chore(deps): firebase-admin 13 → 14

[ToddHebebrand]

Summary

Bumps firebase-admin ^13.7.0 → ^14.4.0 in apps/api/package.json.

firebase-admin 14 removes the legacy admin.app/admin.messaging()/admin.credential compat namespace from the package's default export entirely — confirmed against the shipped .d.ts, whose root index only re-exports App, initializeApp, getApp, getApps, cert, etc. This is a real break beyond what the brief flagged (dead-token error-code matching); fcm.ts no longer typechecked at all against v14 with the old import admin from 'firebase-admin' style.

Rewrote apps/api/src/services/fcm.ts from the legacy namespace to the modular API:

• import admin from 'firebase-admin' → import { initializeApp, getApp, getApps, cert, type App, type ServiceAccount } from 'firebase-admin/app' + import { getMessaging } from 'firebase-admin/messaging'
• admin.apps.length / admin.app() / admin.initializeApp(...) / admin.credential.cert(...) / admin.messaging().send(...) → their modular equivalents.

fcm.test.ts's vi.mock('firebase-admin', ...) is replaced with mocks of the 'firebase-admin/app' and 'firebase-admin/messaging' subpaths (the latter spreads importOriginal() so the real FirebaseMessagingError class stays available for the new test below).

Why

Clears a major-version bump dependabot could not propose (docs/superpowers/plans/2026-09-14-dependency-major-upgrades.md).

Verification (brief step 2 — dead-token code assertion)

Added a test that constructs a real FirebaseMessagingError (from firebase-admin/messaging, via its runtime constructor shape since the public .d.ts marks the constructor @internal) with code registration-token-not-registered, rejects send() with it, and asserts sendFcmNotification returns {unregistered: true}. Ran it on 13 first (green — the class/constructor shape was already compatible pre-bump), then on 14 (green — the error-code contract itself didn't move, only the app/messaging accessor surface did).

cd apps/api && npx vitest run src/services/fcm.test.ts
# on firebase-admin@13.7.0: Test Files 1 passed (1) / Tests 7 passed (7)
# on firebase-admin@14.4.0: Test Files 1 passed (1) / Tests 7 passed (7)

pnpm install --frozen-lockfile --offline   # lockfile consistent

NODE_OPTIONS=--max-old-space-size=8192 npx tsc --noEmit -p tsconfig.json
# 0 errors

npx eslint src/services/fcm.ts src/services/fcm.test.ts
# clean

grep confirms fcm.ts is the only production consumer of firebase-admin in the repo (one unrelated comment mention in quietHours.ts, no import).

Lockfile drift

pnpm up firebase-admin@latest also re-resolved unrelated packages (yaml 2.9.0→2.9.1, joi, hono, compression). Narrowed via git checkout origin/main -- pnpm-lock.yaml && pnpm install --lockfile-only on top of the already-bumped package.json:

git diff origin/main -- pnpm-lock.yaml | grep -E "^[-+]  '?[a-z@][^ ]*@[0-9]" | grep -viE "firebase|google-cloud|grpc|tootallnate|types/caseless|types/long|types/request|types/tough-cookie|arrify|farmhash|gaxios|gcp-metadata|google-auth-library|google-gax|google-logging-utils|gtoken|http-proxy-agent|jose@|jwks-rsa|lru-cache|lru-memoizer|proto3-json-serializer|protobufjs|retry-request|rimraf|teeny-request|yallist"

Output: empty. Remaining diff is entirely firebase-admin 14's own transitive graph moving to new majors — the full @google-cloud/* (firestore, storage, paginator, projectify, promisify), google-auth-library, google-gax, gaxios, gcp-metadata, protobufjs, teeny-request, retry-request, jwks-rsa, lru-memoizer, and @grpc/proto-loader — expected for a Firebase Admin SDK major bump. Re-ran the full verification above against the narrowed lockfile (tsc + fcm test suite, both green).

Concerns

• The brief's breaking-changes summary undersold this one too (like archiver in chore(deps): archiver 7 → 8 (+ @types/archiver 8) #5845) — "legacy namespace removed" was listed but the practical impact (a full rewrite of the app-init/send call sites, not just error-code shape) wasn't obvious until typecheck failed outright on the bump. Flagging for anyone else touching firebase-admin call sites in-flight.

🤖 Generated with Claude Code

https://claude.ai/code/session_018cms2ECUY322qubUH3PmVA

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	4cd6ba7
Status:	✅  Deploy successful!
Preview URL:	https://c2ee847c.breeze-9te.pages.dev
Branch Preview URL:	https://chore-deps-firebase-admin-14.breeze-9te.pages.dev

View logs