@aglyn/tenant-feature-instance 1.0.0-beta.217 → 1.0.0-beta.219

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-feature-instance",
-  "version": "1.0.0-beta.217",
+  "version": "1.0.0-beta.219",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.217",
-    "@aglyn/shared-data-enums": "1.0.0-beta.217",
-    "@aglyn/shared-ui-jsx": "1.0.0-beta.217",
-    "@aglyn/shared-util-email": "1.0.0-beta.217",
-    "@aglyn/shared-util-http": "1.0.0-beta.217",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.217",
+    "@aglyn/aglyn": "1.0.0-beta.219",
+    "@aglyn/shared-data-enums": "1.0.0-beta.219",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.219",
+    "@aglyn/shared-util-email": "1.0.0-beta.219",
+    "@aglyn/shared-util-http": "1.0.0-beta.219",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.219",
     "@swc/helpers": "0.5.23",
     "lodash-es": "^4.18.1"
   },

package/src/lib/hooks/firebase/firebase-services.js

@@ -30,7 +30,9 @@ import { FIREBASE_AUTH_EMULATOR_ENABLED, FIREBASE_FIRESTORE_EMULATOR_ENABLED } f
 import { APP_CHECK_KEY_MISSING_MESSAGE, appCheckSiteKey } from "../../constants/firebase-config.js";
 import { authEmulatorUrl, firestoreEmulatorHost } from "../../constants/firebase-emulator-hosts.js";
 import { createAuthInstance } from "./auth-persistence.js";
-import { localCacheFor, pruneSharedClientStateFor } from "./firestore-cache.js";
+import { firestoreCacheClassFor, localCacheFor, pruneSharedClientStateFor } from "./firestore-cache.js";
+import { markMultiTabFirestore } from "./firestore-multitab-wedge.js";
+import { firestorePersistencePrefix } from "./firestore-shared-client-state.js";
 const FirebaseServicesContext = /*#__PURE__*/ createContext(undefined);
 // Module-scope guards so HMR / remounts don't re-run emulator connection
 // (which throws if called twice) or double-initialize Firestore's
@@ -182,6 +184,10 @@ export function FirebaseServicesProvider(props) {
         const app = (_getApps_find = getApps().find((existing)=>existing.name === appName)) != null ? _getApps_find : initializeApp(firebaseConfig, appName);
         // `durable` resolves to the same `getAuth(app)` this always called.
         const auth = createAuthInstance(app, authPersistence);
+        // The origin's class, unless this tab fell back to the memory cache
+        // because another tab locked the shared one (AGL-3428). Firestore only:
+        // `auth` above keeps the origin's class.
+        const firestoreCacheClass = firestoreCacheClassFor(authPersistence);
         if (!firestoreInitialized.has(appName)) {
             try {
                 // Under the emulator (dev/e2e only): force long-polling and skip
@@ -216,7 +222,7 @@ export function FirebaseServicesProvider(props) {
                     // console domain it is the same exposure D6 removed from the
                     // refresh token — see `firestore-cache.ts` for why one
                     // declaration governs both.
-                    localCache: localCacheFor(authPersistence)
+                    localCache: localCacheFor(firestoreCacheClass)
                 }, isAutomatedChromeSession() ? {
                     experimentalForceLongPolling: true
                 } : {}));
@@ -226,10 +232,16 @@ export function FirebaseServicesProvider(props) {
                     const emulator = firestoreEmulatorHost();
                     connectFirestoreEmulator(getFirestore(app), emulator.host, emulator.port);
                 } else {
+                    var _app_options;
                     // The SDK never sweeps the multi-tab records the durable cache
                     // strands in localStorage, and a full localStorage fails the whole
                     // Firestore client — see `firestore-shared-client-state.ts`.
-                    void pruneSharedClientStateFor(authPersistence, app);
+                    void pruneSharedClientStateFor(firestoreCacheClass, app);
+                    // Only the durable multi-tab cache can be locked by another tab,
+                    // so only it gets the lease check after a stalled recovery.
+                    if (firestoreCacheClass === 'durable' && ((_app_options = app.options) == null ? void 0 : _app_options.projectId)) {
+                        markMultiTabFirestore(getFirestore(app), `${firestorePersistencePrefix(app.name, app.options.projectId)}main`);
+                    }
                 }
             } catch (unused) {
             // already initialized (e.g. HMR reset the module flag) — getFirestore() returns the existing instance

package/src/lib/hooks/firebase/firebase-services.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/firebase-services.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport {\n  type FirebaseApp,\n  type FirebaseOptions,\n  getApps,\n  initializeApp,\n} from 'firebase/app'\nimport {\n  type Analytics,\n  getAnalytics as getAnalyticsInstance,\n  initializeAnalytics as initializeAnalyticsInstance,\n} from 'firebase/analytics'\nimport { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check'\nimport { analyticsMayEmit } from '@aglyn/aglyn/app-utils/analytics-environment'\nimport { pushPlatformConsentDefault } from '@aglyn/aglyn/app-utils/platform-consent-default'\nimport { VISITOR_CONSENT_CHANGED_EVENT } from '@aglyn/aglyn/app-utils/visitor-consent'\nimport {\n  type Auth,\n  connectAuthEmulator,\n  onIdTokenChanged,\n  type User,\n} from 'firebase/auth'\nimport {\n  type Firestore,\n  connectFirestoreEmulator,\n  getFirestore,\n  initializeFirestore,\n} from 'firebase/firestore'\nimport {\n  type RemoteConfig,\n  getRemoteConfig as getRemoteConfigInstance,\n} from 'firebase/remote-config'\nimport {\n  createContext,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react'\nimport {\n  FIREBASE_AUTH_EMULATOR_ENABLED,\n  FIREBASE_FIRESTORE_EMULATOR_ENABLED,\n} from '@aglyn/shared-data-enums'\nimport {\n  APP_CHECK_KEY_MISSING_MESSAGE,\n  appCheckSiteKey,\n} from '../../constants/firebase-config'\nimport {\n  authEmulatorUrl,\n  firestoreEmulatorHost,\n} from '../../constants/firebase-emulator-hosts'\nimport {\n  type AuthPersistenceClass,\n  createAuthInstance,\n} from './auth-persistence'\nimport { localCacheFor, pruneSharedClientStateFor } from './firestore-cache'\n\n/**\n * Drop-in replacement for reactfire's `ObservableStatus<T>` — reactfire is\n * unmaintained against firebase majors past v9, but its shape is preserved\n * here so `helpers/use-doc.ts`'s already-battle-tested onSnapshot+retry\n * implementation (AGL-216/223) didn't need to change.\n */\nexport interface ObservableStatus<T> {\n  status: 'loading' | 'error' | 'success'\n  hasEmitted: boolean\n  isComplete: boolean\n  data: T\n  error: Error | undefined\n  firstValuePromise: Promise<void>\n  /**\n   * The emitted `data` includes local writes the server has NOT\n   * acknowledged (`snapshot.metadata.hasPendingWrites`).\n   *\n   * Carried rather than dropped because a caller cannot otherwise tell \"the\n   * store holds this\" from \"my browser holds this\". `persistentLocalCache`\n   * replays a queued write into the very first snapshot after a reload, so a\n   * caller that treats every snapshot as authoritative will adopt its own\n   * unacknowledged edit as the saved state — which is how the besigner ended\n   * up unable to save real changes (AGL-1262).\n   */\n  hasPendingWrites: boolean\n  /**\n   * The emitted `data` came from the local cache and the server has NOT\n   * confirmed it (`snapshot.metadata.fromCache`).\n   *\n   * Carried because it is the only per-listener ground truth about\n   * freshness the SDK offers, and the console needs it (AGL-1066). Under\n   * `persistentLocalCache` a listener whose server listen is being REFUSED\n   * still emits cached snapshots and still reports `status: 'success'` —\n   * the retry budget is reset by each cached emission and never spends, so\n   * `status` can never reveal the fault (see\n   * `use-firestore-collection-cached-retry.spec.ts`).\n   *\n   * Prefer this over `session-health`'s `staleSession` for anything that\n   * asks \"is what I am looking at live?\". `staleSession` is a heuristic\n   * needing two denied collections inside a window, and it is unreachable\n   * on listener-only pages; this is a fact about THIS listener, costs\n   * nothing, and clears itself the instant a server snapshot lands.\n   */\n  fromCache: boolean\n  /**\n   * The server has REFUSED this listen for longer than the retry budget, and\n   * no server snapshot has arrived since (AGL-1066).\n   *\n   * `fromCache` says \"unconfirmed\", which is also true offline and true for\n   * the first snapshot of a perfectly healthy load. This says \"refused\" —\n   * only `permission-denied` counts it, and it takes a whole budget's worth\n   * in a row, so it cannot fire offline and cannot fire on the AGL-216/217\n   * post-sign-in token race.\n   *\n   * It is what `status` would say if the retry budget were spendable. It is\n   * carried separately because correcting `status` in place would blank\n   * every surface that renders cached data through an `error` branch — see\n   * the note on `attempt = 0` in `use-firestore-collection`.\n   */\n  serverDenied: boolean\n}\n\n/** Replaces reactfire's `ReactFireOptions<T>` — drops the `suspense` field, which was never read. */\nexport interface FirestoreDocOptions<T> {\n  idField?: string\n  initialData?: T\n}\n\n/**\n * The Firebase products this provider builds, and therefore the ones every\n * page that renders it downloads.\n *\n * ⛔ NO Realtime Database and NO Cloud Storage (AGL-2706). Both were built\n * here and published as `useDatabase()` / `useStorage()`, and neither hook had\n * a single caller anywhere in the repo — so `@firebase/database` (125.9 KB\n * raw) and `@firebase/storage` (13.9 KB) were in the first load of every\n * console route to satisfy a context field nothing read.\n *\n * Realtime Database IS used, by `apps/console/hooks/use-presence.ts` and\n * `use-coediting.ts` — on their own Firebase app, with their own\n * `getDatabase`, behind the editor routes that need presence. That is the\n * shape to copy if a surface needs one of these: reach for the product where\n * the feature is, not in the provider every page mounts. A field here is paid\n * for by every route, used or not.\n */\ninterface FirebaseServices {\n  app: FirebaseApp\n  firestore: Firestore\n  auth: Auth\n  analytics: Analytics\n  remoteConfig: RemoteConfig\n  /**\n   * The persistence class `auth` was actually created with (AGL-1379).\n   *\n   * Published so a **second** auth instance derives its class from the\n   * primary rather than re-deciding it. `apps/console/hooks/use-presence.ts`\n   * builds its own Firebase app and its own `Auth`; before this it took the\n   * SDK default unconditionally, so configuring only the provider would have\n   * left presence persisting a refresh token on an origin the provider had\n   * just been careful not to persist one on.\n   */\n  authPersistence: AuthPersistenceClass\n}\n\nconst FirebaseServicesContext = createContext<FirebaseServices | undefined>(undefined)\n\n// Module-scope guards so HMR / remounts don't re-run emulator connection\n// (which throws if called twice) or double-initialize Firestore's\n// persistent cache.\n//\n// Firestore's is keyed by app NAME, not a bare boolean (AGL-1456): Firestore\n// initialization is once-per-app, so a module-global flag made the FIRST app\n// to mount decide for every later one — a second app would silently skip\n// `initializeFirestore` and take SDK defaults. That mattered the moment the\n// cache stopped being the same on every host.\nconst firestoreInitialized = new Set<string>()\nlet connectedAuth = false\n\n/**\n * True when THIS Chrome instance is under WebDriver automation control\n * (Puppeteer, Playwright, Selenium, or a raw CDP client) — never true for a\n * person's own browser.\n *\n * The `initializeFirestore` call below already documents the fault this\n * exists for: \"the emulator's WebChannel streaming misbehaves in automated\n * Chrome — listeners serve the initial empty from-cache snapshot and the\n * server sync never arrives\" (AGL-217). That mitigation only reaches\n * `FIREBASE_FIRESTORE_EMULATOR_ENABLED`, so an automated session against a\n * REAL, deployed backend — a browser-automation agent driving a live\n * console, which is exactly what `navigator.webdriver` detects — stayed\n * exposed. `getDocs`/`getDoc` and `onSnapshot` all resolve over the same\n * Watch stream internally, so a one-shot read wedges exactly like a listener\n * does: no error, nothing to catch, `loading` simply never gets its\n * settling event. That is the Media Library grid spinning on \"Loading\n * media…\" indefinitely with a perfectly healthy account and a perfectly\n * healthy network.\n *\n * `undefined` during SSR reads as `false` — `navigator` does not exist in\n * Node, and a server render can only ever produce the auto-detected\n * transport, never the forced one.\n */\nconst isAutomatedChromeSession = (): boolean =>\n  typeof navigator !== 'undefined' && navigator.webdriver === true\n\n/**\n * The console tag's gtag config — ONE object, at module scope, deliberately\n * (AGL-1979).\n *\n * `initializeAnalytics(app, options)` throws `already-initialized` unless the\n * options `deepEqual` the ones the instance was first created with, and the\n * provider re-enters this block on every mount, every StrictMode double\n * invoke and every Fast Refresh. A fresh object literal per call survives\n * that only by *value*; a shared constant survives it by *identity*, which is\n * the first branch of the SDK's own comparison and cannot drift when someone\n * edits one call site and not another.\n *\n * ⚠️ The SDK MUTATES this object: `_initializeAnalytics` reads `options.config`\n * and writes `origin`, `update` and the installation id onto it in place.\n * That is precisely why sharing it is safe rather than dangerous — the object\n * the provider holds and the object the SDK stored are the same one, so they\n * cannot disagree.\n */\nconst CONSOLE_ANALYTICS_OPTIONS = {\n  config: { send_page_view: false, content_group: 'console' },\n}\n\n/**\n * A surface's answer to \"may an analytics tag exist for this visitor at all?\".\n *\n * Registered from the app, at module scope, in the same shape as\n * `setFirestoreSessionReporters` and `setStaleSessionCheck` — and for a\n * sharper version of the same reason. This is consulted during the provider's\n * FIRST render, before any effect anywhere has run, so a gate installed from\n * an effect would arrive after the decision it exists to make.\n *\n * Answering `false` means the SDK is never asked to initialize: `gtag.js` is\n * never fetched, `window.gtag` never comes into existence, and the shared\n * `deliver()` in `analytics-events.ts` — whose fallback IS `window.gtag` —\n * therefore has nowhere to put a hit. That is the difference between a gate\n * and a suppression, and it is the difference AGL-1608 paid for: a resident\n * tag reports on its own, through enhanced measurement, whatever any flag\n * says afterwards.\n */\nexport type AnalyticsConsentGate = () => boolean\n\nlet analyticsConsentGate: AnalyticsConsentGate | null = null\n\n/**\n * Install the consent gate for this document, or clear it with `null`.\n *\n * UNREGISTERED MEANS ALLOWED, which is deliberate and is the only default that\n * is safe here. The tenant runtime does not use this provider's analytics\n * branch at all (it builds its own tag in `site-analytics.tsx`, behind the\n * AGL-1498 gate), and a self-hosted console points at the operator's own GA\n * property — silencing an operator's analytics because Aglyn's own surface\n * grew a gate is a failure they cannot diagnose. The surface that needs the\n * gate is the one that registers it.\n */\nexport function setAnalyticsConsentGate(\n  gate: AnalyticsConsentGate | null,\n): void {\n  analyticsConsentGate = gate\n}\n\n/** The gate's verdict, with an unregistered gate reading as \"allowed\". */\nfunction analyticsConsentAllows(): boolean {\n  if (analyticsConsentGate === null) return true\n  try {\n    return analyticsConsentGate() === true\n  } catch {\n    // A gate that throws cannot be read as consent. Storage can throw in\n    // private mode, and \"we could not tell\" is the one state this whole\n    // mechanism resolves to \"no\".\n    return false\n  }\n}\n\n/**\n * The Analytics instance per Firebase app, so a re-boot after a consent change\n * hands back the tag that is already resident rather than asking the SDK for a\n * second one.\n *\n * `initializeAnalytics` is idempotent while the options match, so this is not\n * what makes re-entry safe — `CONSOLE_ANALYTICS_OPTIONS` being a shared\n * constant is. What this avoids is the noisy path: once anything has\n * initialized the provider with different options, every later call throws and\n * is logged, and a withdrawal followed by a re-grant would log it again.\n */\nconst analyticsByApp = new WeakMap<FirebaseApp, Analytics>()\n\n/**\n * Boot the console's Analytics tag, or return the one already booted.\n *\n * Extracted from the provider body so that \"when is the tag created\" and \"may\n * it be created\" are separable: the consent gate can defer this call to a\n * later render without the ordering below moving.\n */\nfunction bootAnalytics(app: FirebaseApp): Analytics | undefined {\n  const existing = analyticsByApp.get(app)\n  if (existing) return existing\n  let analytics: Analytics\n  // The region-conditional consent default (AGL-1597), declared BEFORE the\n  // SDK boots the tag. Ordering is the whole of it: a `default` read after\n  // `config` is not a default, and the SDK issues `config` inside\n  // `initializeAnalytics` on the next line. Pushing onto `dataLayer` here\n  // works even though gtag.js is not loaded yet — the queue is what makes the\n  // ordering expressible.\n  //\n  // Still declared even though the gate above has already said yes, and the\n  // two are not redundant. The gate answers \"may a tag exist\"; the default\n  // answers \"what may the tag that does exist do\", per region, from its very\n  // first hit. Ad storage stays denied everywhere on this surface.\n  pushPlatformConsentDefault(\n    typeof window === 'undefined' ? null : (window as never),\n  )\n  try {\n    analytics = initializeAnalyticsInstance(app, CONSOLE_ANALYTICS_OPTIONS)\n  } catch (error) {\n    console.error(error)\n    try {\n      // Already initialized by someone else, with someone else's options:\n      // take THAT instance rather than leaving consumers with nothing. The\n      // tag it is attached to was configured without `send_page_view: false`\n      // and without `content_group`, so this session reports a duplicate\n      // startup page_view and an unstamped surface — degraded, and loudly so,\n      // instead of silently dead.\n      analytics = getAnalyticsInstance(app)\n    } catch (fallbackError) {\n      console.error(fallbackError)\n    }\n  }\n  if (analytics) analyticsByApp.set(app, analytics)\n  return analytics\n}\n\n/**\n * The tag this document may have right now: none outside a real production\n * deployment, none while consent is absent, otherwise the booted instance.\n */\nfunction analyticsForConsentState(app: FirebaseApp): Analytics | undefined {\n  if (!analyticsMayEmit()) return undefined\n  if (!analyticsConsentAllows()) return undefined\n  return bootAnalytics(app)\n}\n\nexport interface FirebaseServicesProviderProps {\n  firebaseConfig: FirebaseOptions\n  appName: string\n  /**\n   * How much of *anything* this origin may keep on disk. Defaults to\n   * `durable`, which is what every host serving this provider today is:\n   * `*.aglyn.com` and `*.aglyn.app`, whose DNS we own and whose 14-day\n   * session is the product.\n   *\n   * A **custom console domain** (AGL-1099c) must pass `ephemeral`. That is\n   * the whole reason this is a prop rather than a constant: the class differs\n   * per origin, not per build, and the decision belongs to whoever knows\n   * which origin is being served.\n   *\n   * **It governs two things, and the name only names one.** It selects the\n   * `Auth` persistence class (AGL-1379) *and* the Firestore `localCache`\n   * (AGL-1456) — because both answer the same question about the same origin,\n   * and splitting them into two props is precisely how the cache came to be\n   * unconditional while the credential was hardened. See `firestore-cache.ts`.\n   */\n  authPersistence?: AuthPersistenceClass\n  children?: ReactNode\n}\n\nexport function FirebaseServicesProvider(props: FirebaseServicesProviderProps) {\n  const { firebaseConfig, appName, authPersistence = 'durable', children } = props\n  const servicesRef = useRef<FirebaseServices | undefined>(undefined)\n\n  if (!servicesRef.current) {\n    const app =\n      getApps().find((existing) => existing.name === appName) ??\n      initializeApp(firebaseConfig, appName)\n    // `durable` resolves to the same `getAuth(app)` this always called.\n    const auth = createAuthInstance(app, authPersistence)\n\n    if (!firestoreInitialized.has(appName)) {\n      try {\n        // Under the emulator (dev/e2e only): force long-polling and skip\n        // the persistent multi-tab cache. The emulator's WebChannel\n        // streaming misbehaves in automated Chrome — listeners serve the\n        // initial empty from-cache snapshot and the server sync never\n        // arrives, which looks like \"empty pages with zero errors\"\n        // (the AGL-217 mystery). Real traffic keeps the default transport\n        // and persistent cache — except a WebDriver-controlled Chrome\n        // against a real backend, which forces long-polling for the same\n        // reason without giving up the cache (see `isAutomatedChromeSession`\n        // below).\n        //\n        // ⚠️ CONSEQUENCE, and it will cost you hours if you do not know it\n        // (AGL-1066): every stale-session/stale-cache fault is UNREPRODUCIBLE\n        // locally through the app, because the cache that causes them is off\n        // in exactly the configuration you would reach for to reproduce one.\n        // A listener that keeps serving arbitrarily-old data while the server\n        // refuses it, a `noDocument` tombstone that 404s a live host, the\n        // retry budget that never spends because a cached emission resets it\n        // — none of them can happen here. Test that behaviour with the unit\n        // seams instead (`use-firestore-collection-cached-retry.spec.ts`\n        // drives cached emissions and denials directly), or against a\n        // deployed environment. Do NOT \"fix\" it by turning the cache on for\n        // the emulator: the AGL-217 empty-pages-with-zero-errors mystery is\n        // what that produces.\n        initializeFirestore(\n          app,\n          FIREBASE_FIRESTORE_EMULATOR_ENABLED\n            ? { experimentalForceLongPolling: true }\n            : {\n                // NOT unconditional (AGL-1456). `persistentLocalCache` writes\n                // document bodies to this origin's IndexedDB, so on a custom\n                // console domain it is the same exposure D6 removed from the\n                // refresh token — see `firestore-cache.ts` for why one\n                // declaration governs both.\n                localCache: localCacheFor(authPersistence),\n                // The real-backend half of the AGL-217 mitigation above: force\n                // long-polling for a WebDriver-controlled Chrome even when it\n                // is NOT talking to the emulator, because the WebChannel wedge\n                // is a property of automated Chrome, not of which backend it\n                // is automating against. Never true for a real visitor, so\n                // production traffic keeps the SDK's own auto-detected\n                // transport untouched.\n                ...(isAutomatedChromeSession()\n                  ? { experimentalForceLongPolling: true }\n                  : {}),\n              },\n        )\n        if (FIREBASE_FIRESTORE_EMULATOR_ENABLED) {\n          // Where the server was told the emulator is, rather than a default\n          // port another session's stack may hold (AGL-2834).\n          const emulator = firestoreEmulatorHost()\n          connectFirestoreEmulator(\n            getFirestore(app),\n            emulator.host,\n            emulator.port,\n          )\n        } else {\n          // The SDK never sweeps the multi-tab records the durable cache\n          // strands in localStorage, and a full localStorage fails the whole\n          // Firestore client — see `firestore-shared-client-state.ts`.\n          void pruneSharedClientStateFor(authPersistence, app)\n        }\n      } catch {\n        // already initialized (e.g. HMR reset the module flag) — getFirestore() returns the existing instance\n      } finally {\n        firestoreInitialized.add(appName)\n      }\n    }\n    const firestore = getFirestore(app)\n\n    if (!connectedAuth) {\n      try {\n        if (FIREBASE_AUTH_EMULATOR_ENABLED) {\n          // The emulator the server was started with (AGL-2834).\n          connectAuthEmulator(auth, authEmulatorUrl())\n        }\n        connectedAuth = true\n      } catch (error) {\n        console.error(error)\n      }\n    }\n    // App Check must be skipped under the emulators: there is no App\n    // Check emulator, so ReCaptcha would hit the real backend and its\n    // 403s break emulator auth (the AGL-216 emulator sessions hit this).\n    if (\n      !FIREBASE_AUTH_EMULATOR_ENABLED &&\n      !FIREBASE_FIRESTORE_EMULATOR_ENABLED\n    ) {\n      // No site key means no provider (AGL-2049). Registering one built on\n      // `undefined` does not throw — it fails asynchronously inside the SDK,\n      // where the catch below cannot see it — so this has to be a pre-check.\n      const siteKey = appCheckSiteKey()\n      if (!siteKey) {\n        console.warn(APP_CHECK_KEY_MISSING_MESSAGE)\n      } else {\n        try {\n          initializeAppCheck(app, {\n            provider: new ReCaptchaV3Provider(siteKey),\n            isTokenAutoRefreshEnabled: true,\n          })\n        } catch (error) {\n          console.error(error)\n        }\n      }\n    }\n    // `initializeAnalytics`, not `getAnalytics`, for exactly one reason: it is\n    // the only form that can pass `config`, and `send_page_view: false` is the\n    // only way to stop the SDK's own startup `page_view` (AGL-1643).\n    //\n    // Booting Analytics issues `gtag('config', <id>, configProperties)`, and\n    // the vendored SDK's own comment on that line reads \"This will trigger a\n    // page_view event unless 'send_page_view' is set to false in\n    // configProperties\". `getAnalytics(app)` passes no config at all, so the\n    // key was never there and the hit always fired — on top of the manual\n    // `page_view` the console's layout sends on mount. Two hits, one page.\n    //\n    // The SDK's is the one suppressed rather than the layout's, and the\n    // direction is the whole decision: the SDK fires ONCE per document load,\n    // while the layout fires on mount AND on every `usePathname` change. In a\n    // client-routed app the layout's is a superset — killing it instead would\n    // have left every in-app navigation unreported, halving console pageviews\n    // rather than correcting them, and the reports would have looked fine.\n    //\n    // Nothing else about attribution moves: the surviving hit is sent from the\n    // same document at mount, so `document.referrer` — which gtag resolves for\n    // `page_referrer` itself, and which is what carries marketing traffic\n    // source into the session — is still the external referrer at that moment.\n    //\n    // Re-entry is safe *only* while the options match. `initializeAnalytics`\n    // returns the existing instance when they deep-equal the first call's and\n    // throws `already-initialized` otherwise — and the options can be made to\n    // differ by things no call site here controls (AGL-1979):\n    //\n    //   * anything that touches the analytics provider WITHOUT options first\n    //     initializes it with `{}`. `getAnalytics()` is the obvious one, but\n    //     `@firebase/remote-config` reaches the same code path on its own —\n    //     `addExperimentToAnalytics` calls `analyticsProvider.getImmediate({\n    //     optional: true })`, and `optional` only suppresses the throw, it\n    //     does not stop the initialization.\n    //   * in dev, a module instance carrying a PREVIOUS version of these\n    //     options (this config changed under AGL-1857) surviving a Fast\n    //     Refresh alongside the new one.\n    //\n    // Once that happens the conflict is permanent for the document: every\n    // later call throws, so without the fallback below `analytics` stayed\n    // undefined forever and the next consumer — `logEvent(analytics, …)` —\n    // read `.app` off it and threw a TypeError two frames away, which is how\n    // this surfaced (top Cloud Error Reporting group, and reproduced live on\n    // app.aglyn.com).\n    //\n    // `getAnalytics(app)` is the remedy the SDK's own error message names. It\n    // cannot cost us the config on a healthy document: it only runs after\n    // `initializeAnalytics` threw, and on a first init that throw can only be\n    // `no-app-id` / `no-api-key` / `already-exists`, none of which\n    // `getAnalytics` can rescue either — it re-throws and we fall through to\n    // an undefined instance, which every consumer must now tolerate.\n    // `content_group: 'console'` (AGL-1857) rides the same config: it is the\n    // first-class GA4 axis that separates console traffic from `marketing`\n    // (stamped by the tenant runtime on aglyn.com's own tag) and `docs`\n    // (stamped by the Docusaurus head snippet) in standard reports, without\n    // reaching for the Hostname dimension. The console is this provider's\n    // only consumer, verified by grep — the tenant runtime builds its tag in\n    // `site-analytics.tsx` and never passes through here.\n    //\n    // AND NOT AT ALL outside a real production deployment (AGL-2067). This\n    // provider used to boot Analytics unconditionally, while\n    // `apps/console/.env.development.local` points at the PRODUCTION\n    // measurement id — so every `next dev` session and every Vercel preview\n    // build produced genuine `session_start` / `first_visit` / `page_view`\n    // hits in the live property. Not a theory: the archived Marketing\n    // property's entire year-to-date history is 30 views / 6 users, ~24 of\n    // them `/signin` on preview urls (docs/ANALYTICS.md).\n    //\n    // Not initialized rather than initialized-and-suppressed, because a\n    // resident tag reports on its own — AGL-1608 is the same lesson from the\n    // consent side. `useAnalytics()` returning undefined is already a\n    // supported state everywhere (AGL-1979), which is what makes this a\n    // two-line gate instead of an audit.\n    //\n    // `analyticsMayEmit` leans LOUD on an unknown deployment: a self-hosted\n    // build points at the operator's own Firebase project and their own GA\n    // property, and silencing a customer's analytics to protect ours is the\n    // worse failure. See the module for the escape hatch.\n    //\n    // AND NOT while a registered consent gate says no (AGL-1498 posture,\n    // applied to Aglyn's own console). `analyticsForConsentState` is where\n    // both conditions and the boot itself now live, because the boot has to\n    // be repeatable: a visitor whose region has not resolved yet is undecided\n    // at this instant and may be granted a moment later, and a visitor who\n    // withdraws mid-session has to lose the instance without the page\n    // reloading. See the effect below.\n    //\n    // SCOPE. This is the console's tag and only the console's:\n    // `CONSOLE_ANALYTICS_OPTIONS`, `content_group: 'console'`, and this\n    // provider's analytics branch has no other consumer (the tenant runtime\n    // builds its tag in `site-analytics.tsx` and never passes through here).\n    // Customer sites keep the AGL-1498 gate and the host's own\n    // `consent.mode`; nothing here reaches them.\n    const initialAnalytics = analyticsForConsentState(app)\n    // Remote Config (AGL-228): release-flag delivery. Browser-only like\n    // analytics; consumers set defaultConfig before their first getValue so\n    // gating never blocks on the network.\n    let remoteConfig: RemoteConfig\n    try {\n      remoteConfig = getRemoteConfigInstance(app)\n      remoteConfig.settings.minimumFetchIntervalMillis =\n        process.env.NODE_ENV === 'production' ? 3_600_000 : 60_000\n    } catch (error) {\n      console.error(error)\n    }\n\n    servicesRef.current = {\n      app,\n      firestore,\n      auth,\n      analytics: initialAnalytics,\n      remoteConfig,\n      authPersistence,\n    }\n  }\n\n  const services = servicesRef.current\n\n  // The consent gate's other half: the verdict can CHANGE within one document,\n  // in both directions, and everything else in this provider is built exactly\n  // once by design.\n  //\n  // Deferred grant. A visitor with no stored record is undecided at the\n  // instant this provider first renders, because resolving them needs the\n  // region endpoint and that is a network call. Outside the prior-consent\n  // regions the answer is implied consent, and it lands a few hundred\n  // milliseconds later — same document, so `document.referrer` is still the\n  // external referrer and the pageview's attribution is unaffected. Without\n  // this, \"the gate is synchronous\" would have quietly meant \"the rest of the\n  // world is never measured on a first visit\".\n  //\n  // Withdrawal. Dropping the instance unmounts every binding hung off it,\n  // which is what unregisters the analytics transport — after that\n  // `deliver()` falls through to `window.gtag`, and the shared consent writer\n  // has already set `ga-disable-<id>` and sent a denied `consent update` on\n  // that exact tag (AGL-1608). The resident tag cannot be unloaded; it can be\n  // made to send nothing, and both halves are needed because either alone\n  // leaks — enhanced measurement fires with no call site at all.\n  const [analytics, setAnalytics] = useState<Analytics | undefined>(\n    () => services.analytics,\n  )\n  useEffect(() => {\n    const sync = () => setAnalytics(analyticsForConsentState(services.app))\n    // Once on mount as well as on the event: the priming pass can resolve a\n    // visitor between this provider's render and this effect, and the event it\n    // dispatched then had no listener yet.\n    sync()\n    window.addEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n    return () =>\n      window.removeEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n  }, [services])\n\n  // Identity changes only when the tag comes or goes, so a consent-stable\n  // document re-renders nothing.\n  const value = useMemo(\n    () =>\n      services.analytics === analytics ? services : { ...services, analytics },\n    [services, analytics],\n  )\n\n  return (\n    <FirebaseServicesContext.Provider value={value}>\n      {children}\n    </FirebaseServicesContext.Provider>\n  )\n}\nFirebaseServicesProvider.displayName = 'FirebaseServicesProvider'\n\nfunction useFirebaseServices(): FirebaseServices {\n  const services = useContext(FirebaseServicesContext)\n  if (!services) {\n    throw new Error(\n      'Firebase hooks must be used within a <FirebaseServicesProvider>',\n    )\n  }\n  return services\n}\n\nexport function useFirebaseApp(): FirebaseApp {\n  return useFirebaseServices().app\n}\nexport function useFirestore(): Firestore {\n  return useFirebaseServices().firestore\n}\nexport function useAuth(): Auth {\n  return useFirebaseServices().auth\n}\n/**\n * The persistence class the provider's `Auth` was created with (AGL-1379).\n *\n * Read it — never re-derive it — when building a **second** Firebase app on\n * the same origin, so the second instance cannot end up more persistent than\n * the first. `apps/console/hooks/use-presence.ts` is the existing case.\n */\nexport function useAuthPersistence(): AuthPersistenceClass {\n  return useFirebaseServices().authPersistence\n}\nexport function useAnalytics(): Analytics {\n  return useFirebaseServices().analytics\n}\nexport function useRemoteConfig(): RemoteConfig {\n  return useFirebaseServices().remoteConfig\n}\n\n/**\n * Replaces reactfire's `useUser()`. Reactfire subscribes via\n * `onIdTokenChanged` rather than `onAuthStateChanged` so fields like\n * `emailVerified` stay live across token refresh (e.g. after\n * `user.reload()` post-email-verification), not just sign-in/out — matched\n * here for behavioral parity.\n *\n * THREE states, not two (AGL-1261): `undefined` = auth has not resolved yet,\n * `null` = resolved, signed OUT, a `User` = resolved, signed in. This used to\n * collapse the emitted `null` into `undefined`, which made \"signed out\" and\n * \"still loading\" the same value — a state that, for a signed-out visitor,\n * never left \"loading\". `useSessionCookie` gates its whole body on\n * `user === undefined`, so its silent restore from the shared `__session`\n * cookie could never run: the cookie exchange returned a valid custom token\n * and nothing ever asked for it.\n */\nexport function useUser(): { data: User | null | undefined } {\n  const auth = useAuth()\n  const [user, setUser] = useState<User | null | undefined>(\n    auth.currentUser ?? undefined,\n  )\n\n  useEffect(() => {\n    return onIdTokenChanged(auth, (nextUser) => {\n      // `?? null`, never `?? undefined` — see the note above.\n      setUser(nextUser ?? null)\n    })\n  }, [auth])\n\n  return { data: user }\n}\n\nexport interface SigninCheckResult {\n  signedIn: boolean\n  user: User | null\n}\n\n/** Replaces reactfire's `useSigninCheck()` — same `onIdTokenChanged` basis as `useUser()`. */\nexport function useSigninCheck(): {\n  status: 'loading' | 'success' | 'error'\n  data: SigninCheckResult | undefined\n  error: Error | undefined\n} {\n  const auth = useAuth()\n  const [status, setStatus] = useState<'loading' | 'success' | 'error'>('loading')\n  const [data, setData] = useState<SigninCheckResult | undefined>(undefined)\n  const [error, setError] = useState<Error | undefined>(undefined)\n\n  useEffect(() => {\n    return onIdTokenChanged(\n      auth,\n      (user) => {\n        setStatus('success')\n        setError(undefined)\n        setData({ signedIn: !!user, user: user ?? null })\n      },\n      (err) => {\n        setStatus('error')\n        setError(err)\n      },\n    )\n  }, [auth])\n\n  return { status, data, error }\n}\n"],"names":["getApps","initializeApp","getAnalytics","getAnalyticsInstance","initializeAnalytics","initializeAnalyticsInstance","initializeAppCheck","ReCaptchaV3Provider","analyticsMayEmit","pushPlatformConsentDefault","VISITOR_CONSENT_CHANGED_EVENT","connectAuthEmulator","onIdTokenChanged","connectFirestoreEmulator","getFirestore","initializeFirestore","getRemoteConfig","getRemoteConfigInstance","createContext","useContext","useEffect","useMemo","useRef","useState","FIREBASE_AUTH_EMULATOR_ENABLED","FIREBASE_FIRESTORE_EMULATOR_ENABLED","APP_CHECK_KEY_MISSING_MESSAGE","appCheckSiteKey","authEmulatorUrl","firestoreEmulatorHost","createAuthInstance","localCacheFor","pruneSharedClientStateFor","FirebaseServicesContext","undefined","firestoreInitialized","Set","connectedAuth","isAutomatedChromeSession","navigator","webdriver","CONSOLE_ANALYTICS_OPTIONS","config","send_page_view","content_group","analyticsConsentGate","setAnalyticsConsentGate","gate","analyticsConsentAllows","analyticsByApp","WeakMap","bootAnalytics","app","existing","get","analytics","window","error","console","fallbackError","set","analyticsForConsentState","FirebaseServicesProvider","props","firebaseConfig","appName","authPersistence","children","servicesRef","current","find","name","auth","has","experimentalForceLongPolling","localCache","emulator","host","port","add","firestore","siteKey","warn","provider","isTokenAutoRefreshEnabled","initialAnalytics","remoteConfig","settings","minimumFetchIntervalMillis","process","env","NODE_ENV","services","setAnalytics","sync","addEventListener","removeEventListener","value","Provider","displayName","useFirebaseServices","Error","useFirebaseApp","useFirestore","useAuth","useAuthPersistence","useAnalytics","useRemoteConfig","useUser","user","setUser","currentUser","nextUser","data","useSigninCheck","status","setStatus","setData","setError","signedIn","err"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA,SAGEA,OAAO,EACPC,aAAa,QACR,eAAc;AACrB,SAEEC,gBAAgBC,oBAAoB,EACpCC,uBAAuBC,2BAA2B,QAC7C,qBAAoB;AAC3B,SAASC,kBAAkB,EAAEC,mBAAmB,QAAQ,qBAAoB;AAC5E,SAASC,gBAAgB,QAAQ,+CAA8C;AAC/E,SAASC,0BAA0B,QAAQ,kDAAiD;AAC5F,SAASC,6BAA6B,QAAQ,yCAAwC;AACtF,SAEEC,mBAAmB,EACnBC,gBAAgB,QAEX,gBAAe;AACtB,SAEEC,wBAAwB,EACxBC,YAAY,EACZC,mBAAmB,QACd,qBAAoB;AAC3B,SAEEC,mBAAmBC,uBAAuB,QACrC,yBAAwB;AAC/B,SACEC,aAAa,EACbC,UAAU,EACVC,SAAS,EACTC,OAAO,EACPC,MAAM,EACNC,QAAQ,QAEH,QAAO;AACd,SACEC,8BAA8B,EAC9BC,mCAAmC,QAC9B,2BAA0B;AACjC,SACEC,6BAA6B,EAC7BC,eAAe,QACV,qCAAiC;AACxC,SACEC,eAAe,EACfC,qBAAqB,QAChB,6CAAyC;AAChD,SAEEC,kBAAkB,QACb,wBAAoB;AAC3B,SAASC,aAAa,EAAEC,yBAAyB,QAAQ,uBAAmB;AA0G5E,MAAMC,wCAA0Bf,cAA4CgB;AAE5E,yEAAyE;AACzE,kEAAkE;AAClE,oBAAoB;AACpB,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAMC,uBAAuB,IAAIC;AACjC,IAAIC,gBAAgB;AAEpB;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,MAAMC,2BAA2B,IAC/B,OAAOC,cAAc,eAAeA,UAAUC,SAAS,KAAK;AAE9D;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMC,4BAA4B;IAChCC,QAAQ;QAAEC,gBAAgB;QAAOC,eAAe;IAAU;AAC5D;AAqBA,IAAIC,uBAAoD;AAExD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,wBACdC,IAAiC;IAEjCF,uBAAuBE;AACzB;AAEA,wEAAwE,GACxE,SAASC;IACP,IAAIH,yBAAyB,MAAM,OAAO;IAC1C,IAAI;QACF,OAAOA,2BAA2B;IACpC,EAAE,eAAM;QACN,qEAAqE;QACrE,oEAAoE;QACpE,8BAA8B;QAC9B,OAAO;IACT;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,iBAAiB,IAAIC;AAE3B;;;;;;CAMC,GACD,SAASC,cAAcC,GAAgB;IACrC,MAAMC,WAAWJ,eAAeK,GAAG,CAACF;IACpC,IAAIC,UAAU,OAAOA;IACrB,IAAIE;IACJ,yEAAyE;IACzE,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,wBAAwB;IACxB,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE9C,2BACE,OAAO+C,WAAW,cAAc,OAAQA;IAE1C,IAAI;QACFD,YAAYlD,4BAA4B+C,KAAKX;IAC/C,EAAE,OAAOgB,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,IAAI;YACF,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,4BAA4B;YAC5BF,YAAYpD,qBAAqBiD;QACnC,EAAE,OAAOO,eAAe;YACtBD,QAAQD,KAAK,CAACE;QAChB;IACF;IACA,IAAIJ,WAAWN,eAAeW,GAAG,CAACR,KAAKG;IACvC,OAAOA;AACT;AAEA;;;CAGC,GACD,SAASM,yBAAyBT,GAAgB;IAChD,IAAI,CAAC5C,oBAAoB,OAAO0B;IAChC,IAAI,CAACc,0BAA0B,OAAOd;IACtC,OAAOiB,cAAcC;AACvB;AA0BA,OAAO,SAASU,yBAAyBC,KAAoC;IAC3E,MAAM,EAAEC,cAAc,EAAEC,OAAO,EAAEC,kBAAkB,SAAS,EAAEC,QAAQ,EAAE,GAAGJ;IAC3E,MAAMK,cAAc9C,OAAqCY;IAEzD,IAAI,CAACkC,YAAYC,OAAO,EAAE;YAEtBrE;QADF,MAAMoD,OACJpD,gBAAAA,UAAUsE,IAAI,CAAC,CAACjB,WAAaA,SAASkB,IAAI,KAAKN,oBAA/CjE,gBACAC,cAAc+D,gBAAgBC;QAChC,oEAAoE;QACpE,MAAMO,OAAO1C,mBAAmBsB,KAAKc;QAErC,IAAI,CAAC/B,qBAAqBsC,GAAG,CAACR,UAAU;YACtC,IAAI;gBACF,iEAAiE;gBACjE,4DAA4D;gBAC5D,iEAAiE;gBACjE,8DAA8D;gBAC9D,2DAA2D;gBAC3D,kEAAkE;gBAClE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qEAAqE;gBACrE,UAAU;gBACV,EAAE;gBACF,mEAAmE;gBACnE,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,iEAAiE;gBACjE,8DAA8D;gBAC9D,oEAAoE;gBACpE,oEAAoE;gBACpE,sBAAsB;gBACtBlD,oBACEqC,KACA3B,sCACI;oBAAEiD,8BAA8B;gBAAK,IACrC;oBACE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,uDAAuD;oBACvD,4BAA4B;oBAC5BC,YAAY5C,cAAcmC;mBAQtB5B,6BACA;oBAAEoC,8BAA8B;gBAAK,IACrC,CAAC;gBAGb,IAAIjD,qCAAqC;oBACvC,mEAAmE;oBACnE,oDAAoD;oBACpD,MAAMmD,WAAW/C;oBACjBhB,yBACEC,aAAasC,MACbwB,SAASC,IAAI,EACbD,SAASE,IAAI;gBAEjB,OAAO;oBACL,+DAA+D;oBAC/D,mEAAmE;oBACnE,6DAA6D;oBAC7D,KAAK9C,0BAA0BkC,iBAAiBd;gBAClD;YACF,EAAE,eAAM;YACN,sGAAsG;YACxG,SAAU;gBACRjB,qBAAqB4C,GAAG,CAACd;YAC3B;QACF;QACA,MAAMe,YAAYlE,aAAasC;QAE/B,IAAI,CAACf,eAAe;YAClB,IAAI;gBACF,IAAIb,gCAAgC;oBAClC,uDAAuD;oBACvDb,oBAAoB6D,MAAM5C;gBAC5B;gBACAS,gBAAgB;YAClB,EAAE,OAAOoB,OAAO;gBACdC,QAAQD,KAAK,CAACA;YAChB;QACF;QACA,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,IACE,CAACjC,kCACD,CAACC,qCACD;YACA,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,MAAMwD,UAAUtD;YAChB,IAAI,CAACsD,SAAS;gBACZvB,QAAQwB,IAAI,CAACxD;YACf,OAAO;gBACL,IAAI;oBACFpB,mBAAmB8C,KAAK;wBACtB+B,UAAU,IAAI5E,oBAAoB0E;wBAClCG,2BAA2B;oBAC7B;gBACF,EAAE,OAAO3B,OAAO;oBACdC,QAAQD,KAAK,CAACA;gBAChB;YACF;QACF;QACA,2EAA2E;QAC3E,2EAA2E;QAC3E,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wCAAwC;QACxC,qEAAqE;QACrE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,kBAAkB;QAClB,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,yEAAyE;QACzE,iEAAiE;QACjE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,EAAE;QACF,uEAAuE;QACvE,yDAAyD;QACzD,iEAAiE;QACjE,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,mCAAmC;QACnC,EAAE;QACF,2DAA2D;QAC3D,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAM4B,mBAAmBxB,yBAAyBT;QAClD,oEAAoE;QACpE,wEAAwE;QACxE,sCAAsC;QACtC,IAAIkC;QACJ,IAAI;YACFA,eAAerE,wBAAwBmC;YACvCkC,aAAaC,QAAQ,CAACC,0BAA0B,GAC9CC,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe,UAAY;QACxD,EAAE,OAAOlC,OAAO;YACdC,QAAQD,KAAK,CAACA;QAChB;QAEAW,YAAYC,OAAO,GAAG;YACpBjB;YACA4B;YACAR;YACAjB,WAAW8B;YACXC;YACApB;QACF;IACF;IAEA,MAAM0B,WAAWxB,YAAYC,OAAO;IAEpC,6EAA6E;IAC7E,4EAA4E;IAC5E,kBAAkB;IAClB,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,wEAAwE;IACxE,iEAAiE;IACjE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,CAACd,WAAWsC,aAAa,GAAGtE,SAChC,IAAMqE,SAASrC,SAAS;IAE1BnC,UAAU;QACR,MAAM0E,OAAO,IAAMD,aAAahC,yBAAyB+B,SAASxC,GAAG;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,uCAAuC;QACvC0C;QACAtC,OAAOuC,gBAAgB,CAACrF,+BAA+BoF;QACvD,OAAO,IACLtC,OAAOwC,mBAAmB,CAACtF,+BAA+BoF;IAC9D,GAAG;QAACF;KAAS;IAEb,wEAAwE;IACxE,+BAA+B;IAC/B,MAAMK,QAAQ5E,QACZ,IACEuE,SAASrC,SAAS,KAAKA,YAAYqC,WAAW,aAAKA;YAAUrC;YAC/D;QAACqC;QAAUrC;KAAU;IAGvB,qBACE,KAACtB,wBAAwBiE,QAAQ;QAACD,OAAOA;kBACtC9B;;AAGP;AACAL,yBAAyBqC,WAAW,GAAG;AAEvC,SAASC;IACP,MAAMR,WAAWzE,WAAWc;IAC5B,IAAI,CAAC2D,UAAU;QACb,MAAM,IAAIS,MACR;IAEJ;IACA,OAAOT;AACT;AAEA,OAAO,SAASU;IACd,OAAOF,sBAAsBhD,GAAG;AAClC;AACA,OAAO,SAASmD;IACd,OAAOH,sBAAsBpB,SAAS;AACxC;AACA,OAAO,SAASwB;IACd,OAAOJ,sBAAsB5B,IAAI;AACnC;AACA;;;;;;CAMC,GACD,OAAO,SAASiC;IACd,OAAOL,sBAAsBlC,eAAe;AAC9C;AACA,OAAO,SAASwC;IACd,OAAON,sBAAsB7C,SAAS;AACxC;AACA,OAAO,SAASoD;IACd,OAAOP,sBAAsBd,YAAY;AAC3C;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASsB;QAGZpC;IAFF,MAAMA,OAAOgC;IACb,MAAM,CAACK,MAAMC,QAAQ,GAAGvF,UACtBiD,oBAAAA,KAAKuC,WAAW,YAAhBvC,oBAAoBtC;IAGtBd,UAAU;QACR,OAAOR,iBAAiB4D,MAAM,CAACwC;YAC7B,wDAAwD;YACxDF,QAAQE,mBAAAA,WAAY;QACtB;IACF,GAAG;QAACxC;KAAK;IAET,OAAO;QAAEyC,MAAMJ;IAAK;AACtB;AAOA,4FAA4F,GAC5F,OAAO,SAASK;IAKd,MAAM1C,OAAOgC;IACb,MAAM,CAACW,QAAQC,UAAU,GAAG7F,SAA0C;IACtE,MAAM,CAAC0F,MAAMI,QAAQ,GAAG9F,SAAwCW;IAChE,MAAM,CAACuB,OAAO6D,SAAS,GAAG/F,SAA4BW;IAEtDd,UAAU;QACR,OAAOR,iBACL4D,MACA,CAACqC;YACCO,UAAU;YACVE,SAASpF;YACTmF,QAAQ;gBAAEE,UAAU,CAAC,CAACV;gBAAMA,IAAI,EAAEA,eAAAA,OAAQ;YAAK;QACjD,GACA,CAACW;YACCJ,UAAU;YACVE,SAASE;QACX;IAEJ,GAAG;QAAChD;KAAK;IAET,OAAO;QAAE2C;QAAQF;QAAMxD;IAAM;AAC/B"}
+{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/firebase-services.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport {\n  type FirebaseApp,\n  type FirebaseOptions,\n  getApps,\n  initializeApp,\n} from 'firebase/app'\nimport {\n  type Analytics,\n  getAnalytics as getAnalyticsInstance,\n  initializeAnalytics as initializeAnalyticsInstance,\n} from 'firebase/analytics'\nimport { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check'\nimport { analyticsMayEmit } from '@aglyn/aglyn/app-utils/analytics-environment'\nimport { pushPlatformConsentDefault } from '@aglyn/aglyn/app-utils/platform-consent-default'\nimport { VISITOR_CONSENT_CHANGED_EVENT } from '@aglyn/aglyn/app-utils/visitor-consent'\nimport {\n  type Auth,\n  connectAuthEmulator,\n  onIdTokenChanged,\n  type User,\n} from 'firebase/auth'\nimport {\n  type Firestore,\n  connectFirestoreEmulator,\n  getFirestore,\n  initializeFirestore,\n} from 'firebase/firestore'\nimport {\n  type RemoteConfig,\n  getRemoteConfig as getRemoteConfigInstance,\n} from 'firebase/remote-config'\nimport {\n  createContext,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react'\nimport {\n  FIREBASE_AUTH_EMULATOR_ENABLED,\n  FIREBASE_FIRESTORE_EMULATOR_ENABLED,\n} from '@aglyn/shared-data-enums'\nimport {\n  APP_CHECK_KEY_MISSING_MESSAGE,\n  appCheckSiteKey,\n} from '../../constants/firebase-config'\nimport {\n  authEmulatorUrl,\n  firestoreEmulatorHost,\n} from '../../constants/firebase-emulator-hosts'\nimport {\n  type AuthPersistenceClass,\n  createAuthInstance,\n} from './auth-persistence'\nimport {\n  firestoreCacheClassFor,\n  localCacheFor,\n  pruneSharedClientStateFor,\n} from './firestore-cache'\nimport { markMultiTabFirestore } from './firestore-multitab-wedge'\nimport { firestorePersistencePrefix } from './firestore-shared-client-state'\n\n/**\n * Drop-in replacement for reactfire's `ObservableStatus<T>` — reactfire is\n * unmaintained against firebase majors past v9, but its shape is preserved\n * here so `helpers/use-doc.ts`'s already-battle-tested onSnapshot+retry\n * implementation (AGL-216/223) didn't need to change.\n */\nexport interface ObservableStatus<T> {\n  status: 'loading' | 'error' | 'success'\n  hasEmitted: boolean\n  isComplete: boolean\n  data: T\n  error: Error | undefined\n  firstValuePromise: Promise<void>\n  /**\n   * The emitted `data` includes local writes the server has NOT\n   * acknowledged (`snapshot.metadata.hasPendingWrites`).\n   *\n   * Carried rather than dropped because a caller cannot otherwise tell \"the\n   * store holds this\" from \"my browser holds this\". `persistentLocalCache`\n   * replays a queued write into the very first snapshot after a reload, so a\n   * caller that treats every snapshot as authoritative will adopt its own\n   * unacknowledged edit as the saved state — which is how the besigner ended\n   * up unable to save real changes (AGL-1262).\n   */\n  hasPendingWrites: boolean\n  /**\n   * The emitted `data` came from the local cache and the server has NOT\n   * confirmed it (`snapshot.metadata.fromCache`).\n   *\n   * Carried because it is the only per-listener ground truth about\n   * freshness the SDK offers, and the console needs it (AGL-1066). Under\n   * `persistentLocalCache` a listener whose server listen is being REFUSED\n   * still emits cached snapshots and still reports `status: 'success'` —\n   * the retry budget is reset by each cached emission and never spends, so\n   * `status` can never reveal the fault (see\n   * `use-firestore-collection-cached-retry.spec.ts`).\n   *\n   * Prefer this over `session-health`'s `staleSession` for anything that\n   * asks \"is what I am looking at live?\". `staleSession` is a heuristic\n   * needing two denied collections inside a window, and it is unreachable\n   * on listener-only pages; this is a fact about THIS listener, costs\n   * nothing, and clears itself the instant a server snapshot lands.\n   */\n  fromCache: boolean\n  /**\n   * The server has REFUSED this listen for longer than the retry budget, and\n   * no server snapshot has arrived since (AGL-1066).\n   *\n   * `fromCache` says \"unconfirmed\", which is also true offline and true for\n   * the first snapshot of a perfectly healthy load. This says \"refused\" —\n   * only `permission-denied` counts it, and it takes a whole budget's worth\n   * in a row, so it cannot fire offline and cannot fire on the AGL-216/217\n   * post-sign-in token race.\n   *\n   * It is what `status` would say if the retry budget were spendable. It is\n   * carried separately because correcting `status` in place would blank\n   * every surface that renders cached data through an `error` branch — see\n   * the note on `attempt = 0` in `use-firestore-collection`.\n   */\n  serverDenied: boolean\n}\n\n/** Replaces reactfire's `ReactFireOptions<T>` — drops the `suspense` field, which was never read. */\nexport interface FirestoreDocOptions<T> {\n  idField?: string\n  initialData?: T\n}\n\n/**\n * The Firebase products this provider builds, and therefore the ones every\n * page that renders it downloads.\n *\n * ⛔ NO Realtime Database and NO Cloud Storage (AGL-2706). Both were built\n * here and published as `useDatabase()` / `useStorage()`, and neither hook had\n * a single caller anywhere in the repo — so `@firebase/database` (125.9 KB\n * raw) and `@firebase/storage` (13.9 KB) were in the first load of every\n * console route to satisfy a context field nothing read.\n *\n * Realtime Database IS used, by `apps/console/hooks/use-presence.ts` and\n * `use-coediting.ts` — on their own Firebase app, with their own\n * `getDatabase`, behind the editor routes that need presence. That is the\n * shape to copy if a surface needs one of these: reach for the product where\n * the feature is, not in the provider every page mounts. A field here is paid\n * for by every route, used or not.\n */\ninterface FirebaseServices {\n  app: FirebaseApp\n  firestore: Firestore\n  auth: Auth\n  analytics: Analytics\n  remoteConfig: RemoteConfig\n  /**\n   * The persistence class `auth` was actually created with (AGL-1379).\n   *\n   * Published so a **second** auth instance derives its class from the\n   * primary rather than re-deciding it. `apps/console/hooks/use-presence.ts`\n   * builds its own Firebase app and its own `Auth`; before this it took the\n   * SDK default unconditionally, so configuring only the provider would have\n   * left presence persisting a refresh token on an origin the provider had\n   * just been careful not to persist one on.\n   */\n  authPersistence: AuthPersistenceClass\n}\n\nconst FirebaseServicesContext = createContext<FirebaseServices | undefined>(undefined)\n\n// Module-scope guards so HMR / remounts don't re-run emulator connection\n// (which throws if called twice) or double-initialize Firestore's\n// persistent cache.\n//\n// Firestore's is keyed by app NAME, not a bare boolean (AGL-1456): Firestore\n// initialization is once-per-app, so a module-global flag made the FIRST app\n// to mount decide for every later one — a second app would silently skip\n// `initializeFirestore` and take SDK defaults. That mattered the moment the\n// cache stopped being the same on every host.\nconst firestoreInitialized = new Set<string>()\nlet connectedAuth = false\n\n/**\n * True when THIS Chrome instance is under WebDriver automation control\n * (Puppeteer, Playwright, Selenium, or a raw CDP client) — never true for a\n * person's own browser.\n *\n * The `initializeFirestore` call below already documents the fault this\n * exists for: \"the emulator's WebChannel streaming misbehaves in automated\n * Chrome — listeners serve the initial empty from-cache snapshot and the\n * server sync never arrives\" (AGL-217). That mitigation only reaches\n * `FIREBASE_FIRESTORE_EMULATOR_ENABLED`, so an automated session against a\n * REAL, deployed backend — a browser-automation agent driving a live\n * console, which is exactly what `navigator.webdriver` detects — stayed\n * exposed. `getDocs`/`getDoc` and `onSnapshot` all resolve over the same\n * Watch stream internally, so a one-shot read wedges exactly like a listener\n * does: no error, nothing to catch, `loading` simply never gets its\n * settling event. That is the Media Library grid spinning on \"Loading\n * media…\" indefinitely with a perfectly healthy account and a perfectly\n * healthy network.\n *\n * `undefined` during SSR reads as `false` — `navigator` does not exist in\n * Node, and a server render can only ever produce the auto-detected\n * transport, never the forced one.\n */\nconst isAutomatedChromeSession = (): boolean =>\n  typeof navigator !== 'undefined' && navigator.webdriver === true\n\n/**\n * The console tag's gtag config — ONE object, at module scope, deliberately\n * (AGL-1979).\n *\n * `initializeAnalytics(app, options)` throws `already-initialized` unless the\n * options `deepEqual` the ones the instance was first created with, and the\n * provider re-enters this block on every mount, every StrictMode double\n * invoke and every Fast Refresh. A fresh object literal per call survives\n * that only by *value*; a shared constant survives it by *identity*, which is\n * the first branch of the SDK's own comparison and cannot drift when someone\n * edits one call site and not another.\n *\n * ⚠️ The SDK MUTATES this object: `_initializeAnalytics` reads `options.config`\n * and writes `origin`, `update` and the installation id onto it in place.\n * That is precisely why sharing it is safe rather than dangerous — the object\n * the provider holds and the object the SDK stored are the same one, so they\n * cannot disagree.\n */\nconst CONSOLE_ANALYTICS_OPTIONS = {\n  config: { send_page_view: false, content_group: 'console' },\n}\n\n/**\n * A surface's answer to \"may an analytics tag exist for this visitor at all?\".\n *\n * Registered from the app, at module scope, in the same shape as\n * `setFirestoreSessionReporters` and `setStaleSessionCheck` — and for a\n * sharper version of the same reason. This is consulted during the provider's\n * FIRST render, before any effect anywhere has run, so a gate installed from\n * an effect would arrive after the decision it exists to make.\n *\n * Answering `false` means the SDK is never asked to initialize: `gtag.js` is\n * never fetched, `window.gtag` never comes into existence, and the shared\n * `deliver()` in `analytics-events.ts` — whose fallback IS `window.gtag` —\n * therefore has nowhere to put a hit. That is the difference between a gate\n * and a suppression, and it is the difference AGL-1608 paid for: a resident\n * tag reports on its own, through enhanced measurement, whatever any flag\n * says afterwards.\n */\nexport type AnalyticsConsentGate = () => boolean\n\nlet analyticsConsentGate: AnalyticsConsentGate | null = null\n\n/**\n * Install the consent gate for this document, or clear it with `null`.\n *\n * UNREGISTERED MEANS ALLOWED, which is deliberate and is the only default that\n * is safe here. The tenant runtime does not use this provider's analytics\n * branch at all (it builds its own tag in `site-analytics.tsx`, behind the\n * AGL-1498 gate), and a self-hosted console points at the operator's own GA\n * property — silencing an operator's analytics because Aglyn's own surface\n * grew a gate is a failure they cannot diagnose. The surface that needs the\n * gate is the one that registers it.\n */\nexport function setAnalyticsConsentGate(\n  gate: AnalyticsConsentGate | null,\n): void {\n  analyticsConsentGate = gate\n}\n\n/** The gate's verdict, with an unregistered gate reading as \"allowed\". */\nfunction analyticsConsentAllows(): boolean {\n  if (analyticsConsentGate === null) return true\n  try {\n    return analyticsConsentGate() === true\n  } catch {\n    // A gate that throws cannot be read as consent. Storage can throw in\n    // private mode, and \"we could not tell\" is the one state this whole\n    // mechanism resolves to \"no\".\n    return false\n  }\n}\n\n/**\n * The Analytics instance per Firebase app, so a re-boot after a consent change\n * hands back the tag that is already resident rather than asking the SDK for a\n * second one.\n *\n * `initializeAnalytics` is idempotent while the options match, so this is not\n * what makes re-entry safe — `CONSOLE_ANALYTICS_OPTIONS` being a shared\n * constant is. What this avoids is the noisy path: once anything has\n * initialized the provider with different options, every later call throws and\n * is logged, and a withdrawal followed by a re-grant would log it again.\n */\nconst analyticsByApp = new WeakMap<FirebaseApp, Analytics>()\n\n/**\n * Boot the console's Analytics tag, or return the one already booted.\n *\n * Extracted from the provider body so that \"when is the tag created\" and \"may\n * it be created\" are separable: the consent gate can defer this call to a\n * later render without the ordering below moving.\n */\nfunction bootAnalytics(app: FirebaseApp): Analytics | undefined {\n  const existing = analyticsByApp.get(app)\n  if (existing) return existing\n  let analytics: Analytics\n  // The region-conditional consent default (AGL-1597), declared BEFORE the\n  // SDK boots the tag. Ordering is the whole of it: a `default` read after\n  // `config` is not a default, and the SDK issues `config` inside\n  // `initializeAnalytics` on the next line. Pushing onto `dataLayer` here\n  // works even though gtag.js is not loaded yet — the queue is what makes the\n  // ordering expressible.\n  //\n  // Still declared even though the gate above has already said yes, and the\n  // two are not redundant. The gate answers \"may a tag exist\"; the default\n  // answers \"what may the tag that does exist do\", per region, from its very\n  // first hit. Ad storage stays denied everywhere on this surface.\n  pushPlatformConsentDefault(\n    typeof window === 'undefined' ? null : (window as never),\n  )\n  try {\n    analytics = initializeAnalyticsInstance(app, CONSOLE_ANALYTICS_OPTIONS)\n  } catch (error) {\n    console.error(error)\n    try {\n      // Already initialized by someone else, with someone else's options:\n      // take THAT instance rather than leaving consumers with nothing. The\n      // tag it is attached to was configured without `send_page_view: false`\n      // and without `content_group`, so this session reports a duplicate\n      // startup page_view and an unstamped surface — degraded, and loudly so,\n      // instead of silently dead.\n      analytics = getAnalyticsInstance(app)\n    } catch (fallbackError) {\n      console.error(fallbackError)\n    }\n  }\n  if (analytics) analyticsByApp.set(app, analytics)\n  return analytics\n}\n\n/**\n * The tag this document may have right now: none outside a real production\n * deployment, none while consent is absent, otherwise the booted instance.\n */\nfunction analyticsForConsentState(app: FirebaseApp): Analytics | undefined {\n  if (!analyticsMayEmit()) return undefined\n  if (!analyticsConsentAllows()) return undefined\n  return bootAnalytics(app)\n}\n\nexport interface FirebaseServicesProviderProps {\n  firebaseConfig: FirebaseOptions\n  appName: string\n  /**\n   * How much of *anything* this origin may keep on disk. Defaults to\n   * `durable`, which is what every host serving this provider today is:\n   * `*.aglyn.com` and `*.aglyn.app`, whose DNS we own and whose 14-day\n   * session is the product.\n   *\n   * A **custom console domain** (AGL-1099c) must pass `ephemeral`. That is\n   * the whole reason this is a prop rather than a constant: the class differs\n   * per origin, not per build, and the decision belongs to whoever knows\n   * which origin is being served.\n   *\n   * **It governs two things, and the name only names one.** It selects the\n   * `Auth` persistence class (AGL-1379) *and* the Firestore `localCache`\n   * (AGL-1456) — because both answer the same question about the same origin,\n   * and splitting them into two props is precisely how the cache came to be\n   * unconditional while the credential was hardened. See `firestore-cache.ts`.\n   */\n  authPersistence?: AuthPersistenceClass\n  children?: ReactNode\n}\n\nexport function FirebaseServicesProvider(props: FirebaseServicesProviderProps) {\n  const { firebaseConfig, appName, authPersistence = 'durable', children } = props\n  const servicesRef = useRef<FirebaseServices | undefined>(undefined)\n\n  if (!servicesRef.current) {\n    const app =\n      getApps().find((existing) => existing.name === appName) ??\n      initializeApp(firebaseConfig, appName)\n    // `durable` resolves to the same `getAuth(app)` this always called.\n    const auth = createAuthInstance(app, authPersistence)\n\n    // The origin's class, unless this tab fell back to the memory cache\n    // because another tab locked the shared one (AGL-3428). Firestore only:\n    // `auth` above keeps the origin's class.\n    const firestoreCacheClass = firestoreCacheClassFor(authPersistence)\n    if (!firestoreInitialized.has(appName)) {\n      try {\n        // Under the emulator (dev/e2e only): force long-polling and skip\n        // the persistent multi-tab cache. The emulator's WebChannel\n        // streaming misbehaves in automated Chrome — listeners serve the\n        // initial empty from-cache snapshot and the server sync never\n        // arrives, which looks like \"empty pages with zero errors\"\n        // (the AGL-217 mystery). Real traffic keeps the default transport\n        // and persistent cache — except a WebDriver-controlled Chrome\n        // against a real backend, which forces long-polling for the same\n        // reason without giving up the cache (see `isAutomatedChromeSession`\n        // below).\n        //\n        // ⚠️ CONSEQUENCE, and it will cost you hours if you do not know it\n        // (AGL-1066): every stale-session/stale-cache fault is UNREPRODUCIBLE\n        // locally through the app, because the cache that causes them is off\n        // in exactly the configuration you would reach for to reproduce one.\n        // A listener that keeps serving arbitrarily-old data while the server\n        // refuses it, a `noDocument` tombstone that 404s a live host, the\n        // retry budget that never spends because a cached emission resets it\n        // — none of them can happen here. Test that behaviour with the unit\n        // seams instead (`use-firestore-collection-cached-retry.spec.ts`\n        // drives cached emissions and denials directly), or against a\n        // deployed environment. Do NOT \"fix\" it by turning the cache on for\n        // the emulator: the AGL-217 empty-pages-with-zero-errors mystery is\n        // what that produces.\n        initializeFirestore(\n          app,\n          FIREBASE_FIRESTORE_EMULATOR_ENABLED\n            ? { experimentalForceLongPolling: true }\n            : {\n                // NOT unconditional (AGL-1456). `persistentLocalCache` writes\n                // document bodies to this origin's IndexedDB, so on a custom\n                // console domain it is the same exposure D6 removed from the\n                // refresh token — see `firestore-cache.ts` for why one\n                // declaration governs both.\n                localCache: localCacheFor(firestoreCacheClass),\n                // The real-backend half of the AGL-217 mitigation above: force\n                // long-polling for a WebDriver-controlled Chrome even when it\n                // is NOT talking to the emulator, because the WebChannel wedge\n                // is a property of automated Chrome, not of which backend it\n                // is automating against. Never true for a real visitor, so\n                // production traffic keeps the SDK's own auto-detected\n                // transport untouched.\n                ...(isAutomatedChromeSession()\n                  ? { experimentalForceLongPolling: true }\n                  : {}),\n              },\n        )\n        if (FIREBASE_FIRESTORE_EMULATOR_ENABLED) {\n          // Where the server was told the emulator is, rather than a default\n          // port another session's stack may hold (AGL-2834).\n          const emulator = firestoreEmulatorHost()\n          connectFirestoreEmulator(\n            getFirestore(app),\n            emulator.host,\n            emulator.port,\n          )\n        } else {\n          // The SDK never sweeps the multi-tab records the durable cache\n          // strands in localStorage, and a full localStorage fails the whole\n          // Firestore client — see `firestore-shared-client-state.ts`.\n          void pruneSharedClientStateFor(firestoreCacheClass, app)\n          // Only the durable multi-tab cache can be locked by another tab,\n          // so only it gets the lease check after a stalled recovery.\n          if (firestoreCacheClass === 'durable' && app.options?.projectId) {\n            markMultiTabFirestore(\n              getFirestore(app),\n              `${firestorePersistencePrefix(app.name, app.options.projectId)}main`,\n            )\n          }\n        }\n      } catch {\n        // already initialized (e.g. HMR reset the module flag) — getFirestore() returns the existing instance\n      } finally {\n        firestoreInitialized.add(appName)\n      }\n    }\n    const firestore = getFirestore(app)\n\n    if (!connectedAuth) {\n      try {\n        if (FIREBASE_AUTH_EMULATOR_ENABLED) {\n          // The emulator the server was started with (AGL-2834).\n          connectAuthEmulator(auth, authEmulatorUrl())\n        }\n        connectedAuth = true\n      } catch (error) {\n        console.error(error)\n      }\n    }\n    // App Check must be skipped under the emulators: there is no App\n    // Check emulator, so ReCaptcha would hit the real backend and its\n    // 403s break emulator auth (the AGL-216 emulator sessions hit this).\n    if (\n      !FIREBASE_AUTH_EMULATOR_ENABLED &&\n      !FIREBASE_FIRESTORE_EMULATOR_ENABLED\n    ) {\n      // No site key means no provider (AGL-2049). Registering one built on\n      // `undefined` does not throw — it fails asynchronously inside the SDK,\n      // where the catch below cannot see it — so this has to be a pre-check.\n      const siteKey = appCheckSiteKey()\n      if (!siteKey) {\n        console.warn(APP_CHECK_KEY_MISSING_MESSAGE)\n      } else {\n        try {\n          initializeAppCheck(app, {\n            provider: new ReCaptchaV3Provider(siteKey),\n            isTokenAutoRefreshEnabled: true,\n          })\n        } catch (error) {\n          console.error(error)\n        }\n      }\n    }\n    // `initializeAnalytics`, not `getAnalytics`, for exactly one reason: it is\n    // the only form that can pass `config`, and `send_page_view: false` is the\n    // only way to stop the SDK's own startup `page_view` (AGL-1643).\n    //\n    // Booting Analytics issues `gtag('config', <id>, configProperties)`, and\n    // the vendored SDK's own comment on that line reads \"This will trigger a\n    // page_view event unless 'send_page_view' is set to false in\n    // configProperties\". `getAnalytics(app)` passes no config at all, so the\n    // key was never there and the hit always fired — on top of the manual\n    // `page_view` the console's layout sends on mount. Two hits, one page.\n    //\n    // The SDK's is the one suppressed rather than the layout's, and the\n    // direction is the whole decision: the SDK fires ONCE per document load,\n    // while the layout fires on mount AND on every `usePathname` change. In a\n    // client-routed app the layout's is a superset — killing it instead would\n    // have left every in-app navigation unreported, halving console pageviews\n    // rather than correcting them, and the reports would have looked fine.\n    //\n    // Nothing else about attribution moves: the surviving hit is sent from the\n    // same document at mount, so `document.referrer` — which gtag resolves for\n    // `page_referrer` itself, and which is what carries marketing traffic\n    // source into the session — is still the external referrer at that moment.\n    //\n    // Re-entry is safe *only* while the options match. `initializeAnalytics`\n    // returns the existing instance when they deep-equal the first call's and\n    // throws `already-initialized` otherwise — and the options can be made to\n    // differ by things no call site here controls (AGL-1979):\n    //\n    //   * anything that touches the analytics provider WITHOUT options first\n    //     initializes it with `{}`. `getAnalytics()` is the obvious one, but\n    //     `@firebase/remote-config` reaches the same code path on its own —\n    //     `addExperimentToAnalytics` calls `analyticsProvider.getImmediate({\n    //     optional: true })`, and `optional` only suppresses the throw, it\n    //     does not stop the initialization.\n    //   * in dev, a module instance carrying a PREVIOUS version of these\n    //     options (this config changed under AGL-1857) surviving a Fast\n    //     Refresh alongside the new one.\n    //\n    // Once that happens the conflict is permanent for the document: every\n    // later call throws, so without the fallback below `analytics` stayed\n    // undefined forever and the next consumer — `logEvent(analytics, …)` —\n    // read `.app` off it and threw a TypeError two frames away, which is how\n    // this surfaced (top Cloud Error Reporting group, and reproduced live on\n    // app.aglyn.com).\n    //\n    // `getAnalytics(app)` is the remedy the SDK's own error message names. It\n    // cannot cost us the config on a healthy document: it only runs after\n    // `initializeAnalytics` threw, and on a first init that throw can only be\n    // `no-app-id` / `no-api-key` / `already-exists`, none of which\n    // `getAnalytics` can rescue either — it re-throws and we fall through to\n    // an undefined instance, which every consumer must now tolerate.\n    // `content_group: 'console'` (AGL-1857) rides the same config: it is the\n    // first-class GA4 axis that separates console traffic from `marketing`\n    // (stamped by the tenant runtime on aglyn.com's own tag) and `docs`\n    // (stamped by the Docusaurus head snippet) in standard reports, without\n    // reaching for the Hostname dimension. The console is this provider's\n    // only consumer, verified by grep — the tenant runtime builds its tag in\n    // `site-analytics.tsx` and never passes through here.\n    //\n    // AND NOT AT ALL outside a real production deployment (AGL-2067). This\n    // provider used to boot Analytics unconditionally, while\n    // `apps/console/.env.development.local` points at the PRODUCTION\n    // measurement id — so every `next dev` session and every Vercel preview\n    // build produced genuine `session_start` / `first_visit` / `page_view`\n    // hits in the live property. Not a theory: the archived Marketing\n    // property's entire year-to-date history is 30 views / 6 users, ~24 of\n    // them `/signin` on preview urls (docs/ANALYTICS.md).\n    //\n    // Not initialized rather than initialized-and-suppressed, because a\n    // resident tag reports on its own — AGL-1608 is the same lesson from the\n    // consent side. `useAnalytics()` returning undefined is already a\n    // supported state everywhere (AGL-1979), which is what makes this a\n    // two-line gate instead of an audit.\n    //\n    // `analyticsMayEmit` leans LOUD on an unknown deployment: a self-hosted\n    // build points at the operator's own Firebase project and their own GA\n    // property, and silencing a customer's analytics to protect ours is the\n    // worse failure. See the module for the escape hatch.\n    //\n    // AND NOT while a registered consent gate says no (AGL-1498 posture,\n    // applied to Aglyn's own console). `analyticsForConsentState` is where\n    // both conditions and the boot itself now live, because the boot has to\n    // be repeatable: a visitor whose region has not resolved yet is undecided\n    // at this instant and may be granted a moment later, and a visitor who\n    // withdraws mid-session has to lose the instance without the page\n    // reloading. See the effect below.\n    //\n    // SCOPE. This is the console's tag and only the console's:\n    // `CONSOLE_ANALYTICS_OPTIONS`, `content_group: 'console'`, and this\n    // provider's analytics branch has no other consumer (the tenant runtime\n    // builds its tag in `site-analytics.tsx` and never passes through here).\n    // Customer sites keep the AGL-1498 gate and the host's own\n    // `consent.mode`; nothing here reaches them.\n    const initialAnalytics = analyticsForConsentState(app)\n    // Remote Config (AGL-228): release-flag delivery. Browser-only like\n    // analytics; consumers set defaultConfig before their first getValue so\n    // gating never blocks on the network.\n    let remoteConfig: RemoteConfig\n    try {\n      remoteConfig = getRemoteConfigInstance(app)\n      remoteConfig.settings.minimumFetchIntervalMillis =\n        process.env.NODE_ENV === 'production' ? 3_600_000 : 60_000\n    } catch (error) {\n      console.error(error)\n    }\n\n    servicesRef.current = {\n      app,\n      firestore,\n      auth,\n      analytics: initialAnalytics,\n      remoteConfig,\n      authPersistence,\n    }\n  }\n\n  const services = servicesRef.current\n\n  // The consent gate's other half: the verdict can CHANGE within one document,\n  // in both directions, and everything else in this provider is built exactly\n  // once by design.\n  //\n  // Deferred grant. A visitor with no stored record is undecided at the\n  // instant this provider first renders, because resolving them needs the\n  // region endpoint and that is a network call. Outside the prior-consent\n  // regions the answer is implied consent, and it lands a few hundred\n  // milliseconds later — same document, so `document.referrer` is still the\n  // external referrer and the pageview's attribution is unaffected. Without\n  // this, \"the gate is synchronous\" would have quietly meant \"the rest of the\n  // world is never measured on a first visit\".\n  //\n  // Withdrawal. Dropping the instance unmounts every binding hung off it,\n  // which is what unregisters the analytics transport — after that\n  // `deliver()` falls through to `window.gtag`, and the shared consent writer\n  // has already set `ga-disable-<id>` and sent a denied `consent update` on\n  // that exact tag (AGL-1608). The resident tag cannot be unloaded; it can be\n  // made to send nothing, and both halves are needed because either alone\n  // leaks — enhanced measurement fires with no call site at all.\n  const [analytics, setAnalytics] = useState<Analytics | undefined>(\n    () => services.analytics,\n  )\n  useEffect(() => {\n    const sync = () => setAnalytics(analyticsForConsentState(services.app))\n    // Once on mount as well as on the event: the priming pass can resolve a\n    // visitor between this provider's render and this effect, and the event it\n    // dispatched then had no listener yet.\n    sync()\n    window.addEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n    return () =>\n      window.removeEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n  }, [services])\n\n  // Identity changes only when the tag comes or goes, so a consent-stable\n  // document re-renders nothing.\n  const value = useMemo(\n    () =>\n      services.analytics === analytics ? services : { ...services, analytics },\n    [services, analytics],\n  )\n\n  return (\n    <FirebaseServicesContext.Provider value={value}>\n      {children}\n    </FirebaseServicesContext.Provider>\n  )\n}\nFirebaseServicesProvider.displayName = 'FirebaseServicesProvider'\n\nfunction useFirebaseServices(): FirebaseServices {\n  const services = useContext(FirebaseServicesContext)\n  if (!services) {\n    throw new Error(\n      'Firebase hooks must be used within a <FirebaseServicesProvider>',\n    )\n  }\n  return services\n}\n\nexport function useFirebaseApp(): FirebaseApp {\n  return useFirebaseServices().app\n}\nexport function useFirestore(): Firestore {\n  return useFirebaseServices().firestore\n}\nexport function useAuth(): Auth {\n  return useFirebaseServices().auth\n}\n/**\n * The persistence class the provider's `Auth` was created with (AGL-1379).\n *\n * Read it — never re-derive it — when building a **second** Firebase app on\n * the same origin, so the second instance cannot end up more persistent than\n * the first. `apps/console/hooks/use-presence.ts` is the existing case.\n */\nexport function useAuthPersistence(): AuthPersistenceClass {\n  return useFirebaseServices().authPersistence\n}\nexport function useAnalytics(): Analytics {\n  return useFirebaseServices().analytics\n}\nexport function useRemoteConfig(): RemoteConfig {\n  return useFirebaseServices().remoteConfig\n}\n\n/**\n * Replaces reactfire's `useUser()`. Reactfire subscribes via\n * `onIdTokenChanged` rather than `onAuthStateChanged` so fields like\n * `emailVerified` stay live across token refresh (e.g. after\n * `user.reload()` post-email-verification), not just sign-in/out — matched\n * here for behavioral parity.\n *\n * THREE states, not two (AGL-1261): `undefined` = auth has not resolved yet,\n * `null` = resolved, signed OUT, a `User` = resolved, signed in. This used to\n * collapse the emitted `null` into `undefined`, which made \"signed out\" and\n * \"still loading\" the same value — a state that, for a signed-out visitor,\n * never left \"loading\". `useSessionCookie` gates its whole body on\n * `user === undefined`, so its silent restore from the shared `__session`\n * cookie could never run: the cookie exchange returned a valid custom token\n * and nothing ever asked for it.\n */\nexport function useUser(): { data: User | null | undefined } {\n  const auth = useAuth()\n  const [user, setUser] = useState<User | null | undefined>(\n    auth.currentUser ?? undefined,\n  )\n\n  useEffect(() => {\n    return onIdTokenChanged(auth, (nextUser) => {\n      // `?? null`, never `?? undefined` — see the note above.\n      setUser(nextUser ?? null)\n    })\n  }, [auth])\n\n  return { data: user }\n}\n\nexport interface SigninCheckResult {\n  signedIn: boolean\n  user: User | null\n}\n\n/** Replaces reactfire's `useSigninCheck()` — same `onIdTokenChanged` basis as `useUser()`. */\nexport function useSigninCheck(): {\n  status: 'loading' | 'success' | 'error'\n  data: SigninCheckResult | undefined\n  error: Error | undefined\n} {\n  const auth = useAuth()\n  const [status, setStatus] = useState<'loading' | 'success' | 'error'>('loading')\n  const [data, setData] = useState<SigninCheckResult | undefined>(undefined)\n  const [error, setError] = useState<Error | undefined>(undefined)\n\n  useEffect(() => {\n    return onIdTokenChanged(\n      auth,\n      (user) => {\n        setStatus('success')\n        setError(undefined)\n        setData({ signedIn: !!user, user: user ?? null })\n      },\n      (err) => {\n        setStatus('error')\n        setError(err)\n      },\n    )\n  }, [auth])\n\n  return { status, data, error }\n}\n"],"names":["getApps","initializeApp","getAnalytics","getAnalyticsInstance","initializeAnalytics","initializeAnalyticsInstance","initializeAppCheck","ReCaptchaV3Provider","analyticsMayEmit","pushPlatformConsentDefault","VISITOR_CONSENT_CHANGED_EVENT","connectAuthEmulator","onIdTokenChanged","connectFirestoreEmulator","getFirestore","initializeFirestore","getRemoteConfig","getRemoteConfigInstance","createContext","useContext","useEffect","useMemo","useRef","useState","FIREBASE_AUTH_EMULATOR_ENABLED","FIREBASE_FIRESTORE_EMULATOR_ENABLED","APP_CHECK_KEY_MISSING_MESSAGE","appCheckSiteKey","authEmulatorUrl","firestoreEmulatorHost","createAuthInstance","firestoreCacheClassFor","localCacheFor","pruneSharedClientStateFor","markMultiTabFirestore","firestorePersistencePrefix","FirebaseServicesContext","undefined","firestoreInitialized","Set","connectedAuth","isAutomatedChromeSession","navigator","webdriver","CONSOLE_ANALYTICS_OPTIONS","config","send_page_view","content_group","analyticsConsentGate","setAnalyticsConsentGate","gate","analyticsConsentAllows","analyticsByApp","WeakMap","bootAnalytics","app","existing","get","analytics","window","error","console","fallbackError","set","analyticsForConsentState","FirebaseServicesProvider","props","firebaseConfig","appName","authPersistence","children","servicesRef","current","find","name","auth","firestoreCacheClass","has","experimentalForceLongPolling","localCache","emulator","host","port","options","projectId","add","firestore","siteKey","warn","provider","isTokenAutoRefreshEnabled","initialAnalytics","remoteConfig","settings","minimumFetchIntervalMillis","process","env","NODE_ENV","services","setAnalytics","sync","addEventListener","removeEventListener","value","Provider","displayName","useFirebaseServices","Error","useFirebaseApp","useFirestore","useAuth","useAuthPersistence","useAnalytics","useRemoteConfig","useUser","user","setUser","currentUser","nextUser","data","useSigninCheck","status","setStatus","setData","setError","signedIn","err"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA,SAGEA,OAAO,EACPC,aAAa,QACR,eAAc;AACrB,SAEEC,gBAAgBC,oBAAoB,EACpCC,uBAAuBC,2BAA2B,QAC7C,qBAAoB;AAC3B,SAASC,kBAAkB,EAAEC,mBAAmB,QAAQ,qBAAoB;AAC5E,SAASC,gBAAgB,QAAQ,+CAA8C;AAC/E,SAASC,0BAA0B,QAAQ,kDAAiD;AAC5F,SAASC,6BAA6B,QAAQ,yCAAwC;AACtF,SAEEC,mBAAmB,EACnBC,gBAAgB,QAEX,gBAAe;AACtB,SAEEC,wBAAwB,EACxBC,YAAY,EACZC,mBAAmB,QACd,qBAAoB;AAC3B,SAEEC,mBAAmBC,uBAAuB,QACrC,yBAAwB;AAC/B,SACEC,aAAa,EACbC,UAAU,EACVC,SAAS,EACTC,OAAO,EACPC,MAAM,EACNC,QAAQ,QAEH,QAAO;AACd,SACEC,8BAA8B,EAC9BC,mCAAmC,QAC9B,2BAA0B;AACjC,SACEC,6BAA6B,EAC7BC,eAAe,QACV,qCAAiC;AACxC,SACEC,eAAe,EACfC,qBAAqB,QAChB,6CAAyC;AAChD,SAEEC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,sBAAsB,EACtBC,aAAa,EACbC,yBAAyB,QACpB,uBAAmB;AAC1B,SAASC,qBAAqB,QAAQ,gCAA4B;AAClE,SAASC,0BAA0B,QAAQ,qCAAiC;AA0G5E,MAAMC,wCAA0BlB,cAA4CmB;AAE5E,yEAAyE;AACzE,kEAAkE;AAClE,oBAAoB;AACpB,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAMC,uBAAuB,IAAIC;AACjC,IAAIC,gBAAgB;AAEpB;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,MAAMC,2BAA2B,IAC/B,OAAOC,cAAc,eAAeA,UAAUC,SAAS,KAAK;AAE9D;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMC,4BAA4B;IAChCC,QAAQ;QAAEC,gBAAgB;QAAOC,eAAe;IAAU;AAC5D;AAqBA,IAAIC,uBAAoD;AAExD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,wBACdC,IAAiC;IAEjCF,uBAAuBE;AACzB;AAEA,wEAAwE,GACxE,SAASC;IACP,IAAIH,yBAAyB,MAAM,OAAO;IAC1C,IAAI;QACF,OAAOA,2BAA2B;IACpC,EAAE,eAAM;QACN,qEAAqE;QACrE,oEAAoE;QACpE,8BAA8B;QAC9B,OAAO;IACT;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,iBAAiB,IAAIC;AAE3B;;;;;;CAMC,GACD,SAASC,cAAcC,GAAgB;IACrC,MAAMC,WAAWJ,eAAeK,GAAG,CAACF;IACpC,IAAIC,UAAU,OAAOA;IACrB,IAAIE;IACJ,yEAAyE;IACzE,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,wBAAwB;IACxB,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjEjD,2BACE,OAAOkD,WAAW,cAAc,OAAQA;IAE1C,IAAI;QACFD,YAAYrD,4BAA4BkD,KAAKX;IAC/C,EAAE,OAAOgB,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,IAAI;YACF,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,4BAA4B;YAC5BF,YAAYvD,qBAAqBoD;QACnC,EAAE,OAAOO,eAAe;YACtBD,QAAQD,KAAK,CAACE;QAChB;IACF;IACA,IAAIJ,WAAWN,eAAeW,GAAG,CAACR,KAAKG;IACvC,OAAOA;AACT;AAEA;;;CAGC,GACD,SAASM,yBAAyBT,GAAgB;IAChD,IAAI,CAAC/C,oBAAoB,OAAO6B;IAChC,IAAI,CAACc,0BAA0B,OAAOd;IACtC,OAAOiB,cAAcC;AACvB;AA0BA,OAAO,SAASU,yBAAyBC,KAAoC;IAC3E,MAAM,EAAEC,cAAc,EAAEC,OAAO,EAAEC,kBAAkB,SAAS,EAAEC,QAAQ,EAAE,GAAGJ;IAC3E,MAAMK,cAAcjD,OAAqCe;IAEzD,IAAI,CAACkC,YAAYC,OAAO,EAAE;YAEtBxE;QADF,MAAMuD,OACJvD,gBAAAA,UAAUyE,IAAI,CAAC,CAACjB,WAAaA,SAASkB,IAAI,KAAKN,oBAA/CpE,gBACAC,cAAckE,gBAAgBC;QAChC,oEAAoE;QACpE,MAAMO,OAAO7C,mBAAmByB,KAAKc;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,yCAAyC;QACzC,MAAMO,sBAAsB7C,uBAAuBsC;QACnD,IAAI,CAAC/B,qBAAqBuC,GAAG,CAACT,UAAU;YACtC,IAAI;gBACF,iEAAiE;gBACjE,4DAA4D;gBAC5D,iEAAiE;gBACjE,8DAA8D;gBAC9D,2DAA2D;gBAC3D,kEAAkE;gBAClE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qEAAqE;gBACrE,UAAU;gBACV,EAAE;gBACF,mEAAmE;gBACnE,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,iEAAiE;gBACjE,8DAA8D;gBAC9D,oEAAoE;gBACpE,oEAAoE;gBACpE,sBAAsB;gBACtBrD,oBACEwC,KACA9B,sCACI;oBAAEqD,8BAA8B;gBAAK,IACrC;oBACE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,uDAAuD;oBACvD,4BAA4B;oBAC5BC,YAAY/C,cAAc4C;mBAQtBnC,6BACA;oBAAEqC,8BAA8B;gBAAK,IACrC,CAAC;gBAGb,IAAIrD,qCAAqC;oBACvC,mEAAmE;oBACnE,oDAAoD;oBACpD,MAAMuD,WAAWnD;oBACjBhB,yBACEC,aAAayC,MACbyB,SAASC,IAAI,EACbD,SAASE,IAAI;gBAEjB,OAAO;wBAOoC3B;oBANzC,+DAA+D;oBAC/D,mEAAmE;oBACnE,6DAA6D;oBAC7D,KAAKtB,0BAA0B2C,qBAAqBrB;oBACpD,iEAAiE;oBACjE,4DAA4D;oBAC5D,IAAIqB,wBAAwB,eAAarB,eAAAA,IAAI4B,OAAO,qBAAX5B,aAAa6B,SAAS,GAAE;wBAC/DlD,sBACEpB,aAAayC,MACb,GAAGpB,2BAA2BoB,IAAImB,IAAI,EAAEnB,IAAI4B,OAAO,CAACC,SAAS,EAAE,IAAI,CAAC;oBAExE;gBACF;YACF,EAAE,eAAM;YACN,sGAAsG;YACxG,SAAU;gBACR9C,qBAAqB+C,GAAG,CAACjB;YAC3B;QACF;QACA,MAAMkB,YAAYxE,aAAayC;QAE/B,IAAI,CAACf,eAAe;YAClB,IAAI;gBACF,IAAIhB,gCAAgC;oBAClC,uDAAuD;oBACvDb,oBAAoBgE,MAAM/C;gBAC5B;gBACAY,gBAAgB;YAClB,EAAE,OAAOoB,OAAO;gBACdC,QAAQD,KAAK,CAACA;YAChB;QACF;QACA,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,IACE,CAACpC,kCACD,CAACC,qCACD;YACA,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM8D,UAAU5D;YAChB,IAAI,CAAC4D,SAAS;gBACZ1B,QAAQ2B,IAAI,CAAC9D;YACf,OAAO;gBACL,IAAI;oBACFpB,mBAAmBiD,KAAK;wBACtBkC,UAAU,IAAIlF,oBAAoBgF;wBAClCG,2BAA2B;oBAC7B;gBACF,EAAE,OAAO9B,OAAO;oBACdC,QAAQD,KAAK,CAACA;gBAChB;YACF;QACF;QACA,2EAA2E;QAC3E,2EAA2E;QAC3E,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wCAAwC;QACxC,qEAAqE;QACrE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,kBAAkB;QAClB,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,yEAAyE;QACzE,iEAAiE;QACjE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,EAAE;QACF,uEAAuE;QACvE,yDAAyD;QACzD,iEAAiE;QACjE,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,mCAAmC;QACnC,EAAE;QACF,2DAA2D;QAC3D,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAM+B,mBAAmB3B,yBAAyBT;QAClD,oEAAoE;QACpE,wEAAwE;QACxE,sCAAsC;QACtC,IAAIqC;QACJ,IAAI;YACFA,eAAe3E,wBAAwBsC;YACvCqC,aAAaC,QAAQ,CAACC,0BAA0B,GAC9CC,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe,UAAY;QACxD,EAAE,OAAOrC,OAAO;YACdC,QAAQD,KAAK,CAACA;QAChB;QAEAW,YAAYC,OAAO,GAAG;YACpBjB;YACA+B;YACAX;YACAjB,WAAWiC;YACXC;YACAvB;QACF;IACF;IAEA,MAAM6B,WAAW3B,YAAYC,OAAO;IAEpC,6EAA6E;IAC7E,4EAA4E;IAC5E,kBAAkB;IAClB,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,wEAAwE;IACxE,iEAAiE;IACjE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,CAACd,WAAWyC,aAAa,GAAG5E,SAChC,IAAM2E,SAASxC,SAAS;IAE1BtC,UAAU;QACR,MAAMgF,OAAO,IAAMD,aAAanC,yBAAyBkC,SAAS3C,GAAG;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,uCAAuC;QACvC6C;QACAzC,OAAO0C,gBAAgB,CAAC3F,+BAA+B0F;QACvD,OAAO,IACLzC,OAAO2C,mBAAmB,CAAC5F,+BAA+B0F;IAC9D,GAAG;QAACF;KAAS;IAEb,wEAAwE;IACxE,+BAA+B;IAC/B,MAAMK,QAAQlF,QACZ,IACE6E,SAASxC,SAAS,KAAKA,YAAYwC,WAAW,aAAKA;YAAUxC;YAC/D;QAACwC;QAAUxC;KAAU;IAGvB,qBACE,KAACtB,wBAAwBoE,QAAQ;QAACD,OAAOA;kBACtCjC;;AAGP;AACAL,yBAAyBwC,WAAW,GAAG;AAEvC,SAASC;IACP,MAAMR,WAAW/E,WAAWiB;IAC5B,IAAI,CAAC8D,UAAU;QACb,MAAM,IAAIS,MACR;IAEJ;IACA,OAAOT;AACT;AAEA,OAAO,SAASU;IACd,OAAOF,sBAAsBnD,GAAG;AAClC;AACA,OAAO,SAASsD;IACd,OAAOH,sBAAsBpB,SAAS;AACxC;AACA,OAAO,SAASwB;IACd,OAAOJ,sBAAsB/B,IAAI;AACnC;AACA;;;;;;CAMC,GACD,OAAO,SAASoC;IACd,OAAOL,sBAAsBrC,eAAe;AAC9C;AACA,OAAO,SAAS2C;IACd,OAAON,sBAAsBhD,SAAS;AACxC;AACA,OAAO,SAASuD;IACd,OAAOP,sBAAsBd,YAAY;AAC3C;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASsB;QAGZvC;IAFF,MAAMA,OAAOmC;IACb,MAAM,CAACK,MAAMC,QAAQ,GAAG7F,UACtBoD,oBAAAA,KAAK0C,WAAW,YAAhB1C,oBAAoBtC;IAGtBjB,UAAU;QACR,OAAOR,iBAAiB+D,MAAM,CAAC2C;YAC7B,wDAAwD;YACxDF,QAAQE,mBAAAA,WAAY;QACtB;IACF,GAAG;QAAC3C;KAAK;IAET,OAAO;QAAE4C,MAAMJ;IAAK;AACtB;AAOA,4FAA4F,GAC5F,OAAO,SAASK;IAKd,MAAM7C,OAAOmC;IACb,MAAM,CAACW,QAAQC,UAAU,GAAGnG,SAA0C;IACtE,MAAM,CAACgG,MAAMI,QAAQ,GAAGpG,SAAwCc;IAChE,MAAM,CAACuB,OAAOgE,SAAS,GAAGrG,SAA4Bc;IAEtDjB,UAAU;QACR,OAAOR,iBACL+D,MACA,CAACwC;YACCO,UAAU;YACVE,SAASvF;YACTsF,QAAQ;gBAAEE,UAAU,CAAC,CAACV;gBAAMA,IAAI,EAAEA,eAAAA,OAAQ;YAAK;QACjD,GACA,CAACW;YACCJ,UAAU;YACVE,SAASE;QACX;IAEJ,GAAG;QAACnD;KAAK;IAET,OAAO;QAAE8C;QAAQF;QAAM3D;IAAM;AAC/B"}

package/src/lib/hooks/firebase/firestore-cache.d.ts

@@ -109,6 +109,19 @@ export declare const DURABLE_CACHE_SIZE_BYTES: number;
  * `allowTabSynchronization: true`.
  */
 export declare function localCacheFor(originClass: AuthPersistenceClass): FirestoreLocalCache;
+/**
+ * The cache class THIS TAB's Firestore runs, which is the origin's own class
+ * unless the tab has fallen back to the memory cache (AGL-3428).
+ *
+ * A durable origin's tab that found the shared IndexedDB locked by another
+ * tab records a fallback in its `sessionStorage` and reloads; this is where
+ * that reload picks it up. The answer is `ephemeral` then because the
+ * ephemeral cache is exactly what the tab needs — memory only, shared with no
+ * other tab — and nothing else keys off this answer: the AUTH persistence of
+ * the tab keeps the origin's class, so the session survives the reload.
+ * Every other tab keeps the durable cache. See `firestore-multitab-wedge.ts`.
+ */
+export declare function firestoreCacheClassFor(originClass: AuthPersistenceClass, fallbackActive?: () => boolean): AuthPersistenceClass;
 /**
  * Prunes the multi-tab records the durable cache strands in `localStorage`
  * (AGL-2845), for an app whose Firestore this page has just initialized.

package/src/lib/hooks/firebase/firestore-cache.js

@@ -15,6 +15,7 @@
  * limitations under the License.
  */ 'use client';
 import { memoryLocalCache, memoryLruGarbageCollector, persistentLocalCache, persistentMultipleTabManager } from "firebase/firestore";
+import { memoryCacheFallbackActive } from "./firestore-multitab-wedge.js";
 import { pruneBrowserSharedClientState } from "./firestore-shared-client-state.js";
 /**
  * The durable cache's size bound: the SDK's own default, 40 MB, written down.
@@ -131,6 +132,21 @@ import { pruneBrowserSharedClientState } from "./firestore-shared-client-state.j
         cacheSizeBytes: DURABLE_CACHE_SIZE_BYTES
     });
 }
+/**
+ * The cache class THIS TAB's Firestore runs, which is the origin's own class
+ * unless the tab has fallen back to the memory cache (AGL-3428).
+ *
+ * A durable origin's tab that found the shared IndexedDB locked by another
+ * tab records a fallback in its `sessionStorage` and reloads; this is where
+ * that reload picks it up. The answer is `ephemeral` then because the
+ * ephemeral cache is exactly what the tab needs — memory only, shared with no
+ * other tab — and nothing else keys off this answer: the AUTH persistence of
+ * the tab keeps the origin's class, so the session survives the reload.
+ * Every other tab keeps the durable cache. See `firestore-multitab-wedge.ts`.
+ */ export function firestoreCacheClassFor(originClass, fallbackActive = ()=>memoryCacheFallbackActive()) {
+    if (originClass === 'durable' && fallbackActive()) return 'ephemeral';
+    return originClass;
+}
 /**
  * Prunes the multi-tab records the durable cache strands in `localStorage`
  * (AGL-2845), for an app whose Firestore this page has just initialized.

package/src/lib/hooks/firebase/firestore-cache.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/firestore-cache.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { type FirebaseApp } from 'firebase/app'\nimport {\n  type FirestoreLocalCache,\n  memoryLocalCache,\n  memoryLruGarbageCollector,\n  persistentLocalCache,\n  persistentMultipleTabManager,\n} from 'firebase/firestore'\n\nimport { type AuthPersistenceClass } from './auth-persistence'\nimport {\n  pruneBrowserSharedClientState,\n  type SharedClientStatePrunePlan,\n} from './firestore-shared-client-state'\n\n/**\n * The durable cache's size bound: the SDK's own default, 40 MB, written down.\n * See \"The durable cache's size\" on {@link localCacheFor}.\n */\nexport const DURABLE_CACHE_SIZE_BYTES = 40 * 1024 * 1024\n\n/**\n * The Firestore `localCache` an origin of this persistence class may use\n * (AGL-1456).\n *\n * ## Why this keys off the *auth* persistence class\n *\n * The name is historical — the class predates this file (AGL-1379) — but the\n * question it answers was never auth-specific. `AuthPersistenceClass` is\n * documented as *\"how much of a session an origin is allowed to keep\"*, and\n * AGL-1099a's D6 justified `ephemeral` on the grounds that **\"the customer can\n * re-point the DNS and read this origin.\"**\n *\n * That reasoning does not stop at the credential. It is equally true of every\n * document body Firestore caches in IndexedDB on that origin — measured, not\n * argued: the PoC (`docs/design/agl-1099a-poc-findings.md` §5) dumped every\n * object store on the origin and found full document contents under\n * `firestore/<app>/<project>/main → remoteDocumentsV14`, alongside\n * `firestore_clients_*` / `firestore_online_state_*` /\n * `firestore_sequence_number_*` in `localStorage`. D6 hardened the key and\n * left the safe behind it open; this closes it.\n *\n * **One declaration, two consequences — deliberately.** A separate\n * `firestoreCache` prop would let a caller declare a custom console domain\n * `ephemeral` for auth and still hand it a persistent cache, which is exactly\n * the split that produced this bug. There is one fact about the origin, so\n * there is one place to state it.\n *\n * ## The two classes\n *\n * - `durable` → `persistentLocalCache` with the multi-tab manager. Unchanged\n *   from what every host has always run, and it must stay that way:\n *   `*.aglyn.com` / `*.aglyn.app` are ours forever, and this cache is part of\n *   why console read volume is what it is (AGL-1440).\n * - `ephemeral` → `memoryLocalCache`, so **nothing** reaches disk on an origin\n *   whose DNS the customer can re-point at their own server.\n *\n * ## The durable cache's size\n *\n * `cacheSizeBytes` is spelled out at the SDK default so the bound is stated\n * here and cannot quietly become `CACHE_SIZE_UNLIMITED` if that default moves.\n * Stating it changes nothing at runtime, and what it governs is narrower than\n * the name suggests — measured against `@firebase/firestore` 4.17.1:\n *\n * - LRU collection is on without it: an unset `cacheSizeBytes` resolves to\n *   `LruParams.DEFAULT`, the same 40 MB threshold.\n * - It runs only in the tab holding the primary lease, 1 minute after that tab\n *   becomes primary and every 5 minutes after.\n * - The threshold is compared with the byte size of **cached documents**\n *   (`remoteDocumentsV14`) and nothing else. `targets` and `targetDocuments`\n *   rows are collected alongside documents once documents cross it, never\n *   before.\n * - It never touches `localStorage`, where the multi-tab manager strands a\n *   record per tab and per query target; {@link pruneSharedClientStateFor}\n *   handles those.\n *\n * It is deliberately not lowered. A smaller cache evicts exactly the documents\n * that make this cache worth having — a cold load resuming from disk, and\n * listeners painting through a stale session — and a collected target is given\n * a NEW id the next time its query is listened to, which adds a `localStorage`\n * record rather than removing one.\n *\n * ## Why the memory cache gets the LRU collector, not the default\n *\n * `memoryLocalCache()` defaults to `memoryEagerGarbageCollector`, which drops\n * a document the moment no listener references it — so navigating away from a\n * console page and back re-reads its whole working set from the server. The\n * LRU collector keeps documents in the JS heap up to its 40 MB default instead,\n * which recovers most of the intra-session read saving `persistentLocalCache`\n * was giving us.\n *\n * It costs nothing against the property being protected: the LRU collector is\n * still **memory only**. Nothing is written to IndexedDB, nothing survives a\n * tab close, and a page load on a re-pointed origin starts empty — the same\n * bound `inMemoryPersistence` gives the refresh token.\n *\n * The read cost that remains is real and is the stated trade: a **cold** page\n * load on a custom console domain re-reads its working set where a durable\n * origin would have resumed from disk, and multiple tabs no longer share one\n * backend connection through `persistentMultipleTabManager`. That is the right\n * trade for an Enterprise-only feature, but it is a trade.\n *\n * ## `Failed to obtain primary lease for action '…'` is not a bug to fix\n *\n * Exactly one open tab holds the IndexedDB primary lease and applies remote\n * events; the rest read the results it writes. When the lease changes hands —\n * a tab opening, closing, or coming back to the foreground — a transaction\n * already in flight on the losing tab finds itself no longer primary, and the\n * SDK `logError`s that message immediately before throwing a\n * `failed-precondition` that its OWN multi-tab sync engine catches\n * (`ignoreIfPrimaryLeaseLoss`) and downgrades to a debug line. The tab then\n * continues as a secondary. Nothing is dropped and no listener stops.\n *\n * It is therefore noise from a handled handoff, and it scales with how many\n * tabs are churning rather than with anything the console does. The message\n * names a lease, so the obvious reading is that the multi-tab manager is\n * missing and should be added — it is already here, which is why the message\n * appears at all: `persistentSingleTabManager` refuses the second tab's\n * persistence outright instead of sharing it. Confirmed at runtime by the\n * `owner` record in `firestore/<app>/<project>/main`, which carries\n * `allowTabSynchronization: true`.\n */\nexport function localCacheFor(\n  originClass: AuthPersistenceClass,\n): FirestoreLocalCache {\n  if (originClass === 'ephemeral') {\n    return memoryLocalCache({ garbageCollector: memoryLruGarbageCollector() })\n  }\n  return persistentLocalCache({\n    tabManager: persistentMultipleTabManager(),\n    cacheSizeBytes: DURABLE_CACHE_SIZE_BYTES,\n  })\n}\n\n/**\n * Prunes the multi-tab records the durable cache strands in `localStorage`\n * (AGL-2845), for an app whose Firestore this page has just initialized.\n *\n * Keyed off the same origin class as {@link localCacheFor}, because the\n * durable class is the only one running `persistentMultipleTabManager`, the\n * only writer of those records. An ephemeral origin's memory cache writes\n * none, so it resolves without looking.\n *\n * Fire-and-forget: it never rejects and nothing waits on it. What it deletes,\n * and why a live tab's records never are, is in\n * `firestore-shared-client-state.ts`.\n */\nexport function pruneSharedClientStateFor(\n  originClass: AuthPersistenceClass,\n  app: FirebaseApp,\n): Promise<SharedClientStatePrunePlan | undefined> {\n  if (originClass === 'ephemeral') return Promise.resolve(undefined)\n  return pruneBrowserSharedClientState(app.name, app.options?.projectId)\n}\n"],"names":["memoryLocalCache","memoryLruGarbageCollector","persistentLocalCache","persistentMultipleTabManager","pruneBrowserSharedClientState","DURABLE_CACHE_SIZE_BYTES","localCacheFor","originClass","garbageCollector","tabManager","cacheSizeBytes","pruneSharedClientStateFor","app","Promise","resolve","undefined","name","options","projectId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;AAGA,SAEEA,gBAAgB,EAChBC,yBAAyB,EACzBC,oBAAoB,EACpBC,4BAA4B,QACvB,qBAAoB;AAG3B,SACEC,6BAA6B,QAExB,qCAAiC;AAExC;;;CAGC,GACD,OAAO,MAAMC,2BAA2B,KAAK,OAAO,KAAI;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGC,GACD,OAAO,SAASC,cACdC,WAAiC;IAEjC,IAAIA,gBAAgB,aAAa;QAC/B,OAAOP,iBAAiB;YAAEQ,kBAAkBP;QAA4B;IAC1E;IACA,OAAOC,qBAAqB;QAC1BO,YAAYN;QACZO,gBAAgBL;IAClB;AACF;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASM,0BACdJ,WAAiC,EACjCK,GAAgB;QAG+BA;IAD/C,IAAIL,gBAAgB,aAAa,OAAOM,QAAQC,OAAO,CAACC;IACxD,OAAOX,8BAA8BQ,IAAII,IAAI,GAAEJ,eAAAA,IAAIK,OAAO,qBAAXL,aAAaM,SAAS;AACvE"}
+{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/firestore-cache.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { type FirebaseApp } from 'firebase/app'\nimport {\n  type FirestoreLocalCache,\n  memoryLocalCache,\n  memoryLruGarbageCollector,\n  persistentLocalCache,\n  persistentMultipleTabManager,\n} from 'firebase/firestore'\n\nimport { type AuthPersistenceClass } from './auth-persistence'\nimport { memoryCacheFallbackActive } from './firestore-multitab-wedge'\nimport {\n  pruneBrowserSharedClientState,\n  type SharedClientStatePrunePlan,\n} from './firestore-shared-client-state'\n\n/**\n * The durable cache's size bound: the SDK's own default, 40 MB, written down.\n * See \"The durable cache's size\" on {@link localCacheFor}.\n */\nexport const DURABLE_CACHE_SIZE_BYTES = 40 * 1024 * 1024\n\n/**\n * The Firestore `localCache` an origin of this persistence class may use\n * (AGL-1456).\n *\n * ## Why this keys off the *auth* persistence class\n *\n * The name is historical — the class predates this file (AGL-1379) — but the\n * question it answers was never auth-specific. `AuthPersistenceClass` is\n * documented as *\"how much of a session an origin is allowed to keep\"*, and\n * AGL-1099a's D6 justified `ephemeral` on the grounds that **\"the customer can\n * re-point the DNS and read this origin.\"**\n *\n * That reasoning does not stop at the credential. It is equally true of every\n * document body Firestore caches in IndexedDB on that origin — measured, not\n * argued: the PoC (`docs/design/agl-1099a-poc-findings.md` §5) dumped every\n * object store on the origin and found full document contents under\n * `firestore/<app>/<project>/main → remoteDocumentsV14`, alongside\n * `firestore_clients_*` / `firestore_online_state_*` /\n * `firestore_sequence_number_*` in `localStorage`. D6 hardened the key and\n * left the safe behind it open; this closes it.\n *\n * **One declaration, two consequences — deliberately.** A separate\n * `firestoreCache` prop would let a caller declare a custom console domain\n * `ephemeral` for auth and still hand it a persistent cache, which is exactly\n * the split that produced this bug. There is one fact about the origin, so\n * there is one place to state it.\n *\n * ## The two classes\n *\n * - `durable` → `persistentLocalCache` with the multi-tab manager. Unchanged\n *   from what every host has always run, and it must stay that way:\n *   `*.aglyn.com` / `*.aglyn.app` are ours forever, and this cache is part of\n *   why console read volume is what it is (AGL-1440).\n * - `ephemeral` → `memoryLocalCache`, so **nothing** reaches disk on an origin\n *   whose DNS the customer can re-point at their own server.\n *\n * ## The durable cache's size\n *\n * `cacheSizeBytes` is spelled out at the SDK default so the bound is stated\n * here and cannot quietly become `CACHE_SIZE_UNLIMITED` if that default moves.\n * Stating it changes nothing at runtime, and what it governs is narrower than\n * the name suggests — measured against `@firebase/firestore` 4.17.1:\n *\n * - LRU collection is on without it: an unset `cacheSizeBytes` resolves to\n *   `LruParams.DEFAULT`, the same 40 MB threshold.\n * - It runs only in the tab holding the primary lease, 1 minute after that tab\n *   becomes primary and every 5 minutes after.\n * - The threshold is compared with the byte size of **cached documents**\n *   (`remoteDocumentsV14`) and nothing else. `targets` and `targetDocuments`\n *   rows are collected alongside documents once documents cross it, never\n *   before.\n * - It never touches `localStorage`, where the multi-tab manager strands a\n *   record per tab and per query target; {@link pruneSharedClientStateFor}\n *   handles those.\n *\n * It is deliberately not lowered. A smaller cache evicts exactly the documents\n * that make this cache worth having — a cold load resuming from disk, and\n * listeners painting through a stale session — and a collected target is given\n * a NEW id the next time its query is listened to, which adds a `localStorage`\n * record rather than removing one.\n *\n * ## Why the memory cache gets the LRU collector, not the default\n *\n * `memoryLocalCache()` defaults to `memoryEagerGarbageCollector`, which drops\n * a document the moment no listener references it — so navigating away from a\n * console page and back re-reads its whole working set from the server. The\n * LRU collector keeps documents in the JS heap up to its 40 MB default instead,\n * which recovers most of the intra-session read saving `persistentLocalCache`\n * was giving us.\n *\n * It costs nothing against the property being protected: the LRU collector is\n * still **memory only**. Nothing is written to IndexedDB, nothing survives a\n * tab close, and a page load on a re-pointed origin starts empty — the same\n * bound `inMemoryPersistence` gives the refresh token.\n *\n * The read cost that remains is real and is the stated trade: a **cold** page\n * load on a custom console domain re-reads its working set where a durable\n * origin would have resumed from disk, and multiple tabs no longer share one\n * backend connection through `persistentMultipleTabManager`. That is the right\n * trade for an Enterprise-only feature, but it is a trade.\n *\n * ## `Failed to obtain primary lease for action '…'` is not a bug to fix\n *\n * Exactly one open tab holds the IndexedDB primary lease and applies remote\n * events; the rest read the results it writes. When the lease changes hands —\n * a tab opening, closing, or coming back to the foreground — a transaction\n * already in flight on the losing tab finds itself no longer primary, and the\n * SDK `logError`s that message immediately before throwing a\n * `failed-precondition` that its OWN multi-tab sync engine catches\n * (`ignoreIfPrimaryLeaseLoss`) and downgrades to a debug line. The tab then\n * continues as a secondary. Nothing is dropped and no listener stops.\n *\n * It is therefore noise from a handled handoff, and it scales with how many\n * tabs are churning rather than with anything the console does. The message\n * names a lease, so the obvious reading is that the multi-tab manager is\n * missing and should be added — it is already here, which is why the message\n * appears at all: `persistentSingleTabManager` refuses the second tab's\n * persistence outright instead of sharing it. Confirmed at runtime by the\n * `owner` record in `firestore/<app>/<project>/main`, which carries\n * `allowTabSynchronization: true`.\n */\nexport function localCacheFor(\n  originClass: AuthPersistenceClass,\n): FirestoreLocalCache {\n  if (originClass === 'ephemeral') {\n    return memoryLocalCache({ garbageCollector: memoryLruGarbageCollector() })\n  }\n  return persistentLocalCache({\n    tabManager: persistentMultipleTabManager(),\n    cacheSizeBytes: DURABLE_CACHE_SIZE_BYTES,\n  })\n}\n\n/**\n * The cache class THIS TAB's Firestore runs, which is the origin's own class\n * unless the tab has fallen back to the memory cache (AGL-3428).\n *\n * A durable origin's tab that found the shared IndexedDB locked by another\n * tab records a fallback in its `sessionStorage` and reloads; this is where\n * that reload picks it up. The answer is `ephemeral` then because the\n * ephemeral cache is exactly what the tab needs — memory only, shared with no\n * other tab — and nothing else keys off this answer: the AUTH persistence of\n * the tab keeps the origin's class, so the session survives the reload.\n * Every other tab keeps the durable cache. See `firestore-multitab-wedge.ts`.\n */\nexport function firestoreCacheClassFor(\n  originClass: AuthPersistenceClass,\n  fallbackActive: () => boolean = () => memoryCacheFallbackActive(),\n): AuthPersistenceClass {\n  if (originClass === 'durable' && fallbackActive()) return 'ephemeral'\n  return originClass\n}\n\n/**\n * Prunes the multi-tab records the durable cache strands in `localStorage`\n * (AGL-2845), for an app whose Firestore this page has just initialized.\n *\n * Keyed off the same origin class as {@link localCacheFor}, because the\n * durable class is the only one running `persistentMultipleTabManager`, the\n * only writer of those records. An ephemeral origin's memory cache writes\n * none, so it resolves without looking.\n *\n * Fire-and-forget: it never rejects and nothing waits on it. What it deletes,\n * and why a live tab's records never are, is in\n * `firestore-shared-client-state.ts`.\n */\nexport function pruneSharedClientStateFor(\n  originClass: AuthPersistenceClass,\n  app: FirebaseApp,\n): Promise<SharedClientStatePrunePlan | undefined> {\n  if (originClass === 'ephemeral') return Promise.resolve(undefined)\n  return pruneBrowserSharedClientState(app.name, app.options?.projectId)\n}\n"],"names":["memoryLocalCache","memoryLruGarbageCollector","persistentLocalCache","persistentMultipleTabManager","memoryCacheFallbackActive","pruneBrowserSharedClientState","DURABLE_CACHE_SIZE_BYTES","localCacheFor","originClass","garbageCollector","tabManager","cacheSizeBytes","firestoreCacheClassFor","fallbackActive","pruneSharedClientStateFor","app","Promise","resolve","undefined","name","options","projectId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;AAGA,SAEEA,gBAAgB,EAChBC,yBAAyB,EACzBC,oBAAoB,EACpBC,4BAA4B,QACvB,qBAAoB;AAG3B,SAASC,yBAAyB,QAAQ,gCAA4B;AACtE,SACEC,6BAA6B,QAExB,qCAAiC;AAExC;;;CAGC,GACD,OAAO,MAAMC,2BAA2B,KAAK,OAAO,KAAI;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGC,GACD,OAAO,SAASC,cACdC,WAAiC;IAEjC,IAAIA,gBAAgB,aAAa;QAC/B,OAAOR,iBAAiB;YAAES,kBAAkBR;QAA4B;IAC1E;IACA,OAAOC,qBAAqB;QAC1BQ,YAAYP;QACZQ,gBAAgBL;IAClB;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASM,uBACdJ,WAAiC,EACjCK,iBAAgC,IAAMT,2BAA2B;IAEjE,IAAII,gBAAgB,aAAaK,kBAAkB,OAAO;IAC1D,OAAOL;AACT;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASM,0BACdN,WAAiC,EACjCO,GAAgB;QAG+BA;IAD/C,IAAIP,gBAAgB,aAAa,OAAOQ,QAAQC,OAAO,CAACC;IACxD,OAAOb,8BAA8BU,IAAII,IAAI,GAAEJ,eAAAA,IAAIK,OAAO,qBAAXL,aAAaM,SAAS;AACvE"}

package/src/lib/hooks/firebase/firestore-multitab-wedge.d.ts

@@ -0,0 +1,200 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type Firestore } from 'firebase/firestore';
+/**
+ * A MULTI-TAB CACHE THAT ANOTHER TAB HAS LOCKED, AND THE WAY OUT (AGL-3428).
+ *
+ * ## The wedge the network cycle cannot clear
+ *
+ * `firestore-stall-recovery.ts` recovers a lapsed primary lease by cycling the
+ * network, which runs the lease election at once (AGL-3373). That needs the
+ * election's IndexedDB transaction to run. Measured against
+ * `@firebase/firestore` 4.17.2: `IndexedDbPersistence.runTransaction` opens
+ * EVERY transaction over EVERY object store (`getObjectStores(schemaVersion)`),
+ * so one tab that stops partway through a readwrite transaction — frozen or
+ * discarded by the browser while it runs — holds every store for every tab on
+ * the origin. Behind it, in every other tab:
+ *
+ * - the lease election waits, so the lease row is never renewed by anyone;
+ * - cache reads wait, so pages sit on their spinners;
+ * - the mutation-queue write waits, so a save never reaches the network;
+ * - a freshly opened tab's persistence `start()` waits, so a new tab hangs too;
+ * - `disableNetwork`, `enableNetwork` and `terminate` are queued on the same
+ *   AsyncQueue behind the stuck operation, so none of them ever runs.
+ *
+ * On 2026-09-30 production (beta.218) did exactly this three times in two
+ * hours: every console tab stopped, and the `owner` row named a background
+ * tab that had stopped renewing it.
+ *
+ * ## How it is told apart from a slow read
+ *
+ * Only after the network cycle, and only from a visible tab on a browser that
+ * reports a network. Such a tab wins a lapsed lease within one 4-second
+ * election tick, and the cycle has just forced one. So, after a short settle,
+ * the tab reads the `owner` row itself:
+ *
+ * - **the read cannot complete in time** — the store is locked by another
+ *   tab's open transaction; or
+ * - **the lease is older than {@link STALE_PRIMARY_LEASE_MS}** — no tab,
+ *   including this one, is completing an election.
+ *
+ * Either is the wedge. A fresh lease — this tab's or another's — is a healthy
+ * cache and a merely slow server, and nothing more happens.
+ *
+ * ## The way out
+ *
+ * The tab records a {@link MemoryCacheFallback} in `sessionStorage` and
+ * reloads. `firestoreCacheClassFor` reads it at startup and gives this tab the
+ * memory cache, which shares nothing with other tabs, so the locked database
+ * cannot reach it. `sessionStorage` is per tab: other tabs keep the durable
+ * cache, and the fallback leaves when this tab closes or after
+ * {@link MEMORY_CACHE_FALLBACK_TTL_MS}.
+ *
+ * A reload, not an in-place swap, because nothing in place can work: the
+ * wedged instance's `terminate()` is queued behind the stuck operation, a
+ * second instance for the same app throws until the first is gone, and
+ * hundreds of readers hold the instance from context and from closures.
+ * Nothing that could be saved is lost — the wedge had already stopped every
+ * write in the tab from leaving it.
+ */
+/** `sessionStorage` key of this tab's memory-cache fallback. */
+export declare const MEMORY_CACHE_FALLBACK_KEY = "aglyn:firestore-memory-cache-fallback";
+/**
+ * How long a tab keeps the memory cache after falling back. The SDK's own
+ * inactivity horizon (`MAX_CLIENT_AGE_MS`), after which a tab that is still
+ * stuck no longer counts as a client; past it, a reload tries the durable
+ * cache again, and falls back again if it has to.
+ */
+export declare const MEMORY_CACHE_FALLBACK_TTL_MS: number;
+/**
+ * A lease older than this, read from a visible online tab right after a
+ * forced election, means no election is completing. The SDK treats a lease as
+ * lapsed at 5 s (`MAX_PRIMARY_ELIGIBLE_AGE_MS`) and runs the election every
+ * 4 s; this is three times the first, so an election that is merely late is
+ * never mistaken for one that cannot run.
+ */
+export declare const STALE_PRIMARY_LEASE_MS = 15000;
+/**
+ * How long the lease read may take before the store is judged locked. The
+ * SDK's own transactions take milliseconds.
+ */
+export declare const LEASE_PROBE_TIMEOUT_MS = 4000;
+/**
+ * How long after the network cycle the lease is read, so the election the
+ * cycle queued has run.
+ */
+export declare const LEASE_SETTLE_MS = 3000;
+/** What reading the lease found. */
+export type PrimaryLeaseProbe = 
+/** The read did not complete in time: another tab's transaction holds the store. */
+{
+    state: 'locked';
+}
+/** The lease row: who holds it and how long ago it was renewed. */
+ | {
+    state: 'leased';
+    ownerId: string;
+    ageMs: number;
+}
+/** There is no lease row. */
+ | {
+    state: 'vacant';
+}
+/** The lease could not be read: no IndexedDB, no database, no store, an error. */
+ | {
+    state: 'unknown';
+};
+/** Why a tab concluded the multi-tab cache is wedged. */
+export type WedgeEvidence = {
+    reason: 'lease-locked';
+} | {
+    reason: 'lease-stale';
+    ownerId: string;
+    ageMs: number;
+};
+/** The fallback this tab recorded, and why. */
+export type MemoryCacheFallback = WedgeEvidence & {
+    at: number;
+};
+/**
+ * Reads the SDK's `owner` row from `databaseName`.
+ *
+ * Opens only a database that already exists, at whatever version it has (the
+ * same rule as `readHeartbeatClientIds`): `open(name)` on a missing database
+ * would create it at version 1 under the SDK. The connection serves one
+ * read-only request and is closed — also on `versionchange`, so it never
+ * holds up the SDK's own upgrade, and also when the read lands after the
+ * timeout.
+ */
+export declare function probePrimaryLease(factory: IDBFactory | undefined, databaseName: string, { timeoutMs, now, }?: {
+    timeoutMs?: number;
+    now?: () => number;
+}): Promise<PrimaryLeaseProbe>;
+/**
+ * Whether a lease read taken right after a forced election, from a visible
+ * online tab, shows the wedge. Anything that could be a healthy cache —
+ * a fresh lease, no lease row, an unreadable one — is not evidence.
+ */
+export declare function wedgeEvidenceFrom(probe: PrimaryLeaseProbe, staleMs?: number): WedgeEvidence | undefined;
+/**
+ * This tab's fallback, or `undefined` when there is none, it has expired, or
+ * it does not parse.
+ */
+export declare function readMemoryCacheFallback(storage: Pick<Storage, 'getItem'> | undefined, now: number, ttlMs?: number): MemoryCacheFallback | undefined;
+/** Whether this browser tab is running on its memory-cache fallback. */
+export declare function memoryCacheFallbackActive(now?: number): boolean;
+export interface WedgeEscalationDeps {
+    /** Reads the lease. */
+    probe: () => Promise<PrimaryLeaseProbe>;
+    /** Moves this tab off the shared cache. */
+    fallBack: (evidence: WedgeEvidence) => void;
+    /** Whether this tab is already on the fallback — it then never escalates. */
+    isFallbackActive?: () => boolean;
+    isOnline?: () => boolean;
+    isVisible?: () => boolean;
+    /** Waits `ms`; the settle before the lease read. */
+    wait?: (ms: number) => Promise<void>;
+    settleMs?: number;
+}
+/**
+ * The step `createStallRecovery` runs after its network cycle for a
+ * multi-tab client. Resolves `true` when it has moved the tab to the fallback.
+ * Never rejects.
+ */
+export declare function createWedgeEscalation(deps: WedgeEscalationDeps): () => Promise<boolean>;
+/**
+ * Records the fallback for this tab and reloads it onto the memory cache.
+ * When the record cannot be written it does not reload: without it, the
+ * reloaded tab would open the same locked database and hang again.
+ */
+export declare function fallBackToMemoryCache(evidence: WedgeEvidence, { storage, reload, now, }?: {
+    storage?: Pick<Storage, 'setItem'>;
+    reload?: () => void;
+    now?: () => number;
+}): void;
+/**
+ * Registers `firestore` as running the durable multi-tab cache under
+ * `databaseName` (`<persistence prefix>main`). Only a registered client ever
+ * escalates past the network cycle.
+ */
+export declare function markMultiTabFirestore(firestore: Firestore, databaseName: string): void;
+/**
+ * The browser escalation for `firestore`, or `undefined` when it does not run
+ * the durable multi-tab cache (the emulator configuration, an ephemeral
+ * origin, a tab already on the fallback).
+ */
+export declare function browserWedgeEscalationFor(firestore: Firestore): (() => Promise<boolean>) | undefined;