vybekiit 0.7.32 → 0.7.33

package/dist/global-skills/firebase-ai-logic-basics/references/usage_patterns_web.md

@@ -1,4 +1,12 @@
-# Firebase AI Logic Basics
+# Firebase AI Logic on Web (JavaScript)
+
+## Installation
+
+The library is part of the standard Firebase Web SDK:
+
+```bash
+npm install firebase@latest
+```
 
 ## Initialization Pattern
 
@@ -19,8 +27,11 @@ const firebaseConfig = {
 const app = initializeApp(firebaseConfig);
 
 // Initialize the AI Logic service (defaults to Gemini Developer API)
-// To set the AI provider, set the backend as the second parameter
-const ai = getAI(app, { backend: new GoogleAIBackend() });
+// Pass useLimitedUseAppCheckTokens: true to enable replay protection:
+const ai = getAI(app, {
+  backend: new GoogleAIBackend(),
+  useLimitedUseAppCheckTokens: true,
+});
 
 const generationConfig = {
   candidateCount: 1,
@@ -36,6 +47,30 @@ const generationConfig = {
 const model = getGenerativeModel(ai, { model: "<latest_supported_model>",  generationConfig });
 ```
 
+### App Check Replay Protection
+
+Generative and preview models enforce replay protection with 5-minute
+limited-use App Check tokens. If you call a protected model without enabling
+limited-use tokens, the request fails with:
+
+```text
+HTTP 403: "To access this model, you must enforce Firebase App Check"
+```
+
+To resolve this error on Web, initialize `getAI` with
+`useLimitedUseAppCheckTokens: true`:
+
+```javascript
+const ai = getAI(app, {
+  backend: new GoogleAIBackend(),
+  useLimitedUseAppCheckTokens: true,
+});
+```
+
+This instructs the SDK to fetch fresh, short-lived limited-use tokens (such as
+via reCAPTCHA Enterprise or the debug provider) for requests rather than reusing
+standard cached App Check tokens.
+
 ## Core Capabilities
 
 Text-Only Generation
@@ -179,8 +214,61 @@ async function getJsonData(prompt) {
 On-Device AI (Hybrid) Automatically switch between local Gemini Nano and cloud
 models based on device capability.
 
+The Firebase JavaScript SDK checks for Gemini Nano's availability (after
+installation) and switches between on-device or cloud-hosted prompt execution.
+This requires specific steps to enable model usage in the Chrome browser, more
+info in the
+[hybrid inference documentation for Web](https://firebase.google.com/docs/ai-logic/hybrid/web/get-started.md.txt).
+
 ```JavaScript
 import {getGenerativeModel, InferenceMode } from "firebase/ai";
 
 const hybridModel = getGenerativeModel(ai, { mode: InferenceMode.PREFER_ON_DEVICE });
 ```
+
+## App Check
+
+See
+[App Check with reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider.md.txt)
+for setup instructions.
+
+App Check debug tokens for local development and CI/CD:
+
+- **Local development**: Set `self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;` before
+  initializing App Check (generates a token in the browser console; do not
+  hardcode secret strings in client code).
+- **CI/CD**: Pass the pre-provisioned token from the environment instead (e.g.
+  `self.FIREBASE_APPCHECK_DEBUG_TOKEN = process.env.APP_CHECK_DEBUG_TOKEN`).
+
+### Debug Token Persistence
+
+When testing AI Logic on Web with App Check, clearing site data, using
+incognito/private windows, or switching browsers generates a new debug token
+when `self.FIREBASE_APPCHECK_DEBUG_TOKEN = true` is used. To avoid this debug
+token churn without leaking secrets into client bundles, load a stable token
+from a gitignored local environment file:
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** Never hardcode
+> debug token strings in web source code. Always load them from a local,
+> gitignored environment file.
+
+```javascript
+import { initializeAppCheck, ReCaptchaEnterpriseProvider } from "firebase/app-check";
+
+if (typeof self !== "undefined") {
+  if (typeof process !== "undefined" && process.env.NODE_ENV === "development") {
+    // ✅ SAFE: Load dynamically from Next.js environment variable; fallback to true to auto-generate
+    self.FIREBASE_APPCHECK_DEBUG_TOKEN =
+      process.env.NEXT_PUBLIC_APP_CHECK_DEBUG_TOKEN || true;
+  } else if (typeof import.meta !== "undefined" && import.meta.env?.DEV) {
+    // ✅ SAFE: Load dynamically from Vite environment variable; fallback to true to auto-generate
+    self.FIREBASE_APPCHECK_DEBUG_TOKEN =
+      import.meta.env.VITE_APPCHECK_DEBUG_TOKEN || true;
+  }
+}
+
+const appCheck = initializeAppCheck(app, {
+  provider: new ReCaptchaEnterpriseProvider("/* reCAPTCHA site key */"),
+  isTokenAutoRefreshEnabled: true,
+});
+```

package/dist/global-skills/firebase-app-hosting-basics/SKILL.md

@@ -3,6 +3,7 @@ name: firebase-app-hosting-basics
 description: >-
   Deploys and manages full-stack web applications (Next.js, Angular) with Server-Side Rendering (SSR) using Firebase App Hosting. Use when deploying Next.js/Angular apps, configuring apphosting.yaml or firebase.json apphosting blocks, managing secrets, setting up GitHub CI/CD, or configuring Blaze billing requirements. Don't use for classic static web hosting, Auth, Firestore, Crashlytics, or Xcode.
 metadata:
+  author: Google LLC
   category: Serverless
 disable-model-invocation: true
 ---
@@ -40,7 +41,7 @@ to upgrade their plan.
 This is the recommended flow for most users.
 
 1. Configure `firebase.json` with an `apphosting` block.
-   
+
    ```json
    {
      "apphosting": {
@@ -56,12 +57,15 @@ This is the recommended flow for most users.
      }
    }
    ```
+
 1. Create or edit `apphosting.yaml`- see
    [Configuration](references/configuration.md) for more information on how to
    do so.
+
 1. If the app needs safe access to sensitive keys, use
    `npx -y firebase-tools@latest apphosting:secrets` commands to set and grant
    access to secrets.
+
 1. Run `npx -y firebase-tools@latest deploy` when you are ready to deploy.
 
 ### Automated deployment via GitHub (CI/CD)

package/dist/global-skills/firebase-auth-basics/SKILL.md

@@ -3,6 +3,7 @@ name: firebase-auth-basics
 description: Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
 compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.
 metadata:
+  author: Google LLC
   category: Identity
 disable-model-invocation: true
 ---

package/dist/global-skills/firebase-auth-basics/references/client_sdk_android.md

@@ -1,8 +1,8 @@
 # Firebase Authentication - Android Setup Guide (Kotlin)
 
-This guide describes the SDK setup and basic usage patterns for
-Firebase Authentication in an Android app using
-Kotlin DSL (`build.gradle.kts`) and Kotlin code.
+This guide describes the SDK setup and basic usage patterns for Firebase
+Authentication in an Android app using Kotlin DSL (`build.gradle.kts`) and
+Kotlin code.
 
 ## Prerequisites
 
@@ -30,10 +30,10 @@ ______________________________________________________________________
 
 ## 2. Add dependencies to Gradle build files
 
-> [!IMPORTANT] **[AGENT] RESOLVING THE SDK VERSION DETERMINISTICALLY**
-> Never guess or hardcode a memorized out-of-date SDK or plugin version.
-> Before adding dependencies, you MUST query the latest available versions
-> directly from the Google Maven Repository:
+> [!IMPORTANT] **[AGENT] RESOLVING THE SDK VERSION DETERMINISTICALLY** Never
+> guess or hardcode a memorized out-of-date SDK or plugin version. Before adding
+> dependencies, you MUST query the latest available versions directly from the
+> Google Maven Repository:
 >
 > ```bash
 > # Find the latest Firebase Android BoM version
@@ -51,8 +51,8 @@ ______________________________________________________________________
 > ```
 
 In the **module (app-level)** `build.gradle.kts` (usually
-`<project>/<app-module>/build.gradle.kts`), add the dependency for
-Firebase Authentication:
+`<project>/<app-module>/build.gradle.kts`), add the dependency for Firebase
+Authentication:
 
 ```kotlin
 dependencies {

package/dist/global-skills/firebase-auth-basics/references/client_sdk_web.md

@@ -76,9 +76,9 @@ signInWithPopup(auth, provider)
 > it means the domain hosting your app is not authorized for OAuth operations in
 > your Firebase project.
 >
-> -   **Fix**: Add your domain (e.g., `localhost` for local testing) to the
->     Authorized Domains list in the Firebase Console (Authentication >
->     Settings > Authorized domains).
+> - **Fix**: Add your domain (e.g., `localhost` for local testing) to the
+>   Authorized Domains list in the Firebase Console (Authentication > Settings >
+>   Authorized domains).
 > - **CRITICAL**: Do NOT include the protocol or port number when adding the
 >   domain (e.g., use `localhost`, NOT `http://localhost:9090`).
 

package/dist/global-skills/firebase-auth-basics/references/flutter_setup.md

@@ -19,22 +19,24 @@ platform-specific quirks.
 
 - **Initialization Requirement**: In 7.x, you must call
   `await GoogleSignIn.instance.initialize();` globally before using the plugin.
+
 - **Web Client ID Constraint**: On Flutter Web, if you call `initialize()`
   without passing a `clientId` argument OR specifying the
   `<meta name="google-signin-client_id" ... />` tag in `web/index.html`, the
   Dart Web Debug Service (DWDS) and the app will throw an assertion error and
   **hang infinitely**, resulting in a blank screen.
--   **Common Workaround**: If you intend to use Firebase Auth's
-    `signInWithPopup(GoogleAuthProvider())` for the web, you can conditionally
-    skip the local `GoogleSignIn` package initialization entirely:
 
-    ```dart
-    import 'package:flutter/foundation.dart' show kIsWeb;
+- **Common Workaround**: If you intend to use Firebase Auth's
+  `signInWithPopup(GoogleAuthProvider())` for the web, you can conditionally
+  skip the local `GoogleSignIn` package initialization entirely:
 
-    if (!kIsWeb) {
-    await GoogleSignIn.instance.initialize();
-    }
-    ```
+  ```dart
+  import 'package:flutter/foundation.dart' show kIsWeb;
+
+  if (!kIsWeb) {
+  await GoogleSignIn.instance.initialize();
+  }
+  ```
 
 ## 3. Web Logout Crashes
 
@@ -43,15 +45,16 @@ platform-specific quirks.
   `await GoogleSignIn.instance.signOut();` during the user's logout flow on the
   Web platform evaluates against an uninitialized context or unsupported
   environment, crashing the app.
--   **Solution**: Conditionally separate the logout logic for Web to rely
-    entirely on `FirebaseAuth`:
 
-    ```dart
-    if (!kIsWeb) {
-      await GoogleSignIn.instance.signOut();
-    }
-    await FirebaseAuth.instance.signOut();
-    ```
+- **Solution**: Conditionally separate the logout logic for Web to rely entirely
+  on `FirebaseAuth`:
+
+  ```dart
+  if (!kIsWeb) {
+    await GoogleSignIn.instance.signOut();
+  }
+  await FirebaseAuth.instance.signOut();
+  ```
 
 ## 4. Prototyping Workaround: Bypassing Firestore Composite Indices
 
@@ -140,8 +143,8 @@ closes.
   `Sign-in failed: [firebase_auth/unauthorized-domain] This domain is not authorized for OAuth operation for your Firebase project.`
 - **Cause**: The domain (usually `localhost` during local testing) is not listed
   in the Authorized Domains in the Firebase Console.
--   **Solution**: Add `localhost` to the Authorized Domains list in the Firebase
-    Console (Authentication > Settings > Authorized domains).
+- **Solution**: Add `localhost` to the Authorized Domains list in the Firebase
+  Console (Authentication > Settings > Authorized domains).
 - **CRITICAL**: Do NOT include the protocol or port number when adding the
   domain (e.g., use `localhost`, NOT `http://localhost:9090`). Flutter Web often
   runs on random ports or specific ports, but Firebase Auth only cares about the

package/dist/global-skills/firebase-auth-basics/references/security_rules.md

@@ -1,8 +1,8 @@
 # Authentication in Security Rules
 
 Firebase Security Rules work with Firebase Authentication to provide rule-based
-access control. For Firestore Security Rules (`firestore.rules`), delegate to the
-`firestore-rules-author` subagent if subagent delegation is available, or
+access control. For Firestore Security Rules (`firestore.rules`), delegate to
+the `firestore-rules-author` subagent if subagent delegation is available, or
 see the `firestore-rules-creation` skill otherwise. For Cloud Storage rules,
 enable the `firebase-storage-basics` skill.
 

package/dist/global-skills/firebase-basics/SKILL.md

@@ -3,6 +3,7 @@ name: firebase-basics
 description: >-
   Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase use`), and app config file downloads (`google-services.json`, `GoogleService-Info.plist`). Use ONLY for CLI login, project creation/switching, or downloading app config files. Don't use for Firebase Hosting deploy, Firestore, Auth, App Hosting, Data Connect, Crashlytics, or Remote Config.
 metadata:
+  author: Google LLC
   category: CloudInfrastructureAndServices
   version: "1.0.0"
 disable-model-invocation: true
@@ -59,11 +60,13 @@ Complete these setup steps before proceeding:
    - **If using an existing Project ID:**
 
      1. Check the current project by running `npx -y firebase-tools@latest use`.
+
      1. If the command outputs `Active Project: <project-id>`, confirm with the
         user if this is the intended project.
+
      1. If not, or if no project is active, set the project provided by the
         user:
-        
+
         ```bash
         npx -y firebase-tools@latest use <PROJECT_ID>
         ```
@@ -143,8 +146,9 @@ Adhere to these principles:
 
 - **Login Issues:** If the browser fails to open during the login step, use
   `npx -y firebase-tools@latest login --no-localhost` instead.
+
 - **Genkit:** If using Genkit, install the skills:
-  
+
   ```bash
   npx skills add genkit-ai/skills
   ```

package/dist/global-skills/firebase-basics/references/android_setup.md

@@ -4,34 +4,34 @@ ______________________________________________________________________
 
 ## Prerequisites
 
-1.  **Firebase CLI**: Make sure the Firebase CLI is available and authenticated.
+1. **Firebase CLI**: Make sure the Firebase CLI is available and authenticated.
 
-    For detailed instructions about the Firebase CLI, see
-    `firebase_basics/references/local-env-setup`. Here are high-level
-    instructions for setting up the Firebase CLI.
+   For detailed instructions about the Firebase CLI, see
+   `firebase_basics/references/local-env-setup`. Here are high-level
+   instructions for setting up the Firebase CLI.
 
-    1.  Ensure the Firebase CLI is available:
+   1. Ensure the Firebase CLI is available:
 
-        ```bash
-        npx -y firebase-tools@latest --version
-        ```
+      ```bash
+      npx -y firebase-tools@latest --version
+      ```
 
-    2.  Login to the CLI:
+   1. Login to the CLI:
 
-        - local:
+      - local:
 
-          ```bash
-          npx -y firebase-tools@latest login
-          ```
+        ```bash
+        npx -y firebase-tools@latest login
+        ```
 
-        - remote servers:
+      - remote servers:
 
-          ```bash
-          npx -y firebase-tools@latest login --no-localhost
-          ```
+        ```bash
+        npx -y firebase-tools@latest login --no-localhost
+        ```
 
-2.  **Android project**: Create or use an existing Android project in an
-    Android-development IDE.
+1. **Android project**: Create or use an existing Android project in an
+   Android-development IDE.
 
 ______________________________________________________________________
 
@@ -63,19 +63,18 @@ ______________________________________________________________________
 
 ## 2. Create a new Firebase project or use an existing one
 
-Check if there's an existing Firebase Project available for use with the
-Android project:
+Check if there's an existing Firebase Project available for use with the Android
+project:
 
 ```bash
 npx -y firebase-tools@latest projects:list
 ```
 
-- **If existing Firebase Project:**
-  Ask the human user if they want to use the existing project.
+- **If existing Firebase Project:** Ask the human user if they want to use the
+  existing project.
 
 - **If no existing Firebase Project or human user does not want to use an
-  existing project:**
-  Create a new Firebase Project.
+  existing project:** Create a new Firebase Project.
 
   Provide a required unique PROJECT_ID and an optional PROJECT_DISPLAY_NAME:
 
@@ -114,25 +113,25 @@ ______________________________________________________________________
 
 ## 4. Obtain and save `google-services.json`
 
-1.  Fetch the Firebase configuration file (`google-services.json`) using the
-    Firebase Android APP_ID (which is printed in the output of the previous
-    `apps:create` command):
+1. Fetch the Firebase configuration file (`google-services.json`) using the
+   Firebase Android APP_ID (which is printed in the output of the previous
+   `apps:create` command):
 
-    ```bash
-    npx -y firebase-tools@latest apps:sdkconfig ANDROID <APP_ID> --project <PROJECT_ID>
-    ```
+   ```bash
+   npx -y firebase-tools@latest apps:sdkconfig ANDROID <APP_ID> --project <PROJECT_ID>
+   ```
 
-2.  Save the configuration file within the **module (app-level)** root directory
-    of the Android project: `app/google-services.json`
+1. Save the configuration file within the **module (app-level)** root directory
+   of the Android project: `app/google-services.json`
 
 ______________________________________________________________________
 
 ## 5. Add the `google-services` plugin
 
-> [!IMPORTANT] **[AGENT] RESOLVING THE PLUGIN VERSION DETERMINISTICALLY**
-> Never guess or hardcode a memorized out-of-date plugin version.
-> Before adding dependencies, you MUST query the latest available versions
-> directly from the Google Maven Repository:
+> [!IMPORTANT] **[AGENT] RESOLVING THE PLUGIN VERSION DETERMINISTICALLY** Never
+> guess or hardcode a memorized out-of-date plugin version. Before adding
+> dependencies, you MUST query the latest available versions directly from the
+> Google Maven Repository:
 >
 > ```bash
 > # Find the latest Google services Gradle plugin version
@@ -168,6 +167,71 @@ plugins {
 
 ______________________________________________________________________
 
+## 6. App Check (Debug Token Persistence)
+
+When using App Check on Android emulators or local development,
+`DebugAppCheckProviderFactory.getInstance()` generates a UUID token and stores
+it in `SharedPreferences`. Wiping emulator data, clearing app storage, or fresh
+installs generate a new UUID in Logcat, causing debug token churn in the
+Firebase Console.
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** App Check debug
+> tokens allow clients to bypass attestation and access backend resources
+> without a genuine device. **Never hardcode debug token strings in
+> build.gradle.kts, Java, or Kotlin files, and never commit tokens to version
+> control.** If a token is compromised, revoke it immediately in the Firebase
+> Console.
+
+To persist a stable debug token across emulator resets and testing without
+committing secrets:
+
+1. Obtain or generate a stable UUID debug token and register it in the Firebase
+   Console under **Security > App Check > Apps > Manage debug tokens**.
+
+1. Store the token in your project's gitignored `local.properties`:
+
+   ```properties
+   # In local.properties (ensure this file is in your .gitignore!)
+   APP_CHECK_DEBUG_TOKEN=<YOUR_DEBUG_TOKEN>
+   ```
+
+1. Inject the secret in `app/build.gradle.kts` for instrumentation/testing:
+
+   ```kotlin
+   val localProperties = java.util.Properties().apply {
+       val localPropertiesFile = rootProject.file("local.properties")
+       if (localPropertiesFile.exists()) {
+           load(localPropertiesFile.inputStream())
+       }
+   }
+   val appCheckDebugToken = localProperties.getProperty("APP_CHECK_DEBUG_TOKEN")
+       ?: System.getenv("APP_CHECK_DEBUG_TOKEN") ?: ""
+
+   android {
+       defaultConfig {
+           // For normal emulator runs (injects into AndroidManifest)
+           manifestPlaceholders["firebaseAppCheckDebugSecret"] = appCheckDebugToken
+
+           // For instrumentation tests
+           if (appCheckDebugToken.isNotEmpty()) {
+               testInstrumentationRunnerArguments["firebaseAppCheckDebugSecret"] = appCheckDebugToken
+           }
+       }
+   }
+   ```
+
+1. In your application or activity, install the debug provider for debug builds:
+
+   ```kotlin
+   if (BuildConfig.DEBUG) {
+       Firebase.appCheck.installAppCheckProviderFactory(
+           DebugAppCheckProviderFactory.getInstance()
+       )
+   }
+   ```
+
+______________________________________________________________________
+
 ## Verification plan
 
 ### Manual verification

package/dist/global-skills/firebase-basics/references/ios_setup.md

@@ -111,3 +111,60 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
   }
 }
 ```
+
+## 4. App Check (Debug Token Persistence)
+
+When using App Check in local development or the iOS Simulator, the Firebase iOS
+SDK generates a new UUID debug token whenever `NSUserDefaults` is erased (such
+as during a simulator reset or fresh install). This causes debug token churn and
+invalidates tokens previously registered in the Firebase console.
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** App Check debug
+> tokens allow clients to bypass attestation and access backend resources
+> without a genuine device. Treat them as sensitive secrets. **Never commit
+> debug tokens into version control or hardcode them directly into source
+> code.** If a token is compromised, revoke it immediately in the Firebase
+> Console.
+
+To persist a stable debug token across simulator resets without committing
+secrets:
+
+1. Obtain or generate a stable UUID debug token and register it in the Firebase
+   Console under **Security > App Check > Apps > Manage debug tokens**.
+
+1. Supply `AppCheckDebugToken` via your local environment instead of hardcoding
+   it in code:
+
+   - **Xcode Scheme Environment Variables (Recommended):**
+
+     - Select **Product > Scheme > Edit Scheme...** (or `Cmd + <`).
+     - Navigate to **Run > Arguments > Environment Variables**.
+     - Add `AppCheckDebugToken = <YOUR_DEBUG_TOKEN>`.
+     - *Tip:* Keep your personal scheme unshared or ensure user scheme data
+       (`xcuserdata/`) is included in `.gitignore` so your personal debug token
+       is not committed.
+
+   - **In Code (Only with Secure / Gitignored Loading):** If setting the
+     environment variable in code before initializing
+     `AppCheckDebugProviderFactory`, load the token dynamically from a
+     gitignored local file or build configuration—never hardcode the raw token
+     string:
+
+     ```swift
+     #if DEBUG
+     // ⛔️ DO NOT hardcode literal tokens: setenv("AppCheckDebugToken", "secret-uuid", 0)
+     // ✅ SAFE: Load dynamically from a gitignored local file, xcconfig, or process environment
+     // Note: loadGitIgnoredDebugToken() is a placeholder for your custom helper (e.g., reading from a gitignored plist)
+     if let debugToken = loadGitIgnoredDebugToken() {
+       setenv("AppCheckDebugToken", debugToken, 0)
+     }
+     let providerFactory = AppCheckDebugProviderFactory()
+     AppCheck.setAppCheckProviderFactory(providerFactory)
+     #endif
+
+     FirebaseApp.configure() // Must be called AFTER setting the App Check provider factory
+     ```
+
+Setting this environment variable avoids invalidating tokens registered in the
+Firebase console by ensuring a consistent debug token is reused across simulator
+resets and fresh app installs.

package/dist/global-skills/firebase-basics/references/web_setup.md

@@ -75,3 +75,55 @@ async function getUsers() {
   });
 }
 ```
+
+## 5. App Check (Debug Token Persistence)
+
+When developing locally with App Check on Web, setting
+`self.FIREBASE_APPCHECK_DEBUG_TOKEN = true` generates a temporary UUID token in
+the browser console and stores it in browser storage (IndexedDB). Clearing site
+data, using incognito/private browsing, or switching browsers causes debug token
+churn and invalidates console registration.
+
+> [!WARNING] **CRITICAL: Never Hardcode or Commit Debug Tokens** App Check debug
+> tokens allow clients to bypass attestation and access backend resources
+> without a genuine client. Treat them as sensitive secrets. **Never commit
+> debug tokens to version control or hardcode raw token strings in client
+> files.** If a token is compromised, revoke it immediately in the Firebase
+> Console.
+
+To persist a stable debug token across browser resets without leaking secrets:
+
+1. Obtain or generate a stable UUID debug token and register it in the Firebase
+   Console under **Security > App Check > Apps > Manage debug tokens**.
+
+1. Add the token to a local, gitignored environment file (e.g. `.env.local`):
+
+   ```bash
+   # In .env.local (ensure this file is in your .gitignore!)
+   NEXT_PUBLIC_APP_CHECK_DEBUG_TOKEN="<YOUR_DEBUG_TOKEN>"
+   # Or for Vite:
+   # VITE_APPCHECK_DEBUG_TOKEN="<YOUR_DEBUG_TOKEN>"
+   ```
+
+1. Configure your code before initializing App Check:
+
+   ```javascript
+   import { initializeAppCheck, ReCaptchaEnterpriseProvider } from "firebase/app-check";
+
+   if (typeof self !== "undefined") {
+     if (typeof process !== "undefined" && process.env.NODE_ENV === "development") {
+       // ✅ SAFE: Load dynamically from Next.js environment variable; fallback to true to auto-generate
+       self.FIREBASE_APPCHECK_DEBUG_TOKEN =
+         process.env.NEXT_PUBLIC_APP_CHECK_DEBUG_TOKEN || true;
+     } else if (typeof import.meta !== "undefined" && import.meta.env?.DEV) {
+       // ✅ SAFE: Load dynamically from Vite environment variable; fallback to true to auto-generate
+       self.FIREBASE_APPCHECK_DEBUG_TOKEN =
+         import.meta.env.VITE_APPCHECK_DEBUG_TOKEN || true;
+     }
+   }
+
+   const appCheck = initializeAppCheck(app, {
+     provider: new ReCaptchaEnterpriseProvider("/* reCAPTCHA site key */"),
+     isTokenAutoRefreshEnabled: true,
+   });
+   ```

package/dist/global-skills/firebase-crashlytics/SKILL.md

@@ -3,6 +3,7 @@ name: firebase-crashlytics
 description: Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.
 compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.
 metadata:
+  author: Google LLC
   category: CloudObservabilityAndMonitoring
 disable-model-invocation: true
 ---