fix(delete-user-data): kit/extension parity – kit uninstall with a plain .env leaves functions running #3262

delete-user-data kit/extension parity. Priority: medium. With a plain .env, "uninstalling" the kit leaves it running and still deleting user data.

Difference

• Extension: firebase ext:uninstall <id> --immediate deletes the functions, Pub/Sub push subscriptions, service account and its IAM bindings. Only the two topics remain.
• Kit: firebase functions:kits:uninstall --instance <id> only deletes deployed resources for instances whose config dir has .env.<projectId>. The README tells users to use .env (or .env.<projectId>). With a plain .env, uninstall exits 0, removes the instance from firebase.json, and leaves all three functions, their Eventarc triggers and subscriptions, and the service account with its 7 project roles running.
• Even with .env.<projectId>, the kit uninstall deletes the service account but leaves its 7 project IAM bindings as deleted:serviceAccount:… entries.

Reproduced

Installed an extension and a kit instance from the same config, then uninstalled both and listed the remaining resources:

Code

• Extension: removal is done by the platform; the resources it removes are declared in extension.yaml#L59-L86.
• Kit: the README recommends a plain .env (README.md#L56, #L96) and has no uninstall section. The no-op comes from firebase-tools' uninstallInstance, which only cleans up per .env.<project> file.

Resolution

• README: recommend .env.<projectId> and add an uninstall section (firebase functions:kits:uninstall --instance <id>), with a note to remove any leftover topics.
• firebase-tools: treat a plain .env as the active project (or refuse with an error instead of exiting 0), and remove IAM bindings before deleting the managed service account.