// firebase.ts
import { initializeApp, FirebaseApp } from 'firebase/app';
import { getAI, GoogleAIBackend, AI } from 'firebase/ai';

const firebaseConfig = {
  apiKey: "your-firebase-api-key",            // ✅ Firebase Web API key — safe in client.
  authDomain: "your-project.firebaseapp.com", // This is a project identifier,
  projectId: "your-project-id",               // NOT a billing credential.
  appId: "your-app-id"
};

const app: FirebaseApp = initializeApp(firebaseConfig);

// All requests route through Firebase's proxy.
// Your Gemini API key never leaves Firebase's servers.
const ai: AI = getAI(app, { backend: new GoogleAIBackend() });

export { app, ai };

---
model: gemini-3.1-flash
config:
  temperature: 0.4
  topP: 0.9
input:
  schema:
    userQuery: string
    userName?: string
---
{{role "system"}}
You are a professional support agent for Acme Corp.
You answer questions about orders, returns, and shipping only.
You do not engage with topics outside these areas.

{{role "user"}}
{{#if userName}}Customer {{userName}} asks:{{/if}}
{{userQuery}}

// secure-chat.ts
import { getAI, GoogleAIBackend, getTemplateGenerativeModel } from 'firebase/ai';
import { app } from './firebase';

// Typed interface matching the template's input schema.
// Enforced at compile time — no undeclared fields can reach the template.
interface SupportTemplateVariables {
  userQuery: string;
  userName?: string;
}

const ai = getAI(app, { backend: new GoogleAIBackend() });

// Must use getTemplateGenerativeModel() — not ai.templateGenerativeModel()
const templateModel = getTemplateGenerativeModel(ai);

export async function askSupportAgent(
  userInput: string,
  displayName?: string
): Promise<string> {
  const variables: SupportTemplateVariables = {
    userQuery: userInput,
    userName: displayName ?? undefined,
  };

  // Client sends only: template ID + typed variable values.
  // System instructions, model config, and safety settings
  // are composed server-side and never reach the client.
  const result = await templateModel.generateContent(
    'support-agent-v2',
    variables
  );

  return result.response.text();
}

// app-check.ts
import { initializeAppCheck, ReCaptchaEnterpriseProvider, AppCheck } from 'firebase/app-check';
import { FirebaseApp } from 'firebase/app';
import { app } from './firebase';

export function initializeSecureAppCheck(app: FirebaseApp): AppCheck {
  return initializeAppCheck(app, {
    provider: new ReCaptchaEnterpriseProvider(
      import.meta.env.VITE_RECAPTCHA_ENTERPRISE_SITE_KEY
    ),
    // The SDK automatically attaches a fresh App Check token
    // to every outgoing Firebase request — no manual token
    // management needed anywhere in your app.
    isTokenAutoRefreshEnabled: true,
  });
}

// main.ts — call this once before any Firebase AI Logic requests
import { initializeSecureAppCheck } from './app-check';
import { app } from './firebase';

initializeSecureAppCheck(app);

// Your application code is identical with or without Model Armor.
// Enforcement happens at the Firebase infrastructure layer.

export async function askSupportAgent(
  userInput: string,
  displayName?: string
): Promise<string | null> {
  const variables: SupportTemplateVariables = {
    userQuery: userInput,
    userName: displayName,
  };

  try {
    const result = await templateModel.generateContent(
      'support-agent-v2',
      variables
    );
    return result.response.text();

  } catch (error: unknown) {
    // If Model Armor intercepted the input or output as a policy violation,
    // Firebase returns an error before the model processes it.
    // You handle the error — not the unsafe content.
    if (error instanceof Error) {
      console.error('Request blocked by content policy:', error.message);
    }
    return null;
  }
}

User submits input
        │
        ▼ TypeScript interface — typed variables enforced at compile time
        │
        ▼ Firebase SDK — App Check token automatically attached
        │
        ▼ Firebase Proxy — token validated; replay check (single-use)
                         — Gemini API key never leaves server ✓
        │
        ▼ Firebase AI Logic — Template-Only Mode enforced
                            — Server template composed, not client prompt ✓
        │
        ▼ Model Armor — input inspected against guardrails ✓
        │
        ▼ Gemini API — processes sanitized, policy-compliant prompt
        │
        ▼ Model Armor — response inspected before return
        │
        ▼ Your app receives a clean, policy-compliant response ✓