vybekiit 0.7.32 → 0.7.33

package/dist/global-skills/firebase-ai-logic-basics/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: firebase-ai-logic-basics
-description: Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.
+description: >-
+  Integrates Firebase AI Logic (formerly Vertex AI for Firebase) into mobile and web apps (Android, iOS, Web, and Flutter) to call Gemini models from client code. Use when provisioning or initializing Firebase AI Logic, or adding Gemini features to an app: text generation, multimodal input, chat, streaming, structured output, hybrid on-device inference, App Check protection, or switching models with Remote Config.
 version: 1.0.1
 metadata:
+  author: Google LLC
   category: AiAndMachineLearning
 disable-model-invocation: true
 ---
@@ -12,57 +14,98 @@ disable-model-invocation: true
 ## Overview
 
 Firebase AI Logic is a product of Firebase that allows developers to add gen AI
-to their mobile and web apps using client-side SDKs. You can call Gemini models
-directly from your app without managing a dedicated backend. Firebase AI Logic,
-which was previously known as "Vertex AI for Firebase", represents the evolution
-of Google's AI integration platform for mobile and web developers.
+to their mobile and web apps using client-side SDKs. The app can directly call
+Gemini models via Firebase AI Logic without the developer needing to manage a
+dedicated backend. Firebase AI Logic was previously known as "Vertex AI for
+Firebase".
 
 It supports the two Gemini API providers:
 
--   **Gemini Developer API**: It has a free tier ideal for prototyping, and
-    pay-as-you-go for production
--   **Agent Platform Gemini API** (formerly branded Vertex AI): Ideal for scale
-    with enterprise-grade production readiness, requires Blaze plan
+- **Gemini Developer API**: It has a free tier ideal for prototyping, and
+  pay-as-you-go for production
+- **Agent Platform Gemini API** (formerly branded Vertex AI): Ideal for scale
+  with enterprise-grade production readiness, requires Blaze pricing plan
 
 Use the Gemini Developer API as a default, and only Agent Platform Gemini API
 (formerly branded Vertex AI) if the application requires it.
 
-## Setup & Initialization
+______________________________________________________________________
+
+## Setup & initialization
 
 ### Prerequisites
 
--   Before starting, ensure you have **Node.js 16+** and npm installed. Install
-    them if they aren’t already available.
--   Identify the platform the user is interested in building on prior to
-    starting: Android, iOS, Flutter or Web.
--   If their platform is unsupported, Direct the user to Firebase Docs to learn
-    how to set up AI Logic for their application (share this link with the user
-    https://firebase.google.com/docs/ai-logic/get-started)
+- Identify the platform the user is interested in building on prior to starting:
+  Android, iOS, Web, or Flutter.
+- If their platform is unsupported, Direct the user to Firebase Docs to learn
+  how to set up AI Logic for their application (share this link with the user
+  https://firebase.google.com/docs/ai-logic/get-started)
+- The Firebase CLI commands below run through `npx` on every platform, so they
+  need **Node.js 20+** and npm. Use the `firebase-basics` skill to check for
+  them and to log in to the Firebase CLI. If Node.js is missing or older than
+  version 20, ask the user to install it as that skill describes. Don't install
+  system packages yourself, for example with `sudo apt-get`, because that
+  changes the user's machine without their consent.
+
+### 1. Provision Firebase AI Logic (ALL platforms)
+
+Use the **Firebase CLI** to provision Firebase AI Logic for the Firebase
+Project:
+
+1. Make sure that you're in a firebase directory (with a `firebase.json`).
 
-### Installation
+1. Verify that you're running Firebase CLI commands against the intended
+   Firebase Project. When you run this command, the active project is marked
+   with "current":
 
-The library is part of the standard Firebase Web SDK.
+   ```bash
+   npx -y firebase-tools@latest projects:list
+   ```
 
-`npm install firebase@latest`
+1. Make sure there's at least one Firebase App for the target platform
+   registered with the current Firebase Project:
 
-If you're in a firebase directory (with a firebase.json) the currently selected
-project will be marked with "current" using this command:
+   ```bash
+   npx -y firebase-tools@latest apps:list
+   ```
 
-`npx -y firebase-tools@latest projects:list`
+1. Provision Firebase AI Logic for the Firebase Project:
 
-Ensure there's at least one app associated with the current project
+   ```bash
+   npx -y firebase-tools@latest init ailogic
+   ```
+
+   This command will enable the Gemini Developer API in the Firebase project.
+
+> [!WARNING] **CRITICAL: Provisioning Firebase AI Logic is Required** For all
+> platforms (Android, iOS, Web, or Flutter), even if the app already uses
+> Firebase, you MUST run `npx -y firebase-tools@latest init ailogic` to
+> provision the service. The configuration files of `GoogleService-Info.plist`,
+> `google-services.json`, and `firebase_options.dart` ONLY handle client
+> configuration and do NOT enable the Firebase AI Logic service, leading to
+> `PERMISSION_DENIED` errors.
 
-`npx -y firebase-tools@latest apps:list`
+If you can't run `init ailogic` yourself (for example because Node.js is missing
+or the Firebase CLI isn't logged in) do NOT skip it. The app's requests to
+Gemini models will fail until the Firebase AI Logic service is provisioned. Tell
+the user to run this command in their project directory, and include it in your
+final summary:
 
-Initialize AI logic SDK with the init command
+```bash
+npx -y firebase-tools@latest init ailogic
+```
 
-`npx -y firebase-tools@latest init ailogic`
+### 2. Add the SDK and initialize the service in the app
 
-This will automatically enable the Gemini Developer API in the Firebase console.
+Adding the SDK dependency and initializing the service are platform-specific.
+Before writing code, read the reference for the target platform listed under
+[Initialization Code References](#initialization-code-references).
 
 More info in
 [Firebase AI Logic Getting Started](https://firebase.google.com/docs/ai-logic/get-started.md.txt)
 
+______________________________________________________________________
+
 ## Core Capabilities
 
 > [!WARNING] **CRITICAL: Use current model names:** Always check the
@@ -92,16 +135,42 @@ To improve the user experience by showing partial results as they arrive (like a
 typing effect), use `generateContentStream` instead of `generateContent` for
 faster display of results.
 
+### Text-to-Speech (TTS) Generation
+
+Generate spoken audio directly on client devices without a custom speech
+backend. Firebase AI Logic supports speech synthesis using dedicated Gemini TTS
+models:
+
+- **Supported Models**: `gemini-3.1-flash-tts-preview`
+- **Capabilities**:
+  - Single-speaker voice persona selection (`voiceName`) and multi-speaker
+    dialogues (up to 2 distinct speakers) via `SpeechConfig` /
+    `MultiSpeakerVoiceConfig`
+  - Direct audio responses by setting `responseModalities` to audio
+  - Streaming speech responses with `generateContentStream` for low-latency
+    playback
+  - Audio directives (`[Audio Profile: ...]`, `[Scene: ...]`,
+    `[Director's Note: ...]`) and emotional tags (`[whispers]`, `[laughs]`,
+    `[slowly]`)
+  - Client-side decoding and playback of 24 kHz 16-bit linear PCM (`audio/l16`)
+    or WAV container format (`audio/x-wav`)
+
+See the [Text-to-Speech (TTS) Generation Guide](references/tts_generation.md)
+for full implementation details, streaming patterns, and copy-paste code
+snippets for iOS (Swift), Android (Kotlin), and Web.
+
 ### Generate Images with Nano Banana
 
 > [!WARNING] **Use current Image model names:** Always check the
 > [Firebase AI Logic Models documentation](https://firebase.google.com/docs/ai-logic/models.md.txt)
 > for the currently supported image generation (Nano Banana) model names.
 
--   Requires an upgraded Blaze pay-as-you-go billing plan.
+- Requires an upgraded Blaze pay-as-you-go billing plan.
 
 ### Search Grounding with the built in googleSearch tool
 
+______________________________________________________________________
+
 ## Supported Platforms and Frameworks
 
 Supported Platforms and Frameworks include Kotlin and Java for Android, Swift
@@ -115,23 +184,26 @@ Enforce a specific JSON schema for the response.
 
 ### On-Device AI (Hybrid)
 
-Hybrid on-device inference for web apps, where the Firebase Javascript SDK
-automatically checks for Gemini Nano's availability (after installation) and
-switches between on-device or cloud-hosted prompt execution. This requires
-specific steps to enable model usage in the Chrome browser, more info in the
-[hybrid-on-device-inference documentation](https://firebase.google.com/docs/ai-logic/hybrid-on-device-inference.md.txt).
+Hybrid inference runs prompts with an on-device model when one is available and
+falls back to a cloud-hosted model otherwise (or vice versa). Availability and
+setup steps differ by platform, more info in the
+[hybrid and on-device documentation](https://firebase.google.com/docs/ai-logic/hybrid.md.txt),
+which links to each platform's guide.
+
+______________________________________________________________________
 
 ## Security & Production
 
-### App Check
+### Firebase App Check
 
 > [!WARNING] **Critical Safety Requirement:** In order to use AI Logic safely,
 > you MUST set up App Check on your app. This prevents unauthorized clients from
 > using your API quota and accessing your backend resources.
 
 See
-[App Check with reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider.md.txt)
-for setup instructions.
+[App Check for Firebase AI Logic](https://firebase.google.com/docs/ai-logic/app-check.md.txt)
+for setup instructions. Each platform uses its own attestation provider, so
+follow the instructions for the target platform.
 
 #### App Check Debug Tokens for Local Development & CI/CD
 
@@ -139,57 +211,69 @@ Because App Check attestation providers (like Play Integrity or DeviceCheck)
 reject emulators, simulators, or CI environments, you must use **App Check Debug
 Tokens** during development and testing to bypass standard attestation.
 
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** App Check debug
+> tokens allow clients to bypass attestation and access backend resources
+> without a genuine device. Treat them as private secrets. **Never commit debug
+> tokens to version control or hardcode raw token strings in client code** (Web,
+> Android, iOS, or Flutter). Always inject them through local environment
+> variables, gitignored local configurations, or CI secrets. If a token is
+> compromised, revoke it immediately in the Firebase Console.
+
 ##### Local Development (Auto-Generated)
 
-1.  Configure your code's App Check provider to use the debug factory:
-    *   **Web**: Set `self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;` before
-        initializing App Check.
-    *   **Android**: Install `DebugAppCheckProviderFactory.getInstance()`.
-    *   **iOS**: Set provider factory to `AppCheckDebugProviderFactory()`.
-2.  Run your app in the emulator/localhost.
-3.  Look at your runtime debugger console / Logcat logs for the generated UUID:
-    *   *Example:* `AppCheck debug token:
-        "123a4567-b89c-12d3-e456-789012345678"`
-4.  Register this token in the Firebase Console under **Security > App Check >
-    Apps > Manage debug tokens**.
+1. Configure your code's App Check provider to use the debug factory. The API is
+   platform-specific; see the App Check section of the platform reference or the
+   App Check documentation linked above.
+1. Run your app in the emulator/localhost.
+1. Look at your runtime debugger console / Logcat logs for the generated UUID:
+   - *Example:* `AppCheck debug token: "123a4567-b89c-12d3-e456-789012345678"`
+1. Register this token in the Firebase Console under **Security > App Check >
+   Apps > Manage debug tokens**.
+
+> **💡 Tip (Prevent Debug Token Churn):** Simulator or emulator resets, fresh
+> installs, and clearing browser data can make the SDK generate a new debug
+> token that you must register again. To keep a stable debug token without
+> hardcoding it, see the App Check section of the platform reference.
 
 ##### CI/CD Pipelines (Pre-Provisioned)
 
-1.  Generate and register a new debug token in the Firebase Console under
-    **Security > App Check > Apps > Manage debug tokens**.
-2.  Add this token string as an encrypted secret in your CI system (e.g.
-    `APP_CHECK_DEBUG_TOKEN`).
-3.  Configure your build to pass this secret as an environment variable to the
-    SDK during test execution (e.g. `self.FIREBASE_APPCHECK_DEBUG_TOKEN =
-    process.env.APP_CHECK_DEBUG_TOKEN`).
+1. Generate and register a new debug token in the Firebase Console under
+   **Security > App Check > Apps > Manage debug tokens**.
+1. Add this token string as an encrypted secret in your CI system (e.g.
+   `APP_CHECK_DEBUG_TOKEN`).
+1. Configure your build to pass this secret as an environment variable to the
+   SDK during test execution.
 
-### Remote Config
+### Firebase Remote Config
 
 Consider that you do not need to hardcode model names (e.g., a specific model
 version string). Use Firebase Remote Config to update model versions dynamically
 without deploying new client code. See
 [Changing model names remotely](https://firebase.google.com/docs/ai-logic/change-model-name-remotely.md.txt)
 
-> [!WARNING] **CRITICAL: Backend Provisioning Required** For all platforms
-> (Flutter, Android, iOS, Web), you MUST run `npx firebase-tools init ailogic`
-> to provision the service. `flutterfire configure` ONLY handles client
-> configuration and does NOT enable the AI service, leading to
-> `PERMISSION_DENIED` errors.
+______________________________________________________________________
 
 ## Initialization Code References
 
--   **Web Modular API**
-    -   Provider: Gemini Developer API
-    -   Reference: [usage_patterns_web.md](references/usage_patterns_web.md)
--   **Android (Kotlin)**
-    -   Provider: Gemini Developer API
-    -   Reference: [usage_patterns_android.md](references/usage_patterns_android.md)
--   **iOS (Swift)**
-    -   Provider: Gemini Developer API
-    -   Reference: [ios_setup.md](references/ios_setup.md)
--   **Flutter (Dart)**
-    -   Provider: Gemini Developer API
-    -   Reference: [flutter_setup.md](references/flutter_setup.md)
+- **Android (Kotlin)**
+
+  - Gemini API Provider: Gemini Developer API
+  - Reference: [usage_patterns_android.md](references/usage_patterns_android.md)
+
+- **iOS (Swift)**
+
+  - Gemini API Provider: Gemini Developer API
+  - Reference: [ios_setup.md](references/ios_setup.md)
+
+- **Web Modular API**
+
+  - Gemini API Provider: Gemini Developer API
+  - Reference: [usage_patterns_web.md](references/usage_patterns_web.md)
+
+- **Flutter (Dart)**
+
+  - Gemini API Provider: Gemini Developer API
+  - Reference: [flutter_setup.md](references/flutter_setup.md)
 
 > [!WARNING] **CRITICAL: Use current model names:** Always check the
 > [Firebase AI Logic Models documentation](https://firebase.google.com/docs/ai-logic/models.md.txt)
@@ -198,8 +282,9 @@ without deploying new client code. See
 
 ## References
 
-[Web SDK code examples and usage patterns](references/usage_patterns_web.md)
+[Android (Kotlin) SDK usage patterns](references/usage_patterns_android.md)
 [iOS SDK code examples and usage patterns](references/ios_setup.md)
-[Flutter SDK code examples and usage patterns](references/flutter_setup.md)
+[Web SDK setup, code examples, and usage patterns](references/usage_patterns_web.md)
 
-[Android (Kotlin) SDK usage patterns](references/usage_patterns_android.md)
+[Flutter SDK code examples and usage patterns](references/flutter_setup.md)
+[Client-side Text-to-Speech (TTS) generation](references/tts_generation.md)

package/dist/global-skills/firebase-ai-logic-basics/references/flutter_setup.md

@@ -96,3 +96,40 @@ final chat = model.startChat(history: [
 
 final response = await chat.sendMessage(Content.text('What is CBT?'));
 ```
+
+## App Check Debug Provider
+
+For App Check debug tokens during local development and CI/CD, add the plugin
+with `flutter pub add firebase_app_check`, then activate the debug providers
+right after `Firebase.initializeApp()`:
+
+```dart
+import 'package:firebase_app_check/firebase_app_check.dart';
+import 'package:flutter/foundation.dart';
+
+// In main(), after `await Firebase.initializeApp();`
+if (kDebugMode) {
+  await FirebaseAppCheck.instance.activate(
+    providerAndroid: const AndroidDebugProvider(),
+    providerApple: const AppleDebugProvider(),
+    providerWeb: WebDebugProvider(),
+  );
+}
+```
+
+- Use `providerAndroid`, `providerApple`, and `providerWeb`. The older
+  `androidProvider` and `appleProvider` parameters (`AndroidProvider.debug`,
+  `AppleProvider.debug`) still appear in many examples but are deprecated.
+- Only use the debug providers in debug builds, as gated by `kDebugMode` above.
+  Release builds must activate the production providers (Play Integrity, App
+  Attest or DeviceCheck, and reCAPTCHA Enterprise) instead; see
+  [App Check for Firebase AI Logic](https://firebase.google.com/docs/ai-logic/app-check.md.txt).
+- **CI/CD**: Pass the pre-provisioned token to all three debug providers, e.g.
+  `debugToken: const String.fromEnvironment('APP_CHECK_DEBUG_TOKEN')`, and build
+  with `--dart-define=APP_CHECK_DEBUG_TOKEN=<token>`.
+- **Flutter web**: `providerWeb` is required on web; without it, `activate()`
+  throws. `WebDebugProvider` turns on the web debug token itself, so
+  `web/index.html` doesn't need `self.FIREBASE_APPCHECK_DEBUG_TOKEN`.
+- If the app uses `firebase_ai` 3.11.0 or lower, also set the `appCheck`
+  parameter of `FirebaseAI.googleAI(...)` to `FirebaseAppCheck.instance`. Newer
+  versions don't need this.

package/dist/global-skills/firebase-ai-logic-basics/references/ios_setup.md

@@ -3,17 +3,46 @@
 ## 1. Import and Initialize
 
 Ensure you have installed the `FirebaseAILogic` SDK via Swift Package Manager.
+Use the `xcode-project-setup` skill to automate adding the SPM dependency to the
+Xcode project.
 
 ```swift
 import FirebaseAILogic
 
-// Initialize the Firebase AI service and the generative model.
-let ai = FirebaseAI.firebaseAI()
+// To enable replay protection for generative or preview models, pass
+// useLimitedUseAppCheckTokens: true with your backend:
+let ai = FirebaseAI.firebaseAI(
+    backend: .googleAI(),
+    useLimitedUseAppCheckTokens: true
+)
 
 // [AGENT] Replace "<latest_supported_model>" with the latest model from https://firebase.google.com/docs/ai-logic/models.md.txt
 let model = ai.generativeModel(modelName: "<latest_supported_model>")
 ```
 
+### App Check Replay Protection
+
+Generative and preview models enforce replay protection with 5-minute
+limited-use App Check tokens. If you call a protected model without enabling
+limited-use tokens, the request fails with:
+
+```text
+HTTP 403: "To access this model, you must enforce Firebase App Check"
+```
+
+To resolve this error, initialize `FirebaseAI` with
+`useLimitedUseAppCheckTokens: true`:
+
+```swift
+let ai = FirebaseAI.firebaseAI(
+    backend: .googleAI(),
+    useLimitedUseAppCheckTokens: true
+)
+```
+
+This ensures the SDK fetches a fresh, short-lived limited-use token for each
+request rather than reusing a standard cached App Check token.
+
 ## 2. SwiftUI Integration (Best Practices)
 
 Use the `@Observable` pattern to manage AI state and provide a smooth UX with
@@ -33,7 +62,10 @@ import FirebaseAILogic
 @Observable
 final class AIViewModel {
     // [AGENT] Replace with the latest model from https://firebase.google.com/docs/ai-logic/models.md.txt
-    private lazy var model = FirebaseAI.firebaseAI().generativeModel(modelName: "<latest_supported_model>")
+    private lazy var model = FirebaseAI.firebaseAI(
+        backend: .googleAI(),
+        useLimitedUseAppCheckTokens: true
+    ).generativeModel(modelName: "<latest_supported_model>")
     
     var responseText: String = ""
     var isFetching: Bool = false
@@ -98,6 +130,68 @@ let model = FirebaseAI.firebaseAI().generativeModel(
 )
 ```
 
+## 4. App Check Debug Provider
+
+For App Check debug tokens during local development and CI/CD, add the
+`FirebaseAppCheck` product to the app target (with the `xcode-project-setup`
+skill), then set the debug provider factory in debug builds *before*
+`FirebaseApp.configure()`. Otherwise the debug provider isn't used.
+
+```swift
+import FirebaseAppCheck
+import FirebaseCore
+
+// In your app's init(), before configuring Firebase:
+#if DEBUG
+AppCheck.setAppCheckProviderFactory(AppCheckDebugProviderFactory())
+#endif
+FirebaseApp.configure()
+```
+
+For CI/CD, add an `AppCheckDebugToken` environment variable to the Xcode test
+scheme with a value like `$(APP_CHECK_DEBUG_TOKEN)`, then pass the token from
+the CI test command:
+
+```bash
+xcodebuild test -scheme <scheme> -workspace <project>.xcworkspace \
+  APP_CHECK_DEBUG_TOKEN=<token>
+```
+
+### Debug Token Persistence
+
+When running on simulators or during development, the Firebase iOS SDK generates
+a new debug token UUID whenever `NSUserDefaults` is cleared (e.g., simulator
+reset or fresh install). To avoid invalidating tokens registered in the Firebase
+Console and prevent token churn, persist a stable token by setting the
+`AppCheckDebugToken` environment variable, which the SDK reads automatically at
+runtime:
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** Debug tokens
+> grant access to backend resources without device attestation. Never commit
+> debug tokens to version control or hardcode token strings in source code.
+
+- **In Xcode Scheme (Recommended):** Edit Scheme -> Run -> Arguments ->
+  Environment Variables -> Add `AppCheckDebugToken = <YOUR_DEBUG_TOKEN>`. Keep
+  user schemes (`xcuserdata/`) unshared and gitignored.
+- **In Code (Safe Dynamic Loading Only):** If setting the environment variable
+  in code before configuring `AppCheckDebugProviderFactory`, load the token
+  dynamically from a gitignored local file or environment rather than hardcoding
+  the token literal:
+
+```swift
+#if DEBUG
+// ✅ SAFE: Load from gitignored local file or process environment
+// Note: loadGitIgnoredDebugToken() is a placeholder for your custom helper (e.g., reading from a gitignored plist)
+if let debugToken = loadGitIgnoredDebugToken() {
+  setenv("AppCheckDebugToken", debugToken, 0)
+}
+let providerFactory = AppCheckDebugProviderFactory()
+AppCheck.setAppCheckProviderFactory(providerFactory)
+#endif
+
+FirebaseApp.configure() // Configure Firebase AFTER setting the App Check provider factory
+```
+
 # Advanced Features
 
 ### Chat Session (Multi-turn)

package/dist/global-skills/firebase-ai-logic-basics/references/usage_patterns_android.md

@@ -38,9 +38,9 @@ In your Activity or Fragment, initialize the `FirebaseAI` service and generate
 content using a Gemini model:
 
 ```kotlin
-import com.google.firebase.ai.FirebaseAI
 import com.google.firebase.Firebase
 import com.google.firebase.ai.ai
+import com.google.firebase.ai.type.GenerativeBackend
 
 class MainActivity : AppCompatActivity() {
 
@@ -48,8 +48,11 @@ class MainActivity : AppCompatActivity() {
         super.onCreate(savedInstanceState)
         setContentView(R.layout.activity_main)
 
-        // Initialize Firebase AI
-        val ai = Firebase.ai
+        // Initialize with replay protection using limited-use App Check tokens:
+        val ai = Firebase.ai(
+            backend = GenerativeBackend.googleAI(),
+            useLimitedUseAppCheckTokens = true
+        )
 
         // [AGENT] Replace "<latest_supported_model>" with the latest model from https://firebase.google.com/docs/ai-logic/models.md.txt
         val model = ai.generativeModel("<latest_supported_model>")
@@ -67,6 +70,30 @@ class MainActivity : AppCompatActivity() {
 }
 ```
 
+#### App Check Replay Protection on Android
+
+Generative and preview models enforce replay protection using short-lived
+(5-minute) limited-use App Check tokens to prevent replay attacks. If you call a
+model enforcing replay protection without limited-use tokens, the request is
+rejected with:
+
+```text
+HTTP 403: "To access this model, you must enforce Firebase App Check"
+```
+
+To resolve this on Android, pass `useLimitedUseAppCheckTokens = true` when
+calling `Firebase.ai`:
+
+```kotlin
+val ai = Firebase.ai(
+    backend = GenerativeBackend.googleAI(),
+    useLimitedUseAppCheckTokens = true
+)
+```
+
+This ensures the SDK requests fresh limited-use tokens (via Play Integrity or
+the debug provider) for each request instead of reusing cached tokens.
+
 #### Jetpack Compose (Modern)
 
 Initialize inside a `ComponentActivity` and use `setContent`:
@@ -155,3 +182,61 @@ lifecycleScope.launch {
         }
 }
 ```
+
+______________________________________________________________________
+
+### 6. App Check Debug Provider
+
+For App Check debug tokens during local development and CI/CD, install
+`DebugAppCheckProviderFactory.getInstance()` as the App Check provider factory
+in debug builds:
+
+```kotlin
+if (BuildConfig.DEBUG) {
+    Firebase.appCheck.installAppCheckProviderFactory(
+        DebugAppCheckProviderFactory.getInstance()
+    )
+}
+```
+
+#### Debug Token Persistence
+
+Emulator resets or clearing app storage erase `SharedPreferences`, causing
+`DebugAppCheckProviderFactory` to print a new debug token in Logcat. To persist
+a stable debug token across emulator resets and fresh installs without
+hardcoding secrets:
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** Never hardcode
+> debug token strings in `build.gradle.kts` or Kotlin source files. Store the
+> token in gitignored `local.properties` and inject it dynamically.
+
+1. In gitignored `local.properties`:
+
+   ```properties
+   APP_CHECK_DEBUG_TOKEN=<YOUR_DEBUG_TOKEN>
+   ```
+
+1. In `app/build.gradle.kts`:
+
+   ```kotlin
+   val localProperties = java.util.Properties().apply {
+       val localPropertiesFile = rootProject.file("local.properties")
+       if (localPropertiesFile.exists()) {
+           load(localPropertiesFile.inputStream())
+       }
+   }
+   val appCheckDebugToken = localProperties.getProperty("APP_CHECK_DEBUG_TOKEN")
+       ?: System.getenv("APP_CHECK_DEBUG_TOKEN") ?: ""
+
+   android {
+       defaultConfig {
+           // For normal emulator runs (injects into AndroidManifest)
+           manifestPlaceholders["firebaseAppCheckDebugSecret"] = appCheckDebugToken
+
+           // For instrumentation tests
+           if (appCheckDebugToken.isNotEmpty()) {
+               testInstrumentationRunnerArguments["firebaseAppCheckDebugSecret"] = appCheckDebugToken
+           }
+       }
+   }
+   ```