@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/dist/serve/site-ui/docs/app-check-compat/index.html

@@ -12,42 +12,58 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">initializeAppCheck(app, { provider, isTokenAutoRefreshEnabled }): AppCheck</code><span class="compat-sub"><span class="compat-behavior">Returns an <code>AppCheck</code> handle whose <code>app</code> is the app it was initialized on.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-initialize-twice.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-initialize-twice</code></a> (<code>instanceKeySet</code> includes <code>app</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L95" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L2" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-initialize-twice.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-initialize-twice</code></a> (<code>instanceKeySet</code> includes <code>app</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L142" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L2" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">initializeAppCheck(app, options) called twice</code><span class="compat-sub"><span class="compat-behavior">A second call with the same options returns the same instance without throwing, including when the provider is a new <code>CustomProvider</code> instance built from the same factory.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-initialize-twice.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-initialize-twice</code></a> (<code>sameOptions</code>, <code>sameOptionsNewProviderInstance</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L96" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L2" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-initialize-twice.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-initialize-twice</code></a> (<code>sameOptions</code>, <code>sameOptionsNewProviderInstance</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L143" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L2" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">initializeAppCheck(app, options) called twice</code><span class="compat-sub"><span class="compat-behavior">A second call with a different <code>isTokenAutoRefreshEnabled</code> throws a <code>FirebaseError</code> with code <code>appCheck/already-initialized</code>, <code>customData.appName</code> set to the app name, and the message that names <code>initializeAppCheck()</code> and the app.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-initialize-twice.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-initialize-twice</code></a> (<code>differentAutoRefresh</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L96" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L2" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-initialize-twice.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-initialize-twice</code></a> (<code>differentAutoRefresh</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L143" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L2" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">initializeAppCheck(app, options) called twice</code><span class="compat-sub"><span class="compat-behavior">An omitted <code>isTokenAutoRefreshEnabled</code> is not equal to <code>false</code>: a first call that omits it followed by one that passes <code>false</code>, or the reverse, throws <code>appCheck/already-initialized</code>, and two calls that both omit it return the same instance.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-initialize-twice-unset-auto-refresh.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-initialize-twice-unset-auto-refresh</code></a> (<code>unsetThenFalse</code>, <code>falseThenUnset</code>, <code>unsetThenUnset</code>). Upstream <code>initializeAppCheck</code> in <code>@firebase/app-check</code> 0.11.3 compares <code>initialOptions.isTokenAutoRefreshEnabled === options.isTokenAutoRefreshEnabled</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L174" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L2" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">new CustomProvider({ getToken })</code><span class="compat-sub"><span class="compat-behavior">A <code>CustomProvider</code> constructs and is accepted by <code>initializeAppCheck</code>. With a debug token in effect, the SDK never calls it (a provider whose <code>getToken</code> would reject is called zero times).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>customProviderCalls</code>; the capture initialized App Check with a <code>CustomProvider</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>customProviderCalls</code>; the capture initialized App Check with a <code>CustomProvider</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L204" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L16" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
-<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code>.</span></span></span></summary>
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getToken(appCheck), getLimitedUseToken(appCheck) with a CustomProvider and no debug token</code><span class="compat-sub"><span class="compat-behavior">With <code>FIREBASE_APPCHECK_DEBUG_TOKEN</code> neither <code>true</code> nor a string, the SDK calls the <code>CustomProvider</code> and returns its token as given, caching it until its <code>expireTimeMillis</code>. When the provider rejects, <code>getToken</code> and <code>getLimitedUseToken</code> reject with its error, an <code>onTokenChanged</code> error handler receives it. AI Logic then depends on the handle: by default it gets the placeholder token and refuses the request with a 403, and with <code>useLimitedUseAppCheckTokens: true</code> no request is sent and the call rejects with <code>AIError</code> code <code>error</code>, message <code>Error fetching from &#x3C;url>: &#x3C;provider message></code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Upstream source only, <code>@firebase/app-check</code> 0.11.3 <code>dist/esm/index.esm.js</code>: <code>initializeDebugMode</code> (lines 638 to 657), <code>getToken$2</code> (the provider path from line 783, <code>makeDummyTokenResult</code> on error), <code>getLimitedUseToken$1</code> (lines 847 to 861, no placeholder), <code>CustomProvider.getToken</code> (lines 1374 to 1388), and the public <code>getToken</code> rethrowing <code>result.error</code>; <code>@firebase/ai</code> 2.12.0 <code>dist/esm/index.esm.js</code> <code>getHeaders</code> (line 1619) awaited inside <code>makeRequest</code>'s <code>try</code>, whose <code>catch</code> wraps the rejection (line 1717). A real-SDK Node run in the ai-app-check hunt (GATE-1) saw the provider called and its token, or the placeholder, sent to AI Logic. No committed capture.</div></div>
+</details>
+<details class="compat-row" data-status="unverified">
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code> in a realm with a <code>document</code>, such as a page.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe">Upstream-documented only (firebase 12.13.0 typings and the App Check web guide). The oracle web app has no reCAPTCHA registration, so no capture exists; the sandbox never loads reCAPTCHA.</div></div>
 </details>
+<details class="compat-row" data-status="unverified">
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeAppCheck(app, { provider: new ReCaptchaV3Provider(siteKey) }) with no <code>document</code>, and the same for ReCaptchaEnterpriseProvider</code><span class="compat-sub"><span class="compat-behavior">Where there is no <code>document</code>, such as a Node process or a server-rendered module, <code>initializeAppCheck</code> with either reCAPTCHA provider throws <code>ReferenceError: document is not defined</code> synchronously, with or without <code>FIREBASE_APPCHECK_DEBUG_TOKEN</code>. App Check is already set up for the app when it throws: a second call with the same options returns the handle, and one with other options throws <code>appCheck/already-initialized</code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Upstream source, <code>@firebase/app-check</code> 0.11.3 <code>dist/esm/index.esm.js</code>: <code>initializeAppCheck</code> creates the instance (line 1511) before <code>_activate</code> marks the app activated and calls <code>provider.initialize</code> last (line 1559); <code>ReCaptchaV3Provider.initialize</code> (line 1270) and <code>ReCaptchaEnterpriseProvider.initialize</code> (line 1347) call <code>initializeV3</code> and <code>initializeEnterprise</code>, whose <code>makeDiv</code> reads <code>document</code> (line 1133). A real-SDK run in plain Node 24 (firebase 12.13.0, offline) saw each provider throw the ReferenceError, debug token or not, then return the instance for the same options and throw <code>appCheck/already-initialized</code> for another site key. The package has no Node build. No committed capture. Integration: <code>test/apps/sandbox-app-check</code> (a registered Node process and a Vite server-rendered module).</div></div>
+</details>
 </div>
 <h2 id="tokens-gettoken-getlimitedusetoken">Tokens: <code>getToken</code>, <code>getLimitedUseToken</code></h2>
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck) on an app without initializeAppCheck</code><span class="compat-sub"><span class="compat-behavior">Rejects with a <code>FirebaseError</code> with code <code>appCheck/use-before-activation</code>, <code>customData.appName</code>, and the message telling the caller to call <code>initializeAppCheck()</code> first.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-get-token-before-initialize.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-get-token-before-initialize</code></a> (<code>publicGetTokenWithUninitializedApp</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L148" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-get-token-before-initialize.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-get-token-before-initialize</code></a> (<code>publicGetTokenWithUninitializedApp</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L273" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck, forceRefresh?): Promise&#x3C;AppCheckTokenResult></code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token }</code> where <code>token</code> is a three-segment JWT: header <code>alg</code> RS256, <code>typ</code> JWT, with a <code>kid</code>; claims <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>; <code>iss</code> is <code>https://firebaseappcheck.googleapis.com/&#x3C;projectNumber></code>, <code>aud</code> is <code>[projects/&#x3C;projectNumber>, projects/&#x3C;projectId>]</code>, <code>sub</code> is the app id, and <code>exp - iat</code> is 3600 seconds.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>first</code>, <code>forced</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>first</code>, <code>forced</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L205" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck, forceRefresh?)</code><span class="compat-sub"><span class="compat-behavior">A second <code>getToken</code> returns the cached token; <code>getToken(appCheck, true)</code> returns a different, newly minted token.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>secondEqualsFirst</code>, <code>forceRefreshDiffersFromFirst</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>secondEqualsFirst</code>, <code>forceRefreshDiffersFromFirst</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L205" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck, forceRefresh?) called concurrently</code><span class="compat-sub"><span class="compat-behavior">Production, debug mode: concurrent <code>getToken</code> calls share one in-flight exchange, <code>forceRefresh</code> calls included: two calls started together with no cached token resolve to one token, and two forced calls started together resolve to one new token. Listener calls are row <code>app-check#on-token-changed-refresh</code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-get-token-concurrent.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-get-token-concurrent</code></a> (<code>concurrentFirstShareOneToken</code>, <code>concurrentForcedShareOneToken</code>, <code>forcedDiffersFromFirst</code>). Upstream <code>getToken</code> in <code>@firebase/app-check</code> 0.11.3 starts an exchange only <code>if (!state.exchangeTokenPromise)</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L306" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getLimitedUseToken(appCheck): Promise&#x3C;AppCheckTokenResult></code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token }</code> with the same JWT shape as <code>getToken</code>, a different token on every call, never the cached token, and leaves the cached <code>getToken</code> token unchanged.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-limited-use-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-limited-use-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L181" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-limited-use-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-limited-use-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L322" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unsupported">
 <summary class="compat-line"><span class="compat-dot" data-status="unsupported" role="img" aria-label="Not implemented yet" title="Not implemented yet"></span><span class="compat-main"><code class="compat-api">getToken / getLimitedUseToken when attestation fails</code><span class="compat-sub"><span class="compat-behavior">When the exchange is refused (an unregistered debug token), both reject with a <code>FirebaseError</code> with code <code>appCheck/fetch-status-error</code> and <code>customData.httpStatus</code> 403.</span></span></span></summary>
@@ -58,15 +74,15 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer): Unsubscribe</code><span class="compat-sub"><span class="compat-behavior">Returns an unsubscribe function. A listener registered after a token exists is not called synchronously; it is called once, asynchronously, with the current cached token.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (<code>unsubscribeType</code>, <code>lateListenerCallsSynchronous</code>, <code>lateListenerCallsWithin500ms</code>, <code>lateListenerTokenSequence</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L205" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (<code>unsubscribeType</code>, <code>lateListenerCallsSynchronous</code>, <code>lateListenerCallsWithin500ms</code>, <code>lateListenerTokenSequence</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L346" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer)</code><span class="compat-sub"><span class="compat-behavior">Production, debug mode: listeners and observers registered before the first <code>getToken</code> are never called, not by the first token, a forced refresh, or limited-use tokens. Sandbox: they are called once each time the cached token changes (the first token and every forced refresh), never for limited-use tokens, and not after unsubscribing, which is the upstream-documented behavior for an attestation provider.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L347" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">setTokenAutoRefreshEnabled(appCheck, isEnabled): void</code><span class="compat-sub"><span class="compat-behavior">Returns <code>undefined</code> and does not throw for either value; <code>getToken</code> still returns the cached token afterwards. Background refresh timing is not captured.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-auto-refresh-toggle.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-auto-refresh-toggle</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L263" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L43" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-auto-refresh-toggle.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-auto-refresh-toggle</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L404" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L42" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 </div>
 <h2 id="token-exchange-on-the-wire">Token exchange on the wire</h2>
@@ -80,23 +96,23 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId)</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token, ttlMillis: 3600000 }</code>; the token has the web SDK token shape (RS256 JWT with <code>kid</code>, claims <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>, <code>exp - iat</code> 3600).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-shape.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-shape</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L70" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-shape.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-shape</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L72" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { ttlMillis })</code><span class="compat-sub"><span class="compat-behavior"><code>ttlMillis</code> of 30 minutes is honored in the result and in <code>exp - iat</code>; 29 minutes and 7 days plus one second reject with <code>app-check/invalid-argument</code> and the message that names the 30 minute to 7 day range.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-custom-ttl.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-custom-ttl</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L105" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-custom-ttl.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-custom-ttl</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L107" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(unknownAppId)</code><span class="compat-sub"><span class="compat-behavior">Production: an app id the project does not own rejects with <code>app-check/unknown-error</code> and the message <code>App not registered: &#x3C;appId>.</code> Sandbox: it has no list of the project's registered apps, so it mints a token for any non-empty app id; an empty app id rejects with <code>app-check/invalid-argument</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L115" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token)</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ appId, token }</code> for an Admin-minted token and for a token from the web debug exchange; the decoded token carries <code>app_id</code>, <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>, and no <code>alreadyConsumed</code> key is present.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L126" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(badToken)</code><span class="compat-sub"><span class="compat-behavior">A token with an altered signature rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has invalid signature.</code>; a non-JWT string and the empty string reject with <code>app-check/invalid-argument</code> and the decoding message.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-tampered.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-tampered</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L143" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-tampered.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-tampered</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L145" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
 <summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&#x3C;alg>".</code>; an <code>aud</code> without <code>projects/&#x3C;projectId></code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&#x3C;projectId>" but got "&#x3C;aud>". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a token with no <code>kid</code> is checked against every key. A <code>kid</code> that names a key other than the sandbox's marks a token from Firebase: in sandbox AI mode it rejects with Pyric's message (row <code>verify-token-firebase-token</code>), and in production AI mode it goes to firebase-admin (row <code>verify-token-firebase-token-production-ai-mode</code>). After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
@@ -104,11 +120,11 @@ html{scrollbar-gutter:stable}
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, { consume: true })</code><span class="compat-sub"><span class="compat-behavior">The first consume resolves with <code>alreadyConsumed: false</code>, a second consume with <code>alreadyConsumed: true</code>, and a plain verify afterwards has no <code>alreadyConsumed</code> key.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L197" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L199" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) in sandbox AI mode</code><span class="compat-sub"><span class="compat-behavior">Production verifies the App Check tokens Firebase issues. Sandbox: in sandbox AI mode, or in a process not started with <code>@pyric/cli/register</code> in production AI mode, a token whose <code>kid</code> names a key other than the sandbox's rejects with <code>app-check/invalid-argument</code> and Pyric's message, which says the token was not minted by the Pyric sandbox and to start the server in production AI mode (<code>PYRIC_AI_MODE=production</code>). The project check comes first, as in production.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L129" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
 <summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) under @pyric/cli/register in production AI mode</code><span class="compat-sub"><span class="compat-behavior">A token whose <code>kid</code> names a key other than the sandbox's goes to firebase-admin's own <code>verifyToken</code>, for an app scoped to the project the mirror resolves. It resolves with production's <code>{ appId, token }</code> shape, the decoded token carrying <code>app_id</code>, and firebase-admin's errors (signature, audience, issuer, expiry) pass through with their codes and messages. Sandbox tokens, tokens with no <code>kid</code>, and malformed tokens keep the sandbox path.</span></span></span></summary>
@@ -116,25 +132,81 @@ html{scrollbar-gutter:stable}
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken, { consume: true }) in production AI mode</code><span class="compat-sub"><span class="compat-behavior">Production records consumption on Firebase's servers, once per project: the first consume resolves with <code>alreadyConsumed: false</code> and a second with <code>alreadyConsumed: true</code>. Sandbox: firebase-admin verifies the token without <code>consume</code>, and the mirror records it in the process, in the set it keeps for sandbox tokens, with the same <code>false</code> then <code>true</code> results.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L200" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
 <summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeApp({ credential: cert(serviceAccount) }), then getAppCheck().createToken and verifyToken</code><span class="compat-sub"><span class="compat-behavior">An app initialized with only a cert credential finds its project in the service account's <code>project_id</code> (or <code>projectId</code>), so <code>createToken</code> mints a token whose <code>aud</code> names <code>projects/&#x3C;project_id></code> and <code>verifyToken</code> accepts it. The <code>projectId</code> app option wins over the credential, and the credential wins over <code>GOOGLE_CLOUD_PROJECT</code> and <code>GCLOUD_PROJECT</code>. The project id is not copied into <code>app.options</code>.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe">Upstream-documented only: firebase-admin 13.6.0 <code>lib/utils/index.js</code> (<code>getExplicitProjectId</code>) and <code>lib/app/credential-internal.js</code> (<code>ServiceAccount</code>, <code>copyAttr</code>). No capture; the project is resolved locally in the Admin SDK.</div></div>
 </details>
 </div>
+<h2 id="firebase-admin-createtoken-options-checked-against-production-captures">firebase-admin <code>createToken</code> options, checked against production captures</h2>
+<p>Each row cites a production capture from the App Check and AI Logic hunt. A <code>bug</code> row states production’s behavior and pyric’s; its replay holds both answers until the fix lands.</p>
+<div class="compat-list">
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { limitedUse: true, jti }) twice, then verifyToken(token, { consume: true })</code><span class="compat-sub"><span class="compat-behavior">AC-1: pyric ignores jti, so two same-jti tokens differ and both first consumes say false; production returns one token and the second consume says true.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-same-jti-consume.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-same-jti-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { jti }) / ({ limitedUse: "yes" }) / ({ limitedUse: true, jti: 5 })</code><span class="compat-sub"><span class="compat-behavior">AC-1c, AC-1d, AC-1e: production rejects jti without limitedUse, a non-boolean limitedUse and a non-string jti; pyric mints a token.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { limitedUse: true })</code><span class="compat-sub"><span class="compat-behavior">AC-1f: production limited-use tokens live 300 s; pyric gives them 3600 s.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, null | "str" | [] | { ttlMillis: null })</code><span class="compat-sub"><span class="compat-behavior">AC-2: production throws for null, string or array options and a null ttlMillis; pyric mints a token.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { ttlMillis: NaN | "1800000" })</code><span class="compat-sub"><span class="compat-behavior">AC-3: for a ttlMillis that is not a number, pyric gives the range message instead of production's duration message.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken("") / createToken(appId, { ttlMillis: 1 }) and the other local option checks</code><span class="compat-sub"><span class="compat-behavior">AC-4: production throws createToken input errors synchronously; pyric returns a rejected promise.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { ttlMillis: 1800999 | 1800000.5 })</code><span class="compat-sub"><span class="compat-behavior">AC-5: for fractional ttlMillis pyric echoes the value and floors the lifetime; production rounds both.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, { consume: true })</code><span class="compat-sub"><span class="compat-behavior">AC-12: the consume result key order is alreadyConsumed, appId, token in production; pyric puts alreadyConsumed last.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-same-jti-consume.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-same-jti-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L132" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div>
+</details>
+</div>
 <h2 id="current-gaps">Current gaps</h2>
 <h3 id="documented-divergences">Documented divergences</h3>
 <p>Known differences between Pyric and production Firebase. Each remains tracked as a non-conforming row.</p>
 <div class="compat-list">
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer)</code><span class="compat-sub"><span class="compat-behavior">Production, debug mode: listeners and observers registered before the first <code>getToken</code> are never called, not by the first token, a forced refresh, or limited-use tokens. Sandbox: they are called once each time the cached token changes (the first token and every forced refresh), never for limited-use tokens, and not after unsubscribing, which is the upstream-documented behavior for an attestation provider.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L347" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L147" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(unknownAppId)</code><span class="compat-sub"><span class="compat-behavior">Production: an app id the project does not own rejects with <code>app-check/unknown-error</code> and the message <code>App not registered: &#x3C;appId>.</code> Sandbox: it has no list of the project's registered apps, so it mints a token for any non-empty app id; an empty app id rejects with <code>app-check/invalid-argument</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L115" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) in sandbox AI mode</code><span class="compat-sub"><span class="compat-behavior">Production verifies the App Check tokens Firebase issues. Sandbox: in sandbox AI mode, or in a process not started with <code>@pyric/cli/register</code> in production AI mode, a token whose <code>kid</code> names a key other than the sandbox's rejects with <code>app-check/invalid-argument</code> and Pyric's message, which says the token was not minted by the Pyric sandbox and to start the server in production AI mode (<code>PYRIC_AI_MODE=production</code>). The project check comes first, as in production.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L129" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken, { consume: true }) in production AI mode</code><span class="compat-sub"><span class="compat-behavior">Production records consumption on Firebase's servers, once per project: the first consume resolves with <code>alreadyConsumed: false</code> and a second with <code>alreadyConsumed: true</code>. Sandbox: firebase-admin verifies the token without <code>consume</code>, and the mirror records it in the process, in the set it keeps for sandbox tokens, with the same <code>false</code> then <code>true</code> results.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L200" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+</div>
+<h3 id="bugs">Bugs</h3>
+<p>Behavior that should match production Firebase but currently does not.</p>
+<div class="compat-list">
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { limitedUse: true, jti }) twice, then verifyToken(token, { consume: true })</code><span class="compat-sub"><span class="compat-behavior">AC-1: pyric ignores jti, so two same-jti tokens differ and both first consumes say false; production returns one token and the second consume says true.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a> and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-same-jti-consume.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-same-jti-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { jti }) / ({ limitedUse: "yes" }) / ({ limitedUse: true, jti: 5 })</code><span class="compat-sub"><span class="compat-behavior">AC-1c, AC-1d, AC-1e: production rejects jti without limitedUse, a non-boolean limitedUse and a non-string jti; pyric mints a token.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { limitedUse: true })</code><span class="compat-sub"><span class="compat-behavior">AC-1f: production limited-use tokens live 300 s; pyric gives them 3600 s.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, null | "str" | [] | { ttlMillis: null })</code><span class="compat-sub"><span class="compat-behavior">AC-2: production throws for null, string or array options and a null ttlMillis; pyric mints a token.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { ttlMillis: NaN | "1800000" })</code><span class="compat-sub"><span class="compat-behavior">AC-3: for a ttlMillis that is not a number, pyric gives the range message instead of production's duration message.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken("") / createToken(appId, { ttlMillis: 1 }) and the other local option checks</code><span class="compat-sub"><span class="compat-behavior">AC-4: production throws createToken input errors synchronously; pyric returns a rejected promise.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { ttlMillis: 1800999 | 1800000.5 })</code><span class="compat-sub"><span class="compat-behavior">AC-5: for fractional ttlMillis pyric echoes the value and floors the lifetime; production rounds both.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-create-token.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-create-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L111" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, { consume: true })</code><span class="compat-sub"><span class="compat-behavior">AC-12: the consume result key order is alreadyConsumed, appId, token in production; pyric puts alreadyConsumed last.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-options-same-jti-consume.json" target="_blank" rel="noopener noreferrer"><code>oracle:app-check-admin-options-same-jti-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/hunt-captures.test.ts#L132" target="_blank" rel="noopener noreferrer"><code>hunt-captures.test.ts</code></a>)</div></div></details>
 </div>
 <h3 id="not-implemented-yet">Not implemented yet</h3>
 <p>Tracked behavior that is not implemented in the current contract.</p>
@@ -147,12 +219,16 @@ html{scrollbar-gutter:stable}
 <h3 id="unverified">Unverified</h3>
 <p>Tracked behavior whose available evidence does not yet establish the production result.</p>
 <div class="compat-list">
-<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code>.</span></span></span></summary>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getToken(appCheck), getLimitedUseToken(appCheck) with a CustomProvider and no debug token</code><span class="compat-sub"><span class="compat-behavior">With <code>FIREBASE_APPCHECK_DEBUG_TOKEN</code> neither <code>true</code> nor a string, the SDK calls the <code>CustomProvider</code> and returns its token as given, caching it until its <code>expireTimeMillis</code>. When the provider rejects, <code>getToken</code> and <code>getLimitedUseToken</code> reject with its error, an <code>onTokenChanged</code> error handler receives it. AI Logic then depends on the handle: by default it gets the placeholder token and refuses the request with a 403, and with <code>useLimitedUseAppCheckTokens: true</code> no request is sent and the call rejects with <code>AIError</code> code <code>error</code>, message <code>Error fetching from &#x3C;url>: &#x3C;provider message></code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Upstream source only, <code>@firebase/app-check</code> 0.11.3 <code>dist/esm/index.esm.js</code>: <code>initializeDebugMode</code> (lines 638 to 657), <code>getToken$2</code> (the provider path from line 783, <code>makeDummyTokenResult</code> on error), <code>getLimitedUseToken$1</code> (lines 847 to 861, no placeholder), <code>CustomProvider.getToken</code> (lines 1374 to 1388), and the public <code>getToken</code> rethrowing <code>result.error</code>; <code>@firebase/ai</code> 2.12.0 <code>dist/esm/index.esm.js</code> <code>getHeaders</code> (line 1619) awaited inside <code>makeRequest</code>'s <code>try</code>, whose <code>catch</code> wraps the rejection (line 1717). A real-SDK Node run in the ai-app-check hunt (GATE-1) saw the provider called and its token, or the placeholder, sent to AI Logic. No committed capture.</div></div></details>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code> in a realm with a <code>document</code>, such as a page.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Upstream-documented only (firebase 12.13.0 typings and the App Check web guide). The oracle web app has no reCAPTCHA registration, so no capture exists; the sandbox never loads reCAPTCHA.</div></div></details>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeAppCheck(app, { provider: new ReCaptchaV3Provider(siteKey) }) with no `document`, and the same for ReCaptchaEnterpriseProvider</code><span class="compat-sub"><span class="compat-behavior">Where there is no <code>document</code>, such as a Node process or a server-rendered module, <code>initializeAppCheck</code> with either reCAPTCHA provider throws <code>ReferenceError: document is not defined</code> synchronously, with or without <code>FIREBASE_APPCHECK_DEBUG_TOKEN</code>. App Check is already set up for the app when it throws: a second call with the same options returns the handle, and one with other options throws <code>appCheck/already-initialized</code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Upstream source, <code>@firebase/app-check</code> 0.11.3 <code>dist/esm/index.esm.js</code>: <code>initializeAppCheck</code> creates the instance (line 1511) before <code>_activate</code> marks the app activated and calls <code>provider.initialize</code> last (line 1559); <code>ReCaptchaV3Provider.initialize</code> (line 1270) and <code>ReCaptchaEnterpriseProvider.initialize</code> (line 1347) call <code>initializeV3</code> and <code>initializeEnterprise</code>, whose <code>makeDiv</code> reads <code>document</code> (line 1133). A real-SDK run in plain Node 24 (firebase 12.13.0, offline) saw each provider throw the ReferenceError, debug token or not, then return the instance for the same options and throw <code>appCheck/already-initialized</code> for another site key. The package has no Node build. No committed capture. Integration: <code>test/apps/sandbox-app-check</code> (a registered Node process and a Vite server-rendered module).</div></div></details>
 <details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&#x3C;alg>".</code>; an <code>aud</code> without <code>projects/&#x3C;projectId></code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&#x3C;projectId>" but got "&#x3C;aud>". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a token with no <code>kid</code> is checked against every key. A <code>kid</code> that names a key other than the sandbox's marks a token from Firebase: in sandbox AI mode it rejects with Pyric's message (row <code>verify-token-firebase-token</code>), and in production AI mode it goes to firebase-admin (row <code>verify-token-firebase-token-production-ai-mode</code>). After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Upstream-documented only: firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code> (<code>verifyToken</code>, <code>verifyContent</code>, <code>ensureProjectId</code>, <code>mapJwtErrorToAppCheckError</code>), <code>lib/utils/jwt.js</code> (<code>getKeyCallback</code>, <code>PublicKeySignatureVerifier.verify</code>), jws 4 <code>verify-stream.js</code> (<code>JWS_REGEX</code>), and jsonwebtoken 9 <code>verify.js</code> (<code>nbf</code>, <code>exp</code>). No capture; verification runs locally in the Admin SDK, so a capture would need no production change.</div></div></details>
 <details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) under @pyric/cli/register in production AI mode</code><span class="compat-sub"><span class="compat-behavior">A token whose <code>kid</code> names a key other than the sandbox's goes to firebase-admin's own <code>verifyToken</code>, for an app scoped to the project the mirror resolves. It resolves with production's <code>{ appId, token }</code> shape, the decoded token carrying <code>app_id</code>, and firebase-admin's errors (signature, audience, issuer, expiry) pass through with their codes and messages. Sandbox tokens, tokens with no <code>kid</code>, and malformed tokens keep the sandbox path.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> for the result shape; the verification itself is firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code>, run unchanged.</div></div></details>
 <details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeApp({ credential: cert(serviceAccount) }), then getAppCheck().createToken and verifyToken</code><span class="compat-sub"><span class="compat-behavior">An app initialized with only a cert credential finds its project in the service account's <code>project_id</code> (or <code>projectId</code>), so <code>createToken</code> mints a token whose <code>aud</code> names <code>projects/&#x3C;project_id></code> and <code>verifyToken</code> accepts it. The <code>projectId</code> app option wins over the credential, and the credential wins over <code>GOOGLE_CLOUD_PROJECT</code> and <code>GCLOUD_PROJECT</code>. The project id is not copied into <code>app.options</code>.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Upstream-documented only: firebase-admin 13.6.0 <code>lib/utils/index.js</code> (<code>getExplicitProjectId</code>) and <code>lib/app/credential-internal.js</code> (<code>ServiceAccount</code>, <code>copyAttr</code>). No capture; the project is resolved locally in the Admin SDK.</div></div></details>
-</div> </article> </main> <aside class="doc-toc" aria-label="On this page" data-astro-cid-mw7aashj> <h2 class="doc-toc-heading" data-astro-cid-mw7aashj>On this page</h2> <ul data-astro-cid-mw7aashj> <li data-depth="2" data-astro-cid-mw7aashj> <a href="#initializeappcheckapp-options-and-providers" data-astro-cid-mw7aashj>initializeAppCheck(app, options) and providers</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#tokens-gettoken-getlimitedusetoken" data-astro-cid-mw7aashj>Tokens: getToken, getLimitedUseToken</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#listeners-and-refresh-ontokenchanged-settokenautorefreshenabled" data-astro-cid-mw7aashj>Listeners and refresh: onTokenChanged, setTokenAutoRefreshEnabled</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#token-exchange-on-the-wire" data-astro-cid-mw7aashj>Token exchange on the wire</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#firebase-admin-getappcheck" data-astro-cid-mw7aashj>firebase-admin getAppCheck()</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#current-gaps" data-astro-cid-mw7aashj>Current gaps</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#documented-divergences" data-astro-cid-mw7aashj>Documented divergences</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#not-implemented-yet" data-astro-cid-mw7aashj>Not implemented yet</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#unverified" data-astro-cid-mw7aashj>Unverified</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script>  </body></html> 
+</div> </article> </main> <aside class="doc-toc" aria-label="On this page" data-astro-cid-mw7aashj> <h2 class="doc-toc-heading" data-astro-cid-mw7aashj>On this page</h2> <ul data-astro-cid-mw7aashj> <li data-depth="2" data-astro-cid-mw7aashj> <a href="#initializeappcheckapp-options-and-providers" data-astro-cid-mw7aashj>initializeAppCheck(app, options) and providers</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#tokens-gettoken-getlimitedusetoken" data-astro-cid-mw7aashj>Tokens: getToken, getLimitedUseToken</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#listeners-and-refresh-ontokenchanged-settokenautorefreshenabled" data-astro-cid-mw7aashj>Listeners and refresh: onTokenChanged, setTokenAutoRefreshEnabled</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#token-exchange-on-the-wire" data-astro-cid-mw7aashj>Token exchange on the wire</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#firebase-admin-getappcheck" data-astro-cid-mw7aashj>firebase-admin getAppCheck()</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#firebase-admin-createtoken-options-checked-against-production-captures" data-astro-cid-mw7aashj>firebase-admin createToken options, checked against production captures</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#current-gaps" data-astro-cid-mw7aashj>Current gaps</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#documented-divergences" data-astro-cid-mw7aashj>Documented divergences</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#bugs" data-astro-cid-mw7aashj>Bugs</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#not-implemented-yet" data-astro-cid-mw7aashj>Not implemented yet</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#unverified" data-astro-cid-mw7aashj>Unverified</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script>  </body></html>