Firebase CLI

Safety-first wrapper for firebase (firebase-tools). Every command is classified by risk tier BEFORE execution — full Firebase control, w/ anything irreversible, live-traffic-affecting, or cost-incurring gated behind explicit AskUserQuestion. Blast radius: a project's entire data (Firestore/RTDB wipes have NO undo), live sites, prod app config served to every user, & real money (Blaze).

When to Use

• Deploy hosting/functions/rules/indexes; preview channels; rollbacks
• Inspect or mutate Firestore, Realtime DB, Auth users, Remote Config, secrets
• Manage projects, apps, sites, backends, extensions, testers
• Local dev: Emulator Suite, serve, functions shell
• NOT for single-doc conversational data edits — Firebase MCP server fits better; see references/mcp.md (CLI vs MCP)

Prerequisites (run once per session)

bash scripts/firebase_preflight.sh [target-project-id]

Reports CLI/Node version, account, active project, & verifies the target project exists. NEVER run a write op w/o knowing which account+project you're pointed at. Not logged in → user runs firebase login themselves (browser). CI → GOOGLE_APPLICATION_CREDENTIALS service account; --token/FIREBASE_TOKEN are deprecated — refuse.