call ensureInstanceUpToDate in ext:export

[Berlioz]

Dumb question: is ensureInstanceUpToDate the correct name now that it doesn't, well, ensure that the instance is up to date if the user refuses permission to upgrade?

[gemini-code-assist]

Code Review

This pull request updates the ext:export command to ensure that the extension instance being exported is up-to-date. It imports and calls ensureInstanceUpToDate with the appropriate options before proceeding with the export. There are no review comments, so I have no additional feedback to provide.

[ajperel]

AI says the following. I'm not 100% sure if it's right, but seems easy enough to defensively do this? We really want this removal to work and I'll admit I haven't tested re-deploying after a migration to ensure secrets really weren't deleted.

[Blocking / Safety] Missing Specification Loading (ensureInstanceSpec)getInstance() from the Extensions API does not populate instance.config.source.spec for published extensions. In ensureInstanceUpToDate(), if the instance is already on the latest version or the user declines the upgrade, it returns instance as is without loading spec.Impact:
handleSecretEjection(options, instance)
Calls
secretsNeedingEjection(instance)
which filters instance.config?.source?.spec?.params for secrets. With spec missing, 0 secrets are detected and secret ejection is silently skipped, risking permanent deletion of Secret Manager secrets on subsequent extension uninstall.

functionsEnvFromInstance(instance)
Reads instance.config?.source?.spec?.params and specSystemParams to inject default parameters and FIREBASE_SECRET_REF_* variables. With spec missing, defaults and secret references are omitted from .env.<projectId>.
Recommendation: Follow src/commands/ext-migrate.ts:79-86 by calling ensureInstanceSpec

instance = await ensureInstanceSpec(instance);
if (!instance.config?.source?.spec) {
  throw new FirebaseError(
    `Could not load extension specification for ${clc.bold(options.instance as string)}. Unable to export configuration.`,
  );
}
instance = await ensureInstanceUpToDate(projectId, instance, {
  nonInteractive: options.nonInteractive,
  force: options.force,
});

[Berlioz]

Yeah agreed, may as well be paranoid. I don't think that if(throw) does anything, if you look at what ensureInstanceSpec does--it throws if anything goes wrong with the API calls, and then it will always populate a spec with blind reads from the API result even if those reads are undefined.