{
 "action": "Not for automatic application — the patched example does not run on 14.5.0: exit code 1, ReferenceError: cert is not defined. Show this correction to the user as a lead. Replace the old line with the new one; the rest of the code can stay.",
 "agent_rule": "Apply a correction on your own only when the installed version is one it was checked on (versions.checked_on: versions.fails_on and every recheck) and its proof.auto_apply is true (proof.equivalent is true and proof.applicability.status is applies). On a newer version than those checked, a version between versions.works_on and versions.fails_on, or an unknown version, show it to the user as a lead and do not apply it; on versions.works_on or older it does not apply.",
 "alternatives": [
  {
   "action": "Not for automatic application — the patched example does not run on 14.5.0: exit code 1, TypeError: admin.auth is not a function. Show this correction to the user as a lead. Replace the old line with the new one; the rest of the code can stay.",
   "applicability": {
    "exit_code": 1,
    "line": 20,
    "method": "literal_patch",
    "occurrences": 1,
    "patched_sha": "22e17f9e10c8",
    "reason": "the patched example does not run on 14.5.0: exit code 1, TypeError: admin.auth is not a function",
    "run_on": "14.5.0",
    "status": "fails"
   },
   "by_notes": true,
   "changelog_ref": {
    "quote": "change: Remove Deprecated Legacy Namespace Support (#3164)",
    "url": "https://github.com/firebase/firebase-admin-node/releases/tag/v14.0.0"
   },
   "confirmations": 1,
   "detect": [
    "admin.credential.cert"
   ],
   "equivalence": "same",
   "format": "replace",
   "kind": "removed",
   "right": "credential: admin.cert({",
   "script_right": "const crypto = require('crypto');\nconst admin = require('firebase-admin');\nconst { getAuth } = require('firebase-admin/auth');\n\nasync function main() {\n  // Generate a 2048-bit RSA key pair at runtime\n  const { privateKey } = crypto.generateKeyPairSync('rsa', {\n    modulusLength: 2048,\n    publicKeyEncoding: {\n      type: 'spki',\n      format: 'pem',\n    },\n    privateKeyEncoding: {\n      type: 'pkcs8',\n      format: 'pem',\n    },\n  });\n\n  // Initialize firebase-admin with a service account credential using the generated private key\n  const app = admin.initializeApp({\n    credential: admin.cert({\n      projectId: 'test-project',\n      clientEmail: 'test-service-account@test-project.iam.gserviceaccount.com',\n      privateKey: privateKey,\n    }),\n  });\n\n  const uid = 'test-user-123';\n  const customClaims = { role: 'admin' };\n\n  // Create custom auth token (signed locally using the private key, no network call required)\n  const token = await getAuth(app).createCustomToken(uid, customClaims);\n\n  // Decode JWT payload (the second segment) without verifying\n  const payloadSegment = token.split('.')[1];\n  const payload = JSON.parse(Buffer.from(payloadSegment, 'base64url').toString('utf8'));\n\n  console.log('UID:', payload.uid);\n  console.log('Claims:', payload.claims);\n}\n\nmain().catch((error) => {\n  console.error(error);\n  process.exit(1);\n});",
   "script_wrong": "const crypto = require('crypto');\nconst admin = require('firebase-admin');\n\nasync function main() {\n  // Generate a 2048-bit RSA key pair at runtime\n  const { privateKey } = crypto.generateKeyPairSync('rsa', {\n    modulusLength: 2048,\n    publicKeyEncoding: {\n      type: 'spki',\n      format: 'pem',\n    },\n    privateKeyEncoding: {\n      type: 'pkcs8',\n      format: 'pem',\n    },\n  });\n\n  // Initialize firebase-admin with a service account credential using the generated private key\n  admin.initializeApp({\n    credential: admin.credential.cert({\n      projectId: 'test-project',\n      clientEmail: 'test-service-account@test-project.iam.gserviceaccount.com',\n      privateKey: privateKey,\n    }),\n  });\n\n  const uid = 'test-user-123';\n  const customClaims = { role: 'admin' };\n\n  // Create custom auth token (signed locally using the private key, no network call required)\n  const token = await admin.auth().createCustomToken(uid, customClaims);\n\n  // Decode JWT payload (the second segment) without verifying\n  const payloadSegment = token.split('.')[1];\n  const payload = JSON.parse(Buffer.from(payloadSegment, 'base64url').toString('utf8'));\n\n  console.log('UID:', payload.uid);\n  console.log('Claims:', payload.claims);\n}\n\nmain().catch((error) => {\n  console.error(error);\n  process.exit(1);\n});",
   "seen_in_models": [
    "gemini-3.8-flash"
   ],
   "wrong": "credential: admin.credential.cert({"
  }
 ],
 "applicability": {
  "exit_code": 1,
  "line": 20,
  "method": "literal_patch",
  "occurrences": 1,
  "patched_sha": "14bf41bf72e0",
  "reason": "the patched example does not run on 14.5.0: exit code 1, ReferenceError: cert is not defined",
  "run_on": "14.5.0",
  "status": "fails"
 },
 "by_notes": true,
 "changelog_ref": {
  "quote": "change: Remove Deprecated Legacy Namespace Support (#3164)",
  "url": "https://github.com/firebase/firebase-admin-node/releases/tag/v14.0.0"
 },
 "confirmations": {
  "failed": 0,
  "worked": 4
 },
 "detect": [
  "admin.credential.cert"
 ],
 "ecosystem": "npm",
 "equivalence": "same",
 "error_kind": "undefined_prop",
 "error_signature": {
  "message": "Cannot read properties of undefined (reading 'cert')",
  "norm": "undefined_prop:cert",
  "type": "TypeError"
 },
 "first_seen": "2026-10-28T08:02:31+00:00",
 "format": "replace",
 "format_version": 2,
 "id": "npm/firebase-admin/14.5.0/0001",
 "kind": "removed",
 "license": "https://creativecommons.org/licenses/by/4.0/",
 "package": "firebase-admin",
 "proof": {
  "applicability": {
   "exit_code": 1,
   "line": 20,
   "method": "literal_patch",
   "occurrences": 1,
   "patched_sha": "14bf41bf72e0",
   "reason": "the patched example does not run on 14.5.0: exit code 1, ReferenceError: cert is not defined",
   "run_on": "14.5.0",
   "status": "fails"
  },
  "auto_apply": false,
  "auto_apply_reason": "the patch gives fails when applied word for word",
  "auto_apply_rule": "Automatic application is allowed only when proof.equivalent is true and proof.applicability.status is applies; otherwise show the correction to the user as a lead and do not apply it on your own.",
  "equivalence": "same",
  "equivalent": true,
  "fails_on": "14.5.0",
  "fixed_on": "14.5.0",
  "level": "differential",
  "method": {
   "fix_on": "14.5.0",
   "name": "stdout_match",
   "normalization": "lines stripped, blank lines dropped, runs of whitespace collapsed; memory addresses, timestamps and temporary paths masked",
   "original_on": "13.7.0",
   "scope": "the observable stdout of one example script; return values, files, other inputs and exception types are not compared, so a match is not a proof of equivalent behaviour"
  },
  "script_right": "const crypto = require('crypto');\nconst { initializeApp, cert, deleteApp } = require('firebase-admin/app');\nconst { getAuth } = require('firebase-admin/auth');\n\nasync function main() {\n  // Generate an RSA key pair at runtime\n  const { privateKey } = crypto.generateKeyPairSync('rsa', {\n    modulusLength: 2048,\n    publicKeyEncoding: {\n      type: 'spki',\n      format: 'pem',\n    },\n    privateKeyEncoding: {\n      type: 'pkcs8',\n      format: 'pem',\n    },\n  });\n\n  // Initialize firebase-admin with a service account credential using the runtime key\n  const app = initializeApp({\n    credential: cert({\n      projectId: 'test-project',\n      clientEmail: 'test-service-account@test-project.iam.gserviceaccount.com',\n      privateKey: privateKey,\n    }),\n  });\n\n  // Create a custom auth token (signed locally via RSA-SHA256, no network required)\n  const customToken = await getAuth(app).createCustomToken('test-user-123', {\n    role: 'admin',\n  });\n\n  // Decode the token payload segment (the middle segment: header.payload.signature)\n  const payloadSegment = customToken.split('.')[1];\n  const decodedPayload = JSON.parse(\n    Buffer.from(payloadSegment, 'base64url').toString('utf8')\n  );\n\n  console.log('UID:', decodedPayload.uid);\n  console.log('Claims:', decodedPayload.claims);\n\n  await deleteApp(app);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});",
  "script_wrong": "const crypto = require('crypto');\nconst admin = require('firebase-admin');\n\nasync function main() {\n  // Generate an RSA key pair at runtime\n  const { privateKey } = crypto.generateKeyPairSync('rsa', {\n    modulusLength: 2048,\n    publicKeyEncoding: {\n      type: 'spki',\n      format: 'pem',\n    },\n    privateKeyEncoding: {\n      type: 'pkcs8',\n      format: 'pem',\n    },\n  });\n\n  // Initialize firebase-admin with a service account credential using the runtime key\n  const app = admin.initializeApp({\n    credential: admin.credential.cert({\n      projectId: 'test-project',\n      clientEmail: 'test-service-account@test-project.iam.gserviceaccount.com',\n      privateKey: privateKey,\n    }),\n  });\n\n  // Create a custom auth token (signed locally via RSA-SHA256, no network required)\n  const customToken = await admin.auth().createCustomToken('test-user-123', {\n    role: 'admin',\n  });\n\n  // Decode the token payload segment (the middle segment: header.payload.signature)\n  const payloadSegment = customToken.split('.')[1];\n  const decodedPayload = JSON.parse(\n    Buffer.from(payloadSegment, 'base64url').toString('utf8')\n  );\n\n  console.log('UID:', decodedPayload.uid);\n  console.log('Claims:', decodedPayload.claims);\n\n  await app.delete();\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});",
  "works_on": "13.7.0"
 },
 "right": "credential: cert({",
 "seen_in_models": [
  "gemini-3.8-flash",
  "gpt-6.1-sol"
 ],
 "seq": 1,
 "slug": "admin-credential",
 "source": "pipeline",
 "symbol": "admin.credential",
 "updated": "2026-10-28T08:02:32+00:00",
 "url": "https://formachines.ai/errata/npm/firebase-admin/0001-admin-credential/",
 "variant_confirmations": 3,
 "variant_models": [
  "gemini-3.8-flash",
  "gpt-6.1-sol"
 ],
 "verified": "sandbox",
 "versions": {
  "changed_in": ">13.7.0,<=14.5.0",
  "checked_on": [
   "14.5.0"
  ],
  "fails_on": "14.5.0",
  "works_on": "13.7.0"
 },
 "wrong": "credential: admin.credential.cert({"
}