pyric 0.1.0-alpha.29 → 0.1.0-alpha.30.1

package/dist/app-check/errors.d.ts

@@ -0,0 +1,14 @@
+/**
+ * App Check errors with the codes, messages, and customData production
+ * throws (captures `app-check-client-initialize-twice` and
+ * `app-check-client-get-token-before-initialize`).
+ */
+import { FirebaseError } from '../sandbox/internal/firebase-error.js';
+declare const MESSAGES: {
+    readonly 'already-initialized': (appName: string) => string;
+    readonly 'use-before-activation': (appName: string) => string;
+};
+export type AppCheckErrorCode = keyof typeof MESSAGES;
+export declare function appCheckError(code: AppCheckErrorCode, appName: string): FirebaseError;
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/app-check/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/app-check/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAEtE,QAAA,MAAM,QAAQ;8CACqB,MAAM;gDAEJ,MAAM;CAEjC,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,QAAQ,CAAC;AAEtD,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAGrF"}

package/dist/app-check/errors.js

@@ -0,0 +1,15 @@
+/**
+ * App Check errors with the codes, messages, and customData production
+ * throws (captures `app-check-client-initialize-twice` and
+ * `app-check-client-get-token-before-initialize`).
+ */
+import { FirebaseError } from '../sandbox/internal/firebase-error.js';
+const MESSAGES = {
+    'already-initialized': (appName) => `You have already called initializeAppCheck() for FirebaseApp ${appName} with different options. To avoid this error, call initializeAppCheck() with the same options as when it was originally called. This will return the already initialized instance.`,
+    'use-before-activation': (appName) => `App Check is being used before initializeAppCheck() is called for FirebaseApp ${appName}. Call initializeAppCheck() before instantiating other Firebase services.`,
+};
+export function appCheckError(code, appName) {
+    const fullCode = `appCheck/${code}`;
+    return new FirebaseError(fullCode, `AppCheck: ${MESSAGES[code](appName)} (${fullCode}).`, { appName });
+}
+//# sourceMappingURL=errors.js.map

package/dist/app-check/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/app-check/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAEtE,MAAM,QAAQ,GAAG;IACf,qBAAqB,EAAE,CAAC,OAAe,EAAE,EAAE,CACzC,gEAAgE,OAAO,oLAAoL;IAC7P,uBAAuB,EAAE,CAAC,OAAe,EAAE,EAAE,CAC3C,iFAAiF,OAAO,2EAA2E;CAC7J,CAAC;AAIX,MAAM,UAAU,aAAa,CAAC,IAAuB,EAAE,OAAe;IACpE,MAAM,QAAQ,GAAG,YAAY,IAAI,EAAE,CAAC;IACpC,OAAO,IAAI,aAAa,CAAC,QAAQ,EAAE,aAAa,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACzG,CAAC"}

package/dist/app-check/index.d.ts

@@ -1,31 +1,26 @@
-/**
- * `pyric/app-check` — a DEFERRED mirror of `firebase/app-check`.
- *
- * App Check attests that a request comes from your app, via reCAPTCHA or a
- * custom attestation provider talking to Google infrastructure. The sandbox
- * has no attestation authority to model against, so the whole surface is
- * deferred.
- *
- * Every symbol below resolves and links so an app that swaps `firebase` for
- * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
- * subpath. See `../deferred/entry.ts` for the full rationale.
- *
- * The value list is the exact public runtime surface of `firebase/app-check`
- * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
- * real mirror.
- */
-import { type DeferredApi } from '../deferred/entry.js';
-export { PyricDeferredApiError } from '../deferred/entry.js';
-export declare const CustomProvider: DeferredApi, ReCaptchaEnterpriseProvider: DeferredApi, ReCaptchaV3Provider: DeferredApi, getLimitedUseToken: DeferredApi, getToken: DeferredApi, initializeAppCheck: DeferredApi, onTokenChanged: DeferredApi, setTokenAutoRefreshEnabled: DeferredApi;
-export type AppCheck = DeferredApi;
-export type AppCheckOptions = DeferredApi;
-export type AppCheckToken = DeferredApi;
-export type AppCheckTokenListener = DeferredApi;
-export type AppCheckTokenResult = DeferredApi;
-export type CustomProvider = DeferredApi;
-export type CustomProviderOptions = DeferredApi;
-export type PartialObserver = DeferredApi;
-export type ReCaptchaEnterpriseProvider = DeferredApi;
-export type ReCaptchaV3Provider = DeferredApi;
-export type Unsubscribe = DeferredApi;
+import type { FirebaseApp } from '../app/types.js';
+import { CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider, type AppCheckProvider } from './providers.js';
+import { type AppCheckTokenResult } from './state.js';
+export { CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider };
+export type { CustomProviderOptions, AppCheckTokenFromProvider as AppCheckToken } from './providers.js';
+export type { AppCheckTokenResult } from './state.js';
+export interface AppCheck {
+    readonly app: FirebaseApp;
+}
+export interface AppCheckOptions {
+    provider: AppCheckProvider;
+    isTokenAutoRefreshEnabled?: boolean;
+}
+export type AppCheckTokenListener = (token: AppCheckTokenResult) => void;
+export type Unsubscribe = () => void;
+export interface PartialObserver<T> {
+    next?: (value: T) => void;
+    error?: (error: Error) => void;
+    complete?: () => void;
+}
+export declare function initializeAppCheck(app: FirebaseApp | undefined, options: AppCheckOptions): AppCheck;
+export declare function getToken(appCheck: AppCheck, forceRefresh?: boolean): Promise<AppCheckTokenResult>;
+export declare function getLimitedUseToken(appCheck: AppCheck): Promise<AppCheckTokenResult>;
+export declare function setTokenAutoRefreshEnabled(appCheck: AppCheck, isTokenAutoRefreshEnabled: boolean): void;
+export declare function onTokenChanged(appCheck: AppCheck, onNextOrObserver: AppCheckTokenListener | PartialObserver<AppCheckTokenResult>, onError?: (error: Error) => void, onCompletion?: () => void): Unsubscribe;
 //# sourceMappingURL=index.d.ts.map

package/dist/app-check/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,eAAO,MACL,cAAc,eAAE,2BAA2B,eAAE,mBAAmB,eAAE,kBAAkB,eACpF,QAAQ,eAAE,kBAAkB,eAAE,cAAc,eAAE,0BAA0B,aAC5C,CAAC;AAO/B,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC;AACnC,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAC1C,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAChD,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;AACzC,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAChD,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAC1C,MAAM,MAAM,2BAA2B,GAAG,WAAW,CAAC;AACtD,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,mBAAmB,EAAgB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvI,OAAO,EAOL,KAAK,mBAAmB,EAEzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,CAAC;AAC5E,YAAY,EAAE,qBAAqB,EAAE,yBAAyB,IAAI,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxG,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AACrC,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB;AAaD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,GAAG,QAAQ,CAWnG;AAQD,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,UAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAGrG;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAGzF;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,EAAE,yBAAyB,EAAE,OAAO,GAAG,IAAI,CAEvG;AAaD,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,QAAQ,EAClB,gBAAgB,EAAE,qBAAqB,GAAG,eAAe,CAAC,mBAAmB,CAAC,EAC9E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,EAChC,YAAY,CAAC,EAAE,MAAM,IAAI,GACxB,WAAW,CAEb"}

package/dist/app-check/index.js

@@ -1,20 +1,67 @@
 /**
- * `pyric/app-check` — a DEFERRED mirror of `firebase/app-check`.
+ * `pyric/app-check`: the sandbox mirror of `firebase/app-check`.
  *
- * App Check attests that a request comes from your app, via reCAPTCHA or a
- * custom attestation provider talking to Google infrastructure. The sandbox
- * has no attestation authority to model against, so the whole surface is
- * deferred.
+ * The sandbox has no attestation authority, so it behaves like production
+ * under a registered debug token: providers are accepted and never called,
+ * and every token request succeeds with a token of production's shape. The
+ * conformance rows are in packages/conformance/registry/app-check.ts and the
+ * suite in packages/pyric/test/app-check/oracle-conformance.test.ts.
  *
- * Every symbol below resolves and links so an app that swaps `firebase` for
- * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
- * subpath. See `../deferred/entry.ts` for the full rationale.
- *
- * The value list is the exact public runtime surface of `firebase/app-check`
- * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
- * real mirror.
+ * The value surface is exactly `firebase/app-check` 12.13.0's.
  */
-import { deferredEntry } from '../deferred/entry.js';
-export { PyricDeferredApiError } from '../deferred/entry.js';
-export const { CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider, getLimitedUseToken, getToken, initializeAppCheck, onTokenChanged, setTokenAutoRefreshEnabled, } = deferredEntry('app-check');
+import { getApp } from '../app/registry.js';
+import { appCheckError } from './errors.js';
+import { CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider, sameProvider } from './providers.js';
+import { activate, addObserver, cachedOrMint, mintLimitedUse, stateOf, } from './state.js';
+export { CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider };
+class AppCheckHandle {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+}
+const handles = new WeakMap();
+function hasSameOptions(state, options) {
+    const refresh = options.isTokenAutoRefreshEnabled ?? false;
+    return state.initialAutoRefresh === refresh && sameProvider(state.provider, options.provider);
+}
+export function initializeAppCheck(app, options) {
+    const target = app ?? getApp();
+    const existing = stateOf(target);
+    if (existing) {
+        if (!hasSameOptions(existing, options))
+            throw appCheckError('already-initialized', target.name);
+        return handles.get(target);
+    }
+    activate(target, options.provider, options.isTokenAutoRefreshEnabled ?? false);
+    const handle = new AppCheckHandle(target);
+    handles.set(target, handle);
+    return handle;
+}
+function activeState(appCheck) {
+    const state = stateOf(appCheck.app);
+    if (!state)
+        throw appCheckError('use-before-activation', appCheck.app.name);
+    return state;
+}
+export async function getToken(appCheck, forceRefresh = false) {
+    const state = activeState(appCheck);
+    return cachedOrMint(appCheck.app, state, forceRefresh);
+}
+export async function getLimitedUseToken(appCheck) {
+    activeState(appCheck);
+    return mintLimitedUse(appCheck.app);
+}
+export function setTokenAutoRefreshEnabled(appCheck, isTokenAutoRefreshEnabled) {
+    activeState(appCheck).isTokenAutoRefreshEnabled = isTokenAutoRefreshEnabled;
+}
+function toObserver(onNextOrObserver, onError, onCompletion) {
+    if (typeof onNextOrObserver === 'function') {
+        return { next: onNextOrObserver, error: onError, complete: onCompletion };
+    }
+    return { next: onNextOrObserver.next ?? (() => { }), error: onNextOrObserver.error, complete: onNextOrObserver.complete };
+}
+export function onTokenChanged(appCheck, onNextOrObserver, onError, onCompletion) {
+    return addObserver(activeState(appCheck), toObserver(onNextOrObserver, onError, onCompletion));
+}
 //# sourceMappingURL=index.js.map

package/dist/app-check/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,EACX,cAAc,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,kBAAkB,EACpF,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,0BAA0B,GACzE,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app-check/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,YAAY,EAAyB,MAAM,gBAAgB,CAAC;AACvI,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,cAAc,EACd,OAAO,GAIR,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,CAAC;AAqB5E,MAAM,cAAc;IACG;IAArB,YAAqB,GAAgB;QAAhB,QAAG,GAAH,GAAG,CAAa;IAAG,CAAC;CAC1C;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAA+B,CAAC;AAE3D,SAAS,cAAc,CAAC,KAAoB,EAAE,OAAwB;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,yBAAyB,IAAI,KAAK,CAAC;IAC3D,OAAO,KAAK,CAAC,kBAAkB,KAAK,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAA4B,EAAE,OAAwB;IACvF,MAAM,MAAM,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,MAAM,aAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;IAC9B,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,yBAAyB,IAAI,KAAK,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,aAAa,CAAC,uBAAuB,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,YAAY,GAAG,KAAK;IACrE,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtB,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAkB,EAAE,yBAAkC;IAC/F,WAAW,CAAC,QAAQ,CAAC,CAAC,yBAAyB,GAAG,yBAAyB,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CACjB,gBAA8E,EAC9E,OAAgC,EAChC,YAAyB;IAEzB,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC;AAC3H,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,gBAA8E,EAC9E,OAAgC,EAChC,YAAyB;IAEzB,OAAO,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACjG,CAAC"}

package/dist/app-check/providers.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The three attestation providers. The sandbox has no attestation service, so
+ * it never calls a provider, as production never does under a debug token
+ * (capture `app-check-client-debug-get-token`, `customProviderCalls: 0`).
+ * `isEqual` decides whether a second `initializeAppCheck` has the same options.
+ */
+export interface AppCheckTokenFromProvider {
+    readonly token: string;
+    readonly expireTimeMillis: number;
+}
+export interface CustomProviderOptions {
+    getToken: () => Promise<AppCheckTokenFromProvider>;
+}
+interface ComparableProvider {
+    isEqual(other: unknown): boolean;
+}
+export declare class ReCaptchaV3Provider implements ComparableProvider {
+    private readonly siteKey;
+    constructor(siteKey: string);
+    isEqual(other: unknown): boolean;
+}
+export declare class ReCaptchaEnterpriseProvider implements ComparableProvider {
+    private readonly siteKey;
+    constructor(siteKey: string);
+    isEqual(other: unknown): boolean;
+}
+export declare class CustomProvider implements ComparableProvider {
+    private readonly options;
+    constructor(options: CustomProviderOptions);
+    /** Upstream compares the getToken functions by source text, so a provider rebuilt by the same factory is equal. */
+    isEqual(other: unknown): boolean;
+}
+export type AppCheckProvider = ReCaptchaV3Provider | ReCaptchaEnterpriseProvider | CustomProvider;
+export declare function sameProvider(a: AppCheckProvider, b: AppCheckProvider): boolean;
+export {};
+//# sourceMappingURL=providers.d.ts.map

package/dist/app-check/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/app-check/providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACpD;AAED,UAAU,kBAAkB;IAC1B,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAClC;AAED,qBAAa,mBAAoB,YAAW,kBAAkB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM;IAC5C,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CAGjC;AAED,qBAAa,2BAA4B,YAAW,kBAAkB;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM;IAC5C,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CAGjC;AAED,qBAAa,cAAe,YAAW,kBAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,qBAAqB;IAC3D,mHAAmH;IACnH,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CAGjC;AAED,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,2BAA2B,GAAG,cAAc,CAAC;AAElG,wBAAgB,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAE9E"}

package/dist/app-check/providers.js

@@ -0,0 +1,32 @@
+export class ReCaptchaV3Provider {
+    siteKey;
+    constructor(siteKey) {
+        this.siteKey = siteKey;
+    }
+    isEqual(other) {
+        return other instanceof ReCaptchaV3Provider && other.siteKey === this.siteKey;
+    }
+}
+export class ReCaptchaEnterpriseProvider {
+    siteKey;
+    constructor(siteKey) {
+        this.siteKey = siteKey;
+    }
+    isEqual(other) {
+        return other instanceof ReCaptchaEnterpriseProvider && other.siteKey === this.siteKey;
+    }
+}
+export class CustomProvider {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /** Upstream compares the getToken functions by source text, so a provider rebuilt by the same factory is equal. */
+    isEqual(other) {
+        return other instanceof CustomProvider && String(other.options.getToken) === String(this.options.getToken);
+    }
+}
+export function sameProvider(a, b) {
+    return a.isEqual(b);
+}
+//# sourceMappingURL=providers.js.map

package/dist/app-check/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../src/app-check/providers.ts"],"names":[],"mappings":"AAmBA,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAChD,OAAO,CAAC,KAAc;QACpB,OAAO,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC;IAChF,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IACT;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAChD,OAAO,CAAC,KAAc;QACpB,OAAO,KAAK,YAAY,2BAA2B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC;IACxF,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAC/D,mHAAmH;IACnH,OAAO,CAAC,KAAc;QACpB,OAAO,KAAK,YAAY,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7G,CAAC;CACF;AAID,MAAM,UAAU,YAAY,CAAC,CAAmB,EAAE,CAAmB;IACnE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC"}

package/dist/app-check/state.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Per-app App Check state: the activation options, the cached token, and the
+ * token listeners. Keyed by the app object, as upstream keys it.
+ */
+import type { FirebaseApp } from '../app/types.js';
+import { type MintedAppCheckToken as MintedToken } from '../sandbox/internal/app-check-token.js';
+import type { AppCheckProvider } from './providers.js';
+export interface AppCheckTokenResult {
+    readonly token: string;
+}
+export interface TokenObserver {
+    next: (result: AppCheckTokenResult) => void;
+    error?: (error: Error) => void;
+    complete?: () => void;
+}
+export interface AppCheckState {
+    provider: AppCheckProvider;
+    /** The option `initializeAppCheck` was called with; a later call is compared with this. */
+    readonly initialAutoRefresh: boolean;
+    isTokenAutoRefreshEnabled: boolean;
+    cached: MintedToken | null;
+    observers: Set<TokenObserver>;
+}
+export declare function stateOf(app: FirebaseApp): AppCheckState | undefined;
+export declare function activate(app: FirebaseApp, provider: AppCheckProvider, isTokenAutoRefreshEnabled: boolean): AppCheckState;
+export declare function cachedOrMint(app: FirebaseApp, state: AppCheckState, forceRefresh: boolean): Promise<AppCheckTokenResult>;
+export declare function mintLimitedUse(app: FirebaseApp): Promise<AppCheckTokenResult>;
+export declare function addObserver(state: AppCheckState, observer: TokenObserver): () => void;
+//# sourceMappingURL=state.d.ts.map

package/dist/app-check/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/app-check/state.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAqB,KAAK,mBAAmB,IAAI,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAIpH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,yBAAyB,EAAE,OAAO,CAAC;IACnC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;CAC/B;AAID,wBAAgB,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,aAAa,GAAG,SAAS,CAEnE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,OAAO,GAAG,aAAa,CAIxH;AAkBD,wBAAsB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAQ9H;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEnF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI,CAMrF"}

package/dist/app-check/state.js

@@ -0,0 +1,47 @@
+import { mintAppCheckToken } from '../sandbox/internal/app-check-token.js';
+/** Web App Check tokens live one hour (capture `app-check-client-debug-get-token`). */
+const TTL_SECONDS = 3600;
+const states = new WeakMap();
+export function stateOf(app) {
+    return states.get(app);
+}
+export function activate(app, provider, isTokenAutoRefreshEnabled) {
+    const state = { provider, initialAutoRefresh: isTokenAutoRefreshEnabled, isTokenAutoRefreshEnabled, cached: null, observers: new Set() };
+    states.set(app, state);
+    return state;
+}
+function identityOf(app) {
+    const options = app.options;
+    return { appId: options.appId ?? '', projectId: options.projectId ?? '' };
+}
+/** Delivers a token to observers off the caller's stack, as the SDK does. */
+function notify(observers, result) {
+    for (const observer of observers) {
+        queueMicrotask(() => observer.next(result));
+    }
+}
+function isValid(token, nowMillis) {
+    return token !== null && token.expireTimeMillis > nowMillis;
+}
+export async function cachedOrMint(app, state, forceRefresh) {
+    const now = Date.now();
+    const reuse = !forceRefresh && isValid(state.cached, now);
+    if (reuse)
+        return { token: state.cached.token };
+    state.cached = await mintAppCheckToken(identityOf(app), TTL_SECONDS, now);
+    const result = { token: state.cached.token };
+    notify(state.observers, result);
+    return result;
+}
+export async function mintLimitedUse(app) {
+    return { token: (await mintAppCheckToken(identityOf(app), TTL_SECONDS)).token };
+}
+export function addObserver(state, observer) {
+    state.observers.add(observer);
+    if (isValid(state.cached, Date.now()))
+        notify([observer], { token: state.cached.token });
+    return () => {
+        state.observers.delete(observer);
+    };
+}
+//# sourceMappingURL=state.js.map

package/dist/app-check/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/app-check/state.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAA2C,MAAM,wCAAwC,CAAC;AAEpH,uFAAuF;AACvF,MAAM,WAAW,GAAG,IAAI,CAAC;AAsBzB,MAAM,MAAM,GAAG,IAAI,OAAO,EAA8B,CAAC;AAEzD,MAAM,UAAU,OAAO,CAAC,GAAgB;IACtC,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAgB,EAAE,QAA0B,EAAE,yBAAkC;IACvG,MAAM,KAAK,GAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACxJ,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAiD,CAAC;IACtE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,6EAA6E;AAC7E,SAAS,MAAM,CAAC,SAAkC,EAAE,MAA2B;IAC7E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,cAAc,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB,EAAE,SAAiB;IAC3D,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,KAAoB,EAAE,YAAqB;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAO,CAAC,KAAK,EAAE,CAAC;IACjD,KAAK,CAAC,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAgB;IACnD,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAoB,EAAE,QAAuB;IACvE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,GAAG,EAAE;QACV,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC"}

package/dist/deferred/entry.d.ts

@@ -1,6 +1,6 @@
 /**
  * The shared factory behind pyric's *deferred* Firebase Web SDK subpaths —
- * `pyric/functions`, `pyric/analytics`, `pyric/app-check`,
+ * `pyric/functions`, `pyric/analytics`,
  * `pyric/firestore/lite`, `pyric/performance` and `pyric/remote-config`.
  *
  * WHY THESE EXIST AT ALL. pyric is a symbol-for-symbol drop-in for the

package/dist/deferred/entry.js

@@ -1,6 +1,6 @@
 /**
  * The shared factory behind pyric's *deferred* Firebase Web SDK subpaths —
- * `pyric/functions`, `pyric/analytics`, `pyric/app-check`,
+ * `pyric/functions`, `pyric/analytics`,
  * `pyric/firestore/lite`, `pyric/performance` and `pyric/remote-config`.
  *
  * WHY THESE EXIST AT ALL. pyric is a symbol-for-symbol drop-in for the

package/dist/sandbox/internal/app-check-token.d.ts

@@ -0,0 +1,46 @@
+export interface AppCheckIdentity {
+    appId: string;
+    projectId: string;
+}
+export interface AppCheckTokenClaims {
+    sub: string;
+    aud: string[];
+    provider: string;
+    iss: string;
+    exp: number;
+    iat: number;
+    jti: string;
+    [claim: string]: unknown;
+}
+export interface MintedAppCheckToken {
+    token: string;
+    expireTimeMillis: number;
+}
+/** The project number a Firebase app id carries: `1:<projectNumber>:<platform>:<hash>`. */
+export declare function appCheckProjectNumber(appId: string): string;
+export declare function mintAppCheckToken(identity: AppCheckIdentity, ttlSeconds: number, nowMillis?: number): Promise<MintedAppCheckToken>;
+/** Signs any header and claims with the sandbox key. Minting uses it; tests use it to build tokens production could not issue. */
+export declare function signAppCheckToken(header: Record<string, unknown>, claims: Record<string, unknown>): Promise<string>;
+/** A decoded token's header and claims, unchecked: any field may be missing or of any type. */
+export interface AppCheckTokenParts {
+    header: Readonly<Record<string, unknown>>;
+    claims: Readonly<Record<string, unknown>>;
+}
+export type AppCheckTokenCheck = ({
+    ok: true;
+} & AppCheckTokenParts) | ({
+    ok: false;
+    reason: 'kid' | 'signature';
+} & AppCheckTokenParts) | {
+    ok: false;
+    reason: 'malformed';
+};
+/**
+ * Decodes a sandbox token and checks its key and signature, in
+ * firebase-admin's order: a `kid` must name the sandbox key, and a token with
+ * no `kid` is checked against it, as firebase-admin tries every key. The
+ * decoded header and claims come back whenever the token decodes; `alg`,
+ * audience, subject and expiry are the caller's rules.
+ */
+export declare function checkAppCheckToken(token: string): Promise<AppCheckTokenCheck>;
+//# sourceMappingURL=app-check-token.d.ts.map

package/dist/sandbox/internal/app-check-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-token.d.ts","sourceRoot":"","sources":["../../../src/sandbox/internal/app-check-token.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAuDD,2FAA2F;AAC3F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,MAAmB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAe9B;AAED,kIAAkI;AAClI,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzH;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,kBAAkB,GAC1B,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,kBAAkB,CAAC,GACnC,CAAC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,GAAG,kBAAkB,CAAC,GACjE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmBnF"}

package/dist/sandbox/internal/app-check-token.js

@@ -0,0 +1,125 @@
+/**
+ * Sandbox App Check tokens, shared by the web mirror (`pyric/app-check`) and
+ * the admin mirror (`pyric-admin/app-check`) so a token minted on either plane
+ * verifies on the other, as production's do (capture
+ * `app-check-admin-verify-token`, `debugExchanged`).
+ *
+ * Shape (captures `app-check-client-debug-get-token`,
+ * `app-check-admin-create-token-shape`): a three-segment JWT, header `alg`
+ * RS256, `typ` JWT, a `kid`; claims `aud`, `exp`, `iat`, `iss`, `jti`,
+ * `provider`, `sub`; `iss` and `aud` name the project number from the app id.
+ *
+ * The signature is not RSA. It is a 256-byte SHA-256 expansion over the
+ * signing input and a fixed sandbox key, the length of a real RS256
+ * signature, so any edit to the header, payload, or signature fails
+ * verification. It is not a security boundary: anyone can mint one.
+ */
+const ISSUER = 'https://firebaseappcheck.googleapis.com';
+const SANDBOX_KID = 'pyric-sandbox';
+const SANDBOX_KEY = 'pyric-sandbox-app-check-signing-key';
+const SIGNATURE_BLOCKS = 8;
+function base64url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** jws `JWS_REGEX`: base64url characters only, header and payload non-empty, signature optional. */
+const JWS_SHAPE = /^[a-zA-Z0-9\-_]+?\.[a-zA-Z0-9\-_]+?\.([a-zA-Z0-9\-_]+)?$/;
+/** A base64url segment as Latin-1 text, one character per byte, as jws reads a header (`toString('binary')`). */
+function latin1FromBase64url(text) {
+    const padded = text.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(text.length / 4) * 4, '=');
+    return atob(padded);
+}
+/**
+ * A base64url segment as UTF-8, as jws reads a payload (`toString('utf8')`):
+ * the inverse of {@link encodeJson}, with invalid bytes replaced by U+FFFD as
+ * Buffer does. Uses `atob` and `TextDecoder` only, so it runs the same in a
+ * browser or worker.
+ */
+function utf8FromBase64url(text) {
+    const binary = latin1FromBase64url(text);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index++)
+        bytes[index] = binary.charCodeAt(index);
+    return new TextDecoder('utf-8').decode(bytes);
+}
+function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function encodeJson(value) {
+    return base64url(new TextEncoder().encode(JSON.stringify(value)));
+}
+function randomId() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return base64url(bytes);
+}
+async function sandboxSignature(signingInput) {
+    const blocks = [];
+    for (let block = 0; block < SIGNATURE_BLOCKS; block++) {
+        const data = new TextEncoder().encode(`${block}.${SANDBOX_KEY}.${signingInput}`);
+        blocks.push(new Uint8Array(await crypto.subtle.digest('SHA-256', data)));
+    }
+    const out = new Uint8Array(blocks.length * 32);
+    blocks.forEach((bytes, index) => out.set(bytes, index * 32));
+    return base64url(out);
+}
+/** The project number a Firebase app id carries: `1:<projectNumber>:<platform>:<hash>`. */
+export function appCheckProjectNumber(appId) {
+    return appId.split(':')[1] ?? '';
+}
+export async function mintAppCheckToken(identity, ttlSeconds, nowMillis = Date.now()) {
+    const iat = Math.floor(nowMillis / 1000);
+    const exp = iat + ttlSeconds;
+    const projectNumber = appCheckProjectNumber(identity.appId);
+    const claims = {
+        sub: identity.appId,
+        aud: [`projects/${projectNumber}`, `projects/${identity.projectId}`],
+        provider: 'pyric-sandbox',
+        iss: `${ISSUER}/${projectNumber}`,
+        exp,
+        iat,
+        jti: randomId(),
+    };
+    const token = await signAppCheckToken({ alg: 'RS256', kid: SANDBOX_KID, typ: 'JWT' }, claims);
+    return { token, expireTimeMillis: exp * 1000 };
+}
+/** Signs any header and claims with the sandbox key. Minting uses it; tests use it to build tokens production could not issue. */
+export async function signAppCheckToken(header, claims) {
+    const signingInput = `${encodeJson(header)}.${encodeJson(claims)}`;
+    return `${signingInput}.${await sandboxSignature(signingInput)}`;
+}
+/**
+ * Decodes a sandbox token and checks its key and signature, in
+ * firebase-admin's order: a `kid` must name the sandbox key, and a token with
+ * no `kid` is checked against it, as firebase-admin tries every key. The
+ * decoded header and claims come back whenever the token decodes; `alg`,
+ * audience, subject and expiry are the caller's rules.
+ */
+export async function checkAppCheckToken(token) {
+    if (!JWS_SHAPE.test(token))
+        return { ok: false, reason: 'malformed' };
+    const segments = token.split('.');
+    let header;
+    let claims;
+    try {
+        header = JSON.parse(latin1FromBase64url(segments[0]));
+        claims = JSON.parse(utf8FromBase64url(segments[1]));
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (!isJsonObject(header) || !isJsonObject(claims))
+        return { ok: false, reason: 'malformed' };
+    const decoded = { header, claims };
+    // jwt.js getKeyCallback: a falsy kid means "no kid", and every key is tried.
+    const kidNamesNoKey = Boolean(header.kid) && header.kid !== SANDBOX_KID;
+    if (kidNamesNoKey)
+        return { ok: false, reason: 'kid', ...decoded };
+    const expected = await sandboxSignature(`${segments[0]}.${segments[1]}`);
+    if (segments[2] !== expected)
+        return { ok: false, reason: 'signature', ...decoded };
+    return { ok: true, ...decoded };
+}
+//# sourceMappingURL=app-check-token.js.map

package/dist/sandbox/internal/app-check-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-token.js","sourceRoot":"","sources":["../../../src/sandbox/internal/app-check-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,GAAG,yCAAyC,CAAC;AACzD,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAuB3B,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,oGAAoG;AACpG,MAAM,SAAS,GAAG,0DAA0D,CAAC;AAE7E,iHAAiH;AACjH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5F,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IAClD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gBAAgB,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA0B,EAC1B,UAAkB,EAClB,YAAoB,IAAI,CAAC,GAAG,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7B,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,QAAQ,CAAC,KAAK;QACnB,GAAG,EAAE,CAAC,YAAY,aAAa,EAAE,EAAE,YAAY,QAAQ,CAAC,SAAS,EAAE,CAAC;QACpE,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,GAAG,MAAM,IAAI,aAAa,EAAE;QACjC,GAAG;QACH,GAAG;QACH,GAAG,EAAE,QAAQ,EAAE;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9F,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,kIAAkI;AAClI,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAA+B,EAAE,MAA+B;IACtG,MAAM,YAAY,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACnE,OAAO,GAAG,YAAY,IAAI,MAAM,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;AACnE,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAe,CAAC;IACpB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9F,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,CAAC;IACxE,IAAI,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;IACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;AAClC,CAAC"}

package/dist/sandbox/internal/index.d.ts

@@ -77,4 +77,5 @@ export { UNNAMED_DEFAULT_DATABASE_INSTANCE, createDatabaseInstanceRegistry, data
 export { DEFAULT_DATABASE_RULES_FILE, databaseRulesConfig, type DatabaseRulesConfig, type DatabaseRulesConfigOptions, type DatabaseRulesFileTarget, type UnresolvedDatabaseRulesTarget, } from './database-rules-config.js';
 export { parsePyricSandbox, isRemoteActivation, type PyricSandboxActivation } from './sandbox-activation.js';
 export { clearProcessActivation, installProcessActivation, onProcessActivationEnd, processActivation, type ProcessActivation, } from './process-activation.js';
+export { appCheckProjectNumber, checkAppCheckToken, mintAppCheckToken, signAppCheckToken, type AppCheckIdentity, type AppCheckTokenCheck, type AppCheckTokenClaims, type AppCheckTokenParts, type MintedAppCheckToken, } from './app-check-token.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/sandbox/internal/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sandbox/internal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAClJ,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EACL,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,EAAE,oBAAoB,EAC1G,KAAK,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAC/E,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,GACvG,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC1H,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,yBAAyB,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,SAAS,EACT,KAAK,iBAAiB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAiB3B,cAAc,8CAA8C,CAAC;AAC7D,OAAO,EACL,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,WAAW,IAAI,qBAAqB,EACzC,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,YAAY,GAClB,MAAM,wCAAwC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,kDAAkD,CAAC;AACjE,cAAc,sDAAsD,CAAC;AACrE,cAAc,+CAA+C,CAAC;AAI9D,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAC9G,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAK/E,cAAc,yCAAyC,CAAC;AAWxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAChI,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,GAC9C,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG/D,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,GACnC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sandbox/internal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAClJ,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EACL,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,EAAE,oBAAoB,EAC1G,KAAK,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAC/E,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,GACvG,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC1H,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,yBAAyB,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,SAAS,EACT,KAAK,iBAAiB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAiB3B,cAAc,8CAA8C,CAAC;AAC7D,OAAO,EACL,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,WAAW,IAAI,qBAAqB,EACzC,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,YAAY,GAClB,MAAM,wCAAwC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,kDAAkD,CAAC;AACjE,cAAc,sDAAsD,CAAC;AACrE,cAAc,+CAA+C,CAAC;AAI9D,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAC9G,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAK/E,cAAc,yCAAyC,CAAC;AAWxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAChI,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,GAC9C,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG/D,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,GACnC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC"}

package/dist/sandbox/internal/index.js

@@ -118,4 +118,5 @@ export { UNNAMED_DEFAULT_DATABASE_INSTANCE, createDatabaseInstanceRegistry, data
 export { DEFAULT_DATABASE_RULES_FILE, databaseRulesConfig, } from './database-rules-config.js';
 export { parsePyricSandbox, isRemoteActivation } from './sandbox-activation.js';
 export { clearProcessActivation, installProcessActivation, onProcessActivationEnd, processActivation, } from './process-activation.js';
+export { appCheckProjectNumber, checkAppCheckToken, mintAppCheckToken, signAppCheckToken, } from './app-check-token.js';
 //# sourceMappingURL=index.js.map

package/dist/sandbox/internal/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sandbox/internal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,GAEhC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAsC,MAAM,uCAAuC,CAAC;AAElJ,OAAO,EACL,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,EAAE,oBAAoB,GAG3G,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,WAAW,GAKZ,MAAM,mBAAmB,CAAC;AAC3B,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GAExB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,GAKZ,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,GAErB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,SAAS,GAEV,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,oEAAoE;AACpE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,iEAAiE;AACjE,iEAAiE;AACjE,oEAAoE;AACpE,gEAAgE;AAChE,8BAA8B;AAC9B,EAAE;AACF,iEAAiE;AACjE,oDAAoD;AACpD,iEAAiE;AACjE,0DAA0D;AAC1D,gEAAgE;AAChE,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,kBAAkB;AAClB,cAAc,8CAA8C,CAAC;AAC7D,OAAO,EACL,UAAU,GAOX,MAAM,wCAAwC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,kDAAkD,CAAC;AACjE,cAAc,sDAAsD,CAAC;AACrE,cAAc,+CAA+C,CAAC;AAC9D,4EAA4E;AAC5E,6EAA6E;AAC7E,6BAA6B;AAC7B,OAAO,EAAE,gBAAgB,EAA0B,MAAM,oDAAoD,CAAC;AAC9G,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAC/E,iEAAiE;AACjE,6DAA6D;AAC7D,kEAAkE;AAClE,WAAW;AACX,cAAc,yCAAyC,CAAC;AAExD,iEAAiE;AACjE,mEAAmE;AACnE,qEAAqE;AACrE,4DAA4D;AAC5D,+DAA+D;AAC/D,oEAAoE;AACpE,iEAAiE;AACjE,+DAA+D;AAC/D,0BAA0B;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,GAEjI,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC/D,wEAAwE;AACxE,mFAAmF;AACnF,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,GAIxB,MAAM,gBAAgB,CAAC;AACxB,+EAA+E;AAC/E,sDAAsD;AACtD,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GAKpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAA+B,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sandbox/internal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,GAEhC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAsC,MAAM,uCAAuC,CAAC;AAElJ,OAAO,EACL,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,YAAY,EAAE,oBAAoB,GAG3G,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,WAAW,GAKZ,MAAM,mBAAmB,CAAC;AAC3B,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GAExB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,GAKZ,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,GAErB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,SAAS,GAEV,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,oEAAoE;AACpE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,0EAA0E;AAC1E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,iEAAiE;AACjE,iEAAiE;AACjE,oEAAoE;AACpE,gEAAgE;AAChE,8BAA8B;AAC9B,EAAE;AACF,iEAAiE;AACjE,oDAAoD;AACpD,iEAAiE;AACjE,0DAA0D;AAC1D,gEAAgE;AAChE,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,kBAAkB;AAClB,cAAc,8CAA8C,CAAC;AAC7D,OAAO,EACL,UAAU,GAOX,MAAM,wCAAwC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,kDAAkD,CAAC;AACjE,cAAc,sDAAsD,CAAC;AACrE,cAAc,+CAA+C,CAAC;AAC9D,4EAA4E;AAC5E,6EAA6E;AAC7E,6BAA6B;AAC7B,OAAO,EAAE,gBAAgB,EAA0B,MAAM,oDAAoD,CAAC;AAC9G,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAC/E,iEAAiE;AACjE,6DAA6D;AAC7D,kEAAkE;AAClE,WAAW;AACX,cAAc,yCAAyC,CAAC;AAExD,iEAAiE;AACjE,mEAAmE;AACnE,qEAAqE;AACrE,4DAA4D;AAC5D,+DAA+D;AAC/D,oEAAoE;AACpE,iEAAiE;AACjE,+DAA+D;AAC/D,0BAA0B;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,GAEjI,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC/D,wEAAwE;AACxE,mFAAmF;AACnF,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,GAIxB,MAAM,gBAAgB,CAAC;AACxB,+EAA+E;AAC/E,sDAAsD;AACtD,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GAKpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAA+B,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAMlB,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyric",
-  "version": "0.1.0-alpha.29",
+  "version": "0.1.0-alpha.30.1",
   "license": "Apache-2.0",
   "homepage": "https://pyric.dev",
   "repository": {

package/src/app-check/errors.ts

@@ -0,0 +1,20 @@
+/**
+ * App Check errors with the codes, messages, and customData production
+ * throws (captures `app-check-client-initialize-twice` and
+ * `app-check-client-get-token-before-initialize`).
+ */
+import { FirebaseError } from '../sandbox/internal/firebase-error.js';
+
+const MESSAGES = {
+  'already-initialized': (appName: string) =>
+    `You have already called initializeAppCheck() for FirebaseApp ${appName} with different options. To avoid this error, call initializeAppCheck() with the same options as when it was originally called. This will return the already initialized instance.`,
+  'use-before-activation': (appName: string) =>
+    `App Check is being used before initializeAppCheck() is called for FirebaseApp ${appName}. Call initializeAppCheck() before instantiating other Firebase services.`,
+} as const;
+
+export type AppCheckErrorCode = keyof typeof MESSAGES;
+
+export function appCheckError(code: AppCheckErrorCode, appName: string): FirebaseError {
+  const fullCode = `appCheck/${code}`;
+  return new FirebaseError(fullCode, `AppCheck: ${MESSAGES[code](appName)} (${fullCode}).`, { appName });
+}

package/src/app-check/index.ts

@@ -1,41 +1,110 @@
 /**
- * `pyric/app-check` — a DEFERRED mirror of `firebase/app-check`.
+ * `pyric/app-check`: the sandbox mirror of `firebase/app-check`.
  *
- * App Check attests that a request comes from your app, via reCAPTCHA or a
- * custom attestation provider talking to Google infrastructure. The sandbox
- * has no attestation authority to model against, so the whole surface is
- * deferred.
+ * The sandbox has no attestation authority, so it behaves like production
+ * under a registered debug token: providers are accepted and never called,
+ * and every token request succeeds with a token of production's shape. The
+ * conformance rows are in packages/conformance/registry/app-check.ts and the
+ * suite in packages/pyric/test/app-check/oracle-conformance.test.ts.
  *
- * Every symbol below resolves and links so an app that swaps `firebase` for
- * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
- * subpath. See `../deferred/entry.ts` for the full rationale.
- *
- * The value list is the exact public runtime surface of `firebase/app-check`
- * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
- * real mirror.
+ * The value surface is exactly `firebase/app-check` 12.13.0's.
  */
-import { deferredEntry, type DeferredApi } from '../deferred/entry.js';
-
-export { PyricDeferredApiError } from '../deferred/entry.js';
-
-export const {
-  CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider, getLimitedUseToken,
-  getToken, initializeAppCheck, onTokenChanged, setTokenAutoRefreshEnabled,
-} = deferredEntry('app-check');
-
-// Type declarations. Aliased to the deferred placeholder so a consumer's own
-// annotations keep type-checking: every deferred call returns `never`, which is
-// assignable to any of these. Names that Firebase exports as a CLASS appear both
-// here and above — a class is a value and a type, and both meanings must survive
-// the swap.
-export type AppCheck = DeferredApi;
-export type AppCheckOptions = DeferredApi;
-export type AppCheckToken = DeferredApi;
-export type AppCheckTokenListener = DeferredApi;
-export type AppCheckTokenResult = DeferredApi;
-export type CustomProvider = DeferredApi;
-export type CustomProviderOptions = DeferredApi;
-export type PartialObserver = DeferredApi;
-export type ReCaptchaEnterpriseProvider = DeferredApi;
-export type ReCaptchaV3Provider = DeferredApi;
-export type Unsubscribe = DeferredApi;
+import { getApp } from '../app/registry.js';
+import type { FirebaseApp } from '../app/types.js';
+import { appCheckError } from './errors.js';
+import { CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider, sameProvider, type AppCheckProvider } from './providers.js';
+import {
+  activate,
+  addObserver,
+  cachedOrMint,
+  mintLimitedUse,
+  stateOf,
+  type AppCheckState,
+  type AppCheckTokenResult,
+  type TokenObserver,
+} from './state.js';
+
+export { CustomProvider, ReCaptchaEnterpriseProvider, ReCaptchaV3Provider };
+export type { CustomProviderOptions, AppCheckTokenFromProvider as AppCheckToken } from './providers.js';
+export type { AppCheckTokenResult } from './state.js';
+
+export interface AppCheck {
+  readonly app: FirebaseApp;
+}
+
+export interface AppCheckOptions {
+  provider: AppCheckProvider;
+  isTokenAutoRefreshEnabled?: boolean;
+}
+
+export type AppCheckTokenListener = (token: AppCheckTokenResult) => void;
+export type Unsubscribe = () => void;
+export interface PartialObserver<T> {
+  next?: (value: T) => void;
+  error?: (error: Error) => void;
+  complete?: () => void;
+}
+
+class AppCheckHandle implements AppCheck {
+  constructor(readonly app: FirebaseApp) {}
+}
+
+const handles = new WeakMap<FirebaseApp, AppCheckHandle>();
+
+function hasSameOptions(state: AppCheckState, options: AppCheckOptions): boolean {
+  const refresh = options.isTokenAutoRefreshEnabled ?? false;
+  return state.initialAutoRefresh === refresh && sameProvider(state.provider, options.provider);
+}
+
+export function initializeAppCheck(app: FirebaseApp | undefined, options: AppCheckOptions): AppCheck {
+  const target = app ?? getApp();
+  const existing = stateOf(target);
+  if (existing) {
+    if (!hasSameOptions(existing, options)) throw appCheckError('already-initialized', target.name);
+    return handles.get(target)!;
+  }
+  activate(target, options.provider, options.isTokenAutoRefreshEnabled ?? false);
+  const handle = new AppCheckHandle(target);
+  handles.set(target, handle);
+  return handle;
+}
+
+function activeState(appCheck: AppCheck): AppCheckState {
+  const state = stateOf(appCheck.app);
+  if (!state) throw appCheckError('use-before-activation', appCheck.app.name);
+  return state;
+}
+
+export async function getToken(appCheck: AppCheck, forceRefresh = false): Promise<AppCheckTokenResult> {
+  const state = activeState(appCheck);
+  return cachedOrMint(appCheck.app, state, forceRefresh);
+}
+
+export async function getLimitedUseToken(appCheck: AppCheck): Promise<AppCheckTokenResult> {
+  activeState(appCheck);
+  return mintLimitedUse(appCheck.app);
+}
+
+export function setTokenAutoRefreshEnabled(appCheck: AppCheck, isTokenAutoRefreshEnabled: boolean): void {
+  activeState(appCheck).isTokenAutoRefreshEnabled = isTokenAutoRefreshEnabled;
+}
+
+function toObserver(
+  onNextOrObserver: AppCheckTokenListener | PartialObserver<AppCheckTokenResult>,
+  onError?: (error: Error) => void,
+  onCompletion?: () => void,
+): TokenObserver {
+  if (typeof onNextOrObserver === 'function') {
+    return { next: onNextOrObserver, error: onError, complete: onCompletion };
+  }
+  return { next: onNextOrObserver.next ?? (() => {}), error: onNextOrObserver.error, complete: onNextOrObserver.complete };
+}
+
+export function onTokenChanged(
+  appCheck: AppCheck,
+  onNextOrObserver: AppCheckTokenListener | PartialObserver<AppCheckTokenResult>,
+  onError?: (error: Error) => void,
+  onCompletion?: () => void,
+): Unsubscribe {
+  return addObserver(activeState(appCheck), toObserver(onNextOrObserver, onError, onCompletion));
+}

package/src/app-check/providers.ts

@@ -0,0 +1,46 @@
+/**
+ * The three attestation providers. The sandbox has no attestation service, so
+ * it never calls a provider, as production never does under a debug token
+ * (capture `app-check-client-debug-get-token`, `customProviderCalls: 0`).
+ * `isEqual` decides whether a second `initializeAppCheck` has the same options.
+ */
+export interface AppCheckTokenFromProvider {
+  readonly token: string;
+  readonly expireTimeMillis: number;
+}
+
+export interface CustomProviderOptions {
+  getToken: () => Promise<AppCheckTokenFromProvider>;
+}
+
+interface ComparableProvider {
+  isEqual(other: unknown): boolean;
+}
+
+export class ReCaptchaV3Provider implements ComparableProvider {
+  constructor(private readonly siteKey: string) {}
+  isEqual(other: unknown): boolean {
+    return other instanceof ReCaptchaV3Provider && other.siteKey === this.siteKey;
+  }
+}
+
+export class ReCaptchaEnterpriseProvider implements ComparableProvider {
+  constructor(private readonly siteKey: string) {}
+  isEqual(other: unknown): boolean {
+    return other instanceof ReCaptchaEnterpriseProvider && other.siteKey === this.siteKey;
+  }
+}
+
+export class CustomProvider implements ComparableProvider {
+  constructor(private readonly options: CustomProviderOptions) {}
+  /** Upstream compares the getToken functions by source text, so a provider rebuilt by the same factory is equal. */
+  isEqual(other: unknown): boolean {
+    return other instanceof CustomProvider && String(other.options.getToken) === String(this.options.getToken);
+  }
+}
+
+export type AppCheckProvider = ReCaptchaV3Provider | ReCaptchaEnterpriseProvider | CustomProvider;
+
+export function sameProvider(a: AppCheckProvider, b: AppCheckProvider): boolean {
+  return a.isEqual(b);
+}

package/src/app-check/state.ts

@@ -0,0 +1,79 @@
+/**
+ * Per-app App Check state: the activation options, the cached token, and the
+ * token listeners. Keyed by the app object, as upstream keys it.
+ */
+import type { FirebaseApp } from '../app/types.js';
+import { mintAppCheckToken, type MintedAppCheckToken as MintedToken } from '../sandbox/internal/app-check-token.js';
+
+/** Web App Check tokens live one hour (capture `app-check-client-debug-get-token`). */
+const TTL_SECONDS = 3600;
+import type { AppCheckProvider } from './providers.js';
+
+export interface AppCheckTokenResult {
+  readonly token: string;
+}
+
+export interface TokenObserver {
+  next: (result: AppCheckTokenResult) => void;
+  error?: (error: Error) => void;
+  complete?: () => void;
+}
+
+export interface AppCheckState {
+  provider: AppCheckProvider;
+  /** The option `initializeAppCheck` was called with; a later call is compared with this. */
+  readonly initialAutoRefresh: boolean;
+  isTokenAutoRefreshEnabled: boolean;
+  cached: MintedToken | null;
+  observers: Set<TokenObserver>;
+}
+
+const states = new WeakMap<FirebaseApp, AppCheckState>();
+
+export function stateOf(app: FirebaseApp): AppCheckState | undefined {
+  return states.get(app);
+}
+
+export function activate(app: FirebaseApp, provider: AppCheckProvider, isTokenAutoRefreshEnabled: boolean): AppCheckState {
+  const state: AppCheckState = { provider, initialAutoRefresh: isTokenAutoRefreshEnabled, isTokenAutoRefreshEnabled, cached: null, observers: new Set() };
+  states.set(app, state);
+  return state;
+}
+
+function identityOf(app: FirebaseApp) {
+  const options = app.options as { appId?: string; projectId?: string };
+  return { appId: options.appId ?? '', projectId: options.projectId ?? '' };
+}
+
+/** Delivers a token to observers off the caller's stack, as the SDK does. */
+function notify(observers: Iterable<TokenObserver>, result: AppCheckTokenResult): void {
+  for (const observer of observers) {
+    queueMicrotask(() => observer.next(result));
+  }
+}
+
+function isValid(token: MintedToken | null, nowMillis: number): token is MintedToken {
+  return token !== null && token.expireTimeMillis > nowMillis;
+}
+
+export async function cachedOrMint(app: FirebaseApp, state: AppCheckState, forceRefresh: boolean): Promise<AppCheckTokenResult> {
+  const now = Date.now();
+  const reuse = !forceRefresh && isValid(state.cached, now);
+  if (reuse) return { token: state.cached!.token };
+  state.cached = await mintAppCheckToken(identityOf(app), TTL_SECONDS, now);
+  const result = { token: state.cached.token };
+  notify(state.observers, result);
+  return result;
+}
+
+export async function mintLimitedUse(app: FirebaseApp): Promise<AppCheckTokenResult> {
+  return { token: (await mintAppCheckToken(identityOf(app), TTL_SECONDS)).token };
+}
+
+export function addObserver(state: AppCheckState, observer: TokenObserver): () => void {
+  state.observers.add(observer);
+  if (isValid(state.cached, Date.now())) notify([observer], { token: state.cached.token });
+  return () => {
+    state.observers.delete(observer);
+  };
+}

package/src/deferred/entry.ts

@@ -1,6 +1,6 @@
 /**
  * The shared factory behind pyric's *deferred* Firebase Web SDK subpaths —
- * `pyric/functions`, `pyric/analytics`, `pyric/app-check`,
+ * `pyric/functions`, `pyric/analytics`,
  * `pyric/firestore/lite`, `pyric/performance` and `pyric/remote-config`.
  *
  * WHY THESE EXIST AT ALL. pyric is a symbol-for-symbol drop-in for the

package/src/sandbox/internal/app-check-token.ts

@@ -0,0 +1,165 @@
+/**
+ * Sandbox App Check tokens, shared by the web mirror (`pyric/app-check`) and
+ * the admin mirror (`pyric-admin/app-check`) so a token minted on either plane
+ * verifies on the other, as production's do (capture
+ * `app-check-admin-verify-token`, `debugExchanged`).
+ *
+ * Shape (captures `app-check-client-debug-get-token`,
+ * `app-check-admin-create-token-shape`): a three-segment JWT, header `alg`
+ * RS256, `typ` JWT, a `kid`; claims `aud`, `exp`, `iat`, `iss`, `jti`,
+ * `provider`, `sub`; `iss` and `aud` name the project number from the app id.
+ *
+ * The signature is not RSA. It is a 256-byte SHA-256 expansion over the
+ * signing input and a fixed sandbox key, the length of a real RS256
+ * signature, so any edit to the header, payload, or signature fails
+ * verification. It is not a security boundary: anyone can mint one.
+ */
+const ISSUER = 'https://firebaseappcheck.googleapis.com';
+const SANDBOX_KID = 'pyric-sandbox';
+const SANDBOX_KEY = 'pyric-sandbox-app-check-signing-key';
+const SIGNATURE_BLOCKS = 8;
+
+export interface AppCheckIdentity {
+  appId: string;
+  projectId: string;
+}
+
+export interface AppCheckTokenClaims {
+  sub: string;
+  aud: string[];
+  provider: string;
+  iss: string;
+  exp: number;
+  iat: number;
+  jti: string;
+  [claim: string]: unknown;
+}
+
+export interface MintedAppCheckToken {
+  token: string;
+  expireTimeMillis: number;
+}
+
+function base64url(bytes: Uint8Array): string {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/** jws `JWS_REGEX`: base64url characters only, header and payload non-empty, signature optional. */
+const JWS_SHAPE = /^[a-zA-Z0-9\-_]+?\.[a-zA-Z0-9\-_]+?\.([a-zA-Z0-9\-_]+)?$/;
+
+/** A base64url segment as Latin-1 text, one character per byte, as jws reads a header (`toString('binary')`). */
+function latin1FromBase64url(text: string): string {
+  const padded = text.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(text.length / 4) * 4, '=');
+  return atob(padded);
+}
+
+/**
+ * A base64url segment as UTF-8, as jws reads a payload (`toString('utf8')`):
+ * the inverse of {@link encodeJson}, with invalid bytes replaced by U+FFFD as
+ * Buffer does. Uses `atob` and `TextDecoder` only, so it runs the same in a
+ * browser or worker.
+ */
+function utf8FromBase64url(text: string): string {
+  const binary = latin1FromBase64url(text);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
+  return new TextDecoder('utf-8').decode(bytes);
+}
+
+function isJsonObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function encodeJson(value: unknown): string {
+  return base64url(new TextEncoder().encode(JSON.stringify(value)));
+}
+
+function randomId(): string {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return base64url(bytes);
+}
+
+async function sandboxSignature(signingInput: string): Promise<string> {
+  const blocks: Uint8Array[] = [];
+  for (let block = 0; block < SIGNATURE_BLOCKS; block++) {
+    const data = new TextEncoder().encode(`${block}.${SANDBOX_KEY}.${signingInput}`);
+    blocks.push(new Uint8Array(await crypto.subtle.digest('SHA-256', data)));
+  }
+  const out = new Uint8Array(blocks.length * 32);
+  blocks.forEach((bytes, index) => out.set(bytes, index * 32));
+  return base64url(out);
+}
+
+/** The project number a Firebase app id carries: `1:<projectNumber>:<platform>:<hash>`. */
+export function appCheckProjectNumber(appId: string): string {
+  return appId.split(':')[1] ?? '';
+}
+
+export async function mintAppCheckToken(
+  identity: AppCheckIdentity,
+  ttlSeconds: number,
+  nowMillis: number = Date.now(),
+): Promise<MintedAppCheckToken> {
+  const iat = Math.floor(nowMillis / 1000);
+  const exp = iat + ttlSeconds;
+  const projectNumber = appCheckProjectNumber(identity.appId);
+  const claims: AppCheckTokenClaims = {
+    sub: identity.appId,
+    aud: [`projects/${projectNumber}`, `projects/${identity.projectId}`],
+    provider: 'pyric-sandbox',
+    iss: `${ISSUER}/${projectNumber}`,
+    exp,
+    iat,
+    jti: randomId(),
+  };
+  const token = await signAppCheckToken({ alg: 'RS256', kid: SANDBOX_KID, typ: 'JWT' }, claims);
+  return { token, expireTimeMillis: exp * 1000 };
+}
+
+/** Signs any header and claims with the sandbox key. Minting uses it; tests use it to build tokens production could not issue. */
+export async function signAppCheckToken(header: Record<string, unknown>, claims: Record<string, unknown>): Promise<string> {
+  const signingInput = `${encodeJson(header)}.${encodeJson(claims)}`;
+  return `${signingInput}.${await sandboxSignature(signingInput)}`;
+}
+
+/** A decoded token's header and claims, unchecked: any field may be missing or of any type. */
+export interface AppCheckTokenParts {
+  header: Readonly<Record<string, unknown>>;
+  claims: Readonly<Record<string, unknown>>;
+}
+
+export type AppCheckTokenCheck =
+  | ({ ok: true } & AppCheckTokenParts)
+  | ({ ok: false; reason: 'kid' | 'signature' } & AppCheckTokenParts)
+  | { ok: false; reason: 'malformed' };
+
+/**
+ * Decodes a sandbox token and checks its key and signature, in
+ * firebase-admin's order: a `kid` must name the sandbox key, and a token with
+ * no `kid` is checked against it, as firebase-admin tries every key. The
+ * decoded header and claims come back whenever the token decodes; `alg`,
+ * audience, subject and expiry are the caller's rules.
+ */
+export async function checkAppCheckToken(token: string): Promise<AppCheckTokenCheck> {
+  if (!JWS_SHAPE.test(token)) return { ok: false, reason: 'malformed' };
+  const segments = token.split('.');
+  let header: unknown;
+  let claims: unknown;
+  try {
+    header = JSON.parse(latin1FromBase64url(segments[0]!));
+    claims = JSON.parse(utf8FromBase64url(segments[1]!));
+  } catch {
+    return { ok: false, reason: 'malformed' };
+  }
+  if (!isJsonObject(header) || !isJsonObject(claims)) return { ok: false, reason: 'malformed' };
+  const decoded = { header, claims };
+  // jwt.js getKeyCallback: a falsy kid means "no kid", and every key is tried.
+  const kidNamesNoKey = Boolean(header.kid) && header.kid !== SANDBOX_KID;
+  if (kidNamesNoKey) return { ok: false, reason: 'kid', ...decoded };
+  const expected = await sandboxSignature(`${segments[0]}.${segments[1]}`);
+  if (segments[2] !== expected) return { ok: false, reason: 'signature', ...decoded };
+  return { ok: true, ...decoded };
+}

package/src/sandbox/internal/index.ts

@@ -227,3 +227,14 @@ export {
   processActivation,
   type ProcessActivation,
 } from './process-activation.js';
+export {
+  appCheckProjectNumber,
+  checkAppCheckToken,
+  mintAppCheckToken,
+  signAppCheckToken,
+  type AppCheckIdentity,
+  type AppCheckTokenCheck,
+  type AppCheckTokenClaims,
+  type AppCheckTokenParts,
+  type MintedAppCheckToken,
+} from './app-check-token.js';