@aglyn/tenant-feature-instance 1.0.0-beta.143

package/src/lib/hooks/firebase/auth-persistence.d.ts

@@ -0,0 +1,74 @@
+import { type FirebaseApp } from 'firebase/app';
+import { type Auth } from 'firebase/auth';
+/**
+ * How much of a session an origin is allowed to keep (AGL-1379).
+ *
+ * - `durable` — the SDK default hierarchy (IndexedDB → localStorage →
+ *   sessionStorage). A **refresh token lands on disk in plaintext**, which is
+ *   correct on `*.aglyn.com`: we own the DNS forever, and a 14-day session is
+ *   the product.
+ * - `ephemeral` — `initializeAuth(app, { persistence: inMemoryPersistence })`
+ *   with **no `popupRedirectResolver`**, per AGL-1099a D6. For a **custom
+ *   console domain**, whose DNS the customer can re-point at their own server
+ *   after a detach: a refresh token left in that origin's IndexedDB is a
+ *   durable account-takeover primitive that no cookie TTL and no server-side
+ *   revocation short of `revokeRefreshTokens` can reach.
+ *
+ * The class is a property of the **instance**, not of any call site, which is
+ * why it is declared here and nowhere else — see `createAuthInstance`.
+ */
+export type AuthPersistenceClass = 'durable' | 'ephemeral';
+/** `code` on {@link SealedAuthPersistenceError}, shaped like a Firebase error code. */
+export declare const AUTH_PERSISTENCE_SEALED_CODE = "aglyn-auth/persistence-sealed";
+/**
+ * Thrown when something tries to re-persist an `ephemeral` auth instance.
+ *
+ * Thrown **synchronously**, deliberately, even though `setPersistence` is
+ * typed `Promise<void>`. That matches how the SDK already refuses the
+ * federated family on a resolver-less instance (`signInWithPopup` and friends
+ * throw `auth/argument-error` before any network request, measured in
+ * `docs/design/agl-1099a-poc-findings.md` §3), and it means a fire-and-forget
+ * `void setPersistence(...)` fails loudly instead of becoming an unhandled
+ * rejection nobody reads.
+ */
+export declare class SealedAuthPersistenceError extends Error {
+    readonly code = "aglyn-auth/persistence-sealed";
+    constructor();
+}
+/**
+ * Is `setPersistence` sealed on this instance? A diagnostic, not a boundary —
+ * the boundary is the property descriptor itself.
+ */
+export declare function isAuthPersistenceSealed(auth: Auth): boolean;
+/**
+ * The only way an Aglyn `Auth` instance is born, and the persistence class is
+ * a **required positional argument** (AGL-1379).
+ *
+ * ## Why this shape
+ *
+ * The thing that has to be guarded is a `setPersistence` call passing
+ * `browserLocalPersistence`, which the PoC measured flipping a refresh token
+ * from absent to present in IndexedDB on an in-memory instance — accepted at
+ * runtime, no error, no warning.
+ *
+ * - **A lint rule cannot classify it.** Whether a given `setPersistence` call
+ *   is safe depends on which host the browser is on, and the same source file
+ *   serves both. `apps/console/utils/passkeys.ts:133` is *correct* on
+ *   `app.aglyn.com` and *fatal* on `console.acme-agency.com`. A rule banning
+ *   the call would be false half the time, and AGL-1357's lesson — derive the
+ *   classification from what the code declares — has nothing to derive from
+ *   at these call sites, because nothing there declares the instance's class.
+ * - **A wrapper the six sites go through is bypassable** by the next person
+ *   who imports `setPersistence` from `firebase/auth` directly, which is what
+ *   all six already do.
+ * - **A required argument works only where the class is knowable**, and that
+ *   is here, at creation — the AGL-1366 shape (`setNode`'s required `parent`)
+ *   applied at the one place it is honest. Every creation site must now say
+ *   which kind of origin it is on, and the guard rides the instance from
+ *   there.
+ *
+ * `durable` is the SDK default, reached by the exact `getAuth(app)` the
+ * console has always called — this factory changes nothing about how
+ * `*.aglyn.com` persists.
+ */
+export declare function createAuthInstance(app: FirebaseApp, persistenceClass: AuthPersistenceClass): Auth;

package/src/lib/hooks/firebase/auth-persistence.js

@@ -0,0 +1,117 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { getAuth, inMemoryPersistence, initializeAuth } from "firebase/auth";
+/** `code` on {@link SealedAuthPersistenceError}, shaped like a Firebase error code. */ export const AUTH_PERSISTENCE_SEALED_CODE = 'aglyn-auth/persistence-sealed';
+/**
+ * Thrown when something tries to re-persist an `ephemeral` auth instance.
+ *
+ * Thrown **synchronously**, deliberately, even though `setPersistence` is
+ * typed `Promise<void>`. That matches how the SDK already refuses the
+ * federated family on a resolver-less instance (`signInWithPopup` and friends
+ * throw `auth/argument-error` before any network request, measured in
+ * `docs/design/agl-1099a-poc-findings.md` §3), and it means a fire-and-forget
+ * `void setPersistence(...)` fails loudly instead of becoming an unhandled
+ * rejection nobody reads.
+ */ export class SealedAuthPersistenceError extends Error {
+    constructor(){
+        super('setPersistence is sealed on this Auth instance: it was created with ' + "persistence class 'ephemeral' (AGL-1099a D6), so persisting a " + 'refresh token to this origin is not permitted. If this origin may ' + "keep a session, create its Auth instance as 'durable' — do not " + 'change persistence after the fact (AGL-1379).'), this.code = AUTH_PERSISTENCE_SEALED_CODE;
+        this.name = 'SealedAuthPersistenceError';
+    }
+}
+/**
+ * Is `setPersistence` sealed on this instance? A diagnostic, not a boundary —
+ * the boundary is the property descriptor itself.
+ */ export function isAuthPersistenceSealed(auth) {
+    const descriptor = Object.getOwnPropertyDescriptor(auth, 'setPersistence');
+    return !!descriptor && descriptor.writable === false && descriptor.configurable === false;
+}
+/**
+ * Make `setPersistence` unrepresentable on this instance.
+ *
+ * The modular `setPersistence(auth, persistence)` is a one-line delegation —
+ * `getModularInstance(auth).setPersistence(persistence)` (verified in
+ * `@firebase/auth` 1.13.3) — so an own, non-writable, non-configurable
+ * property shadowing the prototype method closes **every** route that goes
+ * through the object: the free function, the method, a wrapper, an aliased
+ * import, and any call site nobody has written yet. That is the point. The
+ * six existing `setPersistence` call sites did not have to be touched, and
+ * the seventh nobody has typed yet is covered too.
+ *
+ * Deliberate limit, stated rather than overclaimed: a caller who reaches
+ * around the instance — pulling the method off `Object.getPrototypeOf(auth)`
+ * and `call`-ing it — is not stopped. Overriding the prototype would seal
+ * every `Auth` in the process, including the `durable` ones this file exists
+ * to leave alone.
+ */ function sealPersistence(auth) {
+    // Idempotent: `initializeAuth` returns the existing instance when called
+    // twice with deep-equal options, and `usePresence` re-enters its effect on
+    // every room change. Re-defining a non-configurable property is a
+    // TypeError, so the second pass must be a no-op rather than a crash.
+    if (isAuthPersistenceSealed(auth)) return auth;
+    Object.defineProperty(auth, 'setPersistence', {
+        value: ()=>{
+            throw new SealedAuthPersistenceError();
+        },
+        writable: false,
+        configurable: false,
+        enumerable: false
+    });
+    return auth;
+}
+/**
+ * The only way an Aglyn `Auth` instance is born, and the persistence class is
+ * a **required positional argument** (AGL-1379).
+ *
+ * ## Why this shape
+ *
+ * The thing that has to be guarded is a `setPersistence` call passing
+ * `browserLocalPersistence`, which the PoC measured flipping a refresh token
+ * from absent to present in IndexedDB on an in-memory instance — accepted at
+ * runtime, no error, no warning.
+ *
+ * - **A lint rule cannot classify it.** Whether a given `setPersistence` call
+ *   is safe depends on which host the browser is on, and the same source file
+ *   serves both. `apps/console/utils/passkeys.ts:133` is *correct* on
+ *   `app.aglyn.com` and *fatal* on `console.acme-agency.com`. A rule banning
+ *   the call would be false half the time, and AGL-1357's lesson — derive the
+ *   classification from what the code declares — has nothing to derive from
+ *   at these call sites, because nothing there declares the instance's class.
+ * - **A wrapper the six sites go through is bypassable** by the next person
+ *   who imports `setPersistence` from `firebase/auth` directly, which is what
+ *   all six already do.
+ * - **A required argument works only where the class is knowable**, and that
+ *   is here, at creation — the AGL-1366 shape (`setNode`'s required `parent`)
+ *   applied at the one place it is honest. Every creation site must now say
+ *   which kind of origin it is on, and the guard rides the instance from
+ *   there.
+ *
+ * `durable` is the SDK default, reached by the exact `getAuth(app)` the
+ * console has always called — this factory changes nothing about how
+ * `*.aglyn.com` persists.
+ */ export function createAuthInstance(app, persistenceClass) {
+    if (persistenceClass === 'ephemeral') {
+        // No `popupRedirectResolver`: D6's second half. The auth helper iframe is
+        // never loaded, so the custom domain needs no `frame-ancestors` entry and
+        // can never need a Firebase authorized-domain entry for OAuth.
+        return sealPersistence(initializeAuth(app, {
+            persistence: inMemoryPersistence
+        }));
+    }
+    return getAuth(app);
+}
+
+//# sourceMappingURL=auth-persistence.js.map

package/src/lib/hooks/firebase/auth-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/auth-persistence.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { type FirebaseApp } from 'firebase/app'\nimport {\n  type Auth,\n  getAuth,\n  inMemoryPersistence,\n  initializeAuth,\n} from 'firebase/auth'\n\n/**\n * How much of a session an origin is allowed to keep (AGL-1379).\n *\n * - `durable` — the SDK default hierarchy (IndexedDB → localStorage →\n *   sessionStorage). A **refresh token lands on disk in plaintext**, which is\n *   correct on `*.aglyn.com`: we own the DNS forever, and a 14-day session is\n *   the product.\n * - `ephemeral` — `initializeAuth(app, { persistence: inMemoryPersistence })`\n *   with **no `popupRedirectResolver`**, per AGL-1099a D6. For a **custom\n *   console domain**, whose DNS the customer can re-point at their own server\n *   after a detach: a refresh token left in that origin's IndexedDB is a\n *   durable account-takeover primitive that no cookie TTL and no server-side\n *   revocation short of `revokeRefreshTokens` can reach.\n *\n * The class is a property of the **instance**, not of any call site, which is\n * why it is declared here and nowhere else — see `createAuthInstance`.\n */\nexport type AuthPersistenceClass = 'durable' | 'ephemeral'\n\n/** `code` on {@link SealedAuthPersistenceError}, shaped like a Firebase error code. */\nexport const AUTH_PERSISTENCE_SEALED_CODE = 'aglyn-auth/persistence-sealed'\n\n/**\n * Thrown when something tries to re-persist an `ephemeral` auth instance.\n *\n * Thrown **synchronously**, deliberately, even though `setPersistence` is\n * typed `Promise<void>`. That matches how the SDK already refuses the\n * federated family on a resolver-less instance (`signInWithPopup` and friends\n * throw `auth/argument-error` before any network request, measured in\n * `docs/design/agl-1099a-poc-findings.md` §3), and it means a fire-and-forget\n * `void setPersistence(...)` fails loudly instead of becoming an unhandled\n * rejection nobody reads.\n */\nexport class SealedAuthPersistenceError extends Error {\n  readonly code = AUTH_PERSISTENCE_SEALED_CODE\n  constructor() {\n    super(\n      'setPersistence is sealed on this Auth instance: it was created with ' +\n        \"persistence class 'ephemeral' (AGL-1099a D6), so persisting a \" +\n        'refresh token to this origin is not permitted. If this origin may ' +\n        \"keep a session, create its Auth instance as 'durable' — do not \" +\n        'change persistence after the fact (AGL-1379).',\n    )\n    this.name = 'SealedAuthPersistenceError'\n  }\n}\n\n/**\n * Is `setPersistence` sealed on this instance? A diagnostic, not a boundary —\n * the boundary is the property descriptor itself.\n */\nexport function isAuthPersistenceSealed(auth: Auth): boolean {\n  const descriptor = Object.getOwnPropertyDescriptor(auth, 'setPersistence')\n  return (\n    !!descriptor && descriptor.writable === false && descriptor.configurable === false\n  )\n}\n\n/**\n * Make `setPersistence` unrepresentable on this instance.\n *\n * The modular `setPersistence(auth, persistence)` is a one-line delegation —\n * `getModularInstance(auth).setPersistence(persistence)` (verified in\n * `@firebase/auth` 1.13.3) — so an own, non-writable, non-configurable\n * property shadowing the prototype method closes **every** route that goes\n * through the object: the free function, the method, a wrapper, an aliased\n * import, and any call site nobody has written yet. That is the point. The\n * six existing `setPersistence` call sites did not have to be touched, and\n * the seventh nobody has typed yet is covered too.\n *\n * Deliberate limit, stated rather than overclaimed: a caller who reaches\n * around the instance — pulling the method off `Object.getPrototypeOf(auth)`\n * and `call`-ing it — is not stopped. Overriding the prototype would seal\n * every `Auth` in the process, including the `durable` ones this file exists\n * to leave alone.\n */\nfunction sealPersistence(auth: Auth): Auth {\n  // Idempotent: `initializeAuth` returns the existing instance when called\n  // twice with deep-equal options, and `usePresence` re-enters its effect on\n  // every room change. Re-defining a non-configurable property is a\n  // TypeError, so the second pass must be a no-op rather than a crash.\n  if (isAuthPersistenceSealed(auth)) return auth\n  Object.defineProperty(auth, 'setPersistence', {\n    value: (): Promise<void> => {\n      throw new SealedAuthPersistenceError()\n    },\n    writable: false,\n    configurable: false,\n    enumerable: false,\n  })\n  return auth\n}\n\n/**\n * The only way an Aglyn `Auth` instance is born, and the persistence class is\n * a **required positional argument** (AGL-1379).\n *\n * ## Why this shape\n *\n * The thing that has to be guarded is a `setPersistence` call passing\n * `browserLocalPersistence`, which the PoC measured flipping a refresh token\n * from absent to present in IndexedDB on an in-memory instance — accepted at\n * runtime, no error, no warning.\n *\n * - **A lint rule cannot classify it.** Whether a given `setPersistence` call\n *   is safe depends on which host the browser is on, and the same source file\n *   serves both. `apps/console/utils/passkeys.ts:133` is *correct* on\n *   `app.aglyn.com` and *fatal* on `console.acme-agency.com`. A rule banning\n *   the call would be false half the time, and AGL-1357's lesson — derive the\n *   classification from what the code declares — has nothing to derive from\n *   at these call sites, because nothing there declares the instance's class.\n * - **A wrapper the six sites go through is bypassable** by the next person\n *   who imports `setPersistence` from `firebase/auth` directly, which is what\n *   all six already do.\n * - **A required argument works only where the class is knowable**, and that\n *   is here, at creation — the AGL-1366 shape (`setNode`'s required `parent`)\n *   applied at the one place it is honest. Every creation site must now say\n *   which kind of origin it is on, and the guard rides the instance from\n *   there.\n *\n * `durable` is the SDK default, reached by the exact `getAuth(app)` the\n * console has always called — this factory changes nothing about how\n * `*.aglyn.com` persists.\n */\nexport function createAuthInstance(\n  app: FirebaseApp,\n  persistenceClass: AuthPersistenceClass,\n): Auth {\n  if (persistenceClass === 'ephemeral') {\n    // No `popupRedirectResolver`: D6's second half. The auth helper iframe is\n    // never loaded, so the custom domain needs no `frame-ancestors` entry and\n    // can never need a Firebase authorized-domain entry for OAuth.\n    return sealPersistence(initializeAuth(app, { persistence: inMemoryPersistence }))\n  }\n  return getAuth(app)\n}\n"],"names":["getAuth","inMemoryPersistence","initializeAuth","AUTH_PERSISTENCE_SEALED_CODE","SealedAuthPersistenceError","Error","code","name","isAuthPersistenceSealed","auth","descriptor","Object","getOwnPropertyDescriptor","writable","configurable","sealPersistence","defineProperty","value","enumerable","createAuthInstance","app","persistenceClass","persistence"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;AAGA,SAEEA,OAAO,EACPC,mBAAmB,EACnBC,cAAc,QACT,gBAAe;AAqBtB,qFAAqF,GACrF,OAAO,MAAMC,+BAA+B,gCAA+B;AAE3E;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,mCAAmCC;IAE9C,aAAc;QACZ,KAAK,CACH,yEACE,mEACA,uEACA,oEACA,uDAPGC,OAAOH;QASd,IAAI,CAACI,IAAI,GAAG;IACd;AACF;AAEA;;;CAGC,GACD,OAAO,SAASC,wBAAwBC,IAAU;IAChD,MAAMC,aAAaC,OAAOC,wBAAwB,CAACH,MAAM;IACzD,OACE,CAAC,CAACC,cAAcA,WAAWG,QAAQ,KAAK,SAASH,WAAWI,YAAY,KAAK;AAEjF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,SAASC,gBAAgBN,IAAU;IACjC,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,qEAAqE;IACrE,IAAID,wBAAwBC,OAAO,OAAOA;IAC1CE,OAAOK,cAAc,CAACP,MAAM,kBAAkB;QAC5CQ,OAAO;YACL,MAAM,IAAIb;QACZ;QACAS,UAAU;QACVC,cAAc;QACdI,YAAY;IACd;IACA,OAAOT;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASU,mBACdC,GAAgB,EAChBC,gBAAsC;IAEtC,IAAIA,qBAAqB,aAAa;QACpC,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAON,gBAAgBb,eAAekB,KAAK;YAAEE,aAAarB;QAAoB;IAChF;IACA,OAAOD,QAAQoB;AACjB"}

package/src/lib/hooks/firebase/firebase-services.d.ts

@@ -0,0 +1,172 @@
+import { type FirebaseApp, type FirebaseOptions } from 'firebase/app';
+import { type Analytics } from 'firebase/analytics';
+import { type Auth, type User } from 'firebase/auth';
+import { type Firestore } from 'firebase/firestore';
+import { type RemoteConfig } from 'firebase/remote-config';
+import { type ReactNode } from 'react';
+import { type AuthPersistenceClass } from './auth-persistence';
+/**
+ * Drop-in replacement for reactfire's `ObservableStatus<T>` — reactfire is
+ * unmaintained against firebase majors past v9, but its shape is preserved
+ * here so `helpers/use-doc.ts`'s already-battle-tested onSnapshot+retry
+ * implementation (AGL-216/223) didn't need to change.
+ */
+export interface ObservableStatus<T> {
+    status: 'loading' | 'error' | 'success';
+    hasEmitted: boolean;
+    isComplete: boolean;
+    data: T;
+    error: Error | undefined;
+    firstValuePromise: Promise<void>;
+    /**
+     * The emitted `data` includes local writes the server has NOT
+     * acknowledged (`snapshot.metadata.hasPendingWrites`).
+     *
+     * Carried rather than dropped because a caller cannot otherwise tell "the
+     * store holds this" from "my browser holds this". `persistentLocalCache`
+     * replays a queued write into the very first snapshot after a reload, so a
+     * caller that treats every snapshot as authoritative will adopt its own
+     * unacknowledged edit as the saved state — which is how the besigner ended
+     * up unable to save real changes (AGL-1262).
+     */
+    hasPendingWrites: boolean;
+    /**
+     * The emitted `data` came from the local cache and the server has NOT
+     * confirmed it (`snapshot.metadata.fromCache`).
+     *
+     * Carried because it is the only per-listener ground truth about
+     * freshness the SDK offers, and the console needs it (AGL-1066). Under
+     * `persistentLocalCache` a listener whose server listen is being REFUSED
+     * still emits cached snapshots and still reports `status: 'success'` —
+     * the retry budget is reset by each cached emission and never spends, so
+     * `status` can never reveal the fault (see
+     * `use-firestore-collection-cached-retry.spec.ts`).
+     *
+     * Prefer this over `session-health`'s `staleSession` for anything that
+     * asks "is what I am looking at live?". `staleSession` is a heuristic
+     * needing two denied collections inside a window, and it is unreachable
+     * on listener-only pages; this is a fact about THIS listener, costs
+     * nothing, and clears itself the instant a server snapshot lands.
+     */
+    fromCache: boolean;
+    /**
+     * The server has REFUSED this listen for longer than the retry budget, and
+     * no server snapshot has arrived since (AGL-1066).
+     *
+     * `fromCache` says "unconfirmed", which is also true offline and true for
+     * the first snapshot of a perfectly healthy load. This says "refused" —
+     * only `permission-denied` counts it, and it takes a whole budget's worth
+     * in a row, so it cannot fire offline and cannot fire on the AGL-216/217
+     * post-sign-in token race.
+     *
+     * It is what `status` would say if the retry budget were spendable. It is
+     * carried separately because correcting `status` in place would blank
+     * every surface that renders cached data through an `error` branch — see
+     * the note on `attempt = 0` in `use-firestore-collection`.
+     */
+    serverDenied: boolean;
+}
+/** Replaces reactfire's `ReactFireOptions<T>` — drops the `suspense` field, which was never read. */
+export interface FirestoreDocOptions<T> {
+    idField?: string;
+    initialData?: T;
+}
+/**
+ * A surface's answer to "may an analytics tag exist for this visitor at all?".
+ *
+ * Registered from the app, at module scope, in the same shape as
+ * `setFirestoreSessionReporters` and `setStaleSessionCheck` — and for a
+ * sharper version of the same reason. This is consulted during the provider's
+ * FIRST render, before any effect anywhere has run, so a gate installed from
+ * an effect would arrive after the decision it exists to make.
+ *
+ * Answering `false` means the SDK is never asked to initialize: `gtag.js` is
+ * never fetched, `window.gtag` never comes into existence, and the shared
+ * `deliver()` in `analytics-events.ts` — whose fallback IS `window.gtag` —
+ * therefore has nowhere to put a hit. That is the difference between a gate
+ * and a suppression, and it is the difference AGL-1608 paid for: a resident
+ * tag reports on its own, through enhanced measurement, whatever any flag
+ * says afterwards.
+ */
+export type AnalyticsConsentGate = () => boolean;
+/**
+ * Install the consent gate for this document, or clear it with `null`.
+ *
+ * UNREGISTERED MEANS ALLOWED, which is deliberate and is the only default that
+ * is safe here. The tenant runtime does not use this provider's analytics
+ * branch at all (it builds its own tag in `site-analytics.tsx`, behind the
+ * AGL-1498 gate), and a self-hosted console points at the operator's own GA
+ * property — silencing an operator's analytics because Aglyn's own surface
+ * grew a gate is a failure they cannot diagnose. The surface that needs the
+ * gate is the one that registers it.
+ */
+export declare function setAnalyticsConsentGate(gate: AnalyticsConsentGate | null): void;
+export interface FirebaseServicesProviderProps {
+    firebaseConfig: FirebaseOptions;
+    appName: string;
+    /**
+     * How much of *anything* this origin may keep on disk. Defaults to
+     * `durable`, which is what every host serving this provider today is:
+     * `*.aglyn.com` and `*.aglyn.app`, whose DNS we own and whose 14-day
+     * session is the product.
+     *
+     * A **custom console domain** (AGL-1099c) must pass `ephemeral`. That is
+     * the whole reason this is a prop rather than a constant: the class differs
+     * per origin, not per build, and the decision belongs to whoever knows
+     * which origin is being served.
+     *
+     * **It governs two things, and the name only names one.** It selects the
+     * `Auth` persistence class (AGL-1379) *and* the Firestore `localCache`
+     * (AGL-1456) — because both answer the same question about the same origin,
+     * and splitting them into two props is precisely how the cache came to be
+     * unconditional while the credential was hardened. See `firestore-cache.ts`.
+     */
+    authPersistence?: AuthPersistenceClass;
+    children?: ReactNode;
+}
+export declare function FirebaseServicesProvider(props: FirebaseServicesProviderProps): import("react").JSX.Element;
+export declare namespace FirebaseServicesProvider {
+    var displayName: string;
+}
+export declare function useFirebaseApp(): FirebaseApp;
+export declare function useFirestore(): Firestore;
+export declare function useAuth(): Auth;
+/**
+ * The persistence class the provider's `Auth` was created with (AGL-1379).
+ *
+ * Read it — never re-derive it — when building a **second** Firebase app on
+ * the same origin, so the second instance cannot end up more persistent than
+ * the first. `apps/console/hooks/use-presence.ts` is the existing case.
+ */
+export declare function useAuthPersistence(): AuthPersistenceClass;
+export declare function useAnalytics(): Analytics;
+export declare function useRemoteConfig(): RemoteConfig;
+/**
+ * Replaces reactfire's `useUser()`. Reactfire subscribes via
+ * `onIdTokenChanged` rather than `onAuthStateChanged` so fields like
+ * `emailVerified` stay live across token refresh (e.g. after
+ * `user.reload()` post-email-verification), not just sign-in/out — matched
+ * here for behavioral parity.
+ *
+ * THREE states, not two (AGL-1261): `undefined` = auth has not resolved yet,
+ * `null` = resolved, signed OUT, a `User` = resolved, signed in. This used to
+ * collapse the emitted `null` into `undefined`, which made "signed out" and
+ * "still loading" the same value — a state that, for a signed-out visitor,
+ * never left "loading". `useSessionCookie` gates its whole body on
+ * `user === undefined`, so its silent restore from the shared `__session`
+ * cookie could never run: the cookie exchange returned a valid custom token
+ * and nothing ever asked for it.
+ */
+export declare function useUser(): {
+    data: User | null | undefined;
+};
+export interface SigninCheckResult {
+    signedIn: boolean;
+    user: User | null;
+}
+/** Replaces reactfire's `useSigninCheck()` — same `onIdTokenChanged` basis as `useUser()`. */
+export declare function useSigninCheck(): {
+    status: 'loading' | 'success' | 'error';
+    data: SigninCheckResult | undefined;
+    error: Error | undefined;
+};