@pyric/cli 0.1.0-alpha.30 → 0.1.0-alpha.30.2

package/dist/serve/site-ui/docs/app-check-compat/index.html

@@ -24,7 +24,7 @@ html{scrollbar-gutter:stable}
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">new CustomProvider({ getToken })</code><span class="compat-sub"><span class="compat-behavior">A <code>CustomProvider</code> constructs and is accepted by <code>initializeAppCheck</code>. With a debug token in effect, the SDK never calls it (a provider whose <code>getToken</code> would reject is called zero times).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>customProviderCalls</code>; the capture initialized App Check with a <code>CustomProvider</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>customProviderCalls</code>; the capture initialized App Check with a <code>CustomProvider</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
 <summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code>.</span></span></span></summary>
@@ -35,19 +35,19 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck) on an app without initializeAppCheck</code><span class="compat-sub"><span class="compat-behavior">Rejects with a <code>FirebaseError</code> with code <code>appCheck/use-before-activation</code>, <code>customData.appName</code>, and the message telling the caller to call <code>initializeAppCheck()</code> first.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-get-token-before-initialize.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-get-token-before-initialize</code></a> (<code>publicGetTokenWithUninitializedApp</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L148" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-get-token-before-initialize.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-get-token-before-initialize</code></a> (<code>publicGetTokenWithUninitializedApp</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L148" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck, forceRefresh?): Promise&#x3C;AppCheckTokenResult></code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token }</code> where <code>token</code> is a three-segment JWT: header <code>alg</code> RS256, <code>typ</code> JWT, with a <code>kid</code>; claims <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>; <code>iss</code> is <code>https://firebaseappcheck.googleapis.com/&#x3C;projectNumber></code>, <code>aud</code> is <code>[projects/&#x3C;projectNumber>, projects/&#x3C;projectId>]</code>, <code>sub</code> is the app id, and <code>exp - iat</code> is 3600 seconds.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>first</code>, <code>forced</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>first</code>, <code>forced</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck, forceRefresh?)</code><span class="compat-sub"><span class="compat-behavior">A second <code>getToken</code> returns the cached token; <code>getToken(appCheck, true)</code> returns a different, newly minted token.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>secondEqualsFirst</code>, <code>forceRefreshDiffersFromFirst</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>secondEqualsFirst</code>, <code>forceRefreshDiffersFromFirst</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getLimitedUseToken(appCheck): Promise&#x3C;AppCheckTokenResult></code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token }</code> with the same JWT shape as <code>getToken</code>, a different token on every call, never the cached token, and leaves the cached <code>getToken</code> token unchanged.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-limited-use-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-limited-use-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L181" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-limited-use-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-limited-use-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L181" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unsupported">
 <summary class="compat-line"><span class="compat-dot" data-status="unsupported" role="img" aria-label="Not implemented yet" title="Not implemented yet"></span><span class="compat-main"><code class="compat-api">getToken / getLimitedUseToken when attestation fails</code><span class="compat-sub"><span class="compat-behavior">When the exchange is refused (an unregistered debug token), both reject with a <code>FirebaseError</code> with code <code>appCheck/fetch-status-error</code> and <code>customData.httpStatus</code> 403.</span></span></span></summary>
@@ -58,15 +58,15 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer): Unsubscribe</code><span class="compat-sub"><span class="compat-behavior">Returns an unsubscribe function. A listener registered after a token exists is not called synchronously; it is called once, asynchronously, with the current cached token.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (<code>unsubscribeType</code>, <code>lateListenerCallsSynchronous</code>, <code>lateListenerCallsWithin500ms</code>, <code>lateListenerTokenSequence</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L205" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (<code>unsubscribeType</code>, <code>lateListenerCallsSynchronous</code>, <code>lateListenerCallsWithin500ms</code>, <code>lateListenerTokenSequence</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L205" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer)</code><span class="compat-sub"><span class="compat-behavior">Production, debug mode: listeners and observers registered before the first <code>getToken</code> are never called, not by the first token, a forced refresh, or limited-use tokens. Sandbox: they are called once each time the cached token changes (the first token and every forced refresh), never for limited-use tokens, and not after unsubscribing, which is the upstream-documented behavior for an attestation provider.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">setTokenAutoRefreshEnabled(appCheck, isEnabled): void</code><span class="compat-sub"><span class="compat-behavior">Returns <code>undefined</code> and does not throw for either value; <code>getToken</code> still returns the cached token afterwards. Background refresh timing is not captured.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-auto-refresh-toggle.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-auto-refresh-toggle</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L263" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L41" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-auto-refresh-toggle.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-auto-refresh-toggle</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L263" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L43" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 </div>
 <h2 id="token-exchange-on-the-wire">Token exchange on the wire</h2>
@@ -80,31 +80,47 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId)</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token, ttlMillis: 3600000 }</code>; the token has the web SDK token shape (RS256 JWT with <code>kid</code>, claims <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>, <code>exp - iat</code> 3600).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-shape.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-shape</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L68" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-shape.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-shape</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L70" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { ttlMillis })</code><span class="compat-sub"><span class="compat-behavior"><code>ttlMillis</code> of 30 minutes is honored in the result and in <code>exp - iat</code>; 29 minutes and 7 days plus one second reject with <code>app-check/invalid-argument</code> and the message that names the 30 minute to 7 day range.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-custom-ttl.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-custom-ttl</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L75" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-custom-ttl.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-custom-ttl</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L105" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(unknownAppId)</code><span class="compat-sub"><span class="compat-behavior">Production: an app id the project does not own rejects with <code>app-check/unknown-error</code> and the message <code>App not registered: &#x3C;appId>.</code> Sandbox: it has no list of the project's registered apps, so it mints a token for any non-empty app id; an empty app id rejects with <code>app-check/invalid-argument</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L83" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token)</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ appId, token }</code> for an Admin-minted token and for a token from the web debug exchange; the decoded token carries <code>app_id</code>, <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>, and no <code>alreadyConsumed</code> key is present.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L96" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L126" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(badToken)</code><span class="compat-sub"><span class="compat-behavior">A token with an altered signature rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has invalid signature.</code>; a non-JWT string and the empty string reject with <code>app-check/invalid-argument</code> and the decoding message.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-tampered.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-tampered</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-tampered.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-tampered</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L143" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
-<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&#x3C;alg>".</code>; an <code>aud</code> without <code>projects/&#x3C;projectId></code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&#x3C;projectId>" but got "&#x3C;aud>". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a <code>kid</code> that names no known key rejects with the <code>"kid" claim which does not correspond to a known public key</code> message, and a token with no <code>kid</code> is checked against every key. After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&#x3C;alg>".</code>; an <code>aud</code> without <code>projects/&#x3C;projectId></code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&#x3C;projectId>" but got "&#x3C;aud>". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a token with no <code>kid</code> is checked against every key. A <code>kid</code> that names a key other than the sandbox's marks a token from Firebase: in sandbox AI mode it rejects with Pyric's message (row <code>verify-token-firebase-token</code>), and in production AI mode it goes to firebase-admin (row <code>verify-token-firebase-token-production-ai-mode</code>). After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe">Upstream-documented only: firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code> (<code>verifyToken</code>, <code>verifyContent</code>, <code>ensureProjectId</code>, <code>mapJwtErrorToAppCheckError</code>), <code>lib/utils/jwt.js</code> (<code>getKeyCallback</code>, <code>PublicKeySignatureVerifier.verify</code>), jws 4 <code>verify-stream.js</code> (<code>JWS_REGEX</code>), and jsonwebtoken 9 <code>verify.js</code> (<code>nbf</code>, <code>exp</code>). No capture; verification runs locally in the Admin SDK, so a capture would need no production change.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, { consume: true })</code><span class="compat-sub"><span class="compat-behavior">The first consume resolves with <code>alreadyConsumed: false</code>, a second consume with <code>alreadyConsumed: true</code>, and a plain verify afterwards has no <code>alreadyConsumed</code> key.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L171" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L197" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) in sandbox AI mode</code><span class="compat-sub"><span class="compat-behavior">Production verifies the App Check tokens Firebase issues. Sandbox: in sandbox AI mode, or in a process not started with <code>@pyric/cli/register</code> in production AI mode, a token whose <code>kid</code> names a key other than the sandbox's rejects with <code>app-check/invalid-argument</code> and Pyric's message, which says the token was not minted by the Pyric sandbox and to start the server in production AI mode (<code>PYRIC_AI_MODE=production</code>). The project check comes first, as in production.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="unverified">
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) under @pyric/cli/register in production AI mode</code><span class="compat-sub"><span class="compat-behavior">A token whose <code>kid</code> names a key other than the sandbox's goes to firebase-admin's own <code>verifyToken</code>, for an app scoped to the project the mirror resolves. It resolves with production's <code>{ appId, token }</code> shape, the decoded token carrying <code>app_id</code>, and firebase-admin's errors (signature, audience, issuer, expiry) pass through with their codes and messages. Sandbox tokens, tokens with no <code>kid</code>, and malformed tokens keep the sandbox path.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> for the result shape; the verification itself is firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code>, run unchanged.</div></div>
+</details>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken, { consume: true }) in production AI mode</code><span class="compat-sub"><span class="compat-behavior">Production records consumption on Firebase's servers, once per project: the first consume resolves with <code>alreadyConsumed: false</code> and a second with <code>alreadyConsumed: true</code>. Sandbox: firebase-admin verifies the token without <code>consume</code>, and the mirror records it in the process, in the set it keeps for sandbox tokens, with the same <code>false</code> then <code>true</code> results.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="unverified">
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeApp({ credential: cert(serviceAccount) }), then getAppCheck().createToken and verifyToken</code><span class="compat-sub"><span class="compat-behavior">An app initialized with only a cert credential finds its project in the service account's <code>project_id</code> (or <code>projectId</code>), so <code>createToken</code> mints a token whose <code>aud</code> names <code>projects/&#x3C;project_id></code> and <code>verifyToken</code> accepts it. The <code>projectId</code> app option wins over the credential, and the credential wins over <code>GOOGLE_CLOUD_PROJECT</code> and <code>GCLOUD_PROJECT</code>. The project id is not copied into <code>app.options</code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Upstream-documented only: firebase-admin 13.6.0 <code>lib/utils/index.js</code> (<code>getExplicitProjectId</code>) and <code>lib/app/credential-internal.js</code> (<code>ServiceAccount</code>, <code>copyAttr</code>). No capture; the project is resolved locally in the Admin SDK.</div></div>
 </details>
 </div>
 <h2 id="current-gaps">Current gaps</h2>
@@ -112,9 +128,13 @@ html{scrollbar-gutter:stable}
 <p>Known differences between Pyric and production Firebase. Each remains tracked as a non-conforming row.</p>
 <div class="compat-list">
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer)</code><span class="compat-sub"><span class="compat-behavior">Production, debug mode: listeners and observers registered before the first <code>getToken</code> are never called, not by the first token, a forced refresh, or limited-use tokens. Sandbox: they are called once each time the cached token changes (the first token and every forced refresh), never for limited-use tokens, and not after unsubscribing, which is the upstream-documented behavior for an attestation provider.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(unknownAppId)</code><span class="compat-sub"><span class="compat-behavior">Production: an app id the project does not own rejects with <code>app-check/unknown-error</code> and the message <code>App not registered: &#x3C;appId>.</code> Sandbox: it has no list of the project's registered apps, so it mints a token for any non-empty app id; an empty app id rejects with <code>app-check/invalid-argument</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L83" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) in sandbox AI mode</code><span class="compat-sub"><span class="compat-behavior">Production verifies the App Check tokens Firebase issues. Sandbox: in sandbox AI mode, or in a process not started with <code>@pyric/cli/register</code> in production AI mode, a token whose <code>kid</code> names a key other than the sandbox's rejects with <code>app-check/invalid-argument</code> and Pyric's message, which says the token was not minted by the Pyric sandbox and to start the server in production AI mode (<code>PYRIC_AI_MODE=production</code>). The project check comes first, as in production.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken, { consume: true }) in production AI mode</code><span class="compat-sub"><span class="compat-behavior">Production records consumption on Firebase's servers, once per project: the first consume resolves with <code>alreadyConsumed: false</code> and a second with <code>alreadyConsumed: true</code>. Sandbox: firebase-admin verifies the token without <code>consume</code>, and the mirror records it in the process, in the set it keeps for sandbox tokens, with the same <code>false</code> then <code>true</code> results.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
 </div>
 <h3 id="not-implemented-yet">Not implemented yet</h3>
 <p>Tracked behavior that is not implemented in the current contract.</p>
@@ -129,6 +149,10 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code>.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Upstream-documented only (firebase 12.13.0 typings and the App Check web guide). The oracle web app has no reCAPTCHA registration, so no capture exists; the sandbox never loads reCAPTCHA.</div></div></details>
-<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&#x3C;alg>".</code>; an <code>aud</code> without <code>projects/&#x3C;projectId></code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&#x3C;projectId>" but got "&#x3C;aud>". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a <code>kid</code> that names no known key rejects with the <code>"kid" claim which does not correspond to a known public key</code> message, and a token with no <code>kid</code> is checked against every key. After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&#x3C;alg>".</code>; an <code>aud</code> without <code>projects/&#x3C;projectId></code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&#x3C;projectId>" but got "&#x3C;aud>". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a token with no <code>kid</code> is checked against every key. A <code>kid</code> that names a key other than the sandbox's marks a token from Firebase: in sandbox AI mode it rejects with Pyric's message (row <code>verify-token-firebase-token</code>), and in production AI mode it goes to firebase-admin (row <code>verify-token-firebase-token-production-ai-mode</code>). After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Upstream-documented only: firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code> (<code>verifyToken</code>, <code>verifyContent</code>, <code>ensureProjectId</code>, <code>mapJwtErrorToAppCheckError</code>), <code>lib/utils/jwt.js</code> (<code>getKeyCallback</code>, <code>PublicKeySignatureVerifier.verify</code>), jws 4 <code>verify-stream.js</code> (<code>JWS_REGEX</code>), and jsonwebtoken 9 <code>verify.js</code> (<code>nbf</code>, <code>exp</code>). No capture; verification runs locally in the Admin SDK, so a capture would need no production change.</div></div></details>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) under @pyric/cli/register in production AI mode</code><span class="compat-sub"><span class="compat-behavior">A token whose <code>kid</code> names a key other than the sandbox's goes to firebase-admin's own <code>verifyToken</code>, for an app scoped to the project the mirror resolves. It resolves with production's <code>{ appId, token }</code> shape, the decoded token carrying <code>app_id</code>, and firebase-admin's errors (signature, audience, issuer, expiry) pass through with their codes and messages. Sandbox tokens, tokens with no <code>kid</code>, and malformed tokens keep the sandbox path.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> for the result shape; the verification itself is firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code>, run unchanged.</div></div></details>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeApp({ credential: cert(serviceAccount) }), then getAppCheck().createToken and verifyToken</code><span class="compat-sub"><span class="compat-behavior">An app initialized with only a cert credential finds its project in the service account's <code>project_id</code> (or <code>projectId</code>), so <code>createToken</code> mints a token whose <code>aud</code> names <code>projects/&#x3C;project_id></code> and <code>verifyToken</code> accepts it. The <code>projectId</code> app option wins over the credential, and the credential wins over <code>GOOGLE_CLOUD_PROJECT</code> and <code>GCLOUD_PROJECT</code>. The project id is not copied into <code>app.options</code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Upstream-documented only: firebase-admin 13.6.0 <code>lib/utils/index.js</code> (<code>getExplicitProjectId</code>) and <code>lib/app/credential-internal.js</code> (<code>ServiceAccount</code>, <code>copyAttr</code>). No capture; the project is resolved locally in the Admin SDK.</div></div></details>
 </div> </article> </main> <aside class="doc-toc" aria-label="On this page" data-astro-cid-mw7aashj> <h2 class="doc-toc-heading" data-astro-cid-mw7aashj>On this page</h2> <ul data-astro-cid-mw7aashj> <li data-depth="2" data-astro-cid-mw7aashj> <a href="#initializeappcheckapp-options-and-providers" data-astro-cid-mw7aashj>initializeAppCheck(app, options) and providers</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#tokens-gettoken-getlimitedusetoken" data-astro-cid-mw7aashj>Tokens: getToken, getLimitedUseToken</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#listeners-and-refresh-ontokenchanged-settokenautorefreshenabled" data-astro-cid-mw7aashj>Listeners and refresh: onTokenChanged, setTokenAutoRefreshEnabled</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#token-exchange-on-the-wire" data-astro-cid-mw7aashj>Token exchange on the wire</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#firebase-admin-getappcheck" data-astro-cid-mw7aashj>firebase-admin getAppCheck()</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#current-gaps" data-astro-cid-mw7aashj>Current gaps</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#documented-divergences" data-astro-cid-mw7aashj>Documented divergences</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#not-implemented-yet" data-astro-cid-mw7aashj>Not implemented yet</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#unverified" data-astro-cid-mw7aashj>Unverified</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script>  </body></html>