pyric-admin 0.1.0-alpha.29 → 0.1.0-alpha.30.1

package/dist/app/firebase-error.d.ts

@@ -0,0 +1,27 @@
+/**
+ * firebase-admin's error shape (lib/utils/error.js, 13.10.0), shared by the
+ * admin mirrors so each service's error class matches upstream in one place.
+ *
+ * Upstream keeps `{ code, message }` in an own `errorInfo` property and reads
+ * `code` through a prototype getter. Its `message` getter is shadowed by the
+ * own, non-enumerable `message` that `Error` sets, so only `code` needs one
+ * here. `toJSON()` returns both, and
+ * `hasCode()` tests the unprefixed code. It never sets `name`, so `name` reads
+ * `Error`. The own enumerable keys are `errorInfo` and `codePrefix`.
+ */
+export interface ErrorInfo {
+    code: string;
+    message: string;
+}
+export declare class FirebaseError extends Error {
+    readonly errorInfo: ErrorInfo;
+    constructor(errorInfo: ErrorInfo);
+    get code(): string;
+    toJSON(): ErrorInfo;
+}
+export declare class PrefixedFirebaseError extends FirebaseError {
+    readonly codePrefix: string;
+    constructor(codePrefix: string, code: string, message: string);
+    hasCode(code: string): boolean;
+}
+//# sourceMappingURL=firebase-error.d.ts.map

package/dist/app/firebase-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-error.d.ts","sourceRoot":"","sources":["../../src/app/firebase-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAElB,SAAS,EAAE,SAAS;IAMhC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,MAAM,IAAI,SAAS;CAGpB;AAED,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAK7D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAG/B"}

package/dist/app/firebase-error.js

@@ -0,0 +1,25 @@
+export class FirebaseError extends Error {
+    errorInfo;
+    constructor(errorInfo) {
+        super(errorInfo.message);
+        this.errorInfo = errorInfo;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    get code() {
+        return this.errorInfo?.code;
+    }
+    toJSON() {
+        return { code: this.code, message: this.message };
+    }
+}
+export class PrefixedFirebaseError extends FirebaseError {
+    codePrefix;
+    constructor(codePrefix, code, message) {
+        super({ code: `${codePrefix}/${code}`, message });
+        this.codePrefix = codePrefix;
+    }
+    hasCode(code) {
+        return `${this.codePrefix}/${code}` === this.code;
+    }
+}
+//# sourceMappingURL=firebase-error.js.map

package/dist/app/firebase-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-error.js","sourceRoot":"","sources":["../../src/app/firebase-error.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,SAAS,CAAY;IAE9B,YAAY,SAAoB;QAC9B,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IAC7C,UAAU,CAAS;IAE5B,YAAY,UAAkB,EAAE,IAAY,EAAE,OAAe;QAC3D,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,UAAU,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IACpD,CAAC;CACF"}

package/dist/app/index.d.ts

@@ -40,6 +40,11 @@ export declare function applicationDefault(): never;
  * Link-compatible mirror of `firebase-admin/app`'s `cert(serviceAccountPathOrObject)`.
  * Returns an inert sandbox credential token so unchanged application setup code
  * can assign `appOptions.credential = cert(...)` under `@pyric/cli/register`.
+ *
+ * It keeps one field, the service account's project id, because firebase-admin
+ * finds an app's project there when the options name none. A path is read as a
+ * JSON file; a file that is missing, unreadable, or has no project id gives a
+ * credential without one, and never throws, so apps run without a key on disk.
  */
 export declare function cert(serviceAccountPathOrObject: unknown): object;
 /**

package/dist/app/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAMvB,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,eAAuC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE5C,yCAAyC;AACzC,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC;AAED,sLAAsL;AACtL,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC;AAC5C,MAAM,MAAM,wBAAwB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,eAAe,CAAC;AAE9E;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,KAAK,CAK1C;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,0BAA0B,EAAE,OAAO,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,wBAAwB,EAAE,OAAO,GAAG,MAAM,CAEtE;AA4CD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,CAAC,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,GAAE,MAAyB,GAC9B,aAAa,CAmCf;AAED,4CAA4C;AAC5C,wBAAgB,MAAM,CAAC,IAAI,GAAE,MAAyB,GAAG,aAAa,CAarE;AAED,yCAAyC;AACzC,wBAAgB,OAAO,IAAI,aAAa,EAAE,CAEzC;AAED,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3D;AAwED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,IAAI,eAAe,CAE5E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAOvB,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,eAAuC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE5C,yCAAyC;AACzC,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC;AAED,sLAAsL;AACtL,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC;AAC5C,MAAM,MAAM,wBAAwB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,eAAe,CAAC;AAE9E;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,KAAK,CAK1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,IAAI,CAAC,0BAA0B,EAAE,OAAO,GAAG,MAAM,CAIhE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,wBAAwB,EAAE,OAAO,GAAG,MAAM,CAEtE;AA4CD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,CAAC,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,GAAE,MAAyB,GAC9B,aAAa,CAqCf;AAED,4CAA4C;AAC5C,wBAAgB,MAAM,CAAC,IAAI,GAAE,MAAyB,GAAG,aAAa,CAarE;AAED,yCAAyC;AACzC,wBAAgB,OAAO,IAAI,aAAa,EAAE,CAEzC;AAED,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3D;AAwED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,IAAI,eAAe,CAE5E"}

package/dist/app/index.js

@@ -9,6 +9,7 @@ import { REMOTE_SANDBOX_FACTORY, } from 'pyric/sandbox';
 import { parsePyricSandbox, processActivation } from 'pyric/sandbox/internal';
 import { readFileSync } from 'node:fs';
 import { assertAdminAppActive, markAdminAppDeleted } from './lifecycle.js';
+import { keepAppCredentialProjectId, keepCredentialProjectId } from './project-id.js';
 /** Brand carried by every sandbox admin app. */
 export const ADMIN_APP_TARGET = Symbol.for('pyric.admin.app.target');
 /** firebase-admin's default app name. */
@@ -28,9 +29,16 @@ export function applicationDefault() {
  * Link-compatible mirror of `firebase-admin/app`'s `cert(serviceAccountPathOrObject)`.
  * Returns an inert sandbox credential token so unchanged application setup code
  * can assign `appOptions.credential = cert(...)` under `@pyric/cli/register`.
+ *
+ * It keeps one field, the service account's project id, because firebase-admin
+ * finds an app's project there when the options name none. A path is read as a
+ * JSON file; a file that is missing, unreadable, or has no project id gives a
+ * credential without one, and never throws, so apps run without a key on disk.
  */
 export function cert(serviceAccountPathOrObject) {
-    return { [Symbol.for('pyric.admin.credential')]: 'cert' };
+    const credential = { [Symbol.for('pyric.admin.credential')]: 'cert' };
+    keepCredentialProjectId(credential, serviceAccountPathOrObject);
+    return credential;
 }
 /**
  * Link-compatible mirror of `firebase-admin/app`'s `refreshToken(refreshTokenPathOrObject)`.
@@ -87,6 +95,7 @@ export function initializeApp(config, name = DEFAULT_APP_NAME) {
             throw alreadyExists(name, 'invalid-app-options');
         }
         const app = initializeAmbientApp(name, ambientAppOptions(config));
+        keepAppCredentialProjectId(app, config);
         appRegistry.set(name, app);
         ambientApps.add(app);
         return app;
@@ -102,6 +111,7 @@ export function initializeApp(config, name = DEFAULT_APP_NAME) {
         name,
         options: appOptionsFrom(config),
     };
+    keepAppCredentialProjectId(app, config);
     appRegistry.set(name, app);
     return app;
 }

package/dist/app/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,GAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAGrE,yCAAyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAoB5C;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,KAAK,CACb,uEAAuE;QACrE,wDAAwD,CAC3D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,0BAAmC;IACtD,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,wBAAiC;IAC5D,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;AACrG,CAAC;AAED,sEAAsE;AACtE,MAAM,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,2CAA2C;AAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAK/D,MAAM,cAAc,GAAG,UAA+B,CAAC;AACvD,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,EAAyB,CAAC;AACtF,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,IAAI,OAAO,EAAiB,CAAC;AAElF,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,gBAAgB,CACxB,kBAAkB,EAClB,8BAA8B,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAA6C;IAChF,OAAO,IAAI,gBAAgB,CACzB,IAAI,EACJ,yBAAyB,IAAI,kDAAkD,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA2D,EAC3D,OAAe,gBAAgB;IAE/B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEvC,MAAM,qBAAqB,GAAG,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,aAAa,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QACvF,MAAM,aAAa,CACjB,IAAI,EACJ,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAoB;QAC3B,CAAC,gBAAgB,CAAC,EAAE,SAAS;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;KAChC,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,MAAM,CAAC,OAAe,gBAAgB;IACpD,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,KAAK,gBAAgB;YACpC,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,uBAAuB,IAAI,oBAAoB,CAAC;QACpD,MAAM,IAAI,gBAAgB,CACxB,QAAQ,EACR,IAAI,GAAG,+EAA+E,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,GAAkB;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAwB;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACtC,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC;QACxF,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,yEAAyE;YACzE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,6DAA6D;YAC7D,kEAAkE;YAClE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAI,UAAkE,CACjF,sBAAsB,CACvB,CAAC;IACF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,gCAAgC;YAC/D,0FAA0F;YAC1F,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAC9F,CAAC;IACF,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC;QAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC;IACtF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,qEAAqE;YACrE,uFAAuF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,eAAe;QAClE,+FAA+F,CAClG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC;AAC7C,CAAC;AAED,qGAAqG;AACrG,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAiC,CAAC;IACpF,OAAO;QACL,GAAG,CAAC,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,GAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAGrE,yCAAyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAoB5C;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,KAAK,CACb,uEAAuE;QACrE,wDAAwD,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,IAAI,CAAC,0BAAmC;IACtD,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IACtE,uBAAuB,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAChE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,wBAAiC;IAC5D,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;AACrG,CAAC;AAED,sEAAsE;AACtE,MAAM,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,2CAA2C;AAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAK/D,MAAM,cAAc,GAAG,UAA+B,CAAC;AACvD,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,EAAyB,CAAC;AACtF,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,IAAI,OAAO,EAAiB,CAAC;AAElF,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,gBAAgB,CACxB,kBAAkB,EAClB,8BAA8B,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAA6C;IAChF,OAAO,IAAI,gBAAgB,CACzB,IAAI,EACJ,yBAAyB,IAAI,kDAAkD,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA2D,EAC3D,OAAe,gBAAgB;IAE/B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEvC,MAAM,qBAAqB,GAAG,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,aAAa,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QACvF,MAAM,aAAa,CACjB,IAAI,EACJ,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAoB;QAC3B,CAAC,gBAAgB,CAAC,EAAE,SAAS;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;KAChC,CAAC;IACF,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,MAAM,CAAC,OAAe,gBAAgB;IACpD,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,KAAK,gBAAgB;YACpC,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,uBAAuB,IAAI,oBAAoB,CAAC;QACpD,MAAM,IAAI,gBAAgB,CACxB,QAAQ,EACR,IAAI,GAAG,+EAA+E,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,GAAkB;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAwB;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACtC,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC;QACxF,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,yEAAyE;YACzE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,6DAA6D;YAC7D,kEAAkE;YAClE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAI,UAAkE,CACjF,sBAAsB,CACvB,CAAC;IACF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,gCAAgC;YAC/D,0FAA0F;YAC1F,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAC9F,CAAC;IACF,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC;QAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC;IACtF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,qEAAqE;YACrE,uFAAuF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,eAAe;QAClE,+FAA+F,CAClG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC;AAC7C,CAAC;AAED,qGAAqG;AACrG,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAiC,CAAC;IACpF,OAAO;QACL,GAAG,CAAC,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/app/project-id.d.ts

@@ -0,0 +1,11 @@
+/** Keeps the service account's project id on an inert credential, as a non-enumerable property. */
+export declare function keepCredentialProjectId(credential: object, serviceAccountPathOrObject: unknown): void;
+/** Copies a cert credential's project id from initialization options onto the app, beside `options`. */
+export declare function keepAppCredentialProjectId(app: object, config: unknown): void;
+/** firebase-admin's `getExplicitProjectId` for a sandbox admin app. */
+export declare function explicitProjectId(app: {
+    readonly options: {
+        readonly projectId?: string;
+    };
+}): string | undefined;
+//# sourceMappingURL=project-id.d.ts.map

package/dist/app/project-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-id.d.ts","sourceRoot":"","sources":["../../src/app/project-id.ts"],"names":[],"mappings":"AA4CA,mGAAmG;AACnG,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,GAAG,IAAI,CAGrG;AAED,wGAAwG;AACxG,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMhH"}

package/dist/app/project-id.js

@@ -0,0 +1,62 @@
+/**
+ * The project id an admin app resolves, in firebase-admin's order
+ * (`getExplicitProjectId`, firebase-admin 13 `lib/utils/index.js`): the
+ * `projectId` app option, then a cert credential's project id, then
+ * `GOOGLE_CLOUD_PROJECT`, then `GCLOUD_PROJECT`.
+ *
+ * Pyric's `cert()` is inert: it keeps the service account's project id and
+ * nothing else, so no private key or client email is held in the sandbox.
+ * Both keys sit behind `Symbol.for`, as the app registry does, so the require
+ * and import copies of this module that the register hook can load agree.
+ */
+import { readFileSync } from 'node:fs';
+const CREDENTIAL_PROJECT_ID = Symbol.for('pyric.admin.credential.projectId');
+const APP_CREDENTIAL_PROJECT_ID = Symbol.for('pyric.admin.app.credentialProjectId');
+function nonEmptyString(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+/** firebase-admin's `ServiceAccount.fromPath`, except that a file it cannot read or parse yields no object. */
+function readServiceAccountFile(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The project id of a service account object or file path: `projectId`, then `project_id`, as firebase-admin's `copyAttr` reads it. */
+function serviceAccountProjectId(serviceAccountPathOrObject) {
+    const isPath = typeof serviceAccountPathOrObject === 'string';
+    const account = isPath ? readServiceAccountFile(serviceAccountPathOrObject) : serviceAccountPathOrObject;
+    if (typeof account !== 'object' || account === null)
+        return undefined;
+    const { projectId, project_id: projectIdSnake } = account;
+    return nonEmptyString(projectId) ?? nonEmptyString(projectIdSnake);
+}
+function defineHidden(target, key, value) {
+    Object.defineProperty(target, key, { value, enumerable: false, writable: false, configurable: false });
+}
+/** Keeps the service account's project id on an inert credential, as a non-enumerable property. */
+export function keepCredentialProjectId(credential, serviceAccountPathOrObject) {
+    const projectId = serviceAccountProjectId(serviceAccountPathOrObject);
+    if (projectId !== undefined)
+        defineHidden(credential, CREDENTIAL_PROJECT_ID, projectId);
+}
+/** Copies a cert credential's project id from initialization options onto the app, beside `options`. */
+export function keepAppCredentialProjectId(app, config) {
+    if (typeof config !== 'object' || config === null)
+        return;
+    const credential = config.credential;
+    if (typeof credential !== 'object' || credential === null)
+        return;
+    const projectId = nonEmptyString(credential[CREDENTIAL_PROJECT_ID]);
+    if (projectId !== undefined)
+        defineHidden(app, APP_CREDENTIAL_PROJECT_ID, projectId);
+}
+/** firebase-admin's `getExplicitProjectId` for a sandbox admin app. */
+export function explicitProjectId(app) {
+    return (nonEmptyString(app.options.projectId) ??
+        nonEmptyString(app[APP_CREDENTIAL_PROJECT_ID]) ??
+        nonEmptyString(process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT));
+}
+//# sourceMappingURL=project-id.js.map

package/dist/app/project-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-id.js","sourceRoot":"","sources":["../../src/app/project-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAC7E,MAAM,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAIpF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,+GAA+G;AAC/G,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,wIAAwI;AACxI,SAAS,uBAAuB,CAAC,0BAAmC;IAClE,MAAM,MAAM,GAAG,OAAO,0BAA0B,KAAK,QAAQ,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACzG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAkC,CAAC;IACrF,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,GAAW,EAAE,KAAa;IAC9D,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,0BAAmC;IAC7F,MAAM,SAAS,GAAG,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;IACtE,IAAI,SAAS,KAAK,SAAS;QAAE,YAAY,CAAC,UAAU,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC;AAC1F,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,0BAA0B,CAAC,GAAW,EAAE,MAAe;IACrE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO;IAC1D,MAAM,UAAU,GAAI,MAAmC,CAAC,UAAU,CAAC;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO;IAClE,MAAM,SAAS,GAAG,cAAc,CAAE,UAA4B,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACvF,IAAI,SAAS,KAAK,SAAS;QAAE,YAAY,CAAC,GAAG,EAAE,yBAAyB,EAAE,SAAS,CAAC,CAAC;AACvF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,GAA0D;IAC1F,OAAO,CACL,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,cAAc,CAAE,GAAqB,CAAC,yBAAyB,CAAC,CAAC;QACjE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAC/E,CAAC;AACJ,CAAC"}

package/dist/app-check/error.d.ts

@@ -0,0 +1,7 @@
+import { PrefixedFirebaseError } from '../app/firebase-error.js';
+export type AppCheckErrorCode = 'invalid-argument' | 'invalid-credential' | 'app-check-token-expired' | 'unknown-error';
+/** firebase-admin's FirebaseAppCheckError: a PrefixedFirebaseError with prefix `app-check`. */
+export declare class FirebaseAppCheckError extends PrefixedFirebaseError {
+    constructor(code: AppCheckErrorCode, message: string);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/app-check/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/app-check/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,oBAAoB,GAAG,yBAAyB,GAAG,eAAe,CAAC;AAExH,+FAA+F;AAC/F,qBAAa,qBAAsB,SAAQ,qBAAqB;gBAClD,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;CAGrD"}

package/dist/app-check/error.js

@@ -0,0 +1,8 @@
+import { PrefixedFirebaseError } from '../app/firebase-error.js';
+/** firebase-admin's FirebaseAppCheckError: a PrefixedFirebaseError with prefix `app-check`. */
+export class FirebaseAppCheckError extends PrefixedFirebaseError {
+    constructor(code, message) {
+        super('app-check', code, message);
+    }
+}
+//# sourceMappingURL=error.js.map

package/dist/app-check/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/app-check/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAIjE,+FAA+F;AAC/F,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAC9D,YAAY,IAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/app-check/firebase-token.d.ts

@@ -0,0 +1,7 @@
+import type { VerifyAppCheckTokenResponse } from './index.js';
+/**
+ * Verifies a token from Firebase with firebase-admin, through the verifier the
+ * register installs. Its result and its errors come back unchanged.
+ */
+export declare function verifyFirebaseToken(token: string, projectId: string): Promise<VerifyAppCheckTokenResponse>;
+//# sourceMappingURL=firebase-token.d.ts.map

package/dist/app-check/firebase-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-token.d.ts","sourceRoot":"","sources":["../../src/app-check/firebase-token.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AA8B9D;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAShH"}

package/dist/app-check/firebase-token.js

@@ -0,0 +1,53 @@
+/**
+ * App Check tokens from Firebase: a token whose `kid` names a key that is not
+ * the sandbox's (#1552, #1301).
+ *
+ * In production AI mode the page's `firebase/app-check` is the Firebase SDK,
+ * so its tokens come from Firebase, and only firebase-admin's own verifier can
+ * check them. `@pyric/cli/register` installs that verifier behind
+ * {@link FIREBASE_VERIFIER} in production AI mode only, the same kind of seam
+ * as its `pyric.remote.sandboxFactory`: this package never learns what an AI
+ * mode is, and never loads firebase-admin itself.
+ *
+ * With no verifier installed the token is refused with a message that says
+ * why. The code stays `invalid-argument`, so a server that branches on it
+ * still answers 401.
+ */
+import { FirebaseAppCheckError } from './error.js';
+const FIREBASE_VERIFIER = Symbol.for('pyric.admin.appCheck.firebaseVerifier');
+const MESSAGES = {
+    notSandbox: "This App Check token was not minted by the Pyric sandbox, so the sandbox's firebase-admin/app-check cannot verify it. " +
+        'A page in production AI mode gets its App Check tokens from Firebase. Start this server in production AI mode too ' +
+        '(PYRIC_AI_MODE=production) and Pyric verifies them with firebase-admin. In sandbox AI mode, page tokens come from the sandbox and verify here.',
+    install: 'Production AI mode verifies App Check tokens from Firebase with firebase-admin, which is not installed beside this server. ' +
+        'Install it in the project that runs the server (npm install firebase-admin) and restart.',
+};
+function installedVerifier() {
+    const verifier = globalThis[FIREBASE_VERIFIER];
+    return typeof verifier === 'function' ? verifier : undefined;
+}
+/** Whether a failure is the `firebase-admin` package itself not resolving, from ESM or CJS. */
+function isFirebaseAdminMissing(error) {
+    const { code, message } = (error ?? {});
+    const isNotFound = code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND';
+    const namesFirebaseAdmin = typeof message === 'string' && /'firebase-admin[/']/.test(message);
+    return isNotFound && namesFirebaseAdmin;
+}
+/**
+ * Verifies a token from Firebase with firebase-admin, through the verifier the
+ * register installs. Its result and its errors come back unchanged.
+ */
+export async function verifyFirebaseToken(token, projectId) {
+    const verifier = installedVerifier();
+    if (verifier === undefined)
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.notSandbox);
+    try {
+        return await verifier(token, projectId);
+    }
+    catch (error) {
+        if (isFirebaseAdminMissing(error))
+            throw new FirebaseAppCheckError('invalid-argument', MESSAGES.install);
+        throw error;
+    }
+}
+//# sourceMappingURL=firebase-token.js.map

package/dist/app-check/firebase-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-token.js","sourceRoot":"","sources":["../../src/app-check/firebase-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGnD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAK9E,MAAM,QAAQ,GAAG;IACf,UAAU,EACR,wHAAwH;QACxH,oHAAoH;QACpH,gJAAgJ;IAClJ,OAAO,EACL,6HAA6H;QAC7H,0FAA0F;CAC7F,CAAC;AAEF,SAAS,iBAAiB;IACxB,MAAM,QAAQ,GAAI,UAAsC,CAAC,iBAAiB,CAAC,CAAC;IAC5E,OAAO,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,QAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAA0C,CAAC;IACjF,MAAM,UAAU,GAAG,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,kBAAkB,CAAC;IAClF,MAAM,kBAAkB,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9F,OAAO,UAAU,IAAI,kBAAkB,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,SAAiB;IACxE,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrG,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzG,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/app-check/index.d.ts

@@ -1,15 +1,54 @@
 /**
- * `pyric-admin/app-check`: deferred service handle for `firebase-admin/app-check`.
+ * `pyric-admin/app-check`: the sandbox mirror of `firebase-admin/app-check`.
+ *
+ * `createToken` mints the same sandbox token the web mirror's `getToken`
+ * returns (shared in `pyric/sandbox/internal`), so a token minted on either
+ * plane verifies here. Shapes, TTL limits, error codes, and consume semantics
+ * follow the `app-check-admin-` captures; the rows are in
+ * packages/conformance/registry/app-check.ts (surface `app-check-admin`).
+ *
+ * One deliberate difference: the sandbox has no list of the project's
+ * registered apps, so `createToken` accepts any app id (row
+ * `app-check-admin#create-token-unknown-app`, diverged by design).
+ *
+ * A token whose `kid` is not the sandbox's came from Firebase. It goes to
+ * firebase-admin's own verifier when `@pyric/cli/register` installed one
+ * (production AI mode), and is refused with a message that says why otherwise
+ * (./firebase-token.ts).
  */
-import type { PyricAdminApp } from '../app/index.js';
-export { PyricDeferredApiError } from '../deferred.js';
+import { type AppCheckTokenClaims } from 'pyric/sandbox/internal';
+import { type PyricAdminApp } from '../app/index.js';
+export interface AppCheckTokenOptions {
+    ttlMillis?: number;
+}
+export interface AppCheckToken {
+    token: string;
+    ttlMillis: number;
+}
+export interface VerifyAppCheckTokenOptions {
+    consume?: boolean;
+}
+export interface DecodedAppCheckToken extends AppCheckTokenClaims {
+    app_id: string;
+}
+export interface VerifyAppCheckTokenResponse {
+    appId: string;
+    token: DecodedAppCheckToken;
+    alreadyConsumed?: boolean;
+}
 export declare class AppCheck {
     #private;
     /** @internal */
-    constructor(...args: unknown[]);
+    constructor(app: PyricAdminApp);
     get app(): PyricAdminApp;
-    createToken: (...args: unknown[]) => Promise<never>;
-    verifyToken: (...args: unknown[]) => Promise<never>;
+    createToken(appId: string, options?: AppCheckTokenOptions): Promise<AppCheckToken>;
+    /**
+     * Checks in firebase-admin's order (app-check.js, token-verifier.js,
+     * utils/jwt.js): the options and the token's type, synchronously as
+     * upstream throws them; then the project, decoding, content, key,
+     * signature, and last `nbf` and `exp` as jsonwebtoken reads them.
+     */
+    verifyToken(appCheckToken: string, options?: VerifyAppCheckTokenOptions): Promise<VerifyAppCheckTokenResponse>;
 }
-export declare const getAppCheck: (app?: PyricAdminApp) => AppCheck;
+export declare function getAppCheck(app?: PyricAdminApp): AppCheck;
 //# sourceMappingURL=index.d.ts.map

package/dist/app-check/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,qBAAa,QAAQ;;IAGnB,gBAAgB;gBACJ,GAAG,IAAI,EAAE,OAAO,EAAE;IAI9B,IAAI,GAAG,IAAI,aAAa,CAEvB;IAEO,WAAW,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,WAAW,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;CAC7D;AAED,eAAO,MAAM,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,aAAa,KAAK,QAOlD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAyC,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAiC7D,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,oBAAoB,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,qBAAa,QAAQ;;IAGnB,gBAAgB;gBACJ,GAAG,EAAE,aAAa;IAI9B,IAAI,GAAG,IAAI,aAAa,CAEvB;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;IAUxF;;;;;OAKG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;CAqD/G;AAoCD,wBAAgB,WAAW,CAAC,GAAG,CAAC,EAAE,aAAa,GAAG,QAAQ,CAQzD"}

package/dist/app-check/index.js

@@ -1,16 +1,202 @@
-import { guardDeferredServiceApp, wireDeferredService } from '../deferred.js';
-export { PyricDeferredApiError } from '../deferred.js';
+/**
+ * `pyric-admin/app-check`: the sandbox mirror of `firebase-admin/app-check`.
+ *
+ * `createToken` mints the same sandbox token the web mirror's `getToken`
+ * returns (shared in `pyric/sandbox/internal`), so a token minted on either
+ * plane verifies here. Shapes, TTL limits, error codes, and consume semantics
+ * follow the `app-check-admin-` captures; the rows are in
+ * packages/conformance/registry/app-check.ts (surface `app-check-admin`).
+ *
+ * One deliberate difference: the sandbox has no list of the project's
+ * registered apps, so `createToken` accepts any app id (row
+ * `app-check-admin#create-token-unknown-app`, diverged by design).
+ *
+ * A token whose `kid` is not the sandbox's came from Firebase. It goes to
+ * firebase-admin's own verifier when `@pyric/cli/register` installed one
+ * (production AI mode), and is refused with a message that says why otherwise
+ * (./firebase-token.ts).
+ */
+import { checkAppCheckToken, mintAppCheckToken } from 'pyric/sandbox/internal';
+import { getApp } from '../app/index.js';
+import { explicitProjectId } from '../app/project-id.js';
+import { assertAdminAppActive } from '../app/lifecycle.js';
+import { FirebaseAppCheckError } from './error.js';
+import { verifyFirebaseToken } from './firebase-token.js';
+const MINUTE_MILLIS = 60 * 1000;
+const MIN_TTL_MILLIS = 30 * MINUTE_MILLIS;
+const MAX_TTL_MILLIS = 7 * 24 * 60 * MINUTE_MILLIS;
+const DEFAULT_TTL_MILLIS = 60 * MINUTE_MILLIS;
+const MESSAGES = {
+    notString: 'App check token must be a non-null string.',
+    options: 'VerifyAppCheckTokenOptions must be a non-null object.',
+    algorithm: (alg) => `The provided App Check token has incorrect algorithm. Expected "RS256" but got "${String(alg)}".`,
+    noSub: 'The provided App Check token has no "sub" (subject) claim.',
+    emptySub: 'The provided App Check token has an empty string "sub" (subject) claim.',
+    ttl: 'ttlMillis must be a duration in milliseconds between 30 minutes and 7 days (inclusive).',
+    appId: '`appId` must be a non-empty string.',
+    decode: 'Decoding App Check token failed. Make sure you passed the entire string JWT which represents the Firebase App Check token.',
+    signature: 'The provided App Check token has invalid signature.',
+    expired: 'The provided App Check token has expired. Get a fresh App Check token from your client app and try again.',
+    issuer: 'The provided App Check token has incorrect "iss" (issuer) claim.',
+    createNoProject: 'Failed to determine project ID. Initialize the SDK with service account credentials or set project ID as an app option. Alternatively, set the GOOGLE_CLOUD_PROJECT environment variable.',
+    noProject: 'Must initialize app with a cert credential or set your Firebase project ID as the GOOGLE_CLOUD_PROJECT environment variable to verify an App Check token.',
+    audience: (scoped, aud) => `The provided App Check token has incorrect "aud" (audience) claim. Expected "${scoped}" but got "${String(aud)}". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.`,
+};
+const APP_CHECK_ISSUER = 'https://firebaseappcheck.googleapis.com/';
+/**
+ * Consumed token ids, per sandbox handle, for this process. The map sits
+ * behind Symbol.for, as the app registry in ../app/index.ts does, so the
+ * require and import copies of this module that the register hook can load
+ * share it. It is in memory: it does not survive a restart, and two processes
+ * on one dev server each keep their own. Production consumes once per
+ * project; moving this into the sandbox is #1297.
+ */
+const CONSUMED_BY_SANDBOX = Symbol.for('pyric.admin.appCheck.consumedBySandbox');
+function consumedFor(app) {
+    const global = globalThis;
+    const bySandbox = (global[CONSUMED_BY_SANDBOX] ??= new WeakMap());
+    const key = app.sandbox;
+    let consumed = bySandbox.get(key);
+    if (!consumed) {
+        consumed = new Set();
+        bySandbox.set(key, consumed);
+    }
+    return consumed;
+}
+function ttlFrom(options) {
+    const ttl = options?.ttlMillis ?? DEFAULT_TTL_MILLIS;
+    const inRange = typeof ttl === 'number' && ttl >= MIN_TTL_MILLIS && ttl <= MAX_TTL_MILLIS;
+    if (!inRange)
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.ttl);
+    return ttl;
+}
 export class AppCheck {
     #app;
     /** @internal */
-    constructor(...args) {
-        this.#app = guardDeferredServiceApp('app-check', 'AppCheck', args);
+    constructor(app) {
+        this.#app = app;
     }
     get app() {
         return this.#app;
     }
+    async createToken(appId, options) {
+        assertAdminAppActive(this.#app);
+        if (typeof appId !== 'string' || appId.length === 0)
+            throw new FirebaseAppCheckError('invalid-argument', MESSAGES.appId);
+        const ttlMillis = ttlFrom(options);
+        const projectId = explicitProjectId(this.#app);
+        if (!projectId)
+            throw new FirebaseAppCheckError('unknown-error', MESSAGES.createNoProject);
+        const minted = await mintAppCheckToken({ appId, projectId }, Math.floor(ttlMillis / 1000));
+        return { token: minted.token, ttlMillis };
+    }
+    /**
+     * Checks in firebase-admin's order (app-check.js, token-verifier.js,
+     * utils/jwt.js): the options and the token's type, synchronously as
+     * upstream throws them; then the project, decoding, content, key,
+     * signature, and last `nbf` and `exp` as jsonwebtoken reads them.
+     */
+    verifyToken(appCheckToken, options) {
+        assertAdminAppActive(this.#app);
+        const optionsAreObject = typeof options === 'object' && options !== null && !Array.isArray(options);
+        if (options !== undefined && !optionsAreObject)
+            throw new FirebaseAppCheckError('invalid-argument', MESSAGES.options);
+        if (typeof appCheckToken !== 'string')
+            throw new FirebaseAppCheckError('invalid-argument', MESSAGES.notString);
+        return this.#verify(appCheckToken, options);
+    }
+    async #verify(appCheckToken, options) {
+        const projectId = this.#projectId();
+        const check = await checkAppCheckToken(appCheckToken);
+        if (!check.ok && check.reason === 'malformed')
+            throw new FirebaseAppCheckError('invalid-argument', MESSAGES.decode);
+        // A kid that names a key other than the sandbox's: the token came from
+        // Firebase, so firebase-admin runs every check, in production's order.
+        const isFirebaseToken = !check.ok && check.reason === 'kid';
+        if (isFirebaseToken) {
+            const verified = await verifyFirebaseToken(appCheckToken, projectId);
+            return this.#recordConsume(verified, appCheckToken, options);
+        }
+        verifyContent(check.header, check.claims, projectId);
+        if (!check.ok)
+            throw new FirebaseAppCheckError('invalid-argument', MESSAGES.signature);
+        verifyNotBefore(check.claims.nbf);
+        verifyExpiry(check.claims.exp);
+        const claims = check.claims;
+        const result = { appId: claims.sub, token: { ...claims, app_id: claims.sub } };
+        return this.#recordConsume(result, appCheckToken, options);
+    }
+    /**
+     * `consume: true` marks the token used, in this process, for sandbox and
+     * Firebase tokens alike. It is never forwarded to Firebase, which would need
+     * a credential with App Check permissions.
+     */
+    #recordConsume(result, appCheckToken, options) {
+        if (!options?.consume)
+            return result;
+        const consumed = consumedFor(this.#app);
+        const jti = result.token.jti;
+        const tokenId = typeof jti === 'string' ? jti : appCheckToken;
+        result.alreadyConsumed = consumed.has(tokenId);
+        consumed.add(tokenId);
+        return result;
+    }
+    /** The project a token must be scoped to, resolved as firebase-admin resolves it. */
+    #projectId() {
+        const projectId = explicitProjectId(this.#app);
+        if (!projectId)
+            throw new FirebaseAppCheckError('invalid-credential', MESSAGES.noProject);
+        return projectId;
+    }
+}
+/** token-verifier.js verifyContent: algorithm, audience, issuer, then subject, first failure wins. */
+function verifyContent(header, claims, projectId) {
+    if (header.alg !== 'RS256')
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.algorithm(header.alg));
+    const scoped = `projects/${projectId}`;
+    const audienceMatches = Array.isArray(claims.aud) && claims.aud.length > 0 && claims.aud.includes(scoped);
+    if (!audienceMatches)
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.audience(scoped, claims.aud));
+    const issuerMatches = typeof claims.iss === 'string' && claims.iss.startsWith(APP_CHECK_ISSUER);
+    if (!issuerMatches)
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.issuer);
+    if (typeof claims.sub !== 'string')
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.noSub);
+    if (claims.sub === '')
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.emptySub);
+}
+/** jsonwebtoken's nbf rule, which runs before exp: firebase-admin reports both failures as an invalid signature. */
+function verifyNotBefore(nbf) {
+    if (nbf === undefined)
+        return;
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const active = typeof nbf === 'number' && nbf <= nowSeconds;
+    if (!active)
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.signature);
+}
+/**
+ * jsonwebtoken's exp rule: an absent `exp` never expires, a non-number is an
+ * error that firebase-admin reports as an invalid signature, and the token is
+ * expired once the current second reaches `exp`.
+ */
+function verifyExpiry(exp) {
+    if (exp === undefined)
+        return;
+    if (typeof exp !== 'number')
+        throw new FirebaseAppCheckError('invalid-argument', MESSAGES.signature);
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    if (nowSeconds >= exp)
+        throw new FirebaseAppCheckError('app-check-token-expired', MESSAGES.expired);
+}
+const instances = new WeakMap();
+export function getAppCheck(app) {
+    const resolved = app ?? getApp();
+    assertAdminAppActive(resolved);
+    const existing = instances.get(resolved);
+    if (existing)
+        return existing;
+    const instance = new AppCheck(resolved);
+    instances.set(resolved, instance);
+    return instance;
 }
-export const getAppCheck = wireDeferredService(AppCheck, 'app-check', 'AppCheck', {
-    async: ['createToken', 'verifyToken'],
-});
 //# sourceMappingURL=index.js.map

package/dist/app-check/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,OAAO,QAAQ;IACV,IAAI,CAAgB;IAE7B,gBAAgB;IAChB,YAAY,GAAG,IAAe;QAC5B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CAIF;AAED,MAAM,CAAC,MAAM,WAAW,GAAsC,mBAAmB,CAC/E,QAAQ,EACR,WAAW,EACX,UAAU,EACV;IACE,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;CACtC,CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAA4B,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,MAAM,EAAsB,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,cAAc,GAAG,EAAE,GAAG,aAAa,CAAC;AAC1C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC;AACnD,MAAM,kBAAkB,GAAG,EAAE,GAAG,aAAa,CAAC;AAE9C,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,4CAA4C;IACvD,OAAO,EAAE,uDAAuD;IAChE,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,mFAAmF,MAAM,CAAC,GAAG,CAAC,IAAI;IAC/H,KAAK,EAAE,4DAA4D;IACnE,QAAQ,EAAE,yEAAyE;IACnF,GAAG,EAAE,yFAAyF;IAC9F,KAAK,EAAE,qCAAqC;IAC5C,MAAM,EAAE,4HAA4H;IACpI,SAAS,EAAE,qDAAqD;IAChE,OAAO,EAAE,2GAA2G;IACpH,MAAM,EAAE,kEAAkE;IAC1E,eAAe,EACb,2LAA2L;IAC7L,SAAS,EACP,2JAA2J;IAC7J,QAAQ,EAAE,CAAC,MAAc,EAAE,GAAY,EAAE,EAAE,CACzC,gFAAgF,MAAM,cAAc,MAAM,CAAC,GAAG,CAAC,6HAA6H;CAC/O,CAAC;AAEF,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAyBpE;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AAGjF,SAAS,WAAW,CAAC,GAAkB;IACrC,MAAM,MAAM,GAAG,UAA4B,CAAC;IAC5C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAiB,CAAC;IAClC,IAAI,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,OAAyC;IACxD,MAAM,GAAG,GAAG,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,cAAc,IAAI,GAAG,IAAI,cAAc,CAAC;IAC1F,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,QAAQ;IACV,IAAI,CAAgB;IAE7B,gBAAgB;IAChB,YAAY,GAAkB;QAC5B,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAA8B;QAC7D,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzH,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,aAAqB,EAAE,OAAoC;QACrE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,gBAAgB,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpG,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtH,IAAI,OAAO,aAAa,KAAK,QAAQ;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/G,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,aAAqB,EAAE,OAA+C;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpH,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC;QAC5D,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvF,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAA6B,CAAC;QACnD,MAAM,MAAM,GAAgC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5G,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,cAAc,CACZ,MAAmC,EACnC,aAAqB,EACrB,OAA+C;QAE/C,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;QAC9D,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,UAAU;QACR,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,sGAAsG;AACtG,SAAS,aAAa,CAAC,MAAyC,EAAE,MAAyC,EAAE,SAAiB;IAC5H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,YAAY,SAAS,EAAE,CAAC;IACvC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1G,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjH,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAChG,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChG,CAAC;AAED,oHAAoH;AACpH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,UAAU,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,UAAU,IAAI,GAAG;QAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,OAAO,EAA2B,CAAC;AAEzD,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC7C,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;IACjC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyric-admin",
-  "version": "0.1.0-alpha.29",
+  "version": "0.1.0-alpha.30.1",
   "license": "Apache-2.0",
   "homepage": "https://pyric.dev",
   "repository": {
@@ -106,7 +106,7 @@
     "typecheck": "bun x tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "pyric": "^0.1.0-alpha.29"
+    "pyric": "^0.1.0-alpha.30.1"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",

package/src/app/firebase-error.ts

@@ -0,0 +1,46 @@
+/**
+ * firebase-admin's error shape (lib/utils/error.js, 13.10.0), shared by the
+ * admin mirrors so each service's error class matches upstream in one place.
+ *
+ * Upstream keeps `{ code, message }` in an own `errorInfo` property and reads
+ * `code` through a prototype getter. Its `message` getter is shadowed by the
+ * own, non-enumerable `message` that `Error` sets, so only `code` needs one
+ * here. `toJSON()` returns both, and
+ * `hasCode()` tests the unprefixed code. It never sets `name`, so `name` reads
+ * `Error`. The own enumerable keys are `errorInfo` and `codePrefix`.
+ */
+export interface ErrorInfo {
+  code: string;
+  message: string;
+}
+
+export class FirebaseError extends Error {
+  readonly errorInfo: ErrorInfo;
+
+  constructor(errorInfo: ErrorInfo) {
+    super(errorInfo.message);
+    this.errorInfo = errorInfo;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+
+  get code(): string {
+    return this.errorInfo?.code;
+  }
+
+  toJSON(): ErrorInfo {
+    return { code: this.code, message: this.message };
+  }
+}
+
+export class PrefixedFirebaseError extends FirebaseError {
+  readonly codePrefix: string;
+
+  constructor(codePrefix: string, code: string, message: string) {
+    super({ code: `${codePrefix}/${code}`, message });
+    this.codePrefix = codePrefix;
+  }
+
+  hasCode(code: string): boolean {
+    return `${this.codePrefix}/${code}` === this.code;
+  }
+}

package/src/app/index.ts

@@ -15,6 +15,7 @@ import { parsePyricSandbox, processActivation } from 'pyric/sandbox/internal';
 import { readFileSync } from 'node:fs';
 
 import { assertAdminAppActive, markAdminAppDeleted } from './lifecycle.js';
+import { keepAppCredentialProjectId, keepCredentialProjectId } from './project-id.js';
 
 /** Brand carried by every sandbox admin app. */
 export const ADMIN_APP_TARGET = Symbol.for('pyric.admin.app.target');
@@ -59,9 +60,16 @@ export function applicationDefault(): never {
  * Link-compatible mirror of `firebase-admin/app`'s `cert(serviceAccountPathOrObject)`.
  * Returns an inert sandbox credential token so unchanged application setup code
  * can assign `appOptions.credential = cert(...)` under `@pyric/cli/register`.
+ *
+ * It keeps one field, the service account's project id, because firebase-admin
+ * finds an app's project there when the options name none. A path is read as a
+ * JSON file; a file that is missing, unreadable, or has no project id gives a
+ * credential without one, and never throws, so apps run without a key on disk.
  */
 export function cert(serviceAccountPathOrObject: unknown): object {
-  return { [Symbol.for('pyric.admin.credential')]: 'cert' };
+  const credential = { [Symbol.for('pyric.admin.credential')]: 'cert' };
+  keepCredentialProjectId(credential, serviceAccountPathOrObject);
+  return credential;
 }
 
 /**
@@ -139,6 +147,7 @@ export function initializeApp(
       throw alreadyExists(name, 'invalid-app-options');
     }
     const app = initializeAmbientApp(name, ambientAppOptions(config));
+    keepAppCredentialProjectId(app, config);
     appRegistry.set(name, app);
     ambientApps.add(app);
     return app;
@@ -158,6 +167,7 @@ export function initializeApp(
     name,
     options: appOptionsFrom(config),
   };
+  keepAppCredentialProjectId(app, config);
   appRegistry.set(name, app);
   return app;
 }

package/src/app/project-id.ts

@@ -0,0 +1,67 @@
+/**
+ * The project id an admin app resolves, in firebase-admin's order
+ * (`getExplicitProjectId`, firebase-admin 13 `lib/utils/index.js`): the
+ * `projectId` app option, then a cert credential's project id, then
+ * `GOOGLE_CLOUD_PROJECT`, then `GCLOUD_PROJECT`.
+ *
+ * Pyric's `cert()` is inert: it keeps the service account's project id and
+ * nothing else, so no private key or client email is held in the sandbox.
+ * Both keys sit behind `Symbol.for`, as the app registry does, so the require
+ * and import copies of this module that the register hook can load agree.
+ */
+import { readFileSync } from 'node:fs';
+
+const CREDENTIAL_PROJECT_ID = Symbol.for('pyric.admin.credential.projectId');
+const APP_CREDENTIAL_PROJECT_ID = Symbol.for('pyric.admin.app.credentialProjectId');
+
+type WithProjectId = { [CREDENTIAL_PROJECT_ID]?: unknown; [APP_CREDENTIAL_PROJECT_ID]?: unknown };
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value !== '' ? value : undefined;
+}
+
+/** firebase-admin's `ServiceAccount.fromPath`, except that a file it cannot read or parse yields no object. */
+function readServiceAccountFile(path: string): unknown {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return undefined;
+  }
+}
+
+/** The project id of a service account object or file path: `projectId`, then `project_id`, as firebase-admin's `copyAttr` reads it. */
+function serviceAccountProjectId(serviceAccountPathOrObject: unknown): string | undefined {
+  const isPath = typeof serviceAccountPathOrObject === 'string';
+  const account = isPath ? readServiceAccountFile(serviceAccountPathOrObject) : serviceAccountPathOrObject;
+  if (typeof account !== 'object' || account === null) return undefined;
+  const { projectId, project_id: projectIdSnake } = account as Record<string, unknown>;
+  return nonEmptyString(projectId) ?? nonEmptyString(projectIdSnake);
+}
+
+function defineHidden(target: object, key: symbol, value: string): void {
+  Object.defineProperty(target, key, { value, enumerable: false, writable: false, configurable: false });
+}
+
+/** Keeps the service account's project id on an inert credential, as a non-enumerable property. */
+export function keepCredentialProjectId(credential: object, serviceAccountPathOrObject: unknown): void {
+  const projectId = serviceAccountProjectId(serviceAccountPathOrObject);
+  if (projectId !== undefined) defineHidden(credential, CREDENTIAL_PROJECT_ID, projectId);
+}
+
+/** Copies a cert credential's project id from initialization options onto the app, beside `options`. */
+export function keepAppCredentialProjectId(app: object, config: unknown): void {
+  if (typeof config !== 'object' || config === null) return;
+  const credential = (config as { credential?: unknown }).credential;
+  if (typeof credential !== 'object' || credential === null) return;
+  const projectId = nonEmptyString((credential as WithProjectId)[CREDENTIAL_PROJECT_ID]);
+  if (projectId !== undefined) defineHidden(app, APP_CREDENTIAL_PROJECT_ID, projectId);
+}
+
+/** firebase-admin's `getExplicitProjectId` for a sandbox admin app. */
+export function explicitProjectId(app: { readonly options: { readonly projectId?: string } }): string | undefined {
+  return (
+    nonEmptyString(app.options.projectId) ??
+    nonEmptyString((app as WithProjectId)[APP_CREDENTIAL_PROJECT_ID]) ??
+    nonEmptyString(process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT)
+  );
+}

package/src/app-check/error.ts

@@ -0,0 +1,10 @@
+import { PrefixedFirebaseError } from '../app/firebase-error.js';
+
+export type AppCheckErrorCode = 'invalid-argument' | 'invalid-credential' | 'app-check-token-expired' | 'unknown-error';
+
+/** firebase-admin's FirebaseAppCheckError: a PrefixedFirebaseError with prefix `app-check`. */
+export class FirebaseAppCheckError extends PrefixedFirebaseError {
+  constructor(code: AppCheckErrorCode, message: string) {
+    super('app-check', code, message);
+  }
+}

package/src/app-check/firebase-token.ts

@@ -0,0 +1,60 @@
+/**
+ * App Check tokens from Firebase: a token whose `kid` names a key that is not
+ * the sandbox's (#1552, #1301).
+ *
+ * In production AI mode the page's `firebase/app-check` is the Firebase SDK,
+ * so its tokens come from Firebase, and only firebase-admin's own verifier can
+ * check them. `@pyric/cli/register` installs that verifier behind
+ * {@link FIREBASE_VERIFIER} in production AI mode only, the same kind of seam
+ * as its `pyric.remote.sandboxFactory`: this package never learns what an AI
+ * mode is, and never loads firebase-admin itself.
+ *
+ * With no verifier installed the token is refused with a message that says
+ * why. The code stays `invalid-argument`, so a server that branches on it
+ * still answers 401.
+ */
+import { FirebaseAppCheckError } from './error.js';
+import type { VerifyAppCheckTokenResponse } from './index.js';
+
+const FIREBASE_VERIFIER = Symbol.for('pyric.admin.appCheck.firebaseVerifier');
+
+/** firebase-admin's `getAppCheck(app).verifyToken(token)` for an app scoped to `projectId`, with no options. */
+type FirebaseVerifier = (token: string, projectId: string) => Promise<VerifyAppCheckTokenResponse>;
+
+const MESSAGES = {
+  notSandbox:
+    "This App Check token was not minted by the Pyric sandbox, so the sandbox's firebase-admin/app-check cannot verify it. " +
+    'A page in production AI mode gets its App Check tokens from Firebase. Start this server in production AI mode too ' +
+    '(PYRIC_AI_MODE=production) and Pyric verifies them with firebase-admin. In sandbox AI mode, page tokens come from the sandbox and verify here.',
+  install:
+    'Production AI mode verifies App Check tokens from Firebase with firebase-admin, which is not installed beside this server. ' +
+    'Install it in the project that runs the server (npm install firebase-admin) and restart.',
+};
+
+function installedVerifier(): FirebaseVerifier | undefined {
+  const verifier = (globalThis as Record<symbol, unknown>)[FIREBASE_VERIFIER];
+  return typeof verifier === 'function' ? (verifier as FirebaseVerifier) : undefined;
+}
+
+/** Whether a failure is the `firebase-admin` package itself not resolving, from ESM or CJS. */
+function isFirebaseAdminMissing(error: unknown): boolean {
+  const { code, message } = (error ?? {}) as { code?: unknown; message?: unknown };
+  const isNotFound = code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND';
+  const namesFirebaseAdmin = typeof message === 'string' && /'firebase-admin[/']/.test(message);
+  return isNotFound && namesFirebaseAdmin;
+}
+
+/**
+ * Verifies a token from Firebase with firebase-admin, through the verifier the
+ * register installs. Its result and its errors come back unchanged.
+ */
+export async function verifyFirebaseToken(token: string, projectId: string): Promise<VerifyAppCheckTokenResponse> {
+  const verifier = installedVerifier();
+  if (verifier === undefined) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.notSandbox);
+  try {
+    return await verifier(token, projectId);
+  } catch (error) {
+    if (isFirebaseAdminMissing(error)) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.install);
+    throw error;
+  }
+}

package/src/app-check/index.ts

@@ -1,32 +1,231 @@
 /**
- * `pyric-admin/app-check`: deferred service handle for `firebase-admin/app-check`.
+ * `pyric-admin/app-check`: the sandbox mirror of `firebase-admin/app-check`.
+ *
+ * `createToken` mints the same sandbox token the web mirror's `getToken`
+ * returns (shared in `pyric/sandbox/internal`), so a token minted on either
+ * plane verifies here. Shapes, TTL limits, error codes, and consume semantics
+ * follow the `app-check-admin-` captures; the rows are in
+ * packages/conformance/registry/app-check.ts (surface `app-check-admin`).
+ *
+ * One deliberate difference: the sandbox has no list of the project's
+ * registered apps, so `createToken` accepts any app id (row
+ * `app-check-admin#create-token-unknown-app`, diverged by design).
+ *
+ * A token whose `kid` is not the sandbox's came from Firebase. It goes to
+ * firebase-admin's own verifier when `@pyric/cli/register` installed one
+ * (production AI mode), and is refused with a message that says why otherwise
+ * (./firebase-token.ts).
  */
-import type { PyricAdminApp } from '../app/index.js';
-import { guardDeferredServiceApp, wireDeferredService } from '../deferred.js';
+import { checkAppCheckToken, mintAppCheckToken, type AppCheckTokenClaims } from 'pyric/sandbox/internal';
+import { getApp, type PyricAdminApp } from '../app/index.js';
+import { explicitProjectId } from '../app/project-id.js';
+import { assertAdminAppActive } from '../app/lifecycle.js';
+import { FirebaseAppCheckError } from './error.js';
+import { verifyFirebaseToken } from './firebase-token.js';
 
-export { PyricDeferredApiError } from '../deferred.js';
+const MINUTE_MILLIS = 60 * 1000;
+const MIN_TTL_MILLIS = 30 * MINUTE_MILLIS;
+const MAX_TTL_MILLIS = 7 * 24 * 60 * MINUTE_MILLIS;
+const DEFAULT_TTL_MILLIS = 60 * MINUTE_MILLIS;
+
+const MESSAGES = {
+  notString: 'App check token must be a non-null string.',
+  options: 'VerifyAppCheckTokenOptions must be a non-null object.',
+  algorithm: (alg: unknown) => `The provided App Check token has incorrect algorithm. Expected "RS256" but got "${String(alg)}".`,
+  noSub: 'The provided App Check token has no "sub" (subject) claim.',
+  emptySub: 'The provided App Check token has an empty string "sub" (subject) claim.',
+  ttl: 'ttlMillis must be a duration in milliseconds between 30 minutes and 7 days (inclusive).',
+  appId: '`appId` must be a non-empty string.',
+  decode: 'Decoding App Check token failed. Make sure you passed the entire string JWT which represents the Firebase App Check token.',
+  signature: 'The provided App Check token has invalid signature.',
+  expired: 'The provided App Check token has expired. Get a fresh App Check token from your client app and try again.',
+  issuer: 'The provided App Check token has incorrect "iss" (issuer) claim.',
+  createNoProject:
+    'Failed to determine project ID. Initialize the SDK with service account credentials or set project ID as an app option. Alternatively, set the GOOGLE_CLOUD_PROJECT environment variable.',
+  noProject:
+    'Must initialize app with a cert credential or set your Firebase project ID as the GOOGLE_CLOUD_PROJECT environment variable to verify an App Check token.',
+  audience: (scoped: string, aud: unknown) =>
+    `The provided App Check token has incorrect "aud" (audience) claim. Expected "${scoped}" but got "${String(aud)}". Make sure the App Check token comes from the same Firebase project as the service account used to authenticate this SDK.`,
+};
+
+const APP_CHECK_ISSUER = 'https://firebaseappcheck.googleapis.com/';
+
+export interface AppCheckTokenOptions {
+  ttlMillis?: number;
+}
+
+export interface AppCheckToken {
+  token: string;
+  ttlMillis: number;
+}
+
+export interface VerifyAppCheckTokenOptions {
+  consume?: boolean;
+}
+
+export interface DecodedAppCheckToken extends AppCheckTokenClaims {
+  app_id: string;
+}
+
+export interface VerifyAppCheckTokenResponse {
+  appId: string;
+  token: DecodedAppCheckToken;
+  alreadyConsumed?: boolean;
+}
+
+/**
+ * Consumed token ids, per sandbox handle, for this process. The map sits
+ * behind Symbol.for, as the app registry in ../app/index.ts does, so the
+ * require and import copies of this module that the register hook can load
+ * share it. It is in memory: it does not survive a restart, and two processes
+ * on one dev server each keep their own. Production consumes once per
+ * project; moving this into the sandbox is #1297.
+ */
+const CONSUMED_BY_SANDBOX = Symbol.for('pyric.admin.appCheck.consumedBySandbox');
+type GlobalConsumed = { [CONSUMED_BY_SANDBOX]?: WeakMap<object, Set<string>> };
+
+function consumedFor(app: PyricAdminApp): Set<string> {
+  const global = globalThis as GlobalConsumed;
+  const bySandbox = (global[CONSUMED_BY_SANDBOX] ??= new WeakMap());
+  const key = app.sandbox as object;
+  let consumed = bySandbox.get(key);
+  if (!consumed) {
+    consumed = new Set();
+    bySandbox.set(key, consumed);
+  }
+  return consumed;
+}
+
+function ttlFrom(options: AppCheckTokenOptions | undefined): number {
+  const ttl = options?.ttlMillis ?? DEFAULT_TTL_MILLIS;
+  const inRange = typeof ttl === 'number' && ttl >= MIN_TTL_MILLIS && ttl <= MAX_TTL_MILLIS;
+  if (!inRange) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.ttl);
+  return ttl;
+}
 
 export class AppCheck {
   readonly #app: PyricAdminApp;
 
   /** @internal */
-  constructor(...args: unknown[]) {
-    this.#app = guardDeferredServiceApp('app-check', 'AppCheck', args);
+  constructor(app: PyricAdminApp) {
+    this.#app = app;
   }
 
   get app(): PyricAdminApp {
     return this.#app;
   }
 
-  declare createToken: (...args: unknown[]) => Promise<never>;
-  declare verifyToken: (...args: unknown[]) => Promise<never>;
+  async createToken(appId: string, options?: AppCheckTokenOptions): Promise<AppCheckToken> {
+    assertAdminAppActive(this.#app);
+    if (typeof appId !== 'string' || appId.length === 0) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.appId);
+    const ttlMillis = ttlFrom(options);
+    const projectId = explicitProjectId(this.#app);
+    if (!projectId) throw new FirebaseAppCheckError('unknown-error', MESSAGES.createNoProject);
+    const minted = await mintAppCheckToken({ appId, projectId }, Math.floor(ttlMillis / 1000));
+    return { token: minted.token, ttlMillis };
+  }
+
+  /**
+   * Checks in firebase-admin's order (app-check.js, token-verifier.js,
+   * utils/jwt.js): the options and the token's type, synchronously as
+   * upstream throws them; then the project, decoding, content, key,
+   * signature, and last `nbf` and `exp` as jsonwebtoken reads them.
+   */
+  verifyToken(appCheckToken: string, options?: VerifyAppCheckTokenOptions): Promise<VerifyAppCheckTokenResponse> {
+    assertAdminAppActive(this.#app);
+    const optionsAreObject = typeof options === 'object' && options !== null && !Array.isArray(options);
+    if (options !== undefined && !optionsAreObject) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.options);
+    if (typeof appCheckToken !== 'string') throw new FirebaseAppCheckError('invalid-argument', MESSAGES.notString);
+    return this.#verify(appCheckToken, options);
+  }
+
+  async #verify(appCheckToken: string, options: VerifyAppCheckTokenOptions | undefined): Promise<VerifyAppCheckTokenResponse> {
+    const projectId = this.#projectId();
+    const check = await checkAppCheckToken(appCheckToken);
+    if (!check.ok && check.reason === 'malformed') throw new FirebaseAppCheckError('invalid-argument', MESSAGES.decode);
+    // A kid that names a key other than the sandbox's: the token came from
+    // Firebase, so firebase-admin runs every check, in production's order.
+    const isFirebaseToken = !check.ok && check.reason === 'kid';
+    if (isFirebaseToken) {
+      const verified = await verifyFirebaseToken(appCheckToken, projectId);
+      return this.#recordConsume(verified, appCheckToken, options);
+    }
+    verifyContent(check.header, check.claims, projectId);
+    if (!check.ok) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.signature);
+    verifyNotBefore(check.claims.nbf);
+    verifyExpiry(check.claims.exp);
+    const claims = check.claims as AppCheckTokenClaims;
+    const result: VerifyAppCheckTokenResponse = { appId: claims.sub, token: { ...claims, app_id: claims.sub } };
+    return this.#recordConsume(result, appCheckToken, options);
+  }
+
+  /**
+   * `consume: true` marks the token used, in this process, for sandbox and
+   * Firebase tokens alike. It is never forwarded to Firebase, which would need
+   * a credential with App Check permissions.
+   */
+  #recordConsume(
+    result: VerifyAppCheckTokenResponse,
+    appCheckToken: string,
+    options: VerifyAppCheckTokenOptions | undefined,
+  ): VerifyAppCheckTokenResponse {
+    if (!options?.consume) return result;
+    const consumed = consumedFor(this.#app);
+    const jti = result.token.jti;
+    const tokenId = typeof jti === 'string' ? jti : appCheckToken;
+    result.alreadyConsumed = consumed.has(tokenId);
+    consumed.add(tokenId);
+    return result;
+  }
+
+  /** The project a token must be scoped to, resolved as firebase-admin resolves it. */
+  #projectId(): string {
+    const projectId = explicitProjectId(this.#app);
+    if (!projectId) throw new FirebaseAppCheckError('invalid-credential', MESSAGES.noProject);
+    return projectId;
+  }
 }
 
-export const getAppCheck: (app?: PyricAdminApp) => AppCheck = wireDeferredService(
-  AppCheck,
-  'app-check',
-  'AppCheck',
-  {
-    async: ['createToken', 'verifyToken'],
-  },
-);
+/** token-verifier.js verifyContent: algorithm, audience, issuer, then subject, first failure wins. */
+function verifyContent(header: Readonly<Record<string, unknown>>, claims: Readonly<Record<string, unknown>>, projectId: string): void {
+  if (header.alg !== 'RS256') throw new FirebaseAppCheckError('invalid-argument', MESSAGES.algorithm(header.alg));
+  const scoped = `projects/${projectId}`;
+  const audienceMatches = Array.isArray(claims.aud) && claims.aud.length > 0 && claims.aud.includes(scoped);
+  if (!audienceMatches) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.audience(scoped, claims.aud));
+  const issuerMatches = typeof claims.iss === 'string' && claims.iss.startsWith(APP_CHECK_ISSUER);
+  if (!issuerMatches) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.issuer);
+  if (typeof claims.sub !== 'string') throw new FirebaseAppCheckError('invalid-argument', MESSAGES.noSub);
+  if (claims.sub === '') throw new FirebaseAppCheckError('invalid-argument', MESSAGES.emptySub);
+}
+
+/** jsonwebtoken's nbf rule, which runs before exp: firebase-admin reports both failures as an invalid signature. */
+function verifyNotBefore(nbf: unknown): void {
+  if (nbf === undefined) return;
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  const active = typeof nbf === 'number' && nbf <= nowSeconds;
+  if (!active) throw new FirebaseAppCheckError('invalid-argument', MESSAGES.signature);
+}
+
+/**
+ * jsonwebtoken's exp rule: an absent `exp` never expires, a non-number is an
+ * error that firebase-admin reports as an invalid signature, and the token is
+ * expired once the current second reaches `exp`.
+ */
+function verifyExpiry(exp: unknown): void {
+  if (exp === undefined) return;
+  if (typeof exp !== 'number') throw new FirebaseAppCheckError('invalid-argument', MESSAGES.signature);
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  if (nowSeconds >= exp) throw new FirebaseAppCheckError('app-check-token-expired', MESSAGES.expired);
+}
+
+const instances = new WeakMap<PyricAdminApp, AppCheck>();
+
+export function getAppCheck(app?: PyricAdminApp): AppCheck {
+  const resolved = app ?? getApp();
+  assertAdminAppActive(resolved);
+  const existing = instances.get(resolved);
+  if (existing) return existing;
+  const instance = new AppCheck(resolved);
+  instances.set(resolved, instance);
+  return instance;
+}