Stack Firebase

Firebase Stack — Team Briefing

This is a knowledge overlay, not a new specialist. The existing ETYB team does the work — backend-architect writes the backend code, devops-engineer wires the deploys, security-engineer enforces the boundary. This pack tells each role where the current Firebase knowledge lives.

Where the full briefing lives

The full Stack briefing lives in this same folder. Per-product and per-role pages are siblings of this SKILL.md. Every page carries last_verified_on stamps and authoritative-source URLs in its frontmatter; see skills/etyb/core/knowledge-currency.md for the drift-check protocol that uses them.

• Stack briefing: [stacks/firebase/index.md](index.md)
• Per-product pages: stacks/firebase/.md — one per entry in products_covered above
• Per-role views: stacks/firebase/.md — one per role in applies_to_roles above

When ETYB is installed locally these are read directly from disk. For third-party agents without the install, the same content is reachable as raw markdown at https://raw.githubusercontent.com/e-t-y-b/etyb-skills/main/stacks/firebase/.md.

When delegate_to_skills (frontmatter above) lists a first-party vendor MCP/skill that's installed in the user's environment, ETYB defers to it first. The in-repo Stack content is the curated fallback.

What changed in 2025-2026 that older training data misses

Critical context — an LLM with a 2024 cutoff will get these wrong:

• Project IDX is now Firebase Studio (renamed 2025). Same product surface, new branding, deeper Firebase + Gemini integration. If you say "Project IDX" you're using the old name.
• Vertex AI in Firebase is now Firebase AI Logic (renamed 2025). The client-side Gemini SDK that talks to either Vertex AI or the Gemini Developer API behind App Check. The name change matters because the SDK packages were renamed too (@firebase/ai replaces @firebase/vertexai).
• Firebase App Hosting GA (2024) — the SSR-aware successor for Next.js and Angular. Cloud Run + Cloud Build under the hood, GitHub-integrated, replaces the brittle "Hosting + Cloud Functions rewrites" pattern that everyone built circa 2022.
• Firebase Data Connect GA (2024-2025) — managed Cloud SQL Postgres + GraphQL with generated, typed clients. Firebase now has a first-class relational option; "Firebase = NoSQL only" is out of date.
• Cloud Functions Gen 2 is the default for new functions, backed by Cloud Run with concurrent request handling, better cold-start economics, and a different deploy/runtime model. Gen 1 is on the deprecation roadmap — write all new code on v2 (firebase-functions/v2).
• Firestore multi-database per project (GA 2024). You can now provision multiple Firestore databases per project (named, distinct rules, distinct locations). This replaces "one project per database scope" workarounds.
• App Check Replay Protection (GA 2024) — single-use App Check tokens for callable functions, defending against captured-token replay. Worth enabling on every privileged path.
• FCM legacy HTTP and XMPP server APIs are deprecated. Use HTTP v1 API or the Admin SDK. Old code calling fcm.googleapis.com/fcm/send with a server key will break — that endpoint was sunset.
• Firebase Authentication ↔ Identity Platform convergence (2024-2025). The classic Firebase Auth tier and the paid Identity Platform tier (with MFA, SAML/OIDC SSO, advanced security) share the same surface and billing model now; "upgrading to Identity Platform" is a project toggle, not a re-architecture.
• Modular Web SDK is the only supported shape for firebase v9+. Namespaced v8 imports (firebase.auth().signInWithEmailAndPassword(...)) are legacy and tree-shake badly. New code uses tree-shakable modular imports.
• Genkit JS GA, with Python, Go, and Dart maturing through 2025-2026. Genkit's flow/tool/prompt API has churned multiple times — any sample older than mid-2024 likely has out-of-date shapes (defineFlow → ai.defineFlow etc.).

If you find yourself recommending any retired product, deprecated CLI, or renamed feature from the list above, you're using stale knowledge. Read the relevant sibling file in this folder before continuing.

Standing instructions for every role on a Firebase engagement

1. Anchor to currency. Before recommending API shapes, syntax, product names, or pricing, read the relevant sibling file in this folder and check its last_verified_on. If it's older than 6 months, also probe the vendor's authoritative source (in authoritative_sources above).

1. Defer to verticals on domain compliance. This pack covers platform mechanics. HIPAA, PCI/PSD2, SOC 2 specifics belong to healthcare-architect, fintech-architect, saas-architect. Route to the vertical; don't restate compliance content from this pack.

1. Respect platform-specific limits. Governor limits, request quotas, billing units, concurrency caps — every recommendation that implies volume must consider them. If the user's volume doesn't fit, recommend the platform's escape hatch (batch, queue, partition, scale tier) — don't write code and hope.

1. App Check on every privileged backend in production. Cloud Functions, Firestore, Storage, RTDB, Data Connect, AI Logic. Enable in monitoring/shadow mode first to size the impact; enforce after a clean week.

When to escalate out of this pack

| Situation | Escalate to | |-----------|-------------| | Compliance specifics (HIPAA, PCI, SOC 2) | healthcare-architect / fintech-architect / saas-architect | | Multi-stack architecture spanning vendors | system-architect (without the pack overlay) | | Vendor-agnostic work that happens to touch Firebase | the relevant specialist (without the pack overlay) |

Stack composition

If the user is running Firebase alongside another stack that has its own pack registered, both overlays load. Each pack handles its own platform; neither should pretend to know the other's depth.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: e-t-y-b
• Source: e-t-y-b/etyb-skills
• License: MIT
• Homepage: https://etyb.ai

Install and usage instructions live in the source repository linked above.