Deployment & Infrastructure

Firebase projects

// .firebaserc
{
  "projects": {
    "default": "bidgauge",
    "production": "bidgauge",
    "staging": "bidgauge-staging"
  }
}

Live production app: https://bidgauge.web.app (custom domain: https://bidgauge.peerlesscom.com, used for branded email action links — see Cloud Functions Reference).

Firebase project config

// firebase.json
{
  "firestore": { "rules": "firestore.rules" },
  "storage":   { "rules": "storage.rules" },
  "auth":      { "providers": { "emailPassword": true } },
  "functions": { "source": "functions", "runtime": "nodejs22" },
  "hosting": {
    "public": "dist",
    "headers": [
      { "source": "/index.html", "headers": [{ "key": "Cache-Control", "value": "no-cache" }] },
      { "source": "/",           "headers": [{ "key": "Cache-Control", "value": "no-cache" }] },
      { "source": "/assets/**",  "headers": [{ "key": "Cache-Control", "value": "public, max-age=31536000, immutable" }] }
    ],
    "rewrites": [{ "source": "**", "destination": "/index.html" }]
  }
}

New since the last pass: an explicit auth.providers declaration, cache-control headers (long-lived immutable caching for hashed asset files, no-cache for the HTML shell so deploys take effect immediately), and the Functions runtime bumped to nodejs22.

Build & deploy commands

Environment variables (client)

VITE_FIREBASE_API_KEY=
VITE_FIREBASE_AUTH_DOMAIN=
VITE_FIREBASE_PROJECT_ID=
VITE_FIREBASE_STORAGE_BUCKET=
VITE_FIREBASE_MESSAGING_SENDER_ID=
VITE_FIREBASE_APP_ID=
VITE_FIREBASE_MEASUREMENT_ID=
VITE_ENABLE_LIVE_TAX_LOOKUP=false
VITE_BIDGAUGE_COMPANY_ID=   (optional — pre-login fallback only, see note below)

The app still throws on startup if VITE_FIREBASE_PROJECT_ID is missing. Once a user is signed in, the active tenant comes from their own companyId ID token claim, not from this variable — VITE_BIDGAUGE_COMPANY_ID (along with a ?companyId= URL param and localStorage) now only matters for pre-login screens like password setup/reset links, before a token is available. See Architecture.

Secrets (Cloud Functions runtime only — never in client env files)

Operational scripts

A new scripts/ folder (repo root) and functions/scripts/ folder hold one-off tooling that intentionally isn't wired into any callable or CI step — these are run manually by whoever administers the Firebase project.

Data & storage config

• Firestore — company-scoped rules (see Auth & Permissions). Still no composite indexes needed for the client's own reads, but the projectSummaries chunked where("stage","in",…) queries plus a couple of order-by combinations may need indexes as data grows — worth checking the Firebase console's auto-suggested-index prompts after a fresh deploy.
• Storage — company-scoped under companies/{'{'}companyId{'}'}/project-storage/…, plus a separate, function-only database-backups/ prefix for backup files.
• Functions runtime — Node.js 22, region us-central1 for every function. Backup functions run at 1GiB memory / 540s timeout; everything else is 256–512MiB / 20–120s.
• Scheduled jobs (Cloud Scheduler, via onSchedule) — daily 3:00 AM ET, weekly Monday 3:10 AM ET, monthly 1st-of-month 3:20 AM ET, all America/New_York.