build(deps): bump all package and workflow dependencies

Author: mikehardy

.github/workflows/e2e.yaml

@@ -41,12 +41,12 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          version: 10.34.4
+          version: 11.9.0
 
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22.13.0
+          node-version: 24.18.0
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
 

.github/workflows/lint.yaml

@@ -21,12 +21,12 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '22.13.0'
+          node-version: '24.18.0'
 
       - name: Setup pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          version: 10.34.4
+          version: 11.9.0
 
       - name: Install addlicense
         run: |

.github/workflows/test.yaml

@@ -19,13 +19,13 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22.13.0
+          node-version: 24.18.0
           check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          version: 10.34.4
+          version: 11.9.0
 
       - name: Install addlicense
         run: |
@@ -39,7 +39,7 @@ jobs:
         run: pnpm run build
 
       - name: Install Firebase CLI
-        run: npm i -g firebase-tools@14.15.2
+        run: npm i -g firebase-tools@15.22.4
 
       - name: Enable webframeworks experiment
         run: firebase experiments:enable webframeworks

AGENTS.md

@@ -9,4 +9,6 @@ For architecture or testing work, also read:
 * [developer-docs/decisions.md](developer-docs/decisions.md) — `AD-<number>` decision log
 * [developer-docs/work-queues/playwright-e2e-smoke.md](developer-docs/work-queues/playwright-e2e-smoke.md) — active Playwright backlog
 
+**Before commit or push** on dependency, CI, workflow, or e2e/example changes: complete [developer-docs/playbooks/change-authoring-verification.md](developer-docs/playbooks/change-authoring-verification.md) ([AD-10](developer-docs/decisions.md#ad-10-change-authoring-requires-ci-parity-verification-before-commit)). Dependency bumps: also [dependency-update-verification.md](developer-docs/playbooks/dependency-update-verification.md).
+
 Human onboarding (commands, emulator): [LOCAL_DEVELOPMENT.md](LOCAL_DEVELOPMENT.md) owns that content; do not duplicate here.

LOCAL_DEVELOPMENT.md

@@ -6,7 +6,7 @@ This guide walks you through running FirebaseUI Web locally so you can test feat
 
 Make sure you have these installed:
 
-- [Node.js](https://nodejs.org/) v18+ (CI uses v22 — matching this avoids surprises)
+- [Node.js](https://nodejs.org/) v18+ locally; **CI uses v24** — use Node 24 for pre-push verification to match CI ([change-authoring-verification.md](developer-docs/playbooks/change-authoring-verification.md))
 - [pnpm](https://pnpm.io/) — if you have Node.js 18+, [corepack](https://nodejs.org/api/corepack.html) can install pnpm on demand when you run it
 - [Firebase CLI](https://firebase.google.com/docs/cli):
   ```bash

cloudbuild.yaml

@@ -7,7 +7,7 @@ options:
   logging: CLOUD_LOGGING_ONLY
 
 steps:
-  - name: "node:22"
+  - name: "node:24"
     entrypoint: "bash"
     args:
       - "-c"
@@ -19,7 +19,7 @@ steps:
   # 3. Publish to NPM
   # This step authenticates using the secret token and handles both
   # single-package and monorepo (workspaces) structures.
-  - name: "node:22"
+  - name: "node:24"
     entrypoint: "bash"
     args:
       - "-c"

developer-docs/architecture/testing-strategy.md

@@ -29,6 +29,6 @@ timestamp: 2026-07-03T00:00:00Z
 * Production build artifacts not exercised by e2e — deferred, [AD-8](../decisions.md#ad-8-production-artifact-e2e-deferred-future-phase).
 * `pnpm audit` not gated in CI.
 
-# Post-dependency-update gate (target)
+# Post-dependency-update gate
 
-See [playbooks/dependency-update-verification.md](../playbooks/dependency-update-verification.md).
+Required before commit: [playbooks/change-authoring-verification.md](../playbooks/change-authoring-verification.md) ([AD-10](../decisions.md#ad-10-change-authoring-requires-ci-parity-verification-before-commit)). Dependency-specific steps: [playbooks/dependency-update-verification.md](../playbooks/dependency-update-verification.md).

developer-docs/decisions.md

@@ -3,7 +3,7 @@ type: Decision Log
 title: Architecture decisions
 description: Sequential decision log for firebaseui-web. Entries use AD-number identifiers.
 tags: [adr, architecture]
-timestamp: 2026-07-01T00:00:00Z
+timestamp: 2026-07-03T00:00:00Z
 ---
 
 Decisions follow the shape in [ADR format (mattpocock)](https://github.com/mattpocock/skills/blob/main/skills/engineering/domain-modeling/ADR-FORMAT.md) (read that spec only during documentation maintenance runs).
@@ -57,3 +57,42 @@ Browser smoke runs in its **own workflow**, not folded into the unit `test.yaml`
 ## AD-8: Production-artifact e2e deferred (future phase)
 
 MVP validates **dev-server runtime only**. Validating built/deployed artifacts — Next.js SSG `output: "export"`, Angular production build, `next start` SSR, and `firebase.json` hosting rewrites — is a recognized gap: dev mode auto-connects the emulator via `import.meta.env.MODE` / `process.env.NODE_ENV` / `isDevMode()`, so production builds would need explicit emulator wiring. This is tracked as a **future design phase and is intentionally NOT in the MVP work queue** ([work-queues/playwright-e2e-smoke.md](work-queues/playwright-e2e-smoke.md)).
+
+---
+
+## AD-9: Firebase JS SDK version policy (v11 resolved, v12 for consumers)
+
+The monorepo **resolves** `firebase` **11.x** in the pnpm catalog (`^11.10.0` today). That is **not a regression** from a stable v12 baseline: catalog `^12.2.1` existed only briefly during the Sep 2025 catalog migration and was reverted; main has used catalog **11.x since Sep 2025** ([commit a275905a](https://github.com/firebase/firebaseui-web/commit/a275905a7598cb9d9e1be2250befc840334e8ab2) — peer range widened to `^11 || ^12` while keeping catalog 11 for AngularFire).
+
+**Why catalog 11:** `@angular/fire@20.0.1` depends on `firebase ^11.8.0` and `rxfire ^6.1.0` (rxfire peers firebase through **^11**). `@firebase-oss/ui-angular` imports both `@angular/fire/auth` and `firebase/auth` directly; forcing catalog **12** duplicates SDK types at compile time (e.g. `RecaptchaVerifier`, `TotpSecret`) — same class of failure as [angular/angularfire#3666](https://github.com/angular/angularfire/issues/3666).
+
+**Consumer policy:** package **peer** catalog stays **`firebase: ^11 || ^12`** — apps embedding `@firebase-oss/ui-*` may install firebase 12; published packages must remain compatible with both majors where types overlap.
+
+**Angular paths (explicit pin):** `packages/angular` and `examples/angular` keep a **non-catalog** devDependency pin (e.g. `"firebase": "^11.10.0"`) aligned with `@angular/fire`, not the workspace catalog entry.
+
+**Optional internal split (prove v12 sooner):** bump catalog `firebase` to **12.x** for core/react/shadcn and non-angular examples (`"firebase": "catalog:"`); leave angular packages on explicit **11.x** pins so pnpm can install both majors. Validate with `pnpm build`, `pnpm test`, and `pnpm test:e2e` (especially `@firebase-oss/ui-angular` and the angular example). Do **not** use a workspace-wide `pnpm.overrides` forcing firebase 12 — that breaks AngularFire immediately.
+
+**Upstream to track (harmonize on v12 later):**
+
+| Track | Link |
+|-------|------|
+| Firebase 12 on AngularFire v20 | [angular/angularfire#3666](https://github.com/angular/angularfire/issues/3666) |
+| AngularFire v21 (Angular 21 + firebase 12) | [21.0.0-rc.0 release](https://github.com/angular/angularfire/releases/tag/21.0.0-rc.0), [angular/angularfire#3689](https://github.com/angular/angularfire/issues/3689) |
+| rxfire firebase 12 (blocks AngularFire 21) | [FirebaseExtended/rxfire#123](https://github.com/FirebaseExtended/rxfire/pull/123) |
+| Firebase JS SDK releases | [firebase-js-sdk releases](https://github.com/firebase/firebase-js-sdk/releases), [Firebase JS release notes](https://firebase.google.com/support/release-notes/js) |
+
+**Unlock:** when **AngularFire 21 stable** (and rxfire firebase 12) ships, bump `@angular/fire`, angular pins, and catalog together in one verified change.
+
+Owner for catalog/peer fields: [pnpm-workspace.yaml](../pnpm-workspace.yaml). Verification steps: [playbooks/change-authoring-verification.md](playbooks/change-authoring-verification.md), [playbooks/dependency-update-verification.md](playbooks/dependency-update-verification.md).
+
+---
+
+## AD-10: Change authoring requires CI-parity verification before commit
+
+Authors (human or agent) **must not commit or push** changes that touch dependencies, CI workflows, or example/test harnesses until [change-authoring-verification.md](playbooks/change-authoring-verification.md) **Required sequence** completes locally with exit code 0.
+
+**Why:** CI runs `pnpm test:e2e` and builds `custom-auth-server` on demand; root `pnpm build` does not. Skipping e2e or custom-auth-server build allowed firebase-admin 14 and jsdom/`localStorage` test drift to land while local `pnpm test` + `pnpm build` passed on a different Node version.
+
+**Includes:** run on the **same Node major as CI** ([LOCAL_DEVELOPMENT.md](../LOCAL_DEVELOPMENT.md)). Use the playbook one-shot script for dependency PRs.
+
+**Does not replace** code review or CI; it is the minimum pre-commit bar for change classes above.

developer-docs/index.md

@@ -25,6 +25,7 @@ OKF knowledge bundle for firebaseui-web: architecture, decisions, playbooks, and
 
 # Playbooks
 
+- [playbooks/change-authoring-verification.md](playbooks/change-authoring-verification.md) — **required before commit/push** on deps, CI, or e2e changes ([AD-10](decisions.md#ad-10-change-authoring-requires-ci-parity-verification-before-commit))
 - [playbooks/dependency-update-verification.md](playbooks/dependency-update-verification.md) — verify monorepo after dependency bumps
 
 # Work queues

developer-docs/playbooks/change-authoring-verification.md

@@ -0,0 +1,75 @@
+---
+type: Playbook
+title: Change authoring verification
+description: Mandatory local verification before commit or push when a change can affect CI outcomes.
+tags: [ci, testing, agents, dependencies]
+timestamp: 2026-07-03T00:00:00Z
+---
+
+# When to use
+
+Before **commit or push** on any change that touches:
+
+* `pnpm-workspace.yaml`, lockfile, or `package.json` files (including examples)
+* `.github/workflows/**`, `cloudbuild.yaml`, or Node/pnpm/CI tool versions
+* test harness, e2e, or example apps consumed by CI
+
+Normative gate: [AD-10](../decisions.md#ad-10-change-authoring-requires-ci-parity-verification-before-commit). Agents: [AGENTS.md](../../AGENTS.md) points here.
+
+# Runtime
+
+Use the **same Node major as CI** (see [LOCAL_DEVELOPMENT.md](../../LOCAL_DEVELOPMENT.md)). Local Node 26+ can pass tests that fail on CI Node 24 (e.g. jsdom `localStorage` behavior).
+
+# CI parity matrix
+
+| CI job | Workflow | Local command | Notes |
+|--------|----------|---------------|-------|
+| Lint and Format Check | `lint.yaml` | `pnpm lint:check` && `pnpm format:check` | |
+| Test | `test.yaml` | `pnpm build` then `pnpm test` | CI starts Auth emulator; skipped integration tests do not need it |
+| E2E | `e2e.yaml` | `pnpm test:e2e` | Auth emulator via Playwright `globalSetup`; serial, ~minutes |
+
+# Gaps `pnpm build` does not cover
+
+Root `pnpm build` **does not** compile `examples/custom-auth-server`. E2E builds it on demand — a deps bump can break e2e while `pnpm build` passes.
+
+**Required extra step** when `examples/custom-auth-server` or its deps change:
+
+```bash
+pnpm --filter custom-auth-server run build
+```
+
+Or rely on full `pnpm test:e2e` (includes that build).
+
+# Required sequence (all must exit 0)
+
+Run in order; do not commit until complete:
+
+1. `pnpm install`
+2. `pnpm build`
+3. `pnpm --filter custom-auth-server run build` — if custom-auth-server or firebase-admin/admin deps touched; always safe for deps PRs
+4. `pnpm test`
+5. `pnpm lint:check` && `pnpm format:check`
+6. `pnpm test:e2e`
+
+Dependency-only bumps: also follow [dependency-update-verification.md](dependency-update-verification.md) (audit, AD-9).
+
+# One-shot script (deps / CI-affecting PRs)
+
+```bash
+pnpm install && \
+pnpm build && \
+pnpm --filter custom-auth-server run build && \
+pnpm test && \
+pnpm lint:check && \
+pnpm format:check && \
+pnpm test:e2e
+```
+
+# Owners
+
+| Topic | Document |
+|-------|----------|
+| Test layers | [architecture/testing-strategy.md](../architecture/testing-strategy.md) |
+| Dependency bumps | [dependency-update-verification.md](dependency-update-verification.md) |
+| E2E scope | [decisions.md](../decisions.md) AD-3, AD-4, AD-6 |
+| Local emulator | [LOCAL_DEVELOPMENT.md](../../LOCAL_DEVELOPMENT.md) |