Firebase Agent Skills

Firebase AI Logic provides several key generative AI features via client-side SDKs:

• Text-Only Generation: Standard text prompts and responses.
• Multimodal Inference: Analyze text combined with images, audio, video, or PDFs.
  • Tip: For files larger than 20MB, store them in Cloud Storage for Firebase and pass the URL instead of using inline data to avoid HTTP 413 errors.
• Chat Sessions: Use startChat to maintain multi-turn conversation history automatically.
• Streaming Responses: Use generateContentStream instead of generateContent to provide a better UX (e.g., a typing effect) by displaying partial results as they arrive.
• Image Generation: Use the Nano Banana models to generate images (requires an upgraded Blaze pay-as-you-go plan).
• Search Grounding: Use the built-in googleSearch tool to ground responses in Google Search.
• Structured Output: Enforce specific JSON schemas for model responses.
• On-Device AI (Hybrid): For web apps, the JavaScript SDK can automatically switch between on-device execution (using Gemini Nano in Chrome) and cloud-hosted execution.

Firebase Authentication provides backend services and SDKs to manage user identity.

Users

Every user is identified by a unique uid. Key user properties include:

• uid: Unique identifier.
• email: User's email address.
• displayName: User's display name.
• photoURL: URL to user's photo.
• emailVerified: Boolean indicating if the email is verified.

Identity Providers

Firebase supports several sign-in methods:

• Email/Password: Standard email/password auth.
• Federated Identity Providers: Google, Facebook, Twitter, GitHub, Microsoft, Apple, etc. (Google Sign-In is the recommended default).
• Phone Number: SMS-based auth.
• Anonymous: Temporary accounts that can be linked to permanent ones later.
• Custom Auth: Integration with existing external auth systems.

Tokens

Upon sign-in, users receive tokens used to authenticate requests to Firebase services (Firestore, Storage, etc.) or custom backends:

• ID Token: A short-lived (1 hour) JWT used to verify identity.
• Refresh Token: A long-lived token used to obtain new ID tokens.

SQL Connect automatically refreshes queries that fetch a single entity by its primary key (e.g., movie(id: $id) or user(key: { uid: $uid })). No @refresh directive is required.

Supported Triggering Operations:

• _insert(data) or _insertMany(data)
• _upsert(data) or _upsertMany(data)
• _update(id) or _update(key)
• _delete(id) or _delete(key)

Important Limitations:

• Bulk operations like _updateMany and _deleteMany do not trigger automatic refreshes.
• List queries, nested queries with JOINs, aggregations, and native SQL do not qualify for automatic refresh and require explicit @refresh directives.

To consume these automatic updates, use the subscribe() method on the client.

# When subscribed to, this query auto-refreshes when movie data changes — no @refresh needed
query GetMovie($id: UUID!) @auth(level: PUBLIC) {
  movie(id: $id) {
    id title rating description
    reviews_on_movie { rating text user { displayName } }
  }
}

Native SQL operations in .gql files must follow strict parsing rules to ensure security and prevent SQL injection:

• String Literals: The sql argument must be a hardcoded string literal block using triple quotes (e.g., sql: """SELECT...""""). It cannot be a GraphQL variable.
• Parameters: Use strict positional parameters ($1, $2, etc.) that correspond to the order of the params array. Named parameters (like $id or :name) are forbidden.
• Comments: Use only block comments (/* ... */). Line comments (--) are forbidden as they can truncate query clauses during compilation. If you comment out a parameter in a SQL block, you must also remove it from the params list.
• Context Maps (_expr): Variables cannot be used inside _expr fields. These must be static strings (e.g., {_expr: "auth.uid"}).
• DDL: Do not use Data Definition Language (DDL) in operations. Use the schema.gql file for table or column changes.
• Query Constraints: query operations cannot contain DML and must start with SELECT, TABLE, or WITH.

Firebase Data Connect supports realtime updates using the @refresh directive on queries. You can trigger refreshes based on specific mutations, conditions, or time intervals.

Refresh Strategies:

1. Mutation-driven: Refresh when a specific operation is executed.

   • Use onMutationExecuted: { operation: "OperationName" }.
   • Use condition to filter refreshes based on mutation variables or auth context (e.g., mutation.variables.genre == request.variables.genre).

2. Time-based: Refresh at a fixed interval.

   • Use every: { seconds: N }.

3. Automatic: Single-entity lookups (e.g., movie(id: $id)) refresh automatically when that specific entity is modified by a mutation, without needing an explicit @refresh directive.

# Refresh when a specific mutation is called with matching variables
query ListMoviesByGenre($genre: String!) @auth(level: PUBLIC)
  @refresh(onMutationExecuted: {
    operation: "AddMovieWithGenre",
    condition: "mutation.variables.genre == request.variables.genre"
  }) {
  movies(where: { genre: { eq: $genre } }) { id title }
}

# Refresh every 30 seconds
query MovieLeaderboard
  @auth(level: PUBLIC)
  @refresh(every: { seconds: 30 }) {
  movies(orderBy: [{ rating: DESC }], limit: 10) {
    id title rating
  }
}