib/api.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.githubOrigin = exports.apphostingOrigin = exports.serviceUsageOrigin = exports.cloudRunApiOrigin = exports.hostingApiOrigin = exports.firebaseStorageOrigin = exports.storageOrigin = exports.runtimeconfigOrigin = exports.rulesOrigin = exports.resourceManagerOrigin = exports.remoteConfigApiOrigin = exports.rtdbMetadataOrigin = exports.rtdbManagementOrigin = exports.realtimeOrigin = exports.extensionsTOSOrigin = exports.extensionsPublisherOrigin = exports.extensionsOrigin = exports.iamOrigin = exports.identityOrigin = exports.hostingOrigin = exports.googleOrigin = exports.pubsubOrigin = exports.cloudTasksOrigin = exports.cloudschedulerOrigin = exports.developerConnectP4SAOrigin = exports.developerConnectOrigin = exports.cloudbuildOrigin = exports.functionsDefaultRegion = exports.runOrigin = exports.functionsV2Origin = exports.functionsOrigin = exports.firestoreOrigin = exports.firestoreOriginOrEmulator = exports.firedataOrigin = exports.firebaseExtensionsRegistryOrigin = exports.firebaseApiOrigin = exports.eventarcOrigin = exports.dynamicLinksKey = exports.dynamicLinksOrigin = exports.consoleOrigin = exports.authOrigin = exports.appDistributionOrigin = exports.artifactRegistryDomain = exports.containerRegistryDomain = exports.cloudMonitoringOrigin = exports.cloudloggingOrigin = exports.cloudbillingOrigin = exports.clientSecret = exports.clientId = exports.authProxyOrigin = void 0;
-exports.setScopes = exports.getScopes = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = void 0;
+exports.serviceUsageOrigin = exports.cloudRunApiOrigin = exports.hostingApiOrigin = exports.firebaseStorageOrigin = exports.storageOrigin = exports.runtimeconfigOrigin = exports.rulesOrigin = exports.resourceManagerOrigin = exports.remoteConfigApiOrigin = exports.rtdbMetadataOrigin = exports.rtdbManagementOrigin = exports.realtimeOrigin = exports.extensionsTOSOrigin = exports.extensionsPublisherOrigin = exports.extensionsOrigin = exports.iamOrigin = exports.identityOrigin = exports.hostingOrigin = exports.googleOrigin = exports.pubsubOrigin = exports.cloudTasksOrigin = exports.cloudschedulerOrigin = exports.cloudbuildOrigin = exports.functionsDefaultRegion = exports.runOrigin = exports.functionsV2Origin = exports.functionsOrigin = exports.firestoreOrigin = exports.firestoreOriginOrEmulator = exports.firedataOrigin = exports.firebaseExtensionsRegistryOrigin = exports.firebaseApiOrigin = exports.eventarcOrigin = exports.dynamicLinksKey = exports.dynamicLinksOrigin = exports.consoleOrigin = exports.authOrigin = exports.apphostingP4SADomain = exports.apphostingOrigin = exports.appDistributionOrigin = exports.artifactRegistryDomain = exports.developerConnectP4SADomain = exports.developerConnectOrigin = exports.containerRegistryDomain = exports.cloudMonitoringOrigin = exports.cloudloggingOrigin = exports.cloudbillingOrigin = exports.clientSecret = exports.clientId = exports.authProxyOrigin = void 0;
+exports.setScopes = exports.getScopes = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = exports.githubOrigin = void 0;
 const constants_1 = require("./emulator/constants");
 const logger_1 = require("./logger");
 const scopes = require("./scopes");
@@ -21,10 +21,18 @@ const cloudMonitoringOrigin = () => utils.envOverride("CLOUD_MONITORING_URL", "h
 exports.cloudMonitoringOrigin = cloudMonitoringOrigin;
 const containerRegistryDomain = () => utils.envOverride("CONTAINER_REGISTRY_DOMAIN", "gcr.io");
 exports.containerRegistryDomain = containerRegistryDomain;
+const developerConnectOrigin = () => utils.envOverride("DEVELOPERCONNECT_URL", "https://developerconnect.googleapis.com");
+exports.developerConnectOrigin = developerConnectOrigin;
+const developerConnectP4SADomain = () => utils.envOverride("DEVELOPERCONNECT_P4SA_DOMAIN", "gcp-sa-devconnect.iam.gserviceaccount.com");
+exports.developerConnectP4SADomain = developerConnectP4SADomain;
 const artifactRegistryDomain = () => utils.envOverride("ARTIFACT_REGISTRY_DOMAIN", "https://artifactregistry.googleapis.com");
 exports.artifactRegistryDomain = artifactRegistryDomain;
 const appDistributionOrigin = () => utils.envOverride("FIREBASE_APP_DISTRIBUTION_URL", "https://firebaseappdistribution.googleapis.com");
 exports.appDistributionOrigin = appDistributionOrigin;
+const apphostingOrigin = () => utils.envOverride("FIREBASE_APPHOSTING_URL", "https://firebaseapphosting.googleapis.com");
+exports.apphostingOrigin = apphostingOrigin;
+const apphostingP4SADomain = () => utils.envOverride("FIREBASE_APPHOSTING_P4SA_DOMAIN", "gcp-sa-firebaseapphosting.iam.gserviceaccount.com");
+exports.apphostingP4SADomain = apphostingP4SADomain;
 const authOrigin = () => utils.envOverride("FIREBASE_AUTH_URL", "https://accounts.google.com");
 exports.authOrigin = authOrigin;
 const consoleOrigin = () => utils.envOverride("FIREBASE_CONSOLE_URL", "https://console.firebase.google.com");
@@ -60,10 +68,6 @@ const functionsDefaultRegion = () => utils.envOverride("FIREBASE_FUNCTIONS_DEFAU
 exports.functionsDefaultRegion = functionsDefaultRegion;
 const cloudbuildOrigin = () => utils.envOverride("FIREBASE_CLOUDBUILD_URL", "https://cloudbuild.googleapis.com");
 exports.cloudbuildOrigin = cloudbuildOrigin;
-const developerConnectOrigin = () => utils.envOverride("FIREBASE_DEVELOPERCONNECT_URL", "https://developerconnect.googleapis.com");
-exports.developerConnectOrigin = developerConnectOrigin;
-const developerConnectP4SAOrigin = () => utils.envOverride("FIREBASE_DEVELOPERCONNECT_P4SA_URL", "gcp-sa-devconnect.iam.gserviceaccount.com");
-exports.developerConnectP4SAOrigin = developerConnectP4SAOrigin;
 const cloudschedulerOrigin = () => utils.envOverride("FIREBASE_CLOUDSCHEDULER_URL", "https://cloudscheduler.googleapis.com");
 exports.cloudschedulerOrigin = cloudschedulerOrigin;
 const cloudTasksOrigin = () => utils.envOverride("FIREBASE_CLOUD_TAKS_URL", "https://cloudtasks.googleapis.com");
@@ -108,8 +112,6 @@ const cloudRunApiOrigin = () => utils.envOverride("CLOUD_RUN_API_URL", "https://
 exports.cloudRunApiOrigin = cloudRunApiOrigin;
 const serviceUsageOrigin = () => utils.envOverride("FIREBASE_SERVICE_USAGE_URL", "https://serviceusage.googleapis.com");
 exports.serviceUsageOrigin = serviceUsageOrigin;
-const apphostingOrigin = () => utils.envOverride("APPHOSTING_URL", "https://firebaseapphosting.googleapis.com");
-exports.apphostingOrigin = apphostingOrigin;
 const githubOrigin = () => utils.envOverride("GITHUB_URL", "https://github.com");
 exports.githubOrigin = githubOrigin;
 const githubApiOrigin = () => utils.envOverride("GITHUB_API_URL", "https://api.github.com");

package/lib/apphosting/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALLOWED_DEPLOY_METHODS = exports.DEFAULT_DEPLOY_METHOD = exports.DEFAULT_REGION = void 0;
-exports.DEFAULT_REGION = "us-central1";
+exports.ALLOWED_DEPLOY_METHODS = exports.DEFAULT_DEPLOY_METHOD = exports.DEFAULT_LOCATION = void 0;
+exports.DEFAULT_LOCATION = "us-central1";
 exports.DEFAULT_DEPLOY_METHOD = "github";
 exports.ALLOWED_DEPLOY_METHODS = [{ name: "Deploy using github", value: "github" }];

package/lib/apphosting/githubConnections.js

@@ -89,7 +89,7 @@ async function createFullyInstalledConnection(projectId, location, connectionId,
     });
     while (conn.installationState.stage !== "COMPLETE") {
         utils.logBullet("Install the Firebase GitHub app to enable access to GitHub repositories");
-        const targetUri = conn.installationState.actionUri.replace("install_v2", "direct_install_v2");
+        const targetUri = conn.installationState.actionUri;
         utils.logBullet(targetUri);
         await utils.openInBrowser(targetUri);
         await (0, prompt_1.promptOnce)({

package/lib/apphosting/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteBackendAndPoll = exports.orchestrateRollout = exports.setDefaultTrafficPolicy = exports.createBackend = exports.doSetup = void 0;
+exports.promptLocation = exports.deleteBackendAndPoll = exports.orchestrateRollout = exports.setDefaultTrafficPolicy = exports.createBackend = exports.ensureAppHostingComputeServiceAccount = exports.doSetup = void 0;
 const repo = require("./repo");
 const poller = require("../operation-poller");
 const apphosting = require("../gcp/apphosting");
@@ -30,24 +30,19 @@ async function doSetup(projectId, webAppName, location, serviceAccount, withDevC
         (0, ensureApiEnabled_1.ensure)(projectId, (0, api_1.secretManagerOrigin)(), "apphosting", true),
         (0, ensureApiEnabled_1.ensure)(projectId, (0, api_1.cloudRunApiOrigin)(), "apphosting", true),
         (0, ensureApiEnabled_1.ensure)(projectId, (0, api_1.artifactRegistryDomain)(), "apphosting", true),
+        (0, ensureApiEnabled_1.ensure)(projectId, (0, api_1.iamOrigin)(), "apphosting", true),
     ]);
+    (0, utils_1.logBullet)("First we need a few details to create your backend.\n");
+    await ensureAppHostingComputeServiceAccount(projectId, serviceAccount);
     const allowedLocations = (await apphosting.listLocations(projectId)).map((loc) => loc.locationId);
     if (location) {
         if (!allowedLocations.includes(location)) {
             throw new error_1.FirebaseError(`Invalid location ${location}. Valid choices are ${allowedLocations.join(", ")}`);
         }
     }
-    (0, utils_1.logBullet)("First we need a few details to create your backend.\n");
     location =
-        location ||
-            (await (0, prompt_1.promptOnce)({
-                name: "region",
-                type: "list",
-                default: constants_1.DEFAULT_REGION,
-                message: "Select a region to host your backend:\n",
-                choices: allowedLocations.map((loc) => ({ value: loc })),
-            }));
-    (0, utils_1.logSuccess)(`Region set to ${location}.\n`);
+        location || (await promptLocation(projectId, "Select a location to host your backend:\n"));
+    (0, utils_1.logSuccess)(`Location set to ${location}.\n`);
     const backendId = await promptNewBackendId(projectId, location, {
         name: "backendId",
         type: "input",
@@ -100,6 +95,25 @@ async function doSetup(projectId, webAppName, location, serviceAccount, withDevC
     (0, utils_1.logSuccess)(`Your backend is now deployed at:\n\thttps://${backend.uri}`);
 }
 exports.doSetup = doSetup;
+async function ensureAppHostingComputeServiceAccount(projectId, serviceAccount) {
+    const sa = serviceAccount || defaultComputeServiceAccountEmail(projectId);
+    const name = `projects/${projectId}/serviceAccounts/${sa}`;
+    try {
+        await iam.testResourceIamPermissions((0, api_1.iamOrigin)(), "v1", name, ["iam.serviceAccounts.actAs"], `projects/${projectId}`);
+    }
+    catch (err) {
+        if (!(err instanceof error_1.FirebaseError)) {
+            throw err;
+        }
+        if (err.status === 404) {
+            await provisionDefaultComputeServiceAccount(projectId);
+        }
+        else if (err.status === 403) {
+            throw new error_1.FirebaseError(`Failed to create backend due to missing delegation permissions for ${sa}. Make sure you have the iam.serviceAccounts.actAs permission.`, { original: err });
+        }
+    }
+}
+exports.ensureAppHostingComputeServiceAccount = ensureAppHostingComputeServiceAccount;
 async function promptNewBackendId(projectId, location, prompt) {
     while (true) {
         const backendId = await (0, prompt_1.promptOnce)(prompt);
@@ -130,31 +144,16 @@ async function createBackend(projectId, location, backendId, repository, service
         serviceAccount: serviceAccount || defaultServiceAccount,
         appId: webAppId,
     };
-    delete backendReqBody.serviceAccount;
     async function createBackendAndPoll() {
         const op = await apphosting.createBackend(projectId, location, backendReqBody, backendId);
         return await poller.pollOperation(Object.assign(Object.assign({}, apphostingPollerOptions), { pollerName: `create-${projectId}-${location}-${backendId}`, operationResourceName: op.name }));
     }
-    try {
-        return await createBackendAndPoll();
-    }
-    catch (err) {
-        if (err.status === 403) {
-            if (err.message.includes(defaultServiceAccount)) {
-                await provisionDefaultComputeServiceAccount(projectId);
-                return await createBackendAndPoll();
-            }
-            else if (serviceAccount && err.message.includes(serviceAccount)) {
-                throw new error_1.FirebaseError(`Failed to create backend due to missing delegation permissions for ${serviceAccount}. Make sure you have the iam.serviceAccounts.actAs permission.`, { children: [err] });
-            }
-        }
-        throw err;
-    }
+    return await createBackendAndPoll();
 }
 exports.createBackend = createBackend;
 async function provisionDefaultComputeServiceAccount(projectId) {
     try {
-        await iam.createServiceAccount(projectId, DEFAULT_COMPUTE_SERVICE_ACCOUNT_NAME, "Firebase App Hosting compute service account", "Default service account used to run builds and deploys for Firebase App Hosting");
+        await iam.createServiceAccount(projectId, DEFAULT_COMPUTE_SERVICE_ACCOUNT_NAME, "Default service account used to run builds and deploys for Firebase App Hosting", "Firebase App Hosting compute service account");
     }
     catch (err) {
         if (err.status !== 409) {
@@ -162,11 +161,9 @@ async function provisionDefaultComputeServiceAccount(projectId) {
         }
     }
     await (0, resourceManager_1.addServiceAccountToRoles)(projectId, defaultComputeServiceAccountEmail(projectId), [
-        "roles/firebaseapphosting.viewer",
-        "roles/artifactregistry.createOnPushWriter",
-        "roles/logging.logWriter",
-        "roles/storage.objectAdmin",
+        "roles/firebaseapphosting.computeRunner",
         "roles/firebase.sdkAdminServiceAgent",
+        "roles/developerconnect.tokenAccessor",
     ], true);
 }
 async function setDefaultTrafficPolicy(projectId, location, backendId, codebaseBranch) {
@@ -185,8 +182,12 @@ async function setDefaultTrafficPolicy(projectId, location, backendId, codebaseB
     await poller.pollOperation(Object.assign(Object.assign({}, apphostingPollerOptions), { pollerName: `updateTraffic-${projectId}-${location}-${backendId}`, operationResourceName: op.name }));
 }
 exports.setDefaultTrafficPolicy = setDefaultTrafficPolicy;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function orchestrateRollout(projectId, location, backendId, buildInput) {
     (0, utils_1.logBullet)("Starting a new rollout... this may take a few minutes.");
+    await delay(45 * 1000);
     const buildId = await apphosting.getNextRolloutId(projectId, location, backendId, 1);
     const buildOp = await apphosting.createBuild(projectId, location, backendId, buildId, buildInput);
     const rolloutBody = {
@@ -233,3 +234,14 @@ async function deleteBackendAndPoll(projectId, location, backendId) {
     await poller.pollOperation(Object.assign(Object.assign({}, apphostingPollerOptions), { pollerName: `delete-${projectId}-${location}-${backendId}`, operationResourceName: op.name }));
 }
 exports.deleteBackendAndPoll = deleteBackendAndPoll;
+async function promptLocation(projectId, prompt = "Please select a location:") {
+    const allowedLocations = (await apphosting.listLocations(projectId)).map((loc) => loc.locationId);
+    return (await (0, prompt_1.promptOnce)({
+        name: "location",
+        type: "list",
+        default: constants_1.DEFAULT_LOCATION,
+        message: prompt,
+        choices: allowedLocations,
+    }));
+}
+exports.promptLocation = promptLocation;

package/lib/apphosting/repo.js

@@ -86,7 +86,7 @@ async function createFullyInstalledConnection(projectId, location, connectionId,
     });
     while (conn.installationState.stage !== "COMPLETE") {
         utils.logBullet("Install the Cloud Build GitHub app to enable access to GitHub repositories");
-        const targetUri = conn.installationState.actionUri.replace("install_v2", "direct_install_v2");
+        const targetUri = conn.installationState.actionUri;
         utils.logBullet(targetUri);
         await utils.openInBrowser(targetUri);
         await (0, prompt_1.promptOnce)({

package/lib/apphosting/secrets/index.js

@@ -5,6 +5,7 @@ const error_1 = require("../../error");
 const gcsm = require("../../gcp/secretManager");
 const gcb = require("../../gcp/cloudbuild");
 const gce = require("../../gcp/computeEngine");
+const apphosting = require("../../gcp/apphosting");
 const secretManager_1 = require("../../gcp/secretManager");
 const secretManager_2 = require("../../gcp/secretManager");
 const utils = require("../../utils");
@@ -33,7 +34,8 @@ function serviceAccountsForBackend(projectNumber, backend) {
     };
 }
 exports.serviceAccountsForBackend = serviceAccountsForBackend;
-async function grantSecretAccess(projectId, secretName, accounts) {
+async function grantSecretAccess(projectId, projectNumber, secretName, accounts) {
+    const p4saEmail = apphosting.serviceAgentEmail(projectNumber);
     const newBindings = [
         {
             role: "roles/secretmanager.secretAccessor",
@@ -43,6 +45,10 @@ async function grantSecretAccess(projectId, secretName, accounts) {
             role: "roles/secretmanager.viewer",
             members: accounts.buildServiceAccounts.map((sa) => `serviceAccount:${sa}`),
         },
+        {
+            role: "roles/secretmanager.secretVersionManager",
+            members: [`serviceAccount:${p4saEmail}`],
+        },
     ];
     let existingBindings;
     try {

package/lib/commands/apphosting-backends-create.js

@@ -9,9 +9,9 @@ const apphosting_2 = require("../gcp/apphosting");
 exports.command = new command_1.Command("apphosting:backends:create")
     .description("create a Firebase App Hosting backend")
     .option("-a, --app <webApp>", "specify an existing Firebase web app to associate your App Hosting backend with")
-    .option("-l, --location <location>", "specify the region of the backend", "")
+    .option("-l, --location <location>", "specify the location of the backend", "")
     .option("-s, --service-account <serviceAccount>", "specify the service account used to run the server", "")
-    .option("-w, --with-dev-connect", "use the Developer Connect flow insetad of Cloud Build Repositories (testing)", false)
+    .option("-w, --with-dev-connect", "use the Developer Connect flow instead of Cloud Build Repositories (testing)", true)
     .before(apphosting_2.ensureApiEnabled)
     .before(requireInteractive_1.default)
     .action(async (options) => {

package/lib/commands/apphosting-backends-delete.js

@@ -5,32 +5,21 @@ const command_1 = require("../command");
 const projectUtils_1 = require("../projectUtils");
 const error_1 = require("../error");
 const prompt_1 = require("../prompt");
-const constants_1 = require("../apphosting/constants");
 const utils = require("../utils");
 const apphosting = require("../gcp/apphosting");
 const apphosting_backends_list_1 = require("./apphosting-backends-list");
 const apphosting_1 = require("../apphosting");
 exports.command = new command_1.Command("apphosting:backends:delete <backend>")
     .description("delete a Firebase App Hosting backend")
-    .option("-l, --location <location>", "specify the region of the backend", "")
+    .option("-l, --location <location>", "specify the location of the backend", "")
     .withForce()
     .before(apphosting.ensureApiEnabled)
     .action(async (backendId, options) => {
     const projectId = (0, projectUtils_1.needProjectId)(options);
     let location = options.location;
-    if (!backendId) {
-        throw new error_1.FirebaseError("Backend id can't be empty.");
-    }
-    if (!location) {
-        const allowedLocations = (await apphosting.listLocations(projectId)).map((loc) => loc.locationId);
-        location = await (0, prompt_1.promptOnce)({
-            name: "region",
-            type: "list",
-            default: constants_1.DEFAULT_REGION,
-            message: "Please select the region of the backend you'd like to delete:",
-            choices: allowedLocations,
-        });
-    }
+    location =
+        location ||
+            (await (0, apphosting_1.promptLocation)(projectId, "Please select the location of the backend you'd like to delete:"));
     let backend;
     try {
         backend = await apphosting.getBackend(projectId, location, backendId);

package/lib/commands/apphosting-backends-list.js

@@ -8,7 +8,7 @@ const logger_1 = require("../logger");
 const projectUtils_1 = require("../projectUtils");
 const apphosting = require("../gcp/apphosting");
 const Table = require("cli-table");
-const TABLE_HEAD = ["Backend ID", "Repository", "Location", "URL", "Created Date", "Updated Date"];
+const TABLE_HEAD = ["Backend", "Repository", "URL", "Location", "Updated Date"];
 exports.command = new command_1.Command("apphosting:backends:list")
     .description("list Firebase App Hosting backends")
     .option("-l, --location <location>", "list backends in the specified location", "-")
@@ -39,9 +39,8 @@ function printBackendsTable(backends) {
         table.push([
             backendId,
             (_c = (_b = (_a = backend.codebase) === null || _a === void 0 ? void 0 : _a.repository) === null || _b === void 0 ? void 0 : _b.split("/").pop()) !== null && _c !== void 0 ? _c : "",
-            backendLocation,
             backend.uri.startsWith("https:") ? backend.uri : "https://" + backend.uri,
-            (0, utils_1.datetimeString)(new Date(backend.createTime)),
+            backendLocation,
             (0, utils_1.datetimeString)(new Date(backend.updateTime)),
         ]);
     }

package/lib/commands/apphosting-secrets-access.js

@@ -8,7 +8,7 @@ const secretManager_1 = require("../gcp/secretManager");
 const requireAuth_1 = require("../requireAuth");
 const secretManager = require("../gcp/secretManager");
 const requirePermissions_1 = require("../requirePermissions");
-exports.command = new command_1.Command("apphosting:secrets:access <secretName>[@version]")
+exports.command = new command_1.Command("apphosting:secrets:access <secretName[@version]>")
     .description("Access secret value given secret and its version. Defaults to accessing the latest version.")
     .before(requireAuth_1.requireAuth)
     .before(secretManager.ensureApi)

package/lib/commands/apphosting-secrets-grantaccess.js

@@ -9,6 +9,7 @@ const secretManager = require("../gcp/secretManager");
 const requirePermissions_1 = require("../requirePermissions");
 const apphosting = require("../gcp/apphosting");
 const secrets = require("../apphosting/secrets");
+const apphosting_1 = require("../apphosting");
 exports.command = new command_1.Command("apphosting:secrets:grantaccess <secretName>")
     .description("grant service accounts permissions to the provided secret")
     .option("-l, --location <location>", "backend location")
@@ -27,13 +28,12 @@ exports.command = new command_1.Command("apphosting:secrets:grantaccess <secretN
     .action(async (secretName, options) => {
     const projectId = (0, projectUtils_1.needProjectId)(options);
     const projectNumber = await (0, projectUtils_1.needProjectNumber)(options);
-    if (!options.location) {
-        throw new error_1.FirebaseError("Missing required flag --location. See firebase apphosting:secrets:grantaccess --help for more info");
-    }
-    const location = options.location;
     if (!options.backend) {
         throw new error_1.FirebaseError("Missing required flag --backend. See firebase apphosting:secrets:grantaccess --help for more info");
     }
+    let location = options.location;
+    location =
+        location || (await (0, apphosting_1.promptLocation)(projectId, "Please select the location of your backend"));
     const exists = await secretManager.secretExists(projectId, secretName);
     if (!exists) {
         throw new error_1.FirebaseError(`Cannot find secret ${secretName}`);
@@ -41,5 +41,5 @@ exports.command = new command_1.Command("apphosting:secrets:grantaccess <secretN
     const backendId = options.backend;
     const backend = await apphosting.getBackend(projectId, location, backendId);
     const accounts = secrets.toMulti(secrets.serviceAccountsForBackend(projectNumber, backend));
-    await secrets.grantSecretAccess(projectId, secretName, accounts);
+    await secrets.grantSecretAccess(projectId, projectNumber, secretName, accounts);
 });

package/lib/commands/apphosting-secrets-set.js

@@ -50,7 +50,7 @@ exports.command = new command_1.Command("apphosting:secrets:set <secretName>")
         utils.logWarning(`To use this secret in your backend, you must grant access. You can do so in the future with ${clc.bold("firebase apphosting:secrets:grantaccess")}`);
     }
     else {
-        await secrets.grantSecretAccess(projectId, secretName, accounts);
+        await secrets.grantSecretAccess(projectId, projectNumber, secretName, accounts);
     }
     await config.maybeAddSecretToYaml(secretName);
 });

package/lib/emulator/downloadableEmulators.js

@@ -23,9 +23,9 @@ const EMULATOR_UPDATE_DETAILS = {
         expectedChecksum: "2fd771101c0e1f7898c04c9204f2ce63",
     },
     firestore: {
-        version: "1.19.4",
-        expectedSize: 65913000,
-        expectedChecksum: "a861bfa9d12ef69645b41e2f3bd8db8d",
+        version: "1.19.5",
+        expectedSize: 66204670,
+        expectedChecksum: "6d9fb826605701668af722f25048ad95",
     },
     storage: {
         version: "1.1.3",
@@ -147,6 +147,7 @@ const Commands = {
             "single_project_mode",
         ],
         joinArgs: false,
+        shell: false,
     },
     firestore: {
         binary: "java",
@@ -168,6 +169,7 @@ const Commands = {
             "single_project_mode",
         ],
         joinArgs: false,
+        shell: false,
     },
     storage: {
         binary: "java",
@@ -179,18 +181,21 @@ const Commands = {
         ],
         optionalArgs: [],
         joinArgs: false,
+        shell: false,
     },
     pubsub: {
         binary: getExecPath(types_1.Emulators.PUBSUB),
         args: [],
         optionalArgs: ["port", "host"],
         joinArgs: true,
+        shell: true,
     },
     ui: {
         binary: "node",
         args: [getExecPath(types_1.Emulators.UI)],
         optionalArgs: [],
         joinArgs: false,
+        shell: false,
     },
 };
 function getExecPath(name) {
@@ -237,6 +242,7 @@ function _getCommand(emulator, args) {
         args: cmdLineArgs,
         optionalArgs: baseCmd.optionalArgs,
         joinArgs: baseCmd.joinArgs,
+        shell: baseCmd.shell,
     };
 }
 exports._getCommand = _getCommand;
@@ -273,11 +279,15 @@ async function _runBinary(emulator, command, extraEnv) {
         const logger = emulatorLogger_1.EmulatorLogger.forEmulator(emulator.name);
         emulator.stdout = fs.createWriteStream(getLogFileName(emulator.name));
         try {
-            emulator.instance = childProcess.spawn(command.binary, command.args, {
+            const opts = {
                 env: Object.assign(Object.assign({}, process.env), extraEnv),
                 detached: true,
                 stdio: ["inherit", "pipe", "pipe"],
-            });
+            };
+            if (command.shell && utils.IS_WINDOWS) {
+                opts.shell = true;
+            }
+            emulator.instance = childProcess.spawn(command.binary, command.args, opts);
         }
         catch (e) {
             if (e.code === "EACCES") {

package/lib/frameworks/next/index.js

@@ -123,9 +123,9 @@ async function build(dir, target, context) {
         headers.push(...headersFromMetaFiles);
         if (appPathsManifest) {
             const unrenderedServerComponents = (0, utils_2.getNonStaticServerComponents)(appPathsManifest, appPathRoutesManifest, prerenderedRoutes, dynamicRoutes);
-            if (unrenderedServerComponents.has("/_not-found") &&
-                (await (0, utils_2.hasStaticAppNotFoundComponent)(dir, distDir))) {
-                unrenderedServerComponents.delete("/_not-found");
+            const notFoundPageKey = ["/_not-found", "/_not-found/page"].find((key) => unrenderedServerComponents.has(key));
+            if (notFoundPageKey && (await (0, utils_2.hasStaticAppNotFoundComponent)(dir, distDir))) {
+                unrenderedServerComponents.delete(notFoundPageKey);
             }
             for (const key of unrenderedServerComponents) {
                 reasonsForBackend.add(`non-static component ${key}`);

package/lib/frameworks/next/utils.js

@@ -231,6 +231,7 @@ async function getProductionDistDirFiles(sourceDir, distDir) {
         cwd: (0, path_1.join)(sourceDir, distDir),
         nodir: true,
         absolute: true,
+        realpath: utils_2.IS_WINDOWS,
     }, (err, matches) => {
         if (err)
             reject(err);

package/lib/functions/python.js

@@ -4,13 +4,14 @@ exports.runWithVirtualEnv = exports.virtualEnvCmd = exports.DEFAULT_VENV_DIR = v
 const path = require("path");
 const spawn = require("cross-spawn");
 const logger_1 = require("../logger");
+const utils_1 = require("../utils");
 exports.DEFAULT_VENV_DIR = "venv";
 function virtualEnvCmd(cwd, venvDir) {
-    const activateScriptPath = process.platform === "win32" ? ["Scripts", "activate.bat"] : ["bin", "activate"];
+    const activateScriptPath = utils_1.IS_WINDOWS ? ["Scripts", "activate.bat"] : ["bin", "activate"];
     const venvActivate = `"${path.join(cwd, venvDir, ...activateScriptPath)}"`;
     return {
-        command: process.platform === "win32" ? venvActivate : ".",
-        args: [process.platform === "win32" ? "" : venvActivate],
+        command: utils_1.IS_WINDOWS ? venvActivate : ".",
+        args: [utils_1.IS_WINDOWS ? "" : venvActivate],
     };
 }
 exports.virtualEnvCmd = virtualEnvCmd;

package/lib/gcp/apphosting.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNextRolloutId = exports.ensureApiEnabled = exports.listLocations = exports.updateTraffic = exports.listRollouts = exports.createRollout = exports.createBuild = exports.listBuilds = exports.getBuild = exports.deleteBackend = exports.listBackends = exports.getBackend = exports.createBackend = exports.client = exports.API_VERSION = void 0;
+exports.getNextRolloutId = exports.ensureApiEnabled = exports.listLocations = exports.updateTraffic = exports.listRollouts = exports.createRollout = exports.createBuild = exports.listBuilds = exports.getBuild = exports.deleteBackend = exports.listBackends = exports.getBackend = exports.createBackend = exports.serviceAgentEmail = exports.client = exports.API_VERSION = void 0;
 const proto = require("../gcp/proto");
 const apiv2_1 = require("../apiv2");
 const projectUtils_1 = require("../projectUtils");
@@ -19,6 +19,11 @@ exports.client = new apiv2_1.Client({
 (0, metaprogramming_1.assertImplements)();
 (0, metaprogramming_1.assertImplements)();
 (0, metaprogramming_1.assertImplements)();
+const P4SA_DOMAIN = (0, api_1.apphostingP4SADomain)();
+function serviceAgentEmail(projectNumber) {
+    return `service-${projectNumber}@${P4SA_DOMAIN}`;
+}
+exports.serviceAgentEmail = serviceAgentEmail;
 async function createBackend(projectId, location, backendReqBoby, backendId) {
     const res = await exports.client.post(`projects/${projectId}/locations/${location}/backends`, Object.assign(Object.assign({}, backendReqBoby), { labels: Object.assign(Object.assign({}, backendReqBoby.labels), deploymentTool.labels()) }), { queryParams: { backendId } });
     return res.body;

package/lib/gcp/devConnect.js

@@ -84,7 +84,7 @@ async function getGitRepositoryLink(projectId, location, connectionId, gitReposi
 }
 exports.getGitRepositoryLink = getGitRepositoryLink;
 function serviceAgentEmail(projectNumber) {
-    return `service-${projectNumber}@${(0, api_1.developerConnectP4SAOrigin)()}`;
+    return `service-${projectNumber}@${(0, api_1.developerConnectP4SADomain)()}`;
 }
 exports.serviceAgentEmail = serviceAgentEmail;
 async function generateP4SA(projectNumber) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firebase-tools",
-  "version": "13.7.3",
+  "version": "13.7.5",
   "description": "Command-Line Interface for Firebase",
   "main": "./lib/index.js",
   "bin": {