@pyric/cli 0.1.0-alpha.30 → 0.1.0-alpha.30.2

package/dist/serve/site-ui/docs/app-check-compat.md

@@ -26,7 +26,7 @@ App Check is climbing under Conformance Driven Development. A row below is a tar
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">new CustomProvider({ getToken })</code><span class="compat-sub"><span class="compat-behavior">A <code>CustomProvider</code> constructs and is accepted by <code>initializeAppCheck</code>. With a debug token in effect, the SDK never calls it (a provider whose <code>getToken</code> would reject is called zero times).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>customProviderCalls</code>; the capture initialized App Check with a <code>CustomProvider</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>customProviderCalls</code>; the capture initialized App Check with a <code>CustomProvider</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
 <summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code>.</span></span></span></summary>
@@ -39,19 +39,19 @@ App Check is climbing under Conformance Driven Development. A row below is a tar
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck) on an app without initializeAppCheck</code><span class="compat-sub"><span class="compat-behavior">Rejects with a <code>FirebaseError</code> with code <code>appCheck/use-before-activation</code>, <code>customData.appName</code>, and the message telling the caller to call <code>initializeAppCheck()</code> first.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-get-token-before-initialize.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-get-token-before-initialize</code></a> (<code>publicGetTokenWithUninitializedApp</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L148" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-get-token-before-initialize.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-get-token-before-initialize</code></a> (<code>publicGetTokenWithUninitializedApp</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L148" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck, forceRefresh?): Promise&lt;AppCheckTokenResult&gt;</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token }</code> where <code>token</code> is a three-segment JWT: header <code>alg</code> RS256, <code>typ</code> JWT, with a <code>kid</code>; claims <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>; <code>iss</code> is <code>https://firebaseappcheck.googleapis.com/&lt;projectNumber&gt;</code>, <code>aud</code> is <code>[projects/&lt;projectNumber&gt;, projects/&lt;projectId&gt;]</code>, <code>sub</code> is the app id, and <code>exp - iat</code> is 3600 seconds.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>first</code>, <code>forced</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>first</code>, <code>forced</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getToken(appCheck, forceRefresh?)</code><span class="compat-sub"><span class="compat-behavior">A second <code>getToken</code> returns the cached token; <code>getToken(appCheck, true)</code> returns a different, newly minted token.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>secondEqualsFirst</code>, <code>forceRefreshDiffersFromFirst</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-debug-get-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-debug-get-token</code></a> (<code>secondEqualsFirst</code>, <code>forceRefreshDiffersFromFirst</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L128" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getLimitedUseToken(appCheck): Promise&lt;AppCheckTokenResult&gt;</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token }</code> with the same JWT shape as <code>getToken</code>, a different token on every call, never the cached token, and leaves the cached <code>getToken</code> token unchanged.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-limited-use-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-limited-use-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L181" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-limited-use-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-limited-use-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L181" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unsupported">
 <summary class="compat-line"><span class="compat-dot" data-status="unsupported" role="img" aria-label="Not implemented yet" title="Not implemented yet"></span><span class="compat-main"><code class="compat-api">getToken / getLimitedUseToken when attestation fails</code><span class="compat-sub"><span class="compat-behavior">When the exchange is refused (an unregistered debug token), both reject with a <code>FirebaseError</code> with code <code>appCheck/fetch-status-error</code> and <code>customData.httpStatus</code> 403.</span></span></span></summary>
@@ -64,15 +64,15 @@ App Check is climbing under Conformance Driven Development. A row below is a tar
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer): Unsubscribe</code><span class="compat-sub"><span class="compat-behavior">Returns an unsubscribe function. A listener registered after a token exists is not called synchronously; it is called once, asynchronously, with the current cached token.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (<code>unsubscribeType</code>, <code>lateListenerCallsSynchronous</code>, <code>lateListenerCallsWithin500ms</code>, <code>lateListenerTokenSequence</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L205" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (<code>unsubscribeType</code>, <code>lateListenerCallsSynchronous</code>, <code>lateListenerCallsWithin500ms</code>, <code>lateListenerTokenSequence</code>). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L205" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer)</code><span class="compat-sub"><span class="compat-behavior">Production, debug mode: listeners and observers registered before the first <code>getToken</code> are never called, not by the first token, a forced refresh, or limited-use tokens. Sandbox: they are called once each time the cached token changes (the first token and every forced refresh), never for limited-use tokens, and not after unsubscribing, which is the upstream-documented behavior for an attestation provider.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">setTokenAutoRefreshEnabled(appCheck, isEnabled): void</code><span class="compat-sub"><span class="compat-behavior">Returns <code>undefined</code> and does not throw for either value; <code>getToken</code> still returns the cached token afterwards. Background refresh timing is not captured.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-auto-refresh-toggle.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-auto-refresh-toggle</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L263" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L41" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-auto-refresh-toggle.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-auto-refresh-toggle</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L263" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L43" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 </div>
 
@@ -90,31 +90,47 @@ App Check is climbing under Conformance Driven Development. A row below is a tar
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId)</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ token, ttlMillis: 3600000 }</code>; the token has the web SDK token shape (RS256 JWT with <code>kid</code>, claims <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>, <code>exp - iat</code> 3600).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-shape.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-shape</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L68" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-shape.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-shape</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L70" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(appId, { ttlMillis })</code><span class="compat-sub"><span class="compat-behavior"><code>ttlMillis</code> of 30 minutes is honored in the result and in <code>exp - iat</code>; 29 minutes and 7 days plus one second reject with <code>app-check/invalid-argument</code> and the message that names the 30 minute to 7 day range.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-custom-ttl.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-custom-ttl</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L75" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-custom-ttl.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-custom-ttl</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L105" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(unknownAppId)</code><span class="compat-sub"><span class="compat-behavior">Production: an app id the project does not own rejects with <code>app-check/unknown-error</code> and the message <code>App not registered: &lt;appId&gt;.</code> Sandbox: it has no list of the project's registered apps, so it mints a token for any non-empty app id; an empty app id rejects with <code>app-check/invalid-argument</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L83" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token)</code><span class="compat-sub"><span class="compat-behavior">Resolves <code>{ appId, token }</code> for an Admin-minted token and for a token from the web debug exchange; the decoded token carries <code>app_id</code>, <code>aud</code>, <code>exp</code>, <code>iat</code>, <code>iss</code>, <code>jti</code>, <code>provider</code>, <code>sub</code>, and no <code>alreadyConsumed</code> key is present.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L96" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L126" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(badToken)</code><span class="compat-sub"><span class="compat-behavior">A token with an altered signature rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has invalid signature.</code>; a non-JWT string and the empty string reject with <code>app-check/invalid-argument</code> and the decoding message.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-tampered.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-tampered</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-tampered.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-tampered</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L143" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="unverified">
-<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&lt;alg&gt;".</code>; an <code>aud</code> without <code>projects/&lt;projectId&gt;</code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&lt;projectId&gt;" but got "&lt;aud&gt;". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a <code>kid</code> that names no known key rejects with the <code>"kid" claim which does not correspond to a known public key</code> message, and a token with no <code>kid</code> is checked against every key. After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&lt;alg&gt;".</code>; an <code>aud</code> without <code>projects/&lt;projectId&gt;</code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&lt;projectId&gt;" but got "&lt;aud&gt;". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a token with no <code>kid</code> is checked against every key. A <code>kid</code> that names a key other than the sandbox's marks a token from Firebase: in sandbox AI mode it rejects with Pyric's message (row <code>verify-token-firebase-token</code>), and in production AI mode it goes to firebase-admin (row <code>verify-token-firebase-token-production-ai-mode</code>). After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe">Upstream-documented only: firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code> (<code>verifyToken</code>, <code>verifyContent</code>, <code>ensureProjectId</code>, <code>mapJwtErrorToAppCheckError</code>), <code>lib/utils/jwt.js</code> (<code>getKeyCallback</code>, <code>PublicKeySignatureVerifier.verify</code>), jws 4 <code>verify-stream.js</code> (<code>JWS_REGEX</code>), and jsonwebtoken 9 <code>verify.js</code> (<code>nbf</code>, <code>exp</code>). No capture; verification runs locally in the Admin SDK, so a capture would need no production change.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, { consume: true })</code><span class="compat-sub"><span class="compat-behavior">The first consume resolves with <code>alreadyConsumed: false</code>, a second consume with <code>alreadyConsumed: true</code>, and a plain verify afterwards has no <code>alreadyConsumed</code> key.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L171" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L197" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) in sandbox AI mode</code><span class="compat-sub"><span class="compat-behavior">Production verifies the App Check tokens Firebase issues. Sandbox: in sandbox AI mode, or in a process not started with <code>@pyric/cli/register</code> in production AI mode, a token whose <code>kid</code> names a key other than the sandbox's rejects with <code>app-check/invalid-argument</code> and Pyric's message, which says the token was not minted by the Pyric sandbox and to start the server in production AI mode (<code>PYRIC_AI_MODE=production</code>). The project check comes first, as in production.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="unverified">
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) under @pyric/cli/register in production AI mode</code><span class="compat-sub"><span class="compat-behavior">A token whose <code>kid</code> names a key other than the sandbox's goes to firebase-admin's own <code>verifyToken</code>, for an app scoped to the project the mirror resolves. It resolves with production's <code>{ appId, token }</code> shape, the decoded token carrying <code>app_id</code>, and firebase-admin's errors (signature, audience, issuer, expiry) pass through with their codes and messages. Sandbox tokens, tokens with no <code>kid</code>, and malformed tokens keep the sandbox path.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> for the result shape; the verification itself is firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code>, run unchanged.</div></div>
+</details>
+<details class="compat-row" data-status="diverged">
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken, { consume: true }) in production AI mode</code><span class="compat-sub"><span class="compat-behavior">Production records consumption on Firebase's servers, once per project: the first consume resolves with <code>alreadyConsumed: false</code> and a second with <code>alreadyConsumed: true</code>. Sandbox: firebase-admin verifies the token without <code>consume</code>, and the mirror records it in the process, in the set it keeps for sandbox tokens, with the same <code>false</code> then <code>true</code> results.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="unverified">
+<summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeApp({ credential: cert(serviceAccount) }), then getAppCheck().createToken and verifyToken</code><span class="compat-sub"><span class="compat-behavior">An app initialized with only a cert credential finds its project in the service account's <code>project_id</code> (or <code>projectId</code>), so <code>createToken</code> mints a token whose <code>aud</code> names <code>projects/&lt;project_id&gt;</code> and <code>verifyToken</code> accepts it. The <code>projectId</code> app option wins over the credential, and the credential wins over <code>GOOGLE_CLOUD_PROJECT</code> and <code>GCLOUD_PROJECT</code>. The project id is not copied into <code>app.options</code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Upstream-documented only: firebase-admin 13.6.0 <code>lib/utils/index.js</code> (<code>getExplicitProjectId</code>) and <code>lib/app/credential-internal.js</code> (<code>ServiceAccount</code>, <code>copyAttr</code>). No capture; the project is resolved locally in the Admin SDK.</div></div>
 </details>
 </div>
 
@@ -126,9 +142,13 @@ Known differences between Pyric and production Firebase. Each remains tracked as
 
 <div class="compat-list">
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">onTokenChanged(appCheck, listener | observer)</code><span class="compat-sub"><span class="compat-behavior">Production, debug mode: listeners and observers registered before the first <code>getToken</code> are never called, not by the first token, a forced refresh, or limited-use tokens. Sandbox: they are called once each time the cached token changes (the first token and every forced refresh), never for limited-use tokens, and not after unsubscribing, which is the upstream-documented behavior for an attestation provider.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L30" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check/app-check-client-on-token-changed.json" target="_blank" rel="noopener noreferrer"><code>app-check-client-on-token-changed</code></a> (every <code>listenerCalls*</code> count is 0). The sandbox side and the attested-provider behavior are pinned in the suite; the attested-provider path is upstream-documented, not captured. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/app-check/oracle-conformance.test.ts#L206" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/sandbox-app-check/scenario.ts#L80" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().createToken(unknownAppId)</code><span class="compat-sub"><span class="compat-behavior">Production: an app id the project does not own rejects with <code>app-check/unknown-error</code> and the message <code>App not registered: &lt;appId&gt;.</code> Sandbox: it has no list of the project's registered apps, so it mints a token for any non-empty app id; an empty app id rejects with <code>app-check/invalid-argument</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L83" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-create-token-unknown-app.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-create-token-unknown-app</code></a>; the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L113" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) in sandbox AI mode</code><span class="compat-sub"><span class="compat-behavior">Production verifies the App Check tokens Firebase issues. Sandbox: in sandbox AI mode, or in a process not started with <code>@pyric/cli/register</code> in production AI mode, a token whose <code>kid</code> names a key other than the sandbox's rejects with <code>app-check/invalid-argument</code> and Pyric's message, which says the token was not minted by the Pyric sandbox and to start the server in production AI mode (<code>PYRIC_AI_MODE=production</code>). The project check comes first, as in production.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> (production verifies a token from its debug exchange); the sandbox side is pinned in the admin suite. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L127" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken, { consume: true }) in production AI mode</code><span class="compat-sub"><span class="compat-behavior">Production records consumption on Firebase's servers, once per project: the first consume resolves with <code>alreadyConsumed: false</code> and a second with <code>alreadyConsumed: true</code>. Sandbox: firebase-admin verifies the token without <code>consume</code>, and the mirror records it in the process, in the set it keeps for sandbox tokens, with the same <code>false</code> then <code>true</code> results.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-consume.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-consume</code></a>; the sandbox side is pinned in the admin suite and the production AI mode app scenario. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/app-check/oracle-conformance.test.ts#L198" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
 </div>
 
 ### Not implemented yet
@@ -149,6 +169,10 @@ Tracked behavior whose available evidence does not yet establish the production
 <div class="compat-list">
 <details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">new ReCaptchaV3Provider(siteKey); new ReCaptchaEnterpriseProvider(siteKey)</code><span class="compat-sub"><span class="compat-behavior">Both reCAPTCHA providers construct from a site key and are accepted by <code>initializeAppCheck</code>.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Upstream-documented only (firebase 12.13.0 typings and the App Check web guide). The oracle web app has no reCAPTCHA registration, so no capture exists; the sandbox never loads reCAPTCHA.</div></div></details>
-<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&lt;alg&gt;".</code>; an <code>aud</code> without <code>projects/&lt;projectId&gt;</code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&lt;projectId&gt;" but got "&lt;aud&gt;". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a <code>kid</code> that names no known key rejects with the <code>"kid" claim which does not correspond to a known public key</code> message, and a token with no <code>kid</code> is checked against every key. After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(token, options) with bad input, on another project, or with a foreign issuer, algorithm, subject, key, nbf, or exp</code><span class="compat-sub"><span class="compat-behavior">Options that are not a non-null object throw <code>app-check/invalid-argument</code> with <code>VerifyAppCheckTokenOptions must be a non-null object.</code>, and a token that is not a string throws <code>App check token must be a non-null string.</code>; both throw synchronously. Then, with no project id configured, <code>app-check/invalid-credential</code>. A token with a character outside base64url in any segment fails with the decoding message. Before the signature, the token content is checked in this order: a header <code>alg</code> other than RS256 rejects with <code>The provided App Check token has incorrect algorithm. Expected "RS256" but got "&lt;alg&gt;".</code>; an <code>aud</code> without <code>projects/&lt;projectId&gt;</code> of the verifying app rejects with <code>app-check/invalid-argument</code> and <code>The provided App Check token has incorrect "aud" (audience) claim. Expected "projects/&lt;projectId&gt;" but got "&lt;aud&gt;". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.</code>; an <code>iss</code> not starting with <code>https://firebaseappcheck.googleapis.com/</code> rejects with <code>The provided App Check token has incorrect "iss" (issuer) claim.</code>; a <code>sub</code> that is not a string rejects with <code>The provided App Check token has no "sub" (subject) claim.</code>, and an empty one with <code>The provided App Check token has an empty string "sub" (subject) claim.</code> Then a token with no <code>kid</code> is checked against every key. A <code>kid</code> that names a key other than the sandbox's marks a token from Firebase: in sandbox AI mode it rejects with Pyric's message (row <code>verify-token-firebase-token</code>), and in production AI mode it goes to firebase-admin (row <code>verify-token-firebase-token-production-ai-mode</code>). After the signature, a non-numeric or future <code>nbf</code> and a non-numeric <code>exp</code> reject as an invalid signature; an absent <code>nbf</code> or <code>exp</code> does not apply.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Upstream-documented only: firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code> (<code>verifyToken</code>, <code>verifyContent</code>, <code>ensureProjectId</code>, <code>mapJwtErrorToAppCheckError</code>), <code>lib/utils/jwt.js</code> (<code>getKeyCallback</code>, <code>PublicKeySignatureVerifier.verify</code>), jws 4 <code>verify-stream.js</code> (<code>JWS_REGEX</code>), and jsonwebtoken 9 <code>verify.js</code> (<code>nbf</code>, <code>exp</code>). No capture; verification runs locally in the Admin SDK, so a capture would need no production change.</div></div></details>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">getAppCheck().verifyToken(firebaseToken) under @pyric/cli/register in production AI mode</code><span class="compat-sub"><span class="compat-behavior">A token whose <code>kid</code> names a key other than the sandbox's goes to firebase-admin's own <code>verifyToken</code>, for an app scoped to the project the mirror resolves. It resolves with production's <code>{ appId, token }</code> shape, the decoded token carrying <code>app_id</code>, and firebase-admin's errors (signature, audience, issuer, expiry) pass through with their codes and messages. Sandbox tokens, tokens with no <code>kid</code>, and malformed tokens keep the sandbox path.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/app-check-admin/app-check-admin-verify-token.json" target="_blank" rel="noopener noreferrer"><code>app-check-admin-verify-token</code></a> for the result shape; the verification itself is firebase-admin 13.10.0 <code>lib/app-check/token-verifier.js</code>, run unchanged.</div></div></details>
+<details class="compat-row" data-status="unverified"><summary class="compat-line"><span class="compat-dot" data-status="unverified" role="img" aria-label="Unverified" title="Unverified"></span><span class="compat-main"><code class="compat-api">initializeApp({ credential: cert(serviceAccount) }), then getAppCheck().createToken and verifyToken</code><span class="compat-sub"><span class="compat-behavior">An app initialized with only a cert credential finds its project in the service account's <code>project_id</code> (or <code>projectId</code>), so <code>createToken</code> mints a token whose <code>aud</code> names <code>projects/&lt;project_id&gt;</code> and <code>verifyToken</code> accepts it. The <code>projectId</code> app option wins over the credential, and the credential wins over <code>GOOGLE_CLOUD_PROJECT</code> and <code>GCLOUD_PROJECT</code>. The project id is not copied into <code>app.options</code>.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Upstream-documented only: firebase-admin 13.6.0 <code>lib/utils/index.js</code> (<code>getExplicitProjectId</code>) and <code>lib/app/credential-internal.js</code> (<code>ServiceAccount</code>, <code>copyAttr</code>). No capture; the project is resolved locally in the Admin SDK.</div></div></details>
 </div>

package/dist/serve/site-ui/docs/auth-compat/index.html

@@ -588,7 +588,7 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/auth</code> in a server process signs in to the host: the session belongs to that process, the user is visible to <code>firebase-admin</code>, and its identity applies to the process's RTDB, Firestore and Storage calls. The session lasts as long as the process. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L141" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
+<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
 <div class="compat-note">one configuration per runtime; the session is not persisted across processes</div></div>
 </details>
 </div>
@@ -597,7 +597,7 @@ html{scrollbar-gutter:stable}
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase/auth</code> in a server-rendered module signs in to the host. The session belongs to the dev server process: every SSR request, both of Vite's SSR loaders and a module reloaded after an edit see the same <code>currentUser</code>, and its identity applies to the SSR RTDB, Firestore and Storage calls. Browser sessions are separate. On a SharedWorker dev server every call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>. No call reaches production or an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div>
+<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div>
 <div class="compat-note">one SSR session per dev server process, as one Node server process has one auth state; per-request identity (<code>initializeServerApp</code>) is unsupported</div></div>
 </details>
 </div>
@@ -636,9 +636,9 @@ html{scrollbar-gutter:stable}
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Operations in flight at a hosted connection drop (web hosted client)</code><span class="compat-sub"><span class="compat-behavior">An Auth operation (a sign-in, a profile update, a token refresh) the web hosted client's socket had taken when it dropped fails once with <code>unavailable</code> and the message "The hosted sandbox connection was lost. Requests already sent may have completed; check state before retrying." It is not sent again. In production the Auth Web SDK fails a request whose network call fails with <code>auth/network-request-failed</code> and does not retry it.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production behavior read from <code>@firebase/auth</code> 1.13.1 <code>dist/esm</code>: a failed <code>fetch</code> is reported through <code>_fail(auth, "network-request-failed")</code>, and the request is not retried. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts</code></a> drops a real loopback socket with <code>auth.signInEmail</code> in flight and asserts it fails once with that message and reaches the host once.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/auth</code> in a server process signs in to the host: the session belongs to that process, the user is visible to <code>firebase-admin</code>, and its identity applies to the process's RTDB, Firestore and Storage calls. The session lasts as long as the process. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L141" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase/auth</code> in a server-rendered module signs in to the host. The session belongs to the dev server process: every SSR request, both of Vite's SSR loaders and a module reloaded after an edit see the same <code>currentUser</code>, and its identity applies to the SSR RTDB, Firestore and Storage calls. Browser sessions are separate. On a SharedWorker dev server every call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>. No call reaches production or an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 </div>
 <h3 id="not-implemented-yet">Not implemented yet</h3>
 <p>Tracked behavior that is not implemented in the current contract.</p>

package/dist/serve/site-ui/docs/auth-compat.md

@@ -635,7 +635,7 @@ A server process started with `node --import @pyric/cli/register` and `PYRIC_SAN
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/auth</code> in a server process signs in to the host: the session belongs to that process, the user is visible to <code>firebase-admin</code>, and its identity applies to the process's RTDB, Firestore and Storage calls. The session lasts as long as the process. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L141" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
+<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
 <div class="compat-note">one configuration per runtime; the session is not persisted across processes</div></div>
 </details>
 </div>
@@ -647,7 +647,7 @@ Modules Vite loads for server rendering under `vite dev` with `pyric()` (`server
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase/auth</code> in a server-rendered module signs in to the host. The session belongs to the dev server process: every SSR request, both of Vite's SSR loaders and a module reloaded after an edit see the same <code>currentUser</code>, and its identity applies to the SSR RTDB, Firestore and Storage calls. Browser sessions are separate. On a SharedWorker dev server every call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>. No call reaches production or an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div>
+<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div>
 <div class="compat-note">one SSR session per dev server process, as one Node server process has one auth state; per-request identity (<code>initializeServerApp</code>) is unsupported</div></div>
 </details>
 </div>
@@ -690,9 +690,9 @@ Known differences between Pyric and production Firebase. Each remains tracked as
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Operations in flight at a hosted connection drop (web hosted client)</code><span class="compat-sub"><span class="compat-behavior">An Auth operation (a sign-in, a profile update, a token refresh) the web hosted client's socket had taken when it dropped fails once with <code>unavailable</code> and the message "The hosted sandbox connection was lost. Requests already sent may have completed; check state before retrying." It is not sent again. In production the Auth Web SDK fails a request whose network call fails with <code>auth/network-request-failed</code> and does not retry it.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production behavior read from <code>@firebase/auth</code> 1.13.1 <code>dist/esm</code>: a failed <code>fetch</code> is reported through <code>_fail(auth, "network-request-failed")</code>, and the request is not retried. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts</code></a> drops a real loopback socket with <code>auth.signInEmail</code> in flight and asserts it fails once with that message and reaches the host once.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/auth</code> in a server process signs in to the host: the session belongs to that process, the user is visible to <code>firebase-admin</code>, and its identity applies to the process's RTDB, Firestore and Storage calls. The session lasts as long as the process. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L141" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase/auth</code> in a server-rendered module signs in to the host. The session belongs to the dev server process: every SSR request, both of Vite's SSR loaders and a module reloaded after an edit see the same <code>currentUser</code>, and its identity applies to the SSR RTDB, Firestore and Storage calls. Browser sessions are separate. On a SharedWorker dev server every call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>. No call reaches production or an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L9" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 </div>
 
 ### Not implemented yet