@aglyn/tenant-feature-instance 1.0.0-beta.143

package/src/lib/hooks/firebase/firebase-services.js

@@ -0,0 +1,522 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { getApps, initializeApp } from "firebase/app";
+import { getAnalytics as getAnalyticsInstance, initializeAnalytics as initializeAnalyticsInstance } from "firebase/analytics";
+import { initializeAppCheck, ReCaptchaV3Provider } from "firebase/app-check";
+import { analyticsMayEmit } from "@aglyn/aglyn/app-utils/analytics-environment";
+import { pushPlatformConsentDefault } from "@aglyn/aglyn/app-utils/platform-consent-default";
+import { VISITOR_CONSENT_CHANGED_EVENT } from "@aglyn/aglyn/app-utils/visitor-consent";
+import { connectAuthEmulator, onIdTokenChanged } from "firebase/auth";
+import { connectFirestoreEmulator, getFirestore, initializeFirestore } from "firebase/firestore";
+import { getRemoteConfig as getRemoteConfigInstance } from "firebase/remote-config";
+import { createContext, useContext, useEffect, useMemo, useRef, useState } from "react";
+import { FIREBASE_AUTH_EMULATOR_ENABLED, FIREBASE_FIRESTORE_EMULATOR_ENABLED } from "@aglyn/shared-data-enums";
+import { APP_CHECK_KEY_MISSING_MESSAGE, appCheckSiteKey } from "../../constants/firebase-config.js";
+import { authEmulatorUrl, firestoreEmulatorHost } from "../../constants/firebase-emulator-hosts.js";
+import { createAuthInstance } from "./auth-persistence.js";
+import { localCacheFor, pruneSharedClientStateFor } from "./firestore-cache.js";
+const FirebaseServicesContext = /*#__PURE__*/ createContext(undefined);
+// Module-scope guards so HMR / remounts don't re-run emulator connection
+// (which throws if called twice) or double-initialize Firestore's
+// persistent cache.
+//
+// Firestore's is keyed by app NAME, not a bare boolean (AGL-1456): Firestore
+// initialization is once-per-app, so a module-global flag made the FIRST app
+// to mount decide for every later one — a second app would silently skip
+// `initializeFirestore` and take SDK defaults. That mattered the moment the
+// cache stopped being the same on every host.
+const firestoreInitialized = new Set();
+let connectedAuth = false;
+/**
+ * True when THIS Chrome instance is under WebDriver automation control
+ * (Puppeteer, Playwright, Selenium, or a raw CDP client) — never true for a
+ * person's own browser.
+ *
+ * The `initializeFirestore` call below already documents the fault this
+ * exists for: "the emulator's WebChannel streaming misbehaves in automated
+ * Chrome — listeners serve the initial empty from-cache snapshot and the
+ * server sync never arrives" (AGL-217). That mitigation only reaches
+ * `FIREBASE_FIRESTORE_EMULATOR_ENABLED`, so an automated session against a
+ * REAL, deployed backend — a browser-automation agent driving a live
+ * console, which is exactly what `navigator.webdriver` detects — stayed
+ * exposed. `getDocs`/`getDoc` and `onSnapshot` all resolve over the same
+ * Watch stream internally, so a one-shot read wedges exactly like a listener
+ * does: no error, nothing to catch, `loading` simply never gets its
+ * settling event. That is the Media Library grid spinning on "Loading
+ * media…" indefinitely with a perfectly healthy account and a perfectly
+ * healthy network.
+ *
+ * `undefined` during SSR reads as `false` — `navigator` does not exist in
+ * Node, and a server render can only ever produce the auto-detected
+ * transport, never the forced one.
+ */ const isAutomatedChromeSession = ()=>typeof navigator !== 'undefined' && navigator.webdriver === true;
+/**
+ * The console tag's gtag config — ONE object, at module scope, deliberately
+ * (AGL-1979).
+ *
+ * `initializeAnalytics(app, options)` throws `already-initialized` unless the
+ * options `deepEqual` the ones the instance was first created with, and the
+ * provider re-enters this block on every mount, every StrictMode double
+ * invoke and every Fast Refresh. A fresh object literal per call survives
+ * that only by *value*; a shared constant survives it by *identity*, which is
+ * the first branch of the SDK's own comparison and cannot drift when someone
+ * edits one call site and not another.
+ *
+ * ⚠️ The SDK MUTATES this object: `_initializeAnalytics` reads `options.config`
+ * and writes `origin`, `update` and the installation id onto it in place.
+ * That is precisely why sharing it is safe rather than dangerous — the object
+ * the provider holds and the object the SDK stored are the same one, so they
+ * cannot disagree.
+ */ const CONSOLE_ANALYTICS_OPTIONS = {
+    config: {
+        send_page_view: false,
+        content_group: 'console'
+    }
+};
+let analyticsConsentGate = null;
+/**
+ * Install the consent gate for this document, or clear it with `null`.
+ *
+ * UNREGISTERED MEANS ALLOWED, which is deliberate and is the only default that
+ * is safe here. The tenant runtime does not use this provider's analytics
+ * branch at all (it builds its own tag in `site-analytics.tsx`, behind the
+ * AGL-1498 gate), and a self-hosted console points at the operator's own GA
+ * property — silencing an operator's analytics because Aglyn's own surface
+ * grew a gate is a failure they cannot diagnose. The surface that needs the
+ * gate is the one that registers it.
+ */ export function setAnalyticsConsentGate(gate) {
+    analyticsConsentGate = gate;
+}
+/** The gate's verdict, with an unregistered gate reading as "allowed". */ function analyticsConsentAllows() {
+    if (analyticsConsentGate === null) return true;
+    try {
+        return analyticsConsentGate() === true;
+    } catch (unused) {
+        // A gate that throws cannot be read as consent. Storage can throw in
+        // private mode, and "we could not tell" is the one state this whole
+        // mechanism resolves to "no".
+        return false;
+    }
+}
+/**
+ * The Analytics instance per Firebase app, so a re-boot after a consent change
+ * hands back the tag that is already resident rather than asking the SDK for a
+ * second one.
+ *
+ * `initializeAnalytics` is idempotent while the options match, so this is not
+ * what makes re-entry safe — `CONSOLE_ANALYTICS_OPTIONS` being a shared
+ * constant is. What this avoids is the noisy path: once anything has
+ * initialized the provider with different options, every later call throws and
+ * is logged, and a withdrawal followed by a re-grant would log it again.
+ */ const analyticsByApp = new WeakMap();
+/**
+ * Boot the console's Analytics tag, or return the one already booted.
+ *
+ * Extracted from the provider body so that "when is the tag created" and "may
+ * it be created" are separable: the consent gate can defer this call to a
+ * later render without the ordering below moving.
+ */ function bootAnalytics(app) {
+    const existing = analyticsByApp.get(app);
+    if (existing) return existing;
+    let analytics;
+    // The region-conditional consent default (AGL-1597), declared BEFORE the
+    // SDK boots the tag. Ordering is the whole of it: a `default` read after
+    // `config` is not a default, and the SDK issues `config` inside
+    // `initializeAnalytics` on the next line. Pushing onto `dataLayer` here
+    // works even though gtag.js is not loaded yet — the queue is what makes the
+    // ordering expressible.
+    //
+    // Still declared even though the gate above has already said yes, and the
+    // two are not redundant. The gate answers "may a tag exist"; the default
+    // answers "what may the tag that does exist do", per region, from its very
+    // first hit. Ad storage stays denied everywhere on this surface.
+    pushPlatformConsentDefault(typeof window === 'undefined' ? null : window);
+    try {
+        analytics = initializeAnalyticsInstance(app, CONSOLE_ANALYTICS_OPTIONS);
+    } catch (error) {
+        console.error(error);
+        try {
+            // Already initialized by someone else, with someone else's options:
+            // take THAT instance rather than leaving consumers with nothing. The
+            // tag it is attached to was configured without `send_page_view: false`
+            // and without `content_group`, so this session reports a duplicate
+            // startup page_view and an unstamped surface — degraded, and loudly so,
+            // instead of silently dead.
+            analytics = getAnalyticsInstance(app);
+        } catch (fallbackError) {
+            console.error(fallbackError);
+        }
+    }
+    if (analytics) analyticsByApp.set(app, analytics);
+    return analytics;
+}
+/**
+ * The tag this document may have right now: none outside a real production
+ * deployment, none while consent is absent, otherwise the booted instance.
+ */ function analyticsForConsentState(app) {
+    if (!analyticsMayEmit()) return undefined;
+    if (!analyticsConsentAllows()) return undefined;
+    return bootAnalytics(app);
+}
+export function FirebaseServicesProvider(props) {
+    const { firebaseConfig, appName, authPersistence = 'durable', children } = props;
+    const servicesRef = useRef(undefined);
+    if (!servicesRef.current) {
+        var _getApps_find;
+        const app = (_getApps_find = getApps().find((existing)=>existing.name === appName)) != null ? _getApps_find : initializeApp(firebaseConfig, appName);
+        // `durable` resolves to the same `getAuth(app)` this always called.
+        const auth = createAuthInstance(app, authPersistence);
+        if (!firestoreInitialized.has(appName)) {
+            try {
+                // Under the emulator (dev/e2e only): force long-polling and skip
+                // the persistent multi-tab cache. The emulator's WebChannel
+                // streaming misbehaves in automated Chrome — listeners serve the
+                // initial empty from-cache snapshot and the server sync never
+                // arrives, which looks like "empty pages with zero errors"
+                // (the AGL-217 mystery). Real traffic keeps the default transport
+                // and persistent cache — except a WebDriver-controlled Chrome
+                // against a real backend, which forces long-polling for the same
+                // reason without giving up the cache (see `isAutomatedChromeSession`
+                // below).
+                //
+                // ⚠️ CONSEQUENCE, and it will cost you hours if you do not know it
+                // (AGL-1066): every stale-session/stale-cache fault is UNREPRODUCIBLE
+                // locally through the app, because the cache that causes them is off
+                // in exactly the configuration you would reach for to reproduce one.
+                // A listener that keeps serving arbitrarily-old data while the server
+                // refuses it, a `noDocument` tombstone that 404s a live host, the
+                // retry budget that never spends because a cached emission resets it
+                // — none of them can happen here. Test that behaviour with the unit
+                // seams instead (`use-firestore-collection-cached-retry.spec.ts`
+                // drives cached emissions and denials directly), or against a
+                // deployed environment. Do NOT "fix" it by turning the cache on for
+                // the emulator: the AGL-217 empty-pages-with-zero-errors mystery is
+                // what that produces.
+                initializeFirestore(app, FIREBASE_FIRESTORE_EMULATOR_ENABLED ? {
+                    experimentalForceLongPolling: true
+                } : _extends({
+                    // NOT unconditional (AGL-1456). `persistentLocalCache` writes
+                    // document bodies to this origin's IndexedDB, so on a custom
+                    // console domain it is the same exposure D6 removed from the
+                    // refresh token — see `firestore-cache.ts` for why one
+                    // declaration governs both.
+                    localCache: localCacheFor(authPersistence)
+                }, isAutomatedChromeSession() ? {
+                    experimentalForceLongPolling: true
+                } : {}));
+                if (FIREBASE_FIRESTORE_EMULATOR_ENABLED) {
+                    // Where the server was told the emulator is, rather than a default
+                    // port another session's stack may hold (AGL-2834).
+                    const emulator = firestoreEmulatorHost();
+                    connectFirestoreEmulator(getFirestore(app), emulator.host, emulator.port);
+                } else {
+                    // The SDK never sweeps the multi-tab records the durable cache
+                    // strands in localStorage, and a full localStorage fails the whole
+                    // Firestore client — see `firestore-shared-client-state.ts`.
+                    void pruneSharedClientStateFor(authPersistence, app);
+                }
+            } catch (unused) {
+            // already initialized (e.g. HMR reset the module flag) — getFirestore() returns the existing instance
+            } finally{
+                firestoreInitialized.add(appName);
+            }
+        }
+        const firestore = getFirestore(app);
+        if (!connectedAuth) {
+            try {
+                if (FIREBASE_AUTH_EMULATOR_ENABLED) {
+                    // The emulator the server was started with (AGL-2834).
+                    connectAuthEmulator(auth, authEmulatorUrl());
+                }
+                connectedAuth = true;
+            } catch (error) {
+                console.error(error);
+            }
+        }
+        // App Check must be skipped under the emulators: there is no App
+        // Check emulator, so ReCaptcha would hit the real backend and its
+        // 403s break emulator auth (the AGL-216 emulator sessions hit this).
+        if (!FIREBASE_AUTH_EMULATOR_ENABLED && !FIREBASE_FIRESTORE_EMULATOR_ENABLED) {
+            // No site key means no provider (AGL-2049). Registering one built on
+            // `undefined` does not throw — it fails asynchronously inside the SDK,
+            // where the catch below cannot see it — so this has to be a pre-check.
+            const siteKey = appCheckSiteKey();
+            if (!siteKey) {
+                console.warn(APP_CHECK_KEY_MISSING_MESSAGE);
+            } else {
+                try {
+                    initializeAppCheck(app, {
+                        provider: new ReCaptchaV3Provider(siteKey),
+                        isTokenAutoRefreshEnabled: true
+                    });
+                } catch (error) {
+                    console.error(error);
+                }
+            }
+        }
+        // `initializeAnalytics`, not `getAnalytics`, for exactly one reason: it is
+        // the only form that can pass `config`, and `send_page_view: false` is the
+        // only way to stop the SDK's own startup `page_view` (AGL-1643).
+        //
+        // Booting Analytics issues `gtag('config', <id>, configProperties)`, and
+        // the vendored SDK's own comment on that line reads "This will trigger a
+        // page_view event unless 'send_page_view' is set to false in
+        // configProperties". `getAnalytics(app)` passes no config at all, so the
+        // key was never there and the hit always fired — on top of the manual
+        // `page_view` the console's layout sends on mount. Two hits, one page.
+        //
+        // The SDK's is the one suppressed rather than the layout's, and the
+        // direction is the whole decision: the SDK fires ONCE per document load,
+        // while the layout fires on mount AND on every `usePathname` change. In a
+        // client-routed app the layout's is a superset — killing it instead would
+        // have left every in-app navigation unreported, halving console pageviews
+        // rather than correcting them, and the reports would have looked fine.
+        //
+        // Nothing else about attribution moves: the surviving hit is sent from the
+        // same document at mount, so `document.referrer` — which gtag resolves for
+        // `page_referrer` itself, and which is what carries marketing traffic
+        // source into the session — is still the external referrer at that moment.
+        //
+        // Re-entry is safe *only* while the options match. `initializeAnalytics`
+        // returns the existing instance when they deep-equal the first call's and
+        // throws `already-initialized` otherwise — and the options can be made to
+        // differ by things no call site here controls (AGL-1979):
+        //
+        //   * anything that touches the analytics provider WITHOUT options first
+        //     initializes it with `{}`. `getAnalytics()` is the obvious one, but
+        //     `@firebase/remote-config` reaches the same code path on its own —
+        //     `addExperimentToAnalytics` calls `analyticsProvider.getImmediate({
+        //     optional: true })`, and `optional` only suppresses the throw, it
+        //     does not stop the initialization.
+        //   * in dev, a module instance carrying a PREVIOUS version of these
+        //     options (this config changed under AGL-1857) surviving a Fast
+        //     Refresh alongside the new one.
+        //
+        // Once that happens the conflict is permanent for the document: every
+        // later call throws, so without the fallback below `analytics` stayed
+        // undefined forever and the next consumer — `logEvent(analytics, …)` —
+        // read `.app` off it and threw a TypeError two frames away, which is how
+        // this surfaced (top Cloud Error Reporting group, and reproduced live on
+        // app.aglyn.com).
+        //
+        // `getAnalytics(app)` is the remedy the SDK's own error message names. It
+        // cannot cost us the config on a healthy document: it only runs after
+        // `initializeAnalytics` threw, and on a first init that throw can only be
+        // `no-app-id` / `no-api-key` / `already-exists`, none of which
+        // `getAnalytics` can rescue either — it re-throws and we fall through to
+        // an undefined instance, which every consumer must now tolerate.
+        // `content_group: 'console'` (AGL-1857) rides the same config: it is the
+        // first-class GA4 axis that separates console traffic from `marketing`
+        // (stamped by the tenant runtime on aglyn.com's own tag) and `docs`
+        // (stamped by the Docusaurus head snippet) in standard reports, without
+        // reaching for the Hostname dimension. The console is this provider's
+        // only consumer, verified by grep — the tenant runtime builds its tag in
+        // `site-analytics.tsx` and never passes through here.
+        //
+        // AND NOT AT ALL outside a real production deployment (AGL-2067). This
+        // provider used to boot Analytics unconditionally, while
+        // `apps/console/.env.development.local` points at the PRODUCTION
+        // measurement id — so every `next dev` session and every Vercel preview
+        // build produced genuine `session_start` / `first_visit` / `page_view`
+        // hits in the live property. Not a theory: the archived Marketing
+        // property's entire year-to-date history is 30 views / 6 users, ~24 of
+        // them `/signin` on preview urls (docs/ANALYTICS.md).
+        //
+        // Not initialized rather than initialized-and-suppressed, because a
+        // resident tag reports on its own — AGL-1608 is the same lesson from the
+        // consent side. `useAnalytics()` returning undefined is already a
+        // supported state everywhere (AGL-1979), which is what makes this a
+        // two-line gate instead of an audit.
+        //
+        // `analyticsMayEmit` leans LOUD on an unknown deployment: a self-hosted
+        // build points at the operator's own Firebase project and their own GA
+        // property, and silencing a customer's analytics to protect ours is the
+        // worse failure. See the module for the escape hatch.
+        //
+        // AND NOT while a registered consent gate says no (AGL-1498 posture,
+        // applied to Aglyn's own console). `analyticsForConsentState` is where
+        // both conditions and the boot itself now live, because the boot has to
+        // be repeatable: a visitor whose region has not resolved yet is undecided
+        // at this instant and may be granted a moment later, and a visitor who
+        // withdraws mid-session has to lose the instance without the page
+        // reloading. See the effect below.
+        //
+        // SCOPE. This is the console's tag and only the console's:
+        // `CONSOLE_ANALYTICS_OPTIONS`, `content_group: 'console'`, and this
+        // provider's analytics branch has no other consumer (the tenant runtime
+        // builds its tag in `site-analytics.tsx` and never passes through here).
+        // Customer sites keep the AGL-1498 gate and the host's own
+        // `consent.mode`; nothing here reaches them.
+        const initialAnalytics = analyticsForConsentState(app);
+        // Remote Config (AGL-228): release-flag delivery. Browser-only like
+        // analytics; consumers set defaultConfig before their first getValue so
+        // gating never blocks on the network.
+        let remoteConfig;
+        try {
+            remoteConfig = getRemoteConfigInstance(app);
+            remoteConfig.settings.minimumFetchIntervalMillis = process.env.NODE_ENV === 'production' ? 3600000 : 60000;
+        } catch (error) {
+            console.error(error);
+        }
+        servicesRef.current = {
+            app,
+            firestore,
+            auth,
+            analytics: initialAnalytics,
+            remoteConfig,
+            authPersistence
+        };
+    }
+    const services = servicesRef.current;
+    // The consent gate's other half: the verdict can CHANGE within one document,
+    // in both directions, and everything else in this provider is built exactly
+    // once by design.
+    //
+    // Deferred grant. A visitor with no stored record is undecided at the
+    // instant this provider first renders, because resolving them needs the
+    // region endpoint and that is a network call. Outside the prior-consent
+    // regions the answer is implied consent, and it lands a few hundred
+    // milliseconds later — same document, so `document.referrer` is still the
+    // external referrer and the pageview's attribution is unaffected. Without
+    // this, "the gate is synchronous" would have quietly meant "the rest of the
+    // world is never measured on a first visit".
+    //
+    // Withdrawal. Dropping the instance unmounts every binding hung off it,
+    // which is what unregisters the analytics transport — after that
+    // `deliver()` falls through to `window.gtag`, and the shared consent writer
+    // has already set `ga-disable-<id>` and sent a denied `consent update` on
+    // that exact tag (AGL-1608). The resident tag cannot be unloaded; it can be
+    // made to send nothing, and both halves are needed because either alone
+    // leaks — enhanced measurement fires with no call site at all.
+    const [analytics, setAnalytics] = useState(()=>services.analytics);
+    useEffect(()=>{
+        const sync = ()=>setAnalytics(analyticsForConsentState(services.app));
+        // Once on mount as well as on the event: the priming pass can resolve a
+        // visitor between this provider's render and this effect, and the event it
+        // dispatched then had no listener yet.
+        sync();
+        window.addEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync);
+        return ()=>window.removeEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync);
+    }, [
+        services
+    ]);
+    // Identity changes only when the tag comes or goes, so a consent-stable
+    // document re-renders nothing.
+    const value = useMemo(()=>services.analytics === analytics ? services : _extends({}, services, {
+            analytics
+        }), [
+        services,
+        analytics
+    ]);
+    return /*#__PURE__*/ _jsx(FirebaseServicesContext.Provider, {
+        value: value,
+        children: children
+    });
+}
+FirebaseServicesProvider.displayName = 'FirebaseServicesProvider';
+function useFirebaseServices() {
+    const services = useContext(FirebaseServicesContext);
+    if (!services) {
+        throw new Error('Firebase hooks must be used within a <FirebaseServicesProvider>');
+    }
+    return services;
+}
+export function useFirebaseApp() {
+    return useFirebaseServices().app;
+}
+export function useFirestore() {
+    return useFirebaseServices().firestore;
+}
+export function useAuth() {
+    return useFirebaseServices().auth;
+}
+/**
+ * The persistence class the provider's `Auth` was created with (AGL-1379).
+ *
+ * Read it — never re-derive it — when building a **second** Firebase app on
+ * the same origin, so the second instance cannot end up more persistent than
+ * the first. `apps/console/hooks/use-presence.ts` is the existing case.
+ */ export function useAuthPersistence() {
+    return useFirebaseServices().authPersistence;
+}
+export function useAnalytics() {
+    return useFirebaseServices().analytics;
+}
+export function useRemoteConfig() {
+    return useFirebaseServices().remoteConfig;
+}
+/**
+ * Replaces reactfire's `useUser()`. Reactfire subscribes via
+ * `onIdTokenChanged` rather than `onAuthStateChanged` so fields like
+ * `emailVerified` stay live across token refresh (e.g. after
+ * `user.reload()` post-email-verification), not just sign-in/out — matched
+ * here for behavioral parity.
+ *
+ * THREE states, not two (AGL-1261): `undefined` = auth has not resolved yet,
+ * `null` = resolved, signed OUT, a `User` = resolved, signed in. This used to
+ * collapse the emitted `null` into `undefined`, which made "signed out" and
+ * "still loading" the same value — a state that, for a signed-out visitor,
+ * never left "loading". `useSessionCookie` gates its whole body on
+ * `user === undefined`, so its silent restore from the shared `__session`
+ * cookie could never run: the cookie exchange returned a valid custom token
+ * and nothing ever asked for it.
+ */ export function useUser() {
+    var _auth_currentUser;
+    const auth = useAuth();
+    const [user, setUser] = useState((_auth_currentUser = auth.currentUser) != null ? _auth_currentUser : undefined);
+    useEffect(()=>{
+        return onIdTokenChanged(auth, (nextUser)=>{
+            // `?? null`, never `?? undefined` — see the note above.
+            setUser(nextUser != null ? nextUser : null);
+        });
+    }, [
+        auth
+    ]);
+    return {
+        data: user
+    };
+}
+/** Replaces reactfire's `useSigninCheck()` — same `onIdTokenChanged` basis as `useUser()`. */ export function useSigninCheck() {
+    const auth = useAuth();
+    const [status, setStatus] = useState('loading');
+    const [data, setData] = useState(undefined);
+    const [error, setError] = useState(undefined);
+    useEffect(()=>{
+        return onIdTokenChanged(auth, (user)=>{
+            setStatus('success');
+            setError(undefined);
+            setData({
+                signedIn: !!user,
+                user: user != null ? user : null
+            });
+        }, (err)=>{
+            setStatus('error');
+            setError(err);
+        });
+    }, [
+        auth
+    ]);
+    return {
+        status,
+        data,
+        error
+    };
+}
+
+//# sourceMappingURL=firebase-services.js.map

package/src/lib/hooks/firebase/firebase-services.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/firebase-services.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport {\n  type FirebaseApp,\n  type FirebaseOptions,\n  getApps,\n  initializeApp,\n} from 'firebase/app'\nimport {\n  type Analytics,\n  getAnalytics as getAnalyticsInstance,\n  initializeAnalytics as initializeAnalyticsInstance,\n} from 'firebase/analytics'\nimport { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check'\nimport { analyticsMayEmit } from '@aglyn/aglyn/app-utils/analytics-environment'\nimport { pushPlatformConsentDefault } from '@aglyn/aglyn/app-utils/platform-consent-default'\nimport { VISITOR_CONSENT_CHANGED_EVENT } from '@aglyn/aglyn/app-utils/visitor-consent'\nimport {\n  type Auth,\n  connectAuthEmulator,\n  onIdTokenChanged,\n  type User,\n} from 'firebase/auth'\nimport {\n  type Firestore,\n  connectFirestoreEmulator,\n  getFirestore,\n  initializeFirestore,\n} from 'firebase/firestore'\nimport {\n  type RemoteConfig,\n  getRemoteConfig as getRemoteConfigInstance,\n} from 'firebase/remote-config'\nimport {\n  createContext,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react'\nimport {\n  FIREBASE_AUTH_EMULATOR_ENABLED,\n  FIREBASE_FIRESTORE_EMULATOR_ENABLED,\n} from '@aglyn/shared-data-enums'\nimport {\n  APP_CHECK_KEY_MISSING_MESSAGE,\n  appCheckSiteKey,\n} from '../../constants/firebase-config'\nimport {\n  authEmulatorUrl,\n  firestoreEmulatorHost,\n} from '../../constants/firebase-emulator-hosts'\nimport {\n  type AuthPersistenceClass,\n  createAuthInstance,\n} from './auth-persistence'\nimport { localCacheFor, pruneSharedClientStateFor } from './firestore-cache'\n\n/**\n * Drop-in replacement for reactfire's `ObservableStatus<T>` — reactfire is\n * unmaintained against firebase majors past v9, but its shape is preserved\n * here so `helpers/use-doc.ts`'s already-battle-tested onSnapshot+retry\n * implementation (AGL-216/223) didn't need to change.\n */\nexport interface ObservableStatus<T> {\n  status: 'loading' | 'error' | 'success'\n  hasEmitted: boolean\n  isComplete: boolean\n  data: T\n  error: Error | undefined\n  firstValuePromise: Promise<void>\n  /**\n   * The emitted `data` includes local writes the server has NOT\n   * acknowledged (`snapshot.metadata.hasPendingWrites`).\n   *\n   * Carried rather than dropped because a caller cannot otherwise tell \"the\n   * store holds this\" from \"my browser holds this\". `persistentLocalCache`\n   * replays a queued write into the very first snapshot after a reload, so a\n   * caller that treats every snapshot as authoritative will adopt its own\n   * unacknowledged edit as the saved state — which is how the besigner ended\n   * up unable to save real changes (AGL-1262).\n   */\n  hasPendingWrites: boolean\n  /**\n   * The emitted `data` came from the local cache and the server has NOT\n   * confirmed it (`snapshot.metadata.fromCache`).\n   *\n   * Carried because it is the only per-listener ground truth about\n   * freshness the SDK offers, and the console needs it (AGL-1066). Under\n   * `persistentLocalCache` a listener whose server listen is being REFUSED\n   * still emits cached snapshots and still reports `status: 'success'` —\n   * the retry budget is reset by each cached emission and never spends, so\n   * `status` can never reveal the fault (see\n   * `use-firestore-collection-cached-retry.spec.ts`).\n   *\n   * Prefer this over `session-health`'s `staleSession` for anything that\n   * asks \"is what I am looking at live?\". `staleSession` is a heuristic\n   * needing two denied collections inside a window, and it is unreachable\n   * on listener-only pages; this is a fact about THIS listener, costs\n   * nothing, and clears itself the instant a server snapshot lands.\n   */\n  fromCache: boolean\n  /**\n   * The server has REFUSED this listen for longer than the retry budget, and\n   * no server snapshot has arrived since (AGL-1066).\n   *\n   * `fromCache` says \"unconfirmed\", which is also true offline and true for\n   * the first snapshot of a perfectly healthy load. This says \"refused\" —\n   * only `permission-denied` counts it, and it takes a whole budget's worth\n   * in a row, so it cannot fire offline and cannot fire on the AGL-216/217\n   * post-sign-in token race.\n   *\n   * It is what `status` would say if the retry budget were spendable. It is\n   * carried separately because correcting `status` in place would blank\n   * every surface that renders cached data through an `error` branch — see\n   * the note on `attempt = 0` in `use-firestore-collection`.\n   */\n  serverDenied: boolean\n}\n\n/** Replaces reactfire's `ReactFireOptions<T>` — drops the `suspense` field, which was never read. */\nexport interface FirestoreDocOptions<T> {\n  idField?: string\n  initialData?: T\n}\n\n/**\n * The Firebase products this provider builds, and therefore the ones every\n * page that renders it downloads.\n *\n * ⛔ NO Realtime Database and NO Cloud Storage (AGL-2706). Both were built\n * here and published as `useDatabase()` / `useStorage()`, and neither hook had\n * a single caller anywhere in the repo — so `@firebase/database` (125.9 KB\n * raw) and `@firebase/storage` (13.9 KB) were in the first load of every\n * console route to satisfy a context field nothing read.\n *\n * Realtime Database IS used, by `apps/console/hooks/use-presence.ts` and\n * `use-coediting.ts` — on their own Firebase app, with their own\n * `getDatabase`, behind the editor routes that need presence. That is the\n * shape to copy if a surface needs one of these: reach for the product where\n * the feature is, not in the provider every page mounts. A field here is paid\n * for by every route, used or not.\n */\ninterface FirebaseServices {\n  app: FirebaseApp\n  firestore: Firestore\n  auth: Auth\n  analytics: Analytics\n  remoteConfig: RemoteConfig\n  /**\n   * The persistence class `auth` was actually created with (AGL-1379).\n   *\n   * Published so a **second** auth instance derives its class from the\n   * primary rather than re-deciding it. `apps/console/hooks/use-presence.ts`\n   * builds its own Firebase app and its own `Auth`; before this it took the\n   * SDK default unconditionally, so configuring only the provider would have\n   * left presence persisting a refresh token on an origin the provider had\n   * just been careful not to persist one on.\n   */\n  authPersistence: AuthPersistenceClass\n}\n\nconst FirebaseServicesContext = createContext<FirebaseServices | undefined>(undefined)\n\n// Module-scope guards so HMR / remounts don't re-run emulator connection\n// (which throws if called twice) or double-initialize Firestore's\n// persistent cache.\n//\n// Firestore's is keyed by app NAME, not a bare boolean (AGL-1456): Firestore\n// initialization is once-per-app, so a module-global flag made the FIRST app\n// to mount decide for every later one — a second app would silently skip\n// `initializeFirestore` and take SDK defaults. That mattered the moment the\n// cache stopped being the same on every host.\nconst firestoreInitialized = new Set<string>()\nlet connectedAuth = false\n\n/**\n * True when THIS Chrome instance is under WebDriver automation control\n * (Puppeteer, Playwright, Selenium, or a raw CDP client) — never true for a\n * person's own browser.\n *\n * The `initializeFirestore` call below already documents the fault this\n * exists for: \"the emulator's WebChannel streaming misbehaves in automated\n * Chrome — listeners serve the initial empty from-cache snapshot and the\n * server sync never arrives\" (AGL-217). That mitigation only reaches\n * `FIREBASE_FIRESTORE_EMULATOR_ENABLED`, so an automated session against a\n * REAL, deployed backend — a browser-automation agent driving a live\n * console, which is exactly what `navigator.webdriver` detects — stayed\n * exposed. `getDocs`/`getDoc` and `onSnapshot` all resolve over the same\n * Watch stream internally, so a one-shot read wedges exactly like a listener\n * does: no error, nothing to catch, `loading` simply never gets its\n * settling event. That is the Media Library grid spinning on \"Loading\n * media…\" indefinitely with a perfectly healthy account and a perfectly\n * healthy network.\n *\n * `undefined` during SSR reads as `false` — `navigator` does not exist in\n * Node, and a server render can only ever produce the auto-detected\n * transport, never the forced one.\n */\nconst isAutomatedChromeSession = (): boolean =>\n  typeof navigator !== 'undefined' && navigator.webdriver === true\n\n/**\n * The console tag's gtag config — ONE object, at module scope, deliberately\n * (AGL-1979).\n *\n * `initializeAnalytics(app, options)` throws `already-initialized` unless the\n * options `deepEqual` the ones the instance was first created with, and the\n * provider re-enters this block on every mount, every StrictMode double\n * invoke and every Fast Refresh. A fresh object literal per call survives\n * that only by *value*; a shared constant survives it by *identity*, which is\n * the first branch of the SDK's own comparison and cannot drift when someone\n * edits one call site and not another.\n *\n * ⚠️ The SDK MUTATES this object: `_initializeAnalytics` reads `options.config`\n * and writes `origin`, `update` and the installation id onto it in place.\n * That is precisely why sharing it is safe rather than dangerous — the object\n * the provider holds and the object the SDK stored are the same one, so they\n * cannot disagree.\n */\nconst CONSOLE_ANALYTICS_OPTIONS = {\n  config: { send_page_view: false, content_group: 'console' },\n}\n\n/**\n * A surface's answer to \"may an analytics tag exist for this visitor at all?\".\n *\n * Registered from the app, at module scope, in the same shape as\n * `setFirestoreSessionReporters` and `setStaleSessionCheck` — and for a\n * sharper version of the same reason. This is consulted during the provider's\n * FIRST render, before any effect anywhere has run, so a gate installed from\n * an effect would arrive after the decision it exists to make.\n *\n * Answering `false` means the SDK is never asked to initialize: `gtag.js` is\n * never fetched, `window.gtag` never comes into existence, and the shared\n * `deliver()` in `analytics-events.ts` — whose fallback IS `window.gtag` —\n * therefore has nowhere to put a hit. That is the difference between a gate\n * and a suppression, and it is the difference AGL-1608 paid for: a resident\n * tag reports on its own, through enhanced measurement, whatever any flag\n * says afterwards.\n */\nexport type AnalyticsConsentGate = () => boolean\n\nlet analyticsConsentGate: AnalyticsConsentGate | null = null\n\n/**\n * Install the consent gate for this document, or clear it with `null`.\n *\n * UNREGISTERED MEANS ALLOWED, which is deliberate and is the only default that\n * is safe here. The tenant runtime does not use this provider's analytics\n * branch at all (it builds its own tag in `site-analytics.tsx`, behind the\n * AGL-1498 gate), and a self-hosted console points at the operator's own GA\n * property — silencing an operator's analytics because Aglyn's own surface\n * grew a gate is a failure they cannot diagnose. The surface that needs the\n * gate is the one that registers it.\n */\nexport function setAnalyticsConsentGate(\n  gate: AnalyticsConsentGate | null,\n): void {\n  analyticsConsentGate = gate\n}\n\n/** The gate's verdict, with an unregistered gate reading as \"allowed\". */\nfunction analyticsConsentAllows(): boolean {\n  if (analyticsConsentGate === null) return true\n  try {\n    return analyticsConsentGate() === true\n  } catch {\n    // A gate that throws cannot be read as consent. Storage can throw in\n    // private mode, and \"we could not tell\" is the one state this whole\n    // mechanism resolves to \"no\".\n    return false\n  }\n}\n\n/**\n * The Analytics instance per Firebase app, so a re-boot after a consent change\n * hands back the tag that is already resident rather than asking the SDK for a\n * second one.\n *\n * `initializeAnalytics` is idempotent while the options match, so this is not\n * what makes re-entry safe — `CONSOLE_ANALYTICS_OPTIONS` being a shared\n * constant is. What this avoids is the noisy path: once anything has\n * initialized the provider with different options, every later call throws and\n * is logged, and a withdrawal followed by a re-grant would log it again.\n */\nconst analyticsByApp = new WeakMap<FirebaseApp, Analytics>()\n\n/**\n * Boot the console's Analytics tag, or return the one already booted.\n *\n * Extracted from the provider body so that \"when is the tag created\" and \"may\n * it be created\" are separable: the consent gate can defer this call to a\n * later render without the ordering below moving.\n */\nfunction bootAnalytics(app: FirebaseApp): Analytics | undefined {\n  const existing = analyticsByApp.get(app)\n  if (existing) return existing\n  let analytics: Analytics\n  // The region-conditional consent default (AGL-1597), declared BEFORE the\n  // SDK boots the tag. Ordering is the whole of it: a `default` read after\n  // `config` is not a default, and the SDK issues `config` inside\n  // `initializeAnalytics` on the next line. Pushing onto `dataLayer` here\n  // works even though gtag.js is not loaded yet — the queue is what makes the\n  // ordering expressible.\n  //\n  // Still declared even though the gate above has already said yes, and the\n  // two are not redundant. The gate answers \"may a tag exist\"; the default\n  // answers \"what may the tag that does exist do\", per region, from its very\n  // first hit. Ad storage stays denied everywhere on this surface.\n  pushPlatformConsentDefault(\n    typeof window === 'undefined' ? null : (window as never),\n  )\n  try {\n    analytics = initializeAnalyticsInstance(app, CONSOLE_ANALYTICS_OPTIONS)\n  } catch (error) {\n    console.error(error)\n    try {\n      // Already initialized by someone else, with someone else's options:\n      // take THAT instance rather than leaving consumers with nothing. The\n      // tag it is attached to was configured without `send_page_view: false`\n      // and without `content_group`, so this session reports a duplicate\n      // startup page_view and an unstamped surface — degraded, and loudly so,\n      // instead of silently dead.\n      analytics = getAnalyticsInstance(app)\n    } catch (fallbackError) {\n      console.error(fallbackError)\n    }\n  }\n  if (analytics) analyticsByApp.set(app, analytics)\n  return analytics\n}\n\n/**\n * The tag this document may have right now: none outside a real production\n * deployment, none while consent is absent, otherwise the booted instance.\n */\nfunction analyticsForConsentState(app: FirebaseApp): Analytics | undefined {\n  if (!analyticsMayEmit()) return undefined\n  if (!analyticsConsentAllows()) return undefined\n  return bootAnalytics(app)\n}\n\nexport interface FirebaseServicesProviderProps {\n  firebaseConfig: FirebaseOptions\n  appName: string\n  /**\n   * How much of *anything* this origin may keep on disk. Defaults to\n   * `durable`, which is what every host serving this provider today is:\n   * `*.aglyn.com` and `*.aglyn.app`, whose DNS we own and whose 14-day\n   * session is the product.\n   *\n   * A **custom console domain** (AGL-1099c) must pass `ephemeral`. That is\n   * the whole reason this is a prop rather than a constant: the class differs\n   * per origin, not per build, and the decision belongs to whoever knows\n   * which origin is being served.\n   *\n   * **It governs two things, and the name only names one.** It selects the\n   * `Auth` persistence class (AGL-1379) *and* the Firestore `localCache`\n   * (AGL-1456) — because both answer the same question about the same origin,\n   * and splitting them into two props is precisely how the cache came to be\n   * unconditional while the credential was hardened. See `firestore-cache.ts`.\n   */\n  authPersistence?: AuthPersistenceClass\n  children?: ReactNode\n}\n\nexport function FirebaseServicesProvider(props: FirebaseServicesProviderProps) {\n  const { firebaseConfig, appName, authPersistence = 'durable', children } = props\n  const servicesRef = useRef<FirebaseServices | undefined>(undefined)\n\n  if (!servicesRef.current) {\n    const app =\n      getApps().find((existing) => existing.name === appName) ??\n      initializeApp(firebaseConfig, appName)\n    // `durable` resolves to the same `getAuth(app)` this always called.\n    const auth = createAuthInstance(app, authPersistence)\n\n    if (!firestoreInitialized.has(appName)) {\n      try {\n        // Under the emulator (dev/e2e only): force long-polling and skip\n        // the persistent multi-tab cache. The emulator's WebChannel\n        // streaming misbehaves in automated Chrome — listeners serve the\n        // initial empty from-cache snapshot and the server sync never\n        // arrives, which looks like \"empty pages with zero errors\"\n        // (the AGL-217 mystery). Real traffic keeps the default transport\n        // and persistent cache — except a WebDriver-controlled Chrome\n        // against a real backend, which forces long-polling for the same\n        // reason without giving up the cache (see `isAutomatedChromeSession`\n        // below).\n        //\n        // ⚠️ CONSEQUENCE, and it will cost you hours if you do not know it\n        // (AGL-1066): every stale-session/stale-cache fault is UNREPRODUCIBLE\n        // locally through the app, because the cache that causes them is off\n        // in exactly the configuration you would reach for to reproduce one.\n        // A listener that keeps serving arbitrarily-old data while the server\n        // refuses it, a `noDocument` tombstone that 404s a live host, the\n        // retry budget that never spends because a cached emission resets it\n        // — none of them can happen here. Test that behaviour with the unit\n        // seams instead (`use-firestore-collection-cached-retry.spec.ts`\n        // drives cached emissions and denials directly), or against a\n        // deployed environment. Do NOT \"fix\" it by turning the cache on for\n        // the emulator: the AGL-217 empty-pages-with-zero-errors mystery is\n        // what that produces.\n        initializeFirestore(\n          app,\n          FIREBASE_FIRESTORE_EMULATOR_ENABLED\n            ? { experimentalForceLongPolling: true }\n            : {\n                // NOT unconditional (AGL-1456). `persistentLocalCache` writes\n                // document bodies to this origin's IndexedDB, so on a custom\n                // console domain it is the same exposure D6 removed from the\n                // refresh token — see `firestore-cache.ts` for why one\n                // declaration governs both.\n                localCache: localCacheFor(authPersistence),\n                // The real-backend half of the AGL-217 mitigation above: force\n                // long-polling for a WebDriver-controlled Chrome even when it\n                // is NOT talking to the emulator, because the WebChannel wedge\n                // is a property of automated Chrome, not of which backend it\n                // is automating against. Never true for a real visitor, so\n                // production traffic keeps the SDK's own auto-detected\n                // transport untouched.\n                ...(isAutomatedChromeSession()\n                  ? { experimentalForceLongPolling: true }\n                  : {}),\n              },\n        )\n        if (FIREBASE_FIRESTORE_EMULATOR_ENABLED) {\n          // Where the server was told the emulator is, rather than a default\n          // port another session's stack may hold (AGL-2834).\n          const emulator = firestoreEmulatorHost()\n          connectFirestoreEmulator(\n            getFirestore(app),\n            emulator.host,\n            emulator.port,\n          )\n        } else {\n          // The SDK never sweeps the multi-tab records the durable cache\n          // strands in localStorage, and a full localStorage fails the whole\n          // Firestore client — see `firestore-shared-client-state.ts`.\n          void pruneSharedClientStateFor(authPersistence, app)\n        }\n      } catch {\n        // already initialized (e.g. HMR reset the module flag) — getFirestore() returns the existing instance\n      } finally {\n        firestoreInitialized.add(appName)\n      }\n    }\n    const firestore = getFirestore(app)\n\n    if (!connectedAuth) {\n      try {\n        if (FIREBASE_AUTH_EMULATOR_ENABLED) {\n          // The emulator the server was started with (AGL-2834).\n          connectAuthEmulator(auth, authEmulatorUrl())\n        }\n        connectedAuth = true\n      } catch (error) {\n        console.error(error)\n      }\n    }\n    // App Check must be skipped under the emulators: there is no App\n    // Check emulator, so ReCaptcha would hit the real backend and its\n    // 403s break emulator auth (the AGL-216 emulator sessions hit this).\n    if (\n      !FIREBASE_AUTH_EMULATOR_ENABLED &&\n      !FIREBASE_FIRESTORE_EMULATOR_ENABLED\n    ) {\n      // No site key means no provider (AGL-2049). Registering one built on\n      // `undefined` does not throw — it fails asynchronously inside the SDK,\n      // where the catch below cannot see it — so this has to be a pre-check.\n      const siteKey = appCheckSiteKey()\n      if (!siteKey) {\n        console.warn(APP_CHECK_KEY_MISSING_MESSAGE)\n      } else {\n        try {\n          initializeAppCheck(app, {\n            provider: new ReCaptchaV3Provider(siteKey),\n            isTokenAutoRefreshEnabled: true,\n          })\n        } catch (error) {\n          console.error(error)\n        }\n      }\n    }\n    // `initializeAnalytics`, not `getAnalytics`, for exactly one reason: it is\n    // the only form that can pass `config`, and `send_page_view: false` is the\n    // only way to stop the SDK's own startup `page_view` (AGL-1643).\n    //\n    // Booting Analytics issues `gtag('config', <id>, configProperties)`, and\n    // the vendored SDK's own comment on that line reads \"This will trigger a\n    // page_view event unless 'send_page_view' is set to false in\n    // configProperties\". `getAnalytics(app)` passes no config at all, so the\n    // key was never there and the hit always fired — on top of the manual\n    // `page_view` the console's layout sends on mount. Two hits, one page.\n    //\n    // The SDK's is the one suppressed rather than the layout's, and the\n    // direction is the whole decision: the SDK fires ONCE per document load,\n    // while the layout fires on mount AND on every `usePathname` change. In a\n    // client-routed app the layout's is a superset — killing it instead would\n    // have left every in-app navigation unreported, halving console pageviews\n    // rather than correcting them, and the reports would have looked fine.\n    //\n    // Nothing else about attribution moves: the surviving hit is sent from the\n    // same document at mount, so `document.referrer` — which gtag resolves for\n    // `page_referrer` itself, and which is what carries marketing traffic\n    // source into the session — is still the external referrer at that moment.\n    //\n    // Re-entry is safe *only* while the options match. `initializeAnalytics`\n    // returns the existing instance when they deep-equal the first call's and\n    // throws `already-initialized` otherwise — and the options can be made to\n    // differ by things no call site here controls (AGL-1979):\n    //\n    //   * anything that touches the analytics provider WITHOUT options first\n    //     initializes it with `{}`. `getAnalytics()` is the obvious one, but\n    //     `@firebase/remote-config` reaches the same code path on its own —\n    //     `addExperimentToAnalytics` calls `analyticsProvider.getImmediate({\n    //     optional: true })`, and `optional` only suppresses the throw, it\n    //     does not stop the initialization.\n    //   * in dev, a module instance carrying a PREVIOUS version of these\n    //     options (this config changed under AGL-1857) surviving a Fast\n    //     Refresh alongside the new one.\n    //\n    // Once that happens the conflict is permanent for the document: every\n    // later call throws, so without the fallback below `analytics` stayed\n    // undefined forever and the next consumer — `logEvent(analytics, …)` —\n    // read `.app` off it and threw a TypeError two frames away, which is how\n    // this surfaced (top Cloud Error Reporting group, and reproduced live on\n    // app.aglyn.com).\n    //\n    // `getAnalytics(app)` is the remedy the SDK's own error message names. It\n    // cannot cost us the config on a healthy document: it only runs after\n    // `initializeAnalytics` threw, and on a first init that throw can only be\n    // `no-app-id` / `no-api-key` / `already-exists`, none of which\n    // `getAnalytics` can rescue either — it re-throws and we fall through to\n    // an undefined instance, which every consumer must now tolerate.\n    // `content_group: 'console'` (AGL-1857) rides the same config: it is the\n    // first-class GA4 axis that separates console traffic from `marketing`\n    // (stamped by the tenant runtime on aglyn.com's own tag) and `docs`\n    // (stamped by the Docusaurus head snippet) in standard reports, without\n    // reaching for the Hostname dimension. The console is this provider's\n    // only consumer, verified by grep — the tenant runtime builds its tag in\n    // `site-analytics.tsx` and never passes through here.\n    //\n    // AND NOT AT ALL outside a real production deployment (AGL-2067). This\n    // provider used to boot Analytics unconditionally, while\n    // `apps/console/.env.development.local` points at the PRODUCTION\n    // measurement id — so every `next dev` session and every Vercel preview\n    // build produced genuine `session_start` / `first_visit` / `page_view`\n    // hits in the live property. Not a theory: the archived Marketing\n    // property's entire year-to-date history is 30 views / 6 users, ~24 of\n    // them `/signin` on preview urls (docs/ANALYTICS.md).\n    //\n    // Not initialized rather than initialized-and-suppressed, because a\n    // resident tag reports on its own — AGL-1608 is the same lesson from the\n    // consent side. `useAnalytics()` returning undefined is already a\n    // supported state everywhere (AGL-1979), which is what makes this a\n    // two-line gate instead of an audit.\n    //\n    // `analyticsMayEmit` leans LOUD on an unknown deployment: a self-hosted\n    // build points at the operator's own Firebase project and their own GA\n    // property, and silencing a customer's analytics to protect ours is the\n    // worse failure. See the module for the escape hatch.\n    //\n    // AND NOT while a registered consent gate says no (AGL-1498 posture,\n    // applied to Aglyn's own console). `analyticsForConsentState` is where\n    // both conditions and the boot itself now live, because the boot has to\n    // be repeatable: a visitor whose region has not resolved yet is undecided\n    // at this instant and may be granted a moment later, and a visitor who\n    // withdraws mid-session has to lose the instance without the page\n    // reloading. See the effect below.\n    //\n    // SCOPE. This is the console's tag and only the console's:\n    // `CONSOLE_ANALYTICS_OPTIONS`, `content_group: 'console'`, and this\n    // provider's analytics branch has no other consumer (the tenant runtime\n    // builds its tag in `site-analytics.tsx` and never passes through here).\n    // Customer sites keep the AGL-1498 gate and the host's own\n    // `consent.mode`; nothing here reaches them.\n    const initialAnalytics = analyticsForConsentState(app)\n    // Remote Config (AGL-228): release-flag delivery. Browser-only like\n    // analytics; consumers set defaultConfig before their first getValue so\n    // gating never blocks on the network.\n    let remoteConfig: RemoteConfig\n    try {\n      remoteConfig = getRemoteConfigInstance(app)\n      remoteConfig.settings.minimumFetchIntervalMillis =\n        process.env.NODE_ENV === 'production' ? 3_600_000 : 60_000\n    } catch (error) {\n      console.error(error)\n    }\n\n    servicesRef.current = {\n      app,\n      firestore,\n      auth,\n      analytics: initialAnalytics,\n      remoteConfig,\n      authPersistence,\n    }\n  }\n\n  const services = servicesRef.current\n\n  // The consent gate's other half: the verdict can CHANGE within one document,\n  // in both directions, and everything else in this provider is built exactly\n  // once by design.\n  //\n  // Deferred grant. A visitor with no stored record is undecided at the\n  // instant this provider first renders, because resolving them needs the\n  // region endpoint and that is a network call. Outside the prior-consent\n  // regions the answer is implied consent, and it lands a few hundred\n  // milliseconds later — same document, so `document.referrer` is still the\n  // external referrer and the pageview's attribution is unaffected. Without\n  // this, \"the gate is synchronous\" would have quietly meant \"the rest of the\n  // world is never measured on a first visit\".\n  //\n  // Withdrawal. Dropping the instance unmounts every binding hung off it,\n  // which is what unregisters the analytics transport — after that\n  // `deliver()` falls through to `window.gtag`, and the shared consent writer\n  // has already set `ga-disable-<id>` and sent a denied `consent update` on\n  // that exact tag (AGL-1608). The resident tag cannot be unloaded; it can be\n  // made to send nothing, and both halves are needed because either alone\n  // leaks — enhanced measurement fires with no call site at all.\n  const [analytics, setAnalytics] = useState<Analytics | undefined>(\n    () => services.analytics,\n  )\n  useEffect(() => {\n    const sync = () => setAnalytics(analyticsForConsentState(services.app))\n    // Once on mount as well as on the event: the priming pass can resolve a\n    // visitor between this provider's render and this effect, and the event it\n    // dispatched then had no listener yet.\n    sync()\n    window.addEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n    return () =>\n      window.removeEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n  }, [services])\n\n  // Identity changes only when the tag comes or goes, so a consent-stable\n  // document re-renders nothing.\n  const value = useMemo(\n    () =>\n      services.analytics === analytics ? services : { ...services, analytics },\n    [services, analytics],\n  )\n\n  return (\n    <FirebaseServicesContext.Provider value={value}>\n      {children}\n    </FirebaseServicesContext.Provider>\n  )\n}\nFirebaseServicesProvider.displayName = 'FirebaseServicesProvider'\n\nfunction useFirebaseServices(): FirebaseServices {\n  const services = useContext(FirebaseServicesContext)\n  if (!services) {\n    throw new Error(\n      'Firebase hooks must be used within a <FirebaseServicesProvider>',\n    )\n  }\n  return services\n}\n\nexport function useFirebaseApp(): FirebaseApp {\n  return useFirebaseServices().app\n}\nexport function useFirestore(): Firestore {\n  return useFirebaseServices().firestore\n}\nexport function useAuth(): Auth {\n  return useFirebaseServices().auth\n}\n/**\n * The persistence class the provider's `Auth` was created with (AGL-1379).\n *\n * Read it — never re-derive it — when building a **second** Firebase app on\n * the same origin, so the second instance cannot end up more persistent than\n * the first. `apps/console/hooks/use-presence.ts` is the existing case.\n */\nexport function useAuthPersistence(): AuthPersistenceClass {\n  return useFirebaseServices().authPersistence\n}\nexport function useAnalytics(): Analytics {\n  return useFirebaseServices().analytics\n}\nexport function useRemoteConfig(): RemoteConfig {\n  return useFirebaseServices().remoteConfig\n}\n\n/**\n * Replaces reactfire's `useUser()`. Reactfire subscribes via\n * `onIdTokenChanged` rather than `onAuthStateChanged` so fields like\n * `emailVerified` stay live across token refresh (e.g. after\n * `user.reload()` post-email-verification), not just sign-in/out — matched\n * here for behavioral parity.\n *\n * THREE states, not two (AGL-1261): `undefined` = auth has not resolved yet,\n * `null` = resolved, signed OUT, a `User` = resolved, signed in. This used to\n * collapse the emitted `null` into `undefined`, which made \"signed out\" and\n * \"still loading\" the same value — a state that, for a signed-out visitor,\n * never left \"loading\". `useSessionCookie` gates its whole body on\n * `user === undefined`, so its silent restore from the shared `__session`\n * cookie could never run: the cookie exchange returned a valid custom token\n * and nothing ever asked for it.\n */\nexport function useUser(): { data: User | null | undefined } {\n  const auth = useAuth()\n  const [user, setUser] = useState<User | null | undefined>(\n    auth.currentUser ?? undefined,\n  )\n\n  useEffect(() => {\n    return onIdTokenChanged(auth, (nextUser) => {\n      // `?? null`, never `?? undefined` — see the note above.\n      setUser(nextUser ?? null)\n    })\n  }, [auth])\n\n  return { data: user }\n}\n\nexport interface SigninCheckResult {\n  signedIn: boolean\n  user: User | null\n}\n\n/** Replaces reactfire's `useSigninCheck()` — same `onIdTokenChanged` basis as `useUser()`. */\nexport function useSigninCheck(): {\n  status: 'loading' | 'success' | 'error'\n  data: SigninCheckResult | undefined\n  error: Error | undefined\n} {\n  const auth = useAuth()\n  const [status, setStatus] = useState<'loading' | 'success' | 'error'>('loading')\n  const [data, setData] = useState<SigninCheckResult | undefined>(undefined)\n  const [error, setError] = useState<Error | undefined>(undefined)\n\n  useEffect(() => {\n    return onIdTokenChanged(\n      auth,\n      (user) => {\n        setStatus('success')\n        setError(undefined)\n        setData({ signedIn: !!user, user: user ?? null })\n      },\n      (err) => {\n        setStatus('error')\n        setError(err)\n      },\n    )\n  }, [auth])\n\n  return { status, data, error }\n}\n"],"names":["getApps","initializeApp","getAnalytics","getAnalyticsInstance","initializeAnalytics","initializeAnalyticsInstance","initializeAppCheck","ReCaptchaV3Provider","analyticsMayEmit","pushPlatformConsentDefault","VISITOR_CONSENT_CHANGED_EVENT","connectAuthEmulator","onIdTokenChanged","connectFirestoreEmulator","getFirestore","initializeFirestore","getRemoteConfig","getRemoteConfigInstance","createContext","useContext","useEffect","useMemo","useRef","useState","FIREBASE_AUTH_EMULATOR_ENABLED","FIREBASE_FIRESTORE_EMULATOR_ENABLED","APP_CHECK_KEY_MISSING_MESSAGE","appCheckSiteKey","authEmulatorUrl","firestoreEmulatorHost","createAuthInstance","localCacheFor","pruneSharedClientStateFor","FirebaseServicesContext","undefined","firestoreInitialized","Set","connectedAuth","isAutomatedChromeSession","navigator","webdriver","CONSOLE_ANALYTICS_OPTIONS","config","send_page_view","content_group","analyticsConsentGate","setAnalyticsConsentGate","gate","analyticsConsentAllows","analyticsByApp","WeakMap","bootAnalytics","app","existing","get","analytics","window","error","console","fallbackError","set","analyticsForConsentState","FirebaseServicesProvider","props","firebaseConfig","appName","authPersistence","children","servicesRef","current","find","name","auth","has","experimentalForceLongPolling","localCache","emulator","host","port","add","firestore","siteKey","warn","provider","isTokenAutoRefreshEnabled","initialAnalytics","remoteConfig","settings","minimumFetchIntervalMillis","process","env","NODE_ENV","services","setAnalytics","sync","addEventListener","removeEventListener","value","Provider","displayName","useFirebaseServices","Error","useFirebaseApp","useFirestore","useAuth","useAuthPersistence","useAnalytics","useRemoteConfig","useUser","user","setUser","currentUser","nextUser","data","useSigninCheck","status","setStatus","setData","setError","signedIn","err"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA,SAGEA,OAAO,EACPC,aAAa,QACR,eAAc;AACrB,SAEEC,gBAAgBC,oBAAoB,EACpCC,uBAAuBC,2BAA2B,QAC7C,qBAAoB;AAC3B,SAASC,kBAAkB,EAAEC,mBAAmB,QAAQ,qBAAoB;AAC5E,SAASC,gBAAgB,QAAQ,+CAA8C;AAC/E,SAASC,0BAA0B,QAAQ,kDAAiD;AAC5F,SAASC,6BAA6B,QAAQ,yCAAwC;AACtF,SAEEC,mBAAmB,EACnBC,gBAAgB,QAEX,gBAAe;AACtB,SAEEC,wBAAwB,EACxBC,YAAY,EACZC,mBAAmB,QACd,qBAAoB;AAC3B,SAEEC,mBAAmBC,uBAAuB,QACrC,yBAAwB;AAC/B,SACEC,aAAa,EACbC,UAAU,EACVC,SAAS,EACTC,OAAO,EACPC,MAAM,EACNC,QAAQ,QAEH,QAAO;AACd,SACEC,8BAA8B,EAC9BC,mCAAmC,QAC9B,2BAA0B;AACjC,SACEC,6BAA6B,EAC7BC,eAAe,QACV,qCAAiC;AACxC,SACEC,eAAe,EACfC,qBAAqB,QAChB,6CAAyC;AAChD,SAEEC,kBAAkB,QACb,wBAAoB;AAC3B,SAASC,aAAa,EAAEC,yBAAyB,QAAQ,uBAAmB;AA0G5E,MAAMC,wCAA0Bf,cAA4CgB;AAE5E,yEAAyE;AACzE,kEAAkE;AAClE,oBAAoB;AACpB,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAMC,uBAAuB,IAAIC;AACjC,IAAIC,gBAAgB;AAEpB;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,MAAMC,2BAA2B,IAC/B,OAAOC,cAAc,eAAeA,UAAUC,SAAS,KAAK;AAE9D;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMC,4BAA4B;IAChCC,QAAQ;QAAEC,gBAAgB;QAAOC,eAAe;IAAU;AAC5D;AAqBA,IAAIC,uBAAoD;AAExD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,wBACdC,IAAiC;IAEjCF,uBAAuBE;AACzB;AAEA,wEAAwE,GACxE,SAASC;IACP,IAAIH,yBAAyB,MAAM,OAAO;IAC1C,IAAI;QACF,OAAOA,2BAA2B;IACpC,EAAE,eAAM;QACN,qEAAqE;QACrE,oEAAoE;QACpE,8BAA8B;QAC9B,OAAO;IACT;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,iBAAiB,IAAIC;AAE3B;;;;;;CAMC,GACD,SAASC,cAAcC,GAAgB;IACrC,MAAMC,WAAWJ,eAAeK,GAAG,CAACF;IACpC,IAAIC,UAAU,OAAOA;IACrB,IAAIE;IACJ,yEAAyE;IACzE,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,wBAAwB;IACxB,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE9C,2BACE,OAAO+C,WAAW,cAAc,OAAQA;IAE1C,IAAI;QACFD,YAAYlD,4BAA4B+C,KAAKX;IAC/C,EAAE,OAAOgB,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,IAAI;YACF,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,4BAA4B;YAC5BF,YAAYpD,qBAAqBiD;QACnC,EAAE,OAAOO,eAAe;YACtBD,QAAQD,KAAK,CAACE;QAChB;IACF;IACA,IAAIJ,WAAWN,eAAeW,GAAG,CAACR,KAAKG;IACvC,OAAOA;AACT;AAEA;;;CAGC,GACD,SAASM,yBAAyBT,GAAgB;IAChD,IAAI,CAAC5C,oBAAoB,OAAO0B;IAChC,IAAI,CAACc,0BAA0B,OAAOd;IACtC,OAAOiB,cAAcC;AACvB;AA0BA,OAAO,SAASU,yBAAyBC,KAAoC;IAC3E,MAAM,EAAEC,cAAc,EAAEC,OAAO,EAAEC,kBAAkB,SAAS,EAAEC,QAAQ,EAAE,GAAGJ;IAC3E,MAAMK,cAAc9C,OAAqCY;IAEzD,IAAI,CAACkC,YAAYC,OAAO,EAAE;YAEtBrE;QADF,MAAMoD,OACJpD,gBAAAA,UAAUsE,IAAI,CAAC,CAACjB,WAAaA,SAASkB,IAAI,KAAKN,oBAA/CjE,gBACAC,cAAc+D,gBAAgBC;QAChC,oEAAoE;QACpE,MAAMO,OAAO1C,mBAAmBsB,KAAKc;QAErC,IAAI,CAAC/B,qBAAqBsC,GAAG,CAACR,UAAU;YACtC,IAAI;gBACF,iEAAiE;gBACjE,4DAA4D;gBAC5D,iEAAiE;gBACjE,8DAA8D;gBAC9D,2DAA2D;gBAC3D,kEAAkE;gBAClE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qEAAqE;gBACrE,UAAU;gBACV,EAAE;gBACF,mEAAmE;gBACnE,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,iEAAiE;gBACjE,8DAA8D;gBAC9D,oEAAoE;gBACpE,oEAAoE;gBACpE,sBAAsB;gBACtBlD,oBACEqC,KACA3B,sCACI;oBAAEiD,8BAA8B;gBAAK,IACrC;oBACE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,uDAAuD;oBACvD,4BAA4B;oBAC5BC,YAAY5C,cAAcmC;mBAQtB5B,6BACA;oBAAEoC,8BAA8B;gBAAK,IACrC,CAAC;gBAGb,IAAIjD,qCAAqC;oBACvC,mEAAmE;oBACnE,oDAAoD;oBACpD,MAAMmD,WAAW/C;oBACjBhB,yBACEC,aAAasC,MACbwB,SAASC,IAAI,EACbD,SAASE,IAAI;gBAEjB,OAAO;oBACL,+DAA+D;oBAC/D,mEAAmE;oBACnE,6DAA6D;oBAC7D,KAAK9C,0BAA0BkC,iBAAiBd;gBAClD;YACF,EAAE,eAAM;YACN,sGAAsG;YACxG,SAAU;gBACRjB,qBAAqB4C,GAAG,CAACd;YAC3B;QACF;QACA,MAAMe,YAAYlE,aAAasC;QAE/B,IAAI,CAACf,eAAe;YAClB,IAAI;gBACF,IAAIb,gCAAgC;oBAClC,uDAAuD;oBACvDb,oBAAoB6D,MAAM5C;gBAC5B;gBACAS,gBAAgB;YAClB,EAAE,OAAOoB,OAAO;gBACdC,QAAQD,KAAK,CAACA;YAChB;QACF;QACA,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,IACE,CAACjC,kCACD,CAACC,qCACD;YACA,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,MAAMwD,UAAUtD;YAChB,IAAI,CAACsD,SAAS;gBACZvB,QAAQwB,IAAI,CAACxD;YACf,OAAO;gBACL,IAAI;oBACFpB,mBAAmB8C,KAAK;wBACtB+B,UAAU,IAAI5E,oBAAoB0E;wBAClCG,2BAA2B;oBAC7B;gBACF,EAAE,OAAO3B,OAAO;oBACdC,QAAQD,KAAK,CAACA;gBAChB;YACF;QACF;QACA,2EAA2E;QAC3E,2EAA2E;QAC3E,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wCAAwC;QACxC,qEAAqE;QACrE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,kBAAkB;QAClB,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,yEAAyE;QACzE,iEAAiE;QACjE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,EAAE;QACF,uEAAuE;QACvE,yDAAyD;QACzD,iEAAiE;QACjE,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,mCAAmC;QACnC,EAAE;QACF,2DAA2D;QAC3D,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAM4B,mBAAmBxB,yBAAyBT;QAClD,oEAAoE;QACpE,wEAAwE;QACxE,sCAAsC;QACtC,IAAIkC;QACJ,IAAI;YACFA,eAAerE,wBAAwBmC;YACvCkC,aAAaC,QAAQ,CAACC,0BAA0B,GAC9CC,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe,UAAY;QACxD,EAAE,OAAOlC,OAAO;YACdC,QAAQD,KAAK,CAACA;QAChB;QAEAW,YAAYC,OAAO,GAAG;YACpBjB;YACA4B;YACAR;YACAjB,WAAW8B;YACXC;YACApB;QACF;IACF;IAEA,MAAM0B,WAAWxB,YAAYC,OAAO;IAEpC,6EAA6E;IAC7E,4EAA4E;IAC5E,kBAAkB;IAClB,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,wEAAwE;IACxE,iEAAiE;IACjE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,CAACd,WAAWsC,aAAa,GAAGtE,SAChC,IAAMqE,SAASrC,SAAS;IAE1BnC,UAAU;QACR,MAAM0E,OAAO,IAAMD,aAAahC,yBAAyB+B,SAASxC,GAAG;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,uCAAuC;QACvC0C;QACAtC,OAAOuC,gBAAgB,CAACrF,+BAA+BoF;QACvD,OAAO,IACLtC,OAAOwC,mBAAmB,CAACtF,+BAA+BoF;IAC9D,GAAG;QAACF;KAAS;IAEb,wEAAwE;IACxE,+BAA+B;IAC/B,MAAMK,QAAQ5E,QACZ,IACEuE,SAASrC,SAAS,KAAKA,YAAYqC,WAAW,aAAKA;YAAUrC;YAC/D;QAACqC;QAAUrC;KAAU;IAGvB,qBACE,KAACtB,wBAAwBiE,QAAQ;QAACD,OAAOA;kBACtC9B;;AAGP;AACAL,yBAAyBqC,WAAW,GAAG;AAEvC,SAASC;IACP,MAAMR,WAAWzE,WAAWc;IAC5B,IAAI,CAAC2D,UAAU;QACb,MAAM,IAAIS,MACR;IAEJ;IACA,OAAOT;AACT;AAEA,OAAO,SAASU;IACd,OAAOF,sBAAsBhD,GAAG;AAClC;AACA,OAAO,SAASmD;IACd,OAAOH,sBAAsBpB,SAAS;AACxC;AACA,OAAO,SAASwB;IACd,OAAOJ,sBAAsB5B,IAAI;AACnC;AACA;;;;;;CAMC,GACD,OAAO,SAASiC;IACd,OAAOL,sBAAsBlC,eAAe;AAC9C;AACA,OAAO,SAASwC;IACd,OAAON,sBAAsB7C,SAAS;AACxC;AACA,OAAO,SAASoD;IACd,OAAOP,sBAAsBd,YAAY;AAC3C;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASsB;QAGZpC;IAFF,MAAMA,OAAOgC;IACb,MAAM,CAACK,MAAMC,QAAQ,GAAGvF,UACtBiD,oBAAAA,KAAKuC,WAAW,YAAhBvC,oBAAoBtC;IAGtBd,UAAU;QACR,OAAOR,iBAAiB4D,MAAM,CAACwC;YAC7B,wDAAwD;YACxDF,QAAQE,mBAAAA,WAAY;QACtB;IACF,GAAG;QAACxC;KAAK;IAET,OAAO;QAAEyC,MAAMJ;IAAK;AACtB;AAOA,4FAA4F,GAC5F,OAAO,SAASK;IAKd,MAAM1C,OAAOgC;IACb,MAAM,CAACW,QAAQC,UAAU,GAAG7F,SAA0C;IACtE,MAAM,CAAC0F,MAAMI,QAAQ,GAAG9F,SAAwCW;IAChE,MAAM,CAACuB,OAAO6D,SAAS,GAAG/F,SAA4BW;IAEtDd,UAAU;QACR,OAAOR,iBACL4D,MACA,CAACqC;YACCO,UAAU;YACVE,SAASpF;YACTmF,QAAQ;gBAAEE,UAAU,CAAC,CAACV;gBAAMA,IAAI,EAAEA,eAAAA,OAAQ;YAAK;QACjD,GACA,CAACW;YACCJ,UAAU;YACVE,SAASE;QACX;IAEJ,GAAG;QAAChD;KAAK;IAET,OAAO;QAAE2C;QAAQF;QAAMxD;IAAM;AAC/B"}