vybekiit 0.7.29 → 0.7.33

package/dist/global-skills/firebase-ai-logic-basics/references/usage_patterns_android.md

@@ -38,9 +38,9 @@ In your Activity or Fragment, initialize the `FirebaseAI` service and generate
 content using a Gemini model:
 
 ```kotlin
-import com.google.firebase.ai.FirebaseAI
 import com.google.firebase.Firebase
 import com.google.firebase.ai.ai
+import com.google.firebase.ai.type.GenerativeBackend
 
 class MainActivity : AppCompatActivity() {
 
@@ -48,8 +48,11 @@ class MainActivity : AppCompatActivity() {
         super.onCreate(savedInstanceState)
         setContentView(R.layout.activity_main)
 
-        // Initialize Firebase AI
-        val ai = Firebase.ai
+        // Initialize with replay protection using limited-use App Check tokens:
+        val ai = Firebase.ai(
+            backend = GenerativeBackend.googleAI(),
+            useLimitedUseAppCheckTokens = true
+        )
 
         // [AGENT] Replace "<latest_supported_model>" with the latest model from https://firebase.google.com/docs/ai-logic/models.md.txt
         val model = ai.generativeModel("<latest_supported_model>")
@@ -67,6 +70,30 @@ class MainActivity : AppCompatActivity() {
 }
 ```
 
+#### App Check Replay Protection on Android
+
+Generative and preview models enforce replay protection using short-lived
+(5-minute) limited-use App Check tokens to prevent replay attacks. If you call a
+model enforcing replay protection without limited-use tokens, the request is
+rejected with:
+
+```text
+HTTP 403: "To access this model, you must enforce Firebase App Check"
+```
+
+To resolve this on Android, pass `useLimitedUseAppCheckTokens = true` when
+calling `Firebase.ai`:
+
+```kotlin
+val ai = Firebase.ai(
+    backend = GenerativeBackend.googleAI(),
+    useLimitedUseAppCheckTokens = true
+)
+```
+
+This ensures the SDK requests fresh limited-use tokens (via Play Integrity or
+the debug provider) for each request instead of reusing cached tokens.
+
 #### Jetpack Compose (Modern)
 
 Initialize inside a `ComponentActivity` and use `setContent`:
@@ -155,3 +182,61 @@ lifecycleScope.launch {
         }
 }
 ```
+
+______________________________________________________________________
+
+### 6. App Check Debug Provider
+
+For App Check debug tokens during local development and CI/CD, install
+`DebugAppCheckProviderFactory.getInstance()` as the App Check provider factory
+in debug builds:
+
+```kotlin
+if (BuildConfig.DEBUG) {
+    Firebase.appCheck.installAppCheckProviderFactory(
+        DebugAppCheckProviderFactory.getInstance()
+    )
+}
+```
+
+#### Debug Token Persistence
+
+Emulator resets or clearing app storage erase `SharedPreferences`, causing
+`DebugAppCheckProviderFactory` to print a new debug token in Logcat. To persist
+a stable debug token across emulator resets and fresh installs without
+hardcoding secrets:
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** Never hardcode
+> debug token strings in `build.gradle.kts` or Kotlin source files. Store the
+> token in gitignored `local.properties` and inject it dynamically.
+
+1. In gitignored `local.properties`:
+
+   ```properties
+   APP_CHECK_DEBUG_TOKEN=<YOUR_DEBUG_TOKEN>
+   ```
+
+1. In `app/build.gradle.kts`:
+
+   ```kotlin
+   val localProperties = java.util.Properties().apply {
+       val localPropertiesFile = rootProject.file("local.properties")
+       if (localPropertiesFile.exists()) {
+           load(localPropertiesFile.inputStream())
+       }
+   }
+   val appCheckDebugToken = localProperties.getProperty("APP_CHECK_DEBUG_TOKEN")
+       ?: System.getenv("APP_CHECK_DEBUG_TOKEN") ?: ""
+
+   android {
+       defaultConfig {
+           // For normal emulator runs (injects into AndroidManifest)
+           manifestPlaceholders["firebaseAppCheckDebugSecret"] = appCheckDebugToken
+
+           // For instrumentation tests
+           if (appCheckDebugToken.isNotEmpty()) {
+               testInstrumentationRunnerArguments["firebaseAppCheckDebugSecret"] = appCheckDebugToken
+           }
+       }
+   }
+   ```

package/dist/global-skills/firebase-ai-logic-basics/references/usage_patterns_web.md

@@ -1,4 +1,12 @@
-# Firebase AI Logic Basics
+# Firebase AI Logic on Web (JavaScript)
+
+## Installation
+
+The library is part of the standard Firebase Web SDK:
+
+```bash
+npm install firebase@latest
+```
 
 ## Initialization Pattern
 
@@ -19,8 +27,11 @@ const firebaseConfig = {
 const app = initializeApp(firebaseConfig);
 
 // Initialize the AI Logic service (defaults to Gemini Developer API)
-// To set the AI provider, set the backend as the second parameter
-const ai = getAI(app, { backend: new GoogleAIBackend() });
+// Pass useLimitedUseAppCheckTokens: true to enable replay protection:
+const ai = getAI(app, {
+  backend: new GoogleAIBackend(),
+  useLimitedUseAppCheckTokens: true,
+});
 
 const generationConfig = {
   candidateCount: 1,
@@ -36,6 +47,30 @@ const generationConfig = {
 const model = getGenerativeModel(ai, { model: "<latest_supported_model>",  generationConfig });
 ```
 
+### App Check Replay Protection
+
+Generative and preview models enforce replay protection with 5-minute
+limited-use App Check tokens. If you call a protected model without enabling
+limited-use tokens, the request fails with:
+
+```text
+HTTP 403: "To access this model, you must enforce Firebase App Check"
+```
+
+To resolve this error on Web, initialize `getAI` with
+`useLimitedUseAppCheckTokens: true`:
+
+```javascript
+const ai = getAI(app, {
+  backend: new GoogleAIBackend(),
+  useLimitedUseAppCheckTokens: true,
+});
+```
+
+This instructs the SDK to fetch fresh, short-lived limited-use tokens (such as
+via reCAPTCHA Enterprise or the debug provider) for requests rather than reusing
+standard cached App Check tokens.
+
 ## Core Capabilities
 
 Text-Only Generation
@@ -179,8 +214,61 @@ async function getJsonData(prompt) {
 On-Device AI (Hybrid) Automatically switch between local Gemini Nano and cloud
 models based on device capability.
 
+The Firebase JavaScript SDK checks for Gemini Nano's availability (after
+installation) and switches between on-device or cloud-hosted prompt execution.
+This requires specific steps to enable model usage in the Chrome browser, more
+info in the
+[hybrid inference documentation for Web](https://firebase.google.com/docs/ai-logic/hybrid/web/get-started.md.txt).
+
 ```JavaScript
 import {getGenerativeModel, InferenceMode } from "firebase/ai";
 
 const hybridModel = getGenerativeModel(ai, { mode: InferenceMode.PREFER_ON_DEVICE });
 ```
+
+## App Check
+
+See
+[App Check with reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider.md.txt)
+for setup instructions.
+
+App Check debug tokens for local development and CI/CD:
+
+- **Local development**: Set `self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;` before
+  initializing App Check (generates a token in the browser console; do not
+  hardcode secret strings in client code).
+- **CI/CD**: Pass the pre-provisioned token from the environment instead (e.g.
+  `self.FIREBASE_APPCHECK_DEBUG_TOKEN = process.env.APP_CHECK_DEBUG_TOKEN`).
+
+### Debug Token Persistence
+
+When testing AI Logic on Web with App Check, clearing site data, using
+incognito/private windows, or switching browsers generates a new debug token
+when `self.FIREBASE_APPCHECK_DEBUG_TOKEN = true` is used. To avoid this debug
+token churn without leaking secrets into client bundles, load a stable token
+from a gitignored local environment file:
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** Never hardcode
+> debug token strings in web source code. Always load them from a local,
+> gitignored environment file.
+
+```javascript
+import { initializeAppCheck, ReCaptchaEnterpriseProvider } from "firebase/app-check";
+
+if (typeof self !== "undefined") {
+  if (typeof process !== "undefined" && process.env.NODE_ENV === "development") {
+    // ✅ SAFE: Load dynamically from Next.js environment variable; fallback to true to auto-generate
+    self.FIREBASE_APPCHECK_DEBUG_TOKEN =
+      process.env.NEXT_PUBLIC_APP_CHECK_DEBUG_TOKEN || true;
+  } else if (typeof import.meta !== "undefined" && import.meta.env?.DEV) {
+    // ✅ SAFE: Load dynamically from Vite environment variable; fallback to true to auto-generate
+    self.FIREBASE_APPCHECK_DEBUG_TOKEN =
+      import.meta.env.VITE_APPCHECK_DEBUG_TOKEN || true;
+  }
+}
+
+const appCheck = initializeAppCheck(app, {
+  provider: new ReCaptchaEnterpriseProvider("/* reCAPTCHA site key */"),
+  isTokenAutoRefreshEnabled: true,
+});
+```

package/dist/global-skills/firebase-app-hosting-basics/SKILL.md

@@ -3,7 +3,9 @@ name: firebase-app-hosting-basics
 description: >-
   Deploys and manages full-stack web applications (Next.js, Angular) with Server-Side Rendering (SSR) using Firebase App Hosting. Use when deploying Next.js/Angular apps, configuring apphosting.yaml or firebase.json apphosting blocks, managing secrets, setting up GitHub CI/CD, or configuring Blaze billing requirements. Don't use for classic static web hosting, Auth, Firestore, Crashlytics, or Xcode.
 metadata:
+  author: Google LLC
   category: Serverless
+disable-model-invocation: true
 ---
 
 # App Hosting Basics
@@ -39,7 +41,7 @@ to upgrade their plan.
 This is the recommended flow for most users.
 
 1. Configure `firebase.json` with an `apphosting` block.
-   
+
    ```json
    {
      "apphosting": {
@@ -55,12 +57,15 @@ This is the recommended flow for most users.
      }
    }
    ```
+
 1. Create or edit `apphosting.yaml`- see
    [Configuration](references/configuration.md) for more information on how to
    do so.
+
 1. If the app needs safe access to sensitive keys, use
    `npx -y firebase-tools@latest apphosting:secrets` commands to set and grant
    access to secrets.
+
 1. Run `npx -y firebase-tools@latest deploy` when you are ready to deploy.
 
 ### Automated deployment via GitHub (CI/CD)

package/dist/global-skills/firebase-auth-basics/SKILL.md

@@ -3,7 +3,9 @@ name: firebase-auth-basics
 description: Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
 compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.
 metadata:
+  author: Google LLC
   category: Identity
+disable-model-invocation: true
 ---
 
 ## Prerequisites
@@ -74,7 +76,7 @@ Configure Firebase Authentication in `firebase.json` by adding an 'auth' block:
         "supportEmail": "support@example.com",
         "authorizedRedirectUris": [
           "https://my-project-id.firebaseapp.com/__/auth/handler",
-          "http://localhost:4000"
+          "http://localhost"
         ]
       }
     }
@@ -84,11 +86,15 @@ Configure Firebase Authentication in `firebase.json` by adding an 'auth' block:
 
 > [!NOTE] If the Google Sign-In popup opens and immediately closes with the
 > error `[firebase_auth/unauthorized-domain]`, it means the domain is not
-> authorized. For local development, ensure `localhost` is included in the
-> **Authorized Domains** list in the Firebase Console (Authentication >
-> Settings > Authorized domains). **CRITICAL**: Do NOT include the protocol or
-> port number in the Authorized Domains list (e.g., use `localhost`, NOT
-> `http://localhost:9090`).
+> authorized. For local development, add `http://localhost` to
+> `authorizedRedirectUris` in `firebase.json` (or ensure `localhost` is included
+> in the **Authorized Domains** list in the Firebase Console under
+> Authentication > Settings > Authorized domains). **CRITICAL**: Do NOT include
+> the port number in `authorizedRedirectUris` (e.g., use `http://localhost`, NOT
+> `http://localhost:9090` or `http://localhost:4000`), and do NOT include the
+> protocol or port number in the Console Authorized Domains list (use
+> `localhost`). Including a port number in `authorizedRedirectUris` causes
+> `firebase deploy --only auth` to fail with `INVALID_AUTHORIZED_DOMAIN`.
 
 **CRITICAL**: After configuring `firebase.json`, you MUST deploy the auth
 configuration to the Firebase backend for the changes to take effect. This is

package/dist/global-skills/firebase-auth-basics/references/client_sdk_android.md

@@ -1,12 +1,26 @@
-# Firebase Authentication on Android (Kotlin)
+# Firebase Authentication - Android Setup Guide (Kotlin)
 
-This guide walks you through using Firebase Authentication in your Android app
-using Kotlin DSL (`build.gradle.kts`) and Kotlin code.
+This guide describes the SDK setup and basic usage patterns for Firebase
+Authentication in an Android app using Kotlin DSL (`build.gradle.kts`) and
+Kotlin code.
 
-### 1, Enable Authentication via CLI
+## Prerequisites
 
-Before adding dependencies in your app, make sure you enable the Auth service in
-your Firebase Project using the Firebase CLI:
+IMPORTANT: Before specifically working with Firebase Authentication, make sure
+to use the skill and reference `firebase_basics/references/android_setup` to
+ensure the following is done.
+
+- The Firebase CLI is available and authenticated.
+- An Android project exists and is registered with a Firebase Project.
+- The Android project has a Firebase config file (`google-services.json`) and
+  the Google services Gradle plugin (`google-services`).
+
+______________________________________________________________________
+
+## 1. Enable Authentication via CLI
+
+Enable the Firebase Authentication service in the Firebase Project using the
+Firebase CLI:
 
 ```bash
 npx -y firebase-tools@latest init auth
@@ -14,27 +28,48 @@ npx -y firebase-tools@latest init auth
 
 ______________________________________________________________________
 
-### 2. Add Dependencies
-
-In your module-level `build.gradle.kts` (usually `app/build.gradle.kts`), add
-the dependency for Firebase Authentication:
+## 2. Add dependencies to Gradle build files
+
+> [!IMPORTANT] **[AGENT] RESOLVING THE SDK VERSION DETERMINISTICALLY** Never
+> guess or hardcode a memorized out-of-date SDK or plugin version. Before adding
+> dependencies, you MUST query the latest available versions directly from the
+> Google Maven Repository:
+>
+> ```bash
+> # Find the latest Firebase Android BoM version
+> curl -s https://dl.google.com/dl/android/maven2/com/google/firebase/firebase-bom/maven-metadata.xml | grep -oE '<latest>[^<]+' | cut -d'>' -f2
+>
+> # Find the latest firebase-auth version
+> curl -s https://dl.google.com/dl/android/maven2/com/google/firebase/firebase-auth/maven-metadata.xml | grep -oE '<latest>[^<]+' | cut -d'>' -f2
+> ```
+>
+> If the dependency is already declared, fetch the exact resolved version
+> currently active in the workspace's build graph:
+>
+> ```bash
+> ./gradlew -q :app:dependencyInsight --dependency firebase-auth --configuration releaseRuntimeClasspath
+> ```
+
+In the **module (app-level)** `build.gradle.kts` (usually
+`<project>/<app-module>/build.gradle.kts`), add the dependency for Firebase
+Authentication:
 
 ```kotlin
 dependencies {
-    // [AGENT] Fetch the latest available BoM version from https://firebase.google.com/support/release-notes/android before adding this
+    // [AGENT] Fetch the latest resolved version using the Gradle command above
     implementation(platform("com.google.firebase:firebase-bom:<latest_bom_version>"))
 
     // Add the dependency for the Firebase Authentication library
-    // When using the BoM, you don't specify versions in Firebase library dependencies
+    // When using the BoM, don't specify versions in Firebase library dependencies
     implementation("com.google.firebase:firebase-auth")
 }
 ```
 
 ______________________________________________________________________
 
-### 3. Initialize FirebaseAuth
+## 3. Initialize FirebaseAuth
 
-In your Activity or Fragment, initialize the `FirebaseAuth` instance:
+In the Activity or Fragment, initialize the `FirebaseAuth` instance:
 
 ```kotlin
 import com.google.firebase.Firebase
@@ -48,6 +83,7 @@ class MainActivity : AppCompatActivity() {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         auth = Firebase.auth
+
         setContent {
             MaterialTheme {
                 Text("Auth initialized!")
@@ -57,7 +93,7 @@ class MainActivity : AppCompatActivity() {
 }
 ```
 
-#### Jetpack Compose (Modern)
+### Jetpack Compose (Modern)
 
 Initialize inside a `ComponentActivity` using `setContent`:
 
@@ -86,9 +122,9 @@ class MainActivity : ComponentActivity() {
 
 ______________________________________________________________________
 
-### 4. Check Current Auth State
+## 4. Check current Auth state
 
-You should check if a user is already signed in when your activity starts:
+Check if a user is already signed in when the activity starts:
 
 ```kotlin
 public override fun onStart() {
@@ -105,7 +141,11 @@ public override fun onStart() {
 
 ______________________________________________________________________
 
-### 5. Sign Up New Users (Email/Password)
+## 5. Use sign-in providers in the app
+
+### Email/Password
+
+#### Sign up NEW users with Email/Password
 
 Use `createUserWithEmailAndPassword` to register new users:
 
@@ -125,11 +165,9 @@ fun signUpUser(email: String, password: String) {
 }
 ```
 
-______________________________________________________________________
-
-### 6. Sign In Existing Users (Email/Password)
+#### Sign in EXISTING users with Email/Password
 
-Use `signInWithEmailAndPassword` to log in existing users:
+Use `signInWithEmailAndPassword` to sign in existing users:
 
 ```kotlin
 fun signInUser(email: String, password: String) {
@@ -149,7 +187,7 @@ fun signInUser(email: String, password: String) {
 
 ______________________________________________________________________
 
-### 7. Sign Out
+## 6. Sign out users
 
 To sign out a user, call `signOut()` on the `FirebaseAuth` instance:
 

package/dist/global-skills/firebase-auth-basics/references/client_sdk_web.md

@@ -76,9 +76,9 @@ signInWithPopup(auth, provider)
 > it means the domain hosting your app is not authorized for OAuth operations in
 > your Firebase project.
 >
-> -   **Fix**: Add your domain (e.g., `localhost` for local testing) to the
->     Authorized Domains list in the Firebase Console (Authentication >
->     Settings > Authorized domains).
+> - **Fix**: Add your domain (e.g., `localhost` for local testing) to the
+>   Authorized Domains list in the Firebase Console (Authentication > Settings >
+>   Authorized domains).
 > - **CRITICAL**: Do NOT include the protocol or port number when adding the
 >   domain (e.g., use `localhost`, NOT `http://localhost:9090`).
 

package/dist/global-skills/firebase-auth-basics/references/flutter_setup.md

@@ -19,22 +19,24 @@ platform-specific quirks.
 
 - **Initialization Requirement**: In 7.x, you must call
   `await GoogleSignIn.instance.initialize();` globally before using the plugin.
+
 - **Web Client ID Constraint**: On Flutter Web, if you call `initialize()`
   without passing a `clientId` argument OR specifying the
   `<meta name="google-signin-client_id" ... />` tag in `web/index.html`, the
   Dart Web Debug Service (DWDS) and the app will throw an assertion error and
   **hang infinitely**, resulting in a blank screen.
--   **Common Workaround**: If you intend to use Firebase Auth's
-    `signInWithPopup(GoogleAuthProvider())` for the web, you can conditionally
-    skip the local `GoogleSignIn` package initialization entirely:
 
-    ```dart
-    import 'package:flutter/foundation.dart' show kIsWeb;
+- **Common Workaround**: If you intend to use Firebase Auth's
+  `signInWithPopup(GoogleAuthProvider())` for the web, you can conditionally
+  skip the local `GoogleSignIn` package initialization entirely:
 
-    if (!kIsWeb) {
-    await GoogleSignIn.instance.initialize();
-    }
-    ```
+  ```dart
+  import 'package:flutter/foundation.dart' show kIsWeb;
+
+  if (!kIsWeb) {
+  await GoogleSignIn.instance.initialize();
+  }
+  ```
 
 ## 3. Web Logout Crashes
 
@@ -43,15 +45,16 @@ platform-specific quirks.
   `await GoogleSignIn.instance.signOut();` during the user's logout flow on the
   Web platform evaluates against an uninitialized context or unsupported
   environment, crashing the app.
--   **Solution**: Conditionally separate the logout logic for Web to rely
-    entirely on `FirebaseAuth`:
 
-    ```dart
-    if (!kIsWeb) {
-      await GoogleSignIn.instance.signOut();
-    }
-    await FirebaseAuth.instance.signOut();
-    ```
+- **Solution**: Conditionally separate the logout logic for Web to rely entirely
+  on `FirebaseAuth`:
+
+  ```dart
+  if (!kIsWeb) {
+    await GoogleSignIn.instance.signOut();
+  }
+  await FirebaseAuth.instance.signOut();
+  ```
 
 ## 4. Prototyping Workaround: Bypassing Firestore Composite Indices
 
@@ -140,8 +143,8 @@ closes.
   `Sign-in failed: [firebase_auth/unauthorized-domain] This domain is not authorized for OAuth operation for your Firebase project.`
 - **Cause**: The domain (usually `localhost` during local testing) is not listed
   in the Authorized Domains in the Firebase Console.
--   **Solution**: Add `localhost` to the Authorized Domains list in the Firebase
-    Console (Authentication > Settings > Authorized domains).
+- **Solution**: Add `localhost` to the Authorized Domains list in the Firebase
+  Console (Authentication > Settings > Authorized domains).
 - **CRITICAL**: Do NOT include the protocol or port number when adding the
   domain (e.g., use `localhost`, NOT `http://localhost:9090`). Flutter Web often
   runs on random ports or specific ports, but Firebase Auth only cares about the

package/dist/global-skills/firebase-auth-basics/references/security_rules.md

@@ -1,8 +1,8 @@
 # Authentication in Security Rules
 
 Firebase Security Rules work with Firebase Authentication to provide rule-based
-access control. For Firestore Security Rules (`firestore.rules`), delegate to the
-`firestore-rules-author` subagent if subagent delegation is available, or
+access control. For Firestore Security Rules (`firestore.rules`), delegate to
+the `firestore-rules-author` subagent if subagent delegation is available, or
 see the `firestore-rules-creation` skill otherwise. For Cloud Storage rules,
 enable the `firebase-storage-basics` skill.
 

package/dist/global-skills/firebase-basics/SKILL.md

@@ -3,7 +3,10 @@ name: firebase-basics
 description: >-
   Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase use`), and app config file downloads (`google-services.json`, `GoogleService-Info.plist`). Use ONLY for CLI login, project creation/switching, or downloading app config files. Don't use for Firebase Hosting deploy, Firestore, Auth, App Hosting, Data Connect, Crashlytics, or Remote Config.
 metadata:
+  author: Google LLC
   category: CloudInfrastructureAndServices
+  version: "1.0.0"
+disable-model-invocation: true
 ---
 
 # Prerequisites
@@ -57,11 +60,13 @@ Complete these setup steps before proceeding:
    - **If using an existing Project ID:**
 
      1. Check the current project by running `npx -y firebase-tools@latest use`.
+
      1. If the command outputs `Active Project: <project-id>`, confirm with the
         user if this is the intended project.
+
      1. If not, or if no project is active, set the project provided by the
         user:
-        
+
         ```bash
         npx -y firebase-tools@latest use <PROJECT_ID>
         ```
@@ -141,8 +146,9 @@ Adhere to these principles:
 
 - **Login Issues:** If the browser fails to open during the login step, use
   `npx -y firebase-tools@latest login --no-localhost` instead.
+
 - **Genkit:** If using Genkit, install the skills:
-  
+
   ```bash
   npx skills add genkit-ai/skills
   ```