[REQUIRED] Environment info

firebase-tools: 15.7.0

Platform: macOS (reproduced), likely all platforms

[REQUIRED] Test case

// functions/index.ts
import { beforeUserSignedIn } from "firebase-functions/v2/identity";

export const beforeSignIn = beforeUserSignedIn(
  { region: "asia-northeast1" },
  (event) => {
    // any handler
  }
);

[REQUIRED] Steps to reproduce

  1. Create a v2 Auth Blocking Function using beforeUserSignedIn (as above)
  2. Run firebase deploy --only functions for the first time (create operation)
  3. Attempt to sign in to the Firebase project

[REQUIRED] Expected behavior

Sign-in succeeds. The Auth Blocking Function is registered with the .run.app URL in Identity Platform, which matches the audience expected by firebase-functions.

[REQUIRED] Actual behavior

Sign-in fails with the following error:

Firebase Auth Blocking token has incorrect "aud" (audience) claim.
Expected "run.app" but got "https://asia-northeast1-<project>.cloudfunctions.net/beforeSignIn".

The function deploys successfully but fails at runtime on the first deployment. On subsequent deployments (update operations), sign-in works correctly. The issue only affects the initial deployment.

FIX

#9922