mulmoterminal 6.3.0 → 6.5.0

package/blueprints/firebase/checks/deploy-check.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# The Hosting site of the given alias (dev / prod) serves the build this deploy made: the deploy
+# writes a fresh id to .blueprint/build-id and ships the same id as /blueprint-build.txt. No git is
+# needed — and none is wanted: a new repository takes away the folder's trust, and the next
+# unattended step would stop at Claude Code's trust prompt.
+set -eu
+id=$(sh "$(dirname "$0")/project-id.sh" "$1")
+[ -s .blueprint/build-id ] || { echo "missing .blueprint/build-id; the deploy step writes it before deploying" >&2; exit 1; }
+expected=$(cat .blueprint/build-id)
+served=$(curl -fsS --max-time 20 "https://$id.web.app/blueprint-build.txt")
+[ "$served" = "$expected" ] || { echo "$id serves build $served, this deploy made $expected" >&2; exit 1; }
+# Firebase Hosting hands the app its config at this reserved URL; the app reads it rather than
+# carrying a key of its own, so the same build works on dev and prod.
+curl -fsS --max-time 20 "https://$id.web.app/__/firebase/init.json" | node -e 'let s="";process.stdin.on("data",(c)=>s+=c).on("end",()=>{
+  if (!JSON.parse(s).apiKey) { console.error("no web app config at /__/firebase/init.json; register a web app in the project"); process.exit(1); }
+})'
+sh "$(dirname "$0")/google-signin.sh" "$1"
+sh "$(dirname "$0")/page-renders.sh" "https://$id.web.app/"

package/blueprints/firebase/checks/emulator-test.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Runs test/blueprint/<name>.spec.ts against the emulators, under a demo- project id so it can never
+# reach a real project.
+set -eu
+. "$(dirname "$0")/java21.sh"
+name="$1"
+spec="test/blueprint/$name.spec.ts"
+[ -f "$spec" ] || { echo "missing $spec" >&2; exit 1; }
+only="auth,firestore"
+[ -d functions ] && only="$only,functions"
+firebase emulators:exec --project demo-blueprint --only "$only" "npx vitest run $spec"

package/blueprints/firebase/checks/google-signin.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Google sign-in is switched on in the real project behind an alias (dev / prod). The emulator accepts
+# any provider, so only this shows whether a person can actually sign in; switching it on creates an
+# OAuth client, which only the console does, so a person has to click it.
+set -eu
+id=$(sh "$(dirname "$0")/project-id.sh" "$1")
+token=$(gcloud auth print-access-token)
+config=$(curl -sS --max-time 20 -H "Authorization: Bearer $token" -H "X-Goog-User-Project: $id" \
+  "https://identitytoolkit.googleapis.com/admin/v2/projects/$id/defaultSupportedIdpConfigs/google.com")
+printf '%s' "$config" | node -e 'let s="";process.stdin.on("data",(c)=>s+=c).on("end",()=>{
+  if (JSON.parse(s).enabled === true) return;
+  console.error("Google sign-in is not enabled; turn it on at https://console.firebase.google.com/project/" + process.argv[1] + "/authentication/providers");
+  process.exit(1);
+})' "$id"

package/blueprints/firebase/checks/java21.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Sourced by the checks that start the Firebase emulators, which need a JDK 21 or later. A brew
+# `openjdk@21` is keg-only and not on PATH, so look in the usual places and put the first new enough
+# one in front, rather than failing on whichever `java` happens to be first.
+java_major() {
+  "$1" -version 2>&1 | sed -n 's/.*version "\([0-9][0-9]*\).*/\1/p' | head -1
+}
+blueprint_java_found=""
+for candidate in \
+  "${JAVA_HOME:-/nonexistent}/bin/java" \
+  "$(/usr/libexec/java_home -v 21+ 2>/dev/null || echo /nonexistent)/bin/java" \
+  /opt/homebrew/opt/openjdk@21/bin/java \
+  /usr/local/opt/openjdk@21/bin/java \
+  /opt/homebrew/opt/openjdk/bin/java \
+  "$(command -v java || echo /nonexistent)"; do
+  [ -x "$candidate" ] || continue
+  major=$(java_major "$candidate")
+  if [ "${major:-0}" -ge 21 ]; then
+    blueprint_java_found="$candidate"
+    break
+  fi
+done
+if [ -z "$blueprint_java_found" ]; then
+  echo "no JDK 21 or later found; the Firebase emulators need one (macOS: brew install openjdk@21)" >&2
+  exit 1
+fi
+PATH="$(dirname "$blueprint_java_found"):${PATH:-}"
+export PATH

package/blueprints/firebase/checks/page-renders.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# The served page actually starts: a build can deploy, report its id and answer 200, and still be a
+# blank page because the app threw on load (a missing config does exactly that). Rendered in headless
+# Chrome, the page must show some text. Without a Chrome this cannot be judged, and says so.
+set -eu
+url="$1"
+chrome=""
+for candidate in "${CHROME:-}" "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" google-chrome chromium chromium-browser; do
+  [ -n "$candidate" ] || continue
+  if [ -x "$candidate" ] || command -v "$candidate" >/dev/null 2>&1; then chrome="$candidate"; break; fi
+done
+[ -n "$chrome" ] || { echo "no Chrome found (set CHROME=...); could not confirm that $url renders" >&2; exit 0; }
+# Headless Chrome can print the DOM and then not exit, so it is waited on for the DOM, not for exit.
+RENDER_LIMIT_SECONDS=60
+work=$(mktemp -d)
+"$chrome" --headless=new --disable-gpu --no-first-run --user-data-dir="$work/profile" --virtual-time-budget=15000 --dump-dom "$url" >"$work/dom.html" 2>/dev/null &
+pid=$!
+trap 'kill "$pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+waited=0
+until grep -q "</html>" "$work/dom.html" 2>/dev/null || [ "$waited" -ge "$RENDER_LIMIT_SECONDS" ] || ! kill -0 "$pid" 2>/dev/null; do
+  sleep 1
+  waited=$((waited + 1))
+done
+node -e 'let s="";process.stdin.on("data",(c)=>s+=c).on("end",()=>{
+  const body = (s.match(/<body[^>]*>([\s\S]*)<\/body>/i) || [, ""])[1];
+  const text = body.replace(/<(script|style|noscript)[\s\S]*?<\/\1>/gi, "").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+  if (!text) { console.error(process.argv[1] + " renders a blank page: the app failed to start. Open it in a browser and read the console error."); process.exit(1); }
+})' "$url" <"$work/dom.html"

package/blueprints/firebase/checks/prerequisites.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Every required CLI answers, a JDK new enough for the emulators exists, and Firebase and gcloud are
+# signed in to the SAME account — the checks use both, and a project one of them created is not
+# necessarily visible to the other.
+set -eu
+for probe in "node --version" "yarn --version" "firebase --version" "gcloud --version"; do
+  sh -c "$probe" >/dev/null 2>&1 || { echo "missing: $probe" >&2; exit 1; }
+done
+. "$(dirname "$0")/java21.sh"
+firebase_account=$(firebase login:list 2>/dev/null | sed -n 's/.*Logged in as \([^ ]*\).*/\1/p' | head -1)
+[ -n "$firebase_account" ] || { echo "firebase: not signed in (firebase login)" >&2; exit 1; }
+gcloud_account=$(gcloud auth list --filter=status:ACTIVE --format='value(account)' 2>/dev/null || true)
+[ -n "$gcloud_account" ] || { echo "gcloud: not signed in (gcloud auth login)" >&2; exit 1; }
+[ "$firebase_account" = "$gcloud_account" ] || {
+  echo "firebase is signed in as $firebase_account but gcloud as $gcloud_account; use one account for both (gcloud config set account $firebase_account)" >&2
+  exit 1
+}
+gcloud projects list --limit=1 --format='value(projectId)' >/dev/null 2>&1 || { echo "gcloud: the sign-in has expired (gcloud auth login $gcloud_account)" >&2; exit 1; }

package/blueprints/firebase/checks/project-id.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Prints the project id behind a .firebaserc alias (dev / prod).
+set -eu
+node -e '
+const rc = JSON.parse(require("fs").readFileSync(".firebaserc", "utf8"));
+const id = rc.projects && rc.projects[process.argv[1]];
+if (typeof id !== "string" || id === "") { console.error("no project for alias " + process.argv[1]); process.exit(1); }
+console.log(id);
+' "$1"

package/blueprints/firebase/checks/projects.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# .firebaserc names two different projects; each exists, has billing on (Blaze) and has Firestore.
+set -eu
+here=$(dirname "$0")
+dev=$(sh "$here/project-id.sh" dev)
+prod=$(sh "$here/project-id.sh" prod)
+[ "$dev" != "$prod" ] || { echo "dev and prod are the same project: $dev" >&2; exit 1; }
+for id in "$dev" "$prod"; do
+  billing=$(gcloud billing projects describe "$id" --format='value(billingEnabled)')
+  [ "$billing" = "True" ] || { echo "$id: billing is not enabled (Blaze plan)" >&2; exit 1; }
+  gcloud firestore databases describe --project "$id" --database='(default)' >/dev/null || { echo "$id: no Firestore database" >&2; exit 1; }
+done

package/blueprints/firebase/checks/protect.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# App Check is ENFORCED for Firestore on production, every callable function enforces it, and a
+# budget is scoped to the production project. Each response is captured before it is parsed, so a
+# failed request fails the check instead of hiding behind a pipe.
+set -eu
+prod=$(sh "$(dirname "$0")/project-id.sh" prod)
+number=$(gcloud projects describe "$prod" --format='value(projectNumber)')
+token=$(gcloud auth print-access-token)
+
+appcheck=$(curl -fsS --max-time 20 -H "Authorization: Bearer $token" \
+  "https://firebaseappcheck.googleapis.com/v1/projects/$number/services/firestore.googleapis.com")
+printf '%s' "$appcheck" | node -e 'let s="";process.stdin.on("data",(c)=>s+=c).on("end",()=>{
+  const mode = JSON.parse(s).enforcementMode;
+  if (mode !== "ENFORCED") { console.error("App Check for Firestore is " + mode + ", not ENFORCED"); process.exit(1); }
+})'
+
+# Line by line, so one protected callable cannot vouch for another.
+unprotected=$(grep -rn "onCall(" functions/src | grep -v "onCall({ *enforceAppCheck: true" || true)
+[ -z "$unprotected" ] || { printf 'callable functions without enforceAppCheck:\n%s\n' "$unprotected" >&2; exit 1; }
+
+account=$(gcloud billing projects describe "$prod" --format='value(billingAccountName)')
+account=${account#billingAccounts/}
+[ -n "$account" ] || { echo "$prod has no billing account" >&2; exit 1; }
+budgets=$(gcloud billing budgets list --billing-account="$account" --format=json)
+# gcloud records the filter as projects/<id>; the API also accepts projects/<number>.
+printf '%s' "$budgets" | node -e 'let s="";process.stdin.on("data",(c)=>s+=c).on("end",()=>{
+  const wanted = process.argv.slice(1).map((p) => "projects/" + p);
+  const scoped = JSON.parse(s).some((b) => (b.budgetFilter?.projects ?? []).some((p) => wanted.includes(p)));
+  if (!scoped) { console.error("no budget is scoped to " + wanted.join(" or ")); process.exit(1); }
+})' "$prod" "$number"

package/blueprints/firebase/checks/scaffold.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# The skeleton exists, carries the emulator and test harness later steps rely on, and builds.
+set -eu
+for f in firebase.json package.json firestore.rules; do
+  [ -f "$f" ] || { echo "missing $f" >&2; exit 1; }
+done
+for d in functions test/blueprint; do
+  [ -d "$d" ] || { echo "missing $d/" >&2; exit 1; }
+done
+grep -q '"emulators"' firebase.json || { echo "firebase.json configures no emulators" >&2; exit 1; }
+grep -q '"@firebase/rules-unit-testing"' package.json || { echo "@firebase/rules-unit-testing is not a dependency" >&2; exit 1; }
+yarn build

package/blueprints/firebase/checks/spec.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+# The spec exists and every template placeholder in it was filled or marked undecided.
+set -eu
+[ -s .blueprint/spec.md ] || { echo "missing .blueprint/spec.md" >&2; exit 1; }
+if grep -n '{{' .blueprint/spec.md >&2; then
+  echo "unfilled placeholders are left in .blueprint/spec.md" >&2
+  exit 1
+fi

package/blueprints/firebase/guides/app-check.md

@@ -0,0 +1,13 @@
+# App Check の適用を有効にする
+
+アプリ以外からデータベースや関数を呼ばれないようにする仕組みです。有効にすると、このアプリ以外からの呼び出しは断られます。
+
+1. 次のページを開きます: https://console.firebase.google.com/project/{{PROJECT_ID}}/appcheck/products
+2. 「API」（APIs）の一覧で「Cloud Firestore」の行を開き、「適用」（Enforce）を押して確定します。
+3. 「Cloud Functions」の行でも同じく「適用」を押します。
+
+**うまくいったかの見分け方**: 両方の行が「適用済み」（Enforced）になります。
+
+**注意**: 適用の前にアプリの公開が済んでいないと、アプリ自身も断られます。順番はこちらで確認済みです。
+
+終わったら「済み」と返信してください。

package/blueprints/firebase/guides/billing.md

@@ -0,0 +1,13 @@
+# プロジェクトを従量課金（Blaze プラン）にする
+
+サーバー側の処理（Cloud Functions）を動かすには、プロジェクトに支払い方法をつなぐ必要があります。少人数で使う規模なら、たいていは無料枠に収まります。
+
+1. 次のページを開きます: https://console.firebase.google.com/project/{{PROJECT_ID}}/usage/details
+2. 「プランを変更」（Modify plan）を押します。
+3. 「Blaze」を選び、使う請求先アカウント（Cloud Billing アカウント）を選びます。まだ無ければ、画面の案内に従ってカードを登録します。
+4. 予算の設定を聞かれたら、スペックで決めた金額を入れておくと安心です（あとからでも設定できます）。
+5. 「購入」（Purchase）で確定します。
+
+**うまくいったかの見分け方**: 同じページの上部に「Blaze」と表示されます。
+
+プロジェクトが2つあるときは、もう一方でも同じことをします。終わったら「済み」と返信してください。

package/blueprints/firebase/guides/google-signin.md

@@ -0,0 +1,14 @@
+# Google ログインを有効にする
+
+アプリで「Google でログイン」を使えるようにします。これを有効にするとログイン用の認証情報が作られるので、コンソールで一度だけ操作が必要です。
+
+1. 次のページを開きます: https://console.firebase.google.com/project/{{PROJECT_ID}}/authentication/providers
+2. 「始める」（Get started）が出ていたら押します。
+3. 「新しいプロバイダを追加」（Add new provider）から「Google」を選びます。
+4. 右上のスイッチを「有効にする」（Enable）にします。
+5. 「プロジェクトのサポートメール」（Support email）で自分のアドレスを選びます。
+6. 「保存」（Save）を押します。
+
+**うまくいったかの見分け方**: 一覧の「Google」の行が「有効」（Enabled）になります。
+
+プロジェクトが2つあるときは、もう一方でも同じことをします。終わったら「済み」と返信してください。

package/blueprints/firebase/guides/sign-in.md

@@ -0,0 +1,14 @@
+# Firebase と Google Cloud にログインする
+
+このあと作業するために、あなたの Google アカウントで2つの道具にログインします。パスワードをこの画面に書く必要はありません。
+
+1. ターミナルで `firebase login` が動くと、ブラウザが開きます。
+2. 使う Google アカウントを選び、「許可」（Allow）を押します。
+3. 続けて `gcloud auth login` でもう一度ブラウザが開きます。**1 と同じアカウント**を選び、「許可」を押します。
+4. ブラウザに「ログインしました」のような表示が出たら、そのタブは閉じてかまいません。
+
+**うまくいったかの見分け方**: ターミナルに `Success! Logged in as あなたのアドレス` と出ます。
+
+**困ったら**: 違うアカウントを選んでしまったときは、そのことをそのまま返信してください。やり直します。
+
+終わったら「済み」と返信してください。

package/blueprints/firebase/guides/try-it.md

@@ -0,0 +1,6 @@
+# 公開したアプリを開いて試す
+
+1. ブラウザのシークレットウィンドウ（Chrome なら ⌘+Shift+N、Windows は Ctrl+Shift+N）を開きます。前のログインが残っていない状態で試すためです。
+2. 次のアドレスを開きます: {{URL}}
+3. 画面が表示されるか確かめます。真っ白のときは、そのまま「真っ白」と返信してください。
+4. 聞かれている操作を試し、どうなったかを返信してください。画面に出た文言があれば、そのまま写してください。

package/blueprints/firebase/infra/firebase.json

@@ -0,0 +1,59 @@
+{
+  "firestore": {
+    "rules": "firestore.rules",
+    "indexes": "firestore.indexes.json"
+  },
+  "functions": [
+    {
+      "source": "functions",
+      "codebase": "default",
+      "predeploy": ["yarn --cwd \"$RESOURCE_DIR\" build"]
+    }
+  ],
+  "hosting": {
+    "public": "dist",
+    "ignore": ["firebase.json", "**/.*"],
+    "rewrites": [
+      {
+        "source": "**",
+        "destination": "/index.html"
+      }
+    ],
+    "headers": [
+      {
+        "source": "**",
+        "headers": [
+          {
+            "key": "X-Content-Type-Options",
+            "value": "nosniff"
+          },
+          {
+            "key": "Referrer-Policy",
+            "value": "strict-origin-when-cross-origin"
+          },
+          {
+            "key": "X-Frame-Options",
+            "value": "DENY"
+          }
+        ]
+      }
+    ]
+  },
+  "emulators": {
+    "auth": {
+      "port": 9099
+    },
+    "firestore": {
+      "port": 8080
+    },
+    "functions": {
+      "port": 5001
+    },
+    "hosting": {
+      "port": 5000
+    },
+    "ui": {
+      "enabled": true
+    }
+  }
+}

package/blueprints/firebase/infra/firestore.indexes.json

@@ -0,0 +1,4 @@
+{
+  "indexes": [],
+  "fieldOverrides": []
+}

package/blueprints/firebase/infra/firestore.rules

@@ -0,0 +1,9 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    // Every collection is opened explicitly above this line. Anything not opened is denied.
+    match /{document=**} {
+      allow read, write: if false;
+    }
+  }
+}

package/blueprints/firebase/manifest.json

@@ -0,0 +1,39 @@
+{
+  "kind": "base",
+  "slug": "firebase",
+  "title": "Firebase",
+  "version": "0.1.0",
+  "description": "Firebase Hosting + Authentication + Firestore + Cloud Functions, with separate dev and production projects.",
+  "platform": "firebase",
+  "requires": [
+    {
+      "command": "node",
+      "probe": "node --version",
+      "installHint": "https://nodejs.org/"
+    },
+    {
+      "command": "yarn",
+      "probe": "yarn --version",
+      "installHint": "corepack enable"
+    },
+    {
+      "command": "firebase",
+      "probe": "firebase --version",
+      "installHint": "yarn global add firebase-tools"
+    },
+    {
+      "command": "gcloud",
+      "probe": "gcloud --version",
+      "installHint": "https://cloud.google.com/sdk/docs/install"
+    },
+    {
+      "command": "java",
+      "probe": "sh \"$BLUEPRINT_BASE/checks/java21.sh\"",
+      "installHint": "The Firebase emulators need JDK 21 or later (macOS: brew install openjdk@21)."
+    }
+  ],
+  "credentials": [
+    "firebase login",
+    "gcloud auth login"
+  ]
+}

package/blueprints/firebase/plan.json

@@ -0,0 +1,71 @@
+{
+  "steps": [
+    {
+      "id": "spec",
+      "title": "仕様書を書く",
+      "description": "ヒアリングの答えから、土台と用途の仕様の雛形を埋める。決まっていない点は一覧にする。",
+      "skill": "skills/spec",
+      "check": "sh \"$BLUEPRINT_BASE/checks/spec.sh\""
+    },
+    {
+      "id": "prerequisites",
+      "title": "道具とサインイン",
+      "description": "CLI を入れ、Firebase と Google Cloud にサインインする。",
+      "skill": "skills/prerequisites",
+      "check": "sh \"$BLUEPRINT_BASE/checks/prerequisites.sh\"",
+      "gates": ["review", "credential"]
+    },
+    {
+      "id": "projects",
+      "title": "開発用と本番用のプロジェクト",
+      "description": "Firebase のプロジェクトを二つ用意し、従量課金（Blaze）プランにする。",
+      "skill": "skills/projects",
+      "check": "sh \"$BLUEPRINT_BASE/checks/projects.sh\"",
+      "gates": ["billing"]
+    },
+    {
+      "id": "scaffold",
+      "title": "アプリの雛形",
+      "description": "画面、Cloud Functions、エミュレータの設定、ルールの試験の土台を作る。",
+      "skill": "skills/scaffold",
+      "check": "sh \"$BLUEPRINT_BASE/checks/scaffold.sh\""
+    },
+    {
+      "id": "auth",
+      "title": "ログイン",
+      "description": "Google でのログインを入れ、Auth エミュレータで確かめる。",
+      "skill": "skills/auth",
+      "check": "sh \"$BLUEPRINT_BASE/checks/emulator-test.sh\" auth"
+    },
+    {
+      "id": "data-rules",
+      "title": "データの形とセキュリティルール",
+      "description": "仕様のコレクションを作り、firestore.rules で一つずつ開ける。それ以外はすべて拒否する。",
+      "skill": "skills/data-rules",
+      "check": "sh \"$BLUEPRINT_BASE/checks/emulator-test.sh\" rules"
+    },
+    {
+      "id": "deploy-dev",
+      "title": "開発用に公開",
+      "description": "ルール・関数・画面を開発用のプロジェクトに公開する。",
+      "skill": "skills/deploy-dev",
+      "check": "sh \"$BLUEPRINT_BASE/checks/deploy-check.sh\" dev"
+    },
+    {
+      "id": "protect",
+      "title": "App Check と予算アラート",
+      "description": "App Check を有効にし、本番のプロジェクトに予算アラートを設定する。",
+      "skill": "skills/protect",
+      "check": "sh \"$BLUEPRINT_BASE/checks/protect.sh\"",
+      "gates": ["billing"]
+    },
+    {
+      "id": "deploy-production",
+      "title": "本番に公開",
+      "description": "開発用で確かめたものと同じビルドを本番に公開する。",
+      "skill": "skills/deploy-production",
+      "check": "sh \"$BLUEPRINT_BASE/checks/deploy-check.sh\" prod",
+      "gates": ["deploy-production"]
+    }
+  ]
+}

package/blueprints/firebase/security/checklist.md

@@ -0,0 +1,11 @@
+# Firebase — 必ず詰める点
+
+- [ ] **ルールは既定で拒否**。`match /{document=**} { allow read, write: if false; }` を最後に置き、コレクションごとに開ける
+- [ ] **ルールは試験で証明する**。エミュレータ上で「許されるべき操作が通る」と「拒まれるべき操作が拒まれる」の両方を書く。本番のプロジェクトに対して試さない
+- [ ] **クライアントに管理者の鍵を置かない**。サービスアカウントの JSON をリポジトリにも画面にも入れない。Admin SDK は Cloud Functions の中だけで使う
+- [ ] **利用者が書ける文書に権限を置かない**。役割はカスタムクレームで持ち、付与は関数だけが行う
+- [ ] **App Check を有効にする**。Firestore と Functions の両方で強制する
+- [ ] **開発と本番を分ける**。本番のデータを開発に持ち込まない
+- [ ] **予算アラート**を本番に設定する。暴走した関数や読み取りの嵐は請求で初めて気づくことが多い
+- [ ] **Firestore のリージョン**は作成時に決まり、後から移せない。データの置き場所の制約を確認してから作る
+- [ ] `firebase.json` の Hosting に、`Content-Security-Policy` などのセキュリティヘッダーを付ける

package/blueprints/firebase/skills/auth/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: blueprint-firebase-auth
+description: "Add Google sign-in to the app and prove it against the Auth emulator."
+---
+
+# Sign-in
+
+1. Google sign-in with `signInWithPopup` (fall back to redirect on mobile).
+2. Point the app at the Auth emulator when `import.meta.env.DEV` is set.
+3. A signed-out user sees only the sign-in screen.
+4. Write `test/blueprint/auth.spec.ts`: a signed-in context can read what the rules allow a member, an
+   unauthenticated context cannot.
+
+Done when the check passes: `emulator-test.sh auth`.
+
+## Always
+
+- Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
+- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
+- Never enable billing, deploy to production, delete data or handle a credential unless this step's gates say the
+  user approved exactly that.
+- Say you are done by stopping; the executor runs the check. Do not claim success yourself.

package/blueprints/firebase/skills/data-rules/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: blueprint-firebase-data-rules
+description: "Model the collections from the spec and open each one explicitly in firestore.rules, proven by emulator tests."
+---
+
+# Data model and security rules
+
+The spec has a table per collection: who may read, create, update and delete. That table IS the rules.
+
+1. For each collection, add a `match` block above the final deny-all. Open only what the table says.
+2. On create, pin ownership (`request.resource.data.ownerUid == request.auth.uid`) and the fields a client may set
+   (`request.resource.data.keys().hasOnly([...])`).
+3. On update, forbid changing ownership and any field the table does not let that role change
+   (`diff(resource.data).affectedKeys().hasOnly([...])`).
+4. Write `test/blueprint/rules.spec.ts` with BOTH directions for every row of the table: the allowed operation
+   succeeds (`assertSucceeds`) and every other role is refused (`assertFails`). A rule with only a success test is
+   not tested.
+5. If the table is ambiguous, ask — do not open more than it says.
+
+Done when the check passes: `emulator-test.sh rules`.
+
+## Always
+
+- Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
+- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
+- Never enable billing, deploy to production, delete data or handle a credential unless this step's gates say the
+  user approved exactly that.
+- Say you are done by stopping; the executor runs the check. Do not claim success yourself.

package/blueprints/firebase/skills/deploy-dev/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: blueprint-firebase-deploy-dev
+description: "Deploy rules, indexes, functions and hosting to the dev project."
+---
+
+# Publish to dev
+
+1. `yarn build`, then give this build an id and ship it with the site:
+   `node -e 'console.log(require("crypto").randomUUID())' > .blueprint/build-id && cp .blueprint/build-id dist/blueprint-build.txt`,
+   then `firebase deploy --project dev`. The check compares the served id with `.blueprint/build-id`, so it
+   proves THIS build is live. Git is not needed for this.
+2. Tell the user the URL (`https://<dev-project-id>.web.app`) and what to try there.
+
+Never deploy to `prod` in this step.
+
+Done when the check passes: the dev site serves the id this deploy wrote to `.blueprint/build-id`, serves a web
+app config at `/__/firebase/init.json`, has Google sign-in switched on, and the page renders text in headless Chrome (a blank page fails).
+
+## Always
+
+- Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
+- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
+- Never enable billing, deploy to production, delete data or handle a credential unless this step's gates say the
+  user approved exactly that.
+- Say you are done by stopping; the executor runs the check. Do not claim success yourself.

package/blueprints/firebase/skills/deploy-production/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: blueprint-firebase-deploy-production
+description: "Deploy the same build to the production project."
+---
+
+# Publish to production
+
+This is the **deploy-production** gate: the user has approved it. Deploy the same source that was verified on dev — do not change anything between the two.
+
+1. `yarn build`, then give this build an id and ship it with the site:
+   `node -e 'console.log(require("crypto").randomUUID())' > .blueprint/build-id && cp .blueprint/build-id dist/blueprint-build.txt`,
+   then `firebase deploy --project prod`. The check compares the served id with `.blueprint/build-id`, so it
+   proves THIS build is live. Git is not needed for this.
+2. Tell the user the URL and that the next change should go through dev first.
+
+Done when the check passes: the production site serves the id this deploy wrote to `.blueprint/build-id`.
+
+## Always
+
+- Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
+- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
+- Never enable billing, deploy to production, delete data or handle a credential unless this step's gates say the
+  user approved exactly that.
+- Say you are done by stopping; the executor runs the check. Do not claim success yourself.

package/blueprints/firebase/skills/prerequisites/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: blueprint-firebase-prerequisites
+description: "Check and install the tools a Firebase blueprint needs, and get the user signed in to Firebase and Google Cloud."
+---
+
+# Tools and sign-in
+
+The user is not an engineer. Explain each thing you install in one plain sentence.
+
+1. For every entry in `requires` of the base manifest, run its `probe`. Install what is missing using its `installHint`.
+   The emulators need **JDK 21 or later**; an older `java` on PATH does not count. On macOS
+   `brew install openjdk@21` is enough — the checks find it without changing the user's default `java`.
+2. Firebase and gcloud must be signed in to the **same** account: the checks use both. If they differ, ask
+   which account to use.
+3. Sign-in is the **credential** gate: the executor has already asked the user to approve it. Run `firebase login` and
+   `gcloud auth login` in the terminal and tell the user a browser window will open. Never ask the user to paste a
+   password, token or key into the chat.
+4. Never create or download a service-account key. Nothing in this blueprint needs one on this machine.
+
+Done when the check passes: every tool answers, a JDK 21+ is found, and Firebase and gcloud are signed in to
+the same account with a live session.
+
+## Always
+
+- Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
+- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
+- Never enable billing, deploy to production, delete data or handle a credential unless this step's gates say the
+  user approved exactly that.
+- Say you are done by stopping; the executor runs the check. Do not claim success yourself.