chore(deps): migrate firebase-admin to v14 (#141)

app/api/admin/bootstrap/route.ts

@@ -4,7 +4,7 @@ import {
   getAdminClaims,
   normalizeEmail,
 } from "@/lib/admin-auth";
-import { getFirebaseAdminAuth } from "@/lib/firebase-admin";
+import { getFirebaseAdminAuth } from "@/lib/firebase-admin-auth";
 import { logAdminAudit } from "@/lib/admin-audit";
 import { ensureAdminUser, updateAdminUser } from "@/lib/admin-users";
 import { getBearerToken, unauthorizedResponse } from "@/lib/api-auth";

app/api/admin/invitations/[id]/resend/route.ts

@@ -14,7 +14,7 @@ import {
   recordInvitationEmailAttempt,
 } from "@/lib/admin-invitations";
 import { canResendInvitation } from "@/lib/admin-invitation-resend-policy";
-import { getFirebaseAdminDb } from "@/lib/firebase-admin";
+import { getFirebaseAdminDb } from "@/lib/firebase-admin-db";
 import { serializeAdminInvitation } from "@/lib/admin-serializers";
 import {
   badRequestResponse,

app/api/admin/invitations/accept/route.ts

@@ -4,7 +4,8 @@ import {
   normalizeEmail,
   verifyAdminIdToken,
 } from "@/lib/admin-auth";
-import { getFirebaseAdminAuth, getFirebaseAdminDb } from "@/lib/firebase-admin";
+import { getFirebaseAdminAuth } from "@/lib/firebase-admin-auth";
+import { getFirebaseAdminDb } from "@/lib/firebase-admin-db";
 import { logAdminAudit } from "@/lib/admin-audit";
 import { getPendingInvitationByEmail } from "@/lib/admin-invitations";
 import { getAdminUser } from "@/lib/admin-users";

app/api/admin/users/[uid]/route.ts

@@ -3,7 +3,7 @@ import {
   normalizeEmail,
   requireSuperAdminActor,
 } from "@/lib/admin-auth";
-import { getFirebaseAdminAuth } from "@/lib/firebase-admin";
+import { getFirebaseAdminAuth } from "@/lib/firebase-admin-auth";
 import { logAdminAudit } from "@/lib/admin-audit";
 import {
   countActiveSuperAdmins,

lib/admin-audit.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import { getFirebaseAdminDb } from "@/lib/firebase-admin";
+import { getFirebaseAdminDb } from "@/lib/firebase-admin-db";
 import { dropUndefinedValues } from "@/lib/admin-audit-common";
 import type { AdminAuditRecord } from "@/lib/admin-types";
 import { Timestamp } from "firebase-admin/firestore";

lib/admin-auth.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import { getFirebaseAdminAuth } from "@/lib/firebase-admin";
+import { getFirebaseAdminAuth } from "@/lib/firebase-admin-auth";
 import {
   getAdminClaims,
   getProtectedAdminEmail,

lib/admin-invitations.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import { getFirebaseAdminDb } from "@/lib/firebase-admin";
+import { getFirebaseAdminDb } from "@/lib/firebase-admin-db";
 import { normalizeEmail } from "@/lib/admin-common";
 import type { AdminInvitation, AdminRole } from "@/lib/admin-types";
 import { FieldValue, Timestamp } from "firebase-admin/firestore";

lib/admin-users.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import { getFirebaseAdminDb } from "@/lib/firebase-admin";
+import { getFirebaseAdminDb } from "@/lib/firebase-admin-db";
 import {
   buildExistingAdminLoginUpdate,
   buildNewAdminUserRecord,

lib/firebase-admin.ts → lib/firebase-admin-app.ts

@@ -1,7 +1,5 @@
 import "server-only";
 import { App, cert, getApps, initializeApp } from "firebase-admin/app";
-import { getAuth } from "firebase-admin/auth";
-import { getFirestore } from "firebase-admin/firestore";
 
 let adminApp: App | undefined;
 
@@ -43,11 +41,3 @@ export function getFirebaseAdminApp(): App {
 
   return adminApp;
 }
-
-export function getFirebaseAdminAuth() {
-  return getAuth(getFirebaseAdminApp());
-}
-
-export function getFirebaseAdminDb() {
-  return getFirestore(getFirebaseAdminApp());
-}

lib/firebase-admin-auth.ts

@@ -0,0 +1,9 @@
+import "server-only";
+import { getAuth } from "firebase-admin/auth";
+import { getFirebaseAdminApp } from "@/lib/firebase-admin-app";
+
+// Auth is isolated in its own module: only routes that actually verify
+// tokens or manage users pay for the jwks-rsa -> jose dependency graph.
+export function getFirebaseAdminAuth() {
+  return getAuth(getFirebaseAdminApp());
+}

lib/firebase-admin-db.ts

@@ -0,0 +1,11 @@
+import "server-only";
+import { getFirestore } from "firebase-admin/firestore";
+import { getFirebaseAdminApp } from "@/lib/firebase-admin-app";
+
+// Firestore lives in its own module so Firestore-only routes never import
+// firebase-admin/auth — its jwks-rsa -> ESM-only jose chain is the failure
+// that caused the nfl-picks Vercel runtime outage (ERR_REQUIRE_ESM despite
+// a clean build).
+export function getFirebaseAdminDb() {
+  return getFirestore(getFirebaseAdminApp());
+}

lib/trade-leads.ts

@@ -1,6 +1,6 @@
 import "server-only";
 import { FieldValue } from "firebase-admin/firestore";
-import { getFirebaseAdminDb } from "@/lib/firebase-admin";
+import { getFirebaseAdminDb } from "@/lib/firebase-admin-db";
 import { getResendClient } from "@/lib/resend";
 import { getDefaultFromEmail } from "@/lib/resend-config";
 import { logError, logInfo } from "@/lib/log";

next.config.ts

@@ -41,6 +41,11 @@ const mediaCacheHeaders = [
 const nextConfig: NextConfig = {
   pageExtensions: ["ts", "tsx", "md", "mdx"],
   poweredByHeader: false,
+  // Keep firebase-admin outside the server bundle: its auth graph pulls
+  // jwks-rsa -> jose, and bundling the Node-specific chain into a
+  // serverless chunk caused a Vercel runtime outage class (ERR_REQUIRE_ESM)
+  // in other projects. Load the real node_modules at runtime instead.
+  serverExternalPackages: ["firebase-admin"],
   images: {
     formats: ["image/avif", "image/webp"],
     deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048, 3840],