Firebase Emulator

Efficient access to the Firebase Emulator Suite. Each rule below exists because skipping it has burned a real debugging session.

Iron rules

Always use 127.0.0.1, never localhost, in emulator URLs. localhost can resolve to IPv6 ::1, where an unrelated service (e.g. Docker publishing *:8080) may be listening — you get confusing 404s from the wrong server, and no auth header will fix it.
Firestore REST always needs -H "Authorization: Bearer owner" (the literal string owner). Security rules ARE evaluated by the emulator; without the header, reads fail with 403 PERMISSION_DENIED (Null value error). owner is treated as admin and bypasses rules. OAuth access tokens are NOT accepted (invalid jwt) — only owner or an Auth-Emulator-issued ID token works.
To act as a signed-in user with rules evaluated, sign in via the Auth Emulator REST (accounts:signInWithPassword, any ?key= string works) and pass the returned unsigned idToken as the Bearer.
On any unexpected 404 or off-looking response, first verify you are talking to the emulator at all: curl -s http://127.0.0.1:<port>/ and lsof -nP -iTCP:<port> -sTCP:LISTEN. Do not iterate on headers or paths against an unverified port.
Discover the setup, don't assume it. Read firebase.json (emulators block) and .firebaserc (project id), or ask the Hub: curl -s http://127.0.0.1:4400/emulators lists every running emulator with its host/port. Project id matters: data is namespaced per project id, so a "missing" document may just be under a different id.
Never stop or restart emulators the user started unless explicitly asked — they often hold imported data and parallel work.
An empty collection is often not a bug — seed data may simply not contain it. Check what actually exists first with documents:listCollectionIds before investigating.

Project config

Keep project-specific knowledge in .agents/skills-config/firebase-emulator/config.json at the project's git root (create it and its directories if missing):