@aglyn/tenant-feature-instance 1.0.0-beta.240 → 1.0.0-beta.242

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-feature-instance",
-  "version": "1.0.0-beta.240",
+  "version": "1.0.0-beta.242",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.240",
-    "@aglyn/shared-data-enums": "1.0.0-beta.240",
-    "@aglyn/shared-ui-jsx": "1.0.0-beta.240",
-    "@aglyn/shared-util-email": "1.0.0-beta.240",
-    "@aglyn/shared-util-http": "1.0.0-beta.240",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.240",
+    "@aglyn/aglyn": "1.0.0-beta.242",
+    "@aglyn/shared-data-enums": "1.0.0-beta.242",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.242",
+    "@aglyn/shared-util-email": "1.0.0-beta.242",
+    "@aglyn/shared-util-http": "1.0.0-beta.242",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.242",
     "@swc/helpers": "0.5.23",
     "lodash-es": "^4.18.1"
   },

package/src/lib/hooks/firebase/app-check-recaptcha-container.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Keeps App Check's reCAPTCHA container in the page until, and after, the
+ * widget renders into it.
+ *
+ * The only reCAPTCHA the console and tenant pages run is App Check's
+ * `ReCaptchaV3Provider` (there is no `RecaptchaVerifier` anywhere). Inside
+ * `initializeAppCheck` the SDK appends `<div id="fire_app_check_<app>">` to
+ * `<body>` at once, but renders the invisible widget into it only later, from
+ * `grecaptcha.ready()`, once Google's script has loaded. That gap is a whole
+ * network round trip, and on the console Firebase now boots before hydration
+ * (AGL-3660), so it spans hydration. Anything that clears `<body>` in that
+ * window takes the div with it: React's client-render fallback after a
+ * hydration mismatch (it clears the body of every node it did not render),
+ * `global-error` replacing `<body>`, a translator moving nodes. The render
+ * then throws `reCAPTCHA placeholder element must be an element or id`
+ * inside Google's code, where nothing of ours can catch it, so it lands as
+ * an `unhandledrejection` — and the SDK's `initialized` promise never
+ * resolves, so every later App Check token request for that app waits on a
+ * widget that will never exist.
+ *
+ * Seen in production on 2026-10-09 (translator, guarded since #1342) and on
+ * 2026-10-10 18:11Z on `/verify-email` and then `/` during a real password
+ * sign-up.
+ *
+ * The keeper answers exactly that: it holds the SDK's own element and, the
+ * moment a mutation leaves no element with that id in the document, puts it
+ * back under the current `<body>`. MutationObserver callbacks run as
+ * microtasks, so the element is back before `grecaptcha.ready()` (a script
+ * load or timer, i.e. a later task) can render. It keeps watching after the
+ * render as well, because `execute()` for every later token needs the
+ * widget's iframe to still be in the page.
+ *
+ * Framework-free, browser-only, once per app name; a no-op during SSR.
+ */
+/** The id `@firebase/app-check` gives the container it renders into. */
+export declare function appCheckRecaptchaContainerId(appName: string): string;
+/**
+ * Start keeping `appName`'s App Check reCAPTCHA container in the document.
+ * Call it right after `initializeAppCheck` for that app. Returns a stop
+ * function (tests; a page never needs to stop it).
+ */
+export declare function keepAppCheckRecaptchaContainer(appName: string): () => void;

package/src/lib/hooks/firebase/app-check-recaptcha-container.js

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Keeps App Check's reCAPTCHA container in the page until, and after, the
+ * widget renders into it.
+ *
+ * The only reCAPTCHA the console and tenant pages run is App Check's
+ * `ReCaptchaV3Provider` (there is no `RecaptchaVerifier` anywhere). Inside
+ * `initializeAppCheck` the SDK appends `<div id="fire_app_check_<app>">` to
+ * `<body>` at once, but renders the invisible widget into it only later, from
+ * `grecaptcha.ready()`, once Google's script has loaded. That gap is a whole
+ * network round trip, and on the console Firebase now boots before hydration
+ * (AGL-3660), so it spans hydration. Anything that clears `<body>` in that
+ * window takes the div with it: React's client-render fallback after a
+ * hydration mismatch (it clears the body of every node it did not render),
+ * `global-error` replacing `<body>`, a translator moving nodes. The render
+ * then throws `reCAPTCHA placeholder element must be an element or id`
+ * inside Google's code, where nothing of ours can catch it, so it lands as
+ * an `unhandledrejection` — and the SDK's `initialized` promise never
+ * resolves, so every later App Check token request for that app waits on a
+ * widget that will never exist.
+ *
+ * Seen in production on 2026-10-09 (translator, guarded since #1342) and on
+ * 2026-10-10 18:11Z on `/verify-email` and then `/` during a real password
+ * sign-up.
+ *
+ * The keeper answers exactly that: it holds the SDK's own element and, the
+ * moment a mutation leaves no element with that id in the document, puts it
+ * back under the current `<body>`. MutationObserver callbacks run as
+ * microtasks, so the element is back before `grecaptcha.ready()` (a script
+ * load or timer, i.e. a later task) can render. It keeps watching after the
+ * render as well, because `execute()` for every later token needs the
+ * widget's iframe to still be in the page.
+ *
+ * Framework-free, browser-only, once per app name; a no-op during SSR.
+ */ /** The id `@firebase/app-check` gives the container it renders into. */ export function appCheckRecaptchaContainerId(appName) {
+    return `fire_app_check_${appName}`;
+}
+const keepers = new Map();
+/**
+ * Start keeping `appName`'s App Check reCAPTCHA container in the document.
+ * Call it right after `initializeAppCheck` for that app. Returns a stop
+ * function (tests; a page never needs to stop it).
+ */ export function keepAppCheckRecaptchaContainer(appName) {
+    const existing = keepers.get(appName);
+    if (existing) return existing;
+    if (typeof document === 'undefined' || typeof MutationObserver !== 'function') {
+        return ()=>undefined;
+    }
+    const id = appCheckRecaptchaContainerId(appName);
+    let held = document.getElementById(id);
+    const restore = ()=>{
+        const current = document.getElementById(id);
+        if (current) {
+            held = current;
+            return;
+        }
+        const body = document.body;
+        if (!body) return;
+        if (!held) {
+            // Same shape the SDK makes, for the case where it was removed before
+            // this keeper ever saw it.
+            held = document.createElement('div');
+            held.id = id;
+            held.style.display = 'none';
+        }
+        body.appendChild(held);
+    };
+    const observer = new MutationObserver(restore);
+    observer.observe(document, {
+        childList: true,
+        subtree: true
+    });
+    restore();
+    const stop = ()=>{
+        observer.disconnect();
+        keepers.delete(appName);
+    };
+    keepers.set(appName, stop);
+    return stop;
+}
+
+//# sourceMappingURL=app-check-recaptcha-container.js.map

package/src/lib/hooks/firebase/app-check-recaptcha-container.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/app-check-recaptcha-container.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Keeps App Check's reCAPTCHA container in the page until, and after, the\n * widget renders into it.\n *\n * The only reCAPTCHA the console and tenant pages run is App Check's\n * `ReCaptchaV3Provider` (there is no `RecaptchaVerifier` anywhere). Inside\n * `initializeAppCheck` the SDK appends `<div id=\"fire_app_check_<app>\">` to\n * `<body>` at once, but renders the invisible widget into it only later, from\n * `grecaptcha.ready()`, once Google's script has loaded. That gap is a whole\n * network round trip, and on the console Firebase now boots before hydration\n * (AGL-3660), so it spans hydration. Anything that clears `<body>` in that\n * window takes the div with it: React's client-render fallback after a\n * hydration mismatch (it clears the body of every node it did not render),\n * `global-error` replacing `<body>`, a translator moving nodes. The render\n * then throws `reCAPTCHA placeholder element must be an element or id`\n * inside Google's code, where nothing of ours can catch it, so it lands as\n * an `unhandledrejection` — and the SDK's `initialized` promise never\n * resolves, so every later App Check token request for that app waits on a\n * widget that will never exist.\n *\n * Seen in production on 2026-10-09 (translator, guarded since #1342) and on\n * 2026-10-10 18:11Z on `/verify-email` and then `/` during a real password\n * sign-up.\n *\n * The keeper answers exactly that: it holds the SDK's own element and, the\n * moment a mutation leaves no element with that id in the document, puts it\n * back under the current `<body>`. MutationObserver callbacks run as\n * microtasks, so the element is back before `grecaptcha.ready()` (a script\n * load or timer, i.e. a later task) can render. It keeps watching after the\n * render as well, because `execute()` for every later token needs the\n * widget's iframe to still be in the page.\n *\n * Framework-free, browser-only, once per app name; a no-op during SSR.\n */\n\n/** The id `@firebase/app-check` gives the container it renders into. */\nexport function appCheckRecaptchaContainerId(appName: string): string {\n  return `fire_app_check_${appName}`\n}\n\nconst keepers = new Map<string, () => void>()\n\n/**\n * Start keeping `appName`'s App Check reCAPTCHA container in the document.\n * Call it right after `initializeAppCheck` for that app. Returns a stop\n * function (tests; a page never needs to stop it).\n */\nexport function keepAppCheckRecaptchaContainer(appName: string): () => void {\n  const existing = keepers.get(appName)\n  if (existing) return existing\n  if (\n    typeof document === 'undefined' ||\n    typeof MutationObserver !== 'function'\n  ) {\n    return () => undefined\n  }\n\n  const id = appCheckRecaptchaContainerId(appName)\n  let held: HTMLElement | null = document.getElementById(id)\n\n  const restore = () => {\n    const current = document.getElementById(id)\n    if (current) {\n      held = current\n      return\n    }\n    const body = document.body\n    if (!body) return\n    if (!held) {\n      // Same shape the SDK makes, for the case where it was removed before\n      // this keeper ever saw it.\n      held = document.createElement('div')\n      held.id = id\n      held.style.display = 'none'\n    }\n    body.appendChild(held)\n  }\n\n  const observer = new MutationObserver(restore)\n  observer.observe(document, { childList: true, subtree: true })\n  restore()\n\n  const stop = () => {\n    observer.disconnect()\n    keepers.delete(appName)\n  }\n  keepers.set(appName, stop)\n  return stop\n}\n"],"names":["appCheckRecaptchaContainerId","appName","keepers","Map","keepAppCheckRecaptchaContainer","existing","get","document","MutationObserver","undefined","id","held","getElementById","restore","current","body","createElement","style","display","appendChild","observer","observe","childList","subtree","stop","disconnect","delete","set"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GAED,sEAAsE,GACtE,OAAO,SAASA,6BAA6BC,OAAe;IAC1D,OAAO,CAAC,eAAe,EAAEA,SAAS;AACpC;AAEA,MAAMC,UAAU,IAAIC;AAEpB;;;;CAIC,GACD,OAAO,SAASC,+BAA+BH,OAAe;IAC5D,MAAMI,WAAWH,QAAQI,GAAG,CAACL;IAC7B,IAAII,UAAU,OAAOA;IACrB,IACE,OAAOE,aAAa,eACpB,OAAOC,qBAAqB,YAC5B;QACA,OAAO,IAAMC;IACf;IAEA,MAAMC,KAAKV,6BAA6BC;IACxC,IAAIU,OAA2BJ,SAASK,cAAc,CAACF;IAEvD,MAAMG,UAAU;QACd,MAAMC,UAAUP,SAASK,cAAc,CAACF;QACxC,IAAII,SAAS;YACXH,OAAOG;YACP;QACF;QACA,MAAMC,OAAOR,SAASQ,IAAI;QAC1B,IAAI,CAACA,MAAM;QACX,IAAI,CAACJ,MAAM;YACT,qEAAqE;YACrE,2BAA2B;YAC3BA,OAAOJ,SAASS,aAAa,CAAC;YAC9BL,KAAKD,EAAE,GAAGA;YACVC,KAAKM,KAAK,CAACC,OAAO,GAAG;QACvB;QACAH,KAAKI,WAAW,CAACR;IACnB;IAEA,MAAMS,WAAW,IAAIZ,iBAAiBK;IACtCO,SAASC,OAAO,CAACd,UAAU;QAAEe,WAAW;QAAMC,SAAS;IAAK;IAC5DV;IAEA,MAAMW,OAAO;QACXJ,SAASK,UAAU;QACnBvB,QAAQwB,MAAM,CAACzB;IACjB;IACAC,QAAQyB,GAAG,CAAC1B,SAASuB;IACrB,OAAOA;AACT"}

package/src/lib/hooks/firebase/firebase-services.js

@@ -31,6 +31,7 @@ import { APP_CHECK_KEY_MISSING_MESSAGE, appCheckSiteKey } from "../../constants/
 import { authEmulatorUrl, firestoreEmulatorHost } from "../../constants/firebase-emulator-hosts.js";
 import { createAuthInstance } from "./auth-persistence.js";
 import { firestoreCacheClassFor, localCacheFor, pruneSharedClientStateFor } from "./firestore-cache.js";
+import { keepAppCheckRecaptchaContainer } from "./app-check-recaptcha-container.js";
 import { markMultiTabFirestore } from "./firestore-multitab-wedge.js";
 import { firestorePersistencePrefix } from "./firestore-shared-client-state.js";
 import { startFirestoreTabHandoff } from "./firestore-tab-handoff.js";
@@ -286,6 +287,10 @@ let analyticsConsentGate = null;
                     provider: new ReCaptchaV3Provider(siteKey),
                     isTokenAutoRefreshEnabled: true
                 });
+                // The widget renders into the SDK's <body> div only once Google's
+                // script loads; a body cleared before then (hydration fallback,
+                // global-error) made that render throw unhandled.
+                keepAppCheckRecaptchaContainer(app.name);
             } catch (error) {
                 console.error(error);
             }

package/src/lib/hooks/firebase/firebase-services.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/firebase-services.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport {\n  type FirebaseApp,\n  type FirebaseOptions,\n  getApps,\n  initializeApp,\n} from 'firebase/app'\nimport {\n  type Analytics,\n  getAnalytics as getAnalyticsInstance,\n  initializeAnalytics as initializeAnalyticsInstance,\n} from 'firebase/analytics'\nimport { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check'\nimport { analyticsMayEmit } from '@aglyn/aglyn/app-utils/analytics-environment'\nimport { pushPlatformConsentDefault } from '@aglyn/aglyn/app-utils/platform-consent-default'\nimport { VISITOR_CONSENT_CHANGED_EVENT } from '@aglyn/aglyn/app-utils/visitor-consent'\nimport {\n  type Auth,\n  connectAuthEmulator,\n  onIdTokenChanged,\n  type User,\n} from 'firebase/auth'\nimport {\n  type Firestore,\n  connectFirestoreEmulator,\n  getFirestore,\n  initializeFirestore,\n} from 'firebase/firestore'\nimport {\n  type RemoteConfig,\n  getRemoteConfig as getRemoteConfigInstance,\n} from 'firebase/remote-config'\nimport {\n  createContext,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react'\nimport {\n  FIREBASE_AUTH_EMULATOR_ENABLED,\n  FIREBASE_FIRESTORE_EMULATOR_ENABLED,\n} from '@aglyn/shared-data-enums'\nimport {\n  APP_CHECK_KEY_MISSING_MESSAGE,\n  appCheckSiteKey,\n} from '../../constants/firebase-config'\nimport {\n  authEmulatorUrl,\n  firestoreEmulatorHost,\n} from '../../constants/firebase-emulator-hosts'\nimport {\n  type AuthPersistenceClass,\n  createAuthInstance,\n} from './auth-persistence'\nimport {\n  firestoreCacheClassFor,\n  localCacheFor,\n  pruneSharedClientStateFor,\n} from './firestore-cache'\nimport { markMultiTabFirestore } from './firestore-multitab-wedge'\nimport { firestorePersistencePrefix } from './firestore-shared-client-state'\nimport { startFirestoreTabHandoff } from './firestore-tab-handoff'\n\n/**\n * Drop-in replacement for reactfire's `ObservableStatus<T>` — reactfire is\n * unmaintained against firebase majors past v9, but its shape is preserved\n * here so `helpers/use-doc.ts`'s already-battle-tested onSnapshot+retry\n * implementation (AGL-216/223) didn't need to change.\n */\nexport interface ObservableStatus<T> {\n  status: 'loading' | 'error' | 'success'\n  hasEmitted: boolean\n  isComplete: boolean\n  data: T\n  error: Error | undefined\n  firstValuePromise: Promise<void>\n  /**\n   * The emitted `data` includes local writes the server has NOT\n   * acknowledged (`snapshot.metadata.hasPendingWrites`).\n   *\n   * Carried rather than dropped because a caller cannot otherwise tell \"the\n   * store holds this\" from \"my browser holds this\". `persistentLocalCache`\n   * replays a queued write into the very first snapshot after a reload, so a\n   * caller that treats every snapshot as authoritative will adopt its own\n   * unacknowledged edit as the saved state — which is how the besigner ended\n   * up unable to save real changes (AGL-1262).\n   */\n  hasPendingWrites: boolean\n  /**\n   * The emitted `data` came from the local cache and the server has NOT\n   * confirmed it (`snapshot.metadata.fromCache`).\n   *\n   * Carried because it is the only per-listener ground truth about\n   * freshness the SDK offers, and the console needs it (AGL-1066). Under\n   * `persistentLocalCache` a listener whose server listen is being REFUSED\n   * still emits cached snapshots and still reports `status: 'success'` —\n   * the retry budget is reset by each cached emission and never spends, so\n   * `status` can never reveal the fault (see\n   * `use-firestore-collection-cached-retry.spec.ts`).\n   *\n   * Prefer this over `session-health`'s `staleSession` for anything that\n   * asks \"is what I am looking at live?\". `staleSession` is a heuristic\n   * needing two denied collections inside a window, and it is unreachable\n   * on listener-only pages; this is a fact about THIS listener, costs\n   * nothing, and clears itself the instant a server snapshot lands.\n   */\n  fromCache: boolean\n  /**\n   * The server has REFUSED this listen for longer than the retry budget, and\n   * no server snapshot has arrived since (AGL-1066).\n   *\n   * `fromCache` says \"unconfirmed\", which is also true offline and true for\n   * the first snapshot of a perfectly healthy load. This says \"refused\" —\n   * only `permission-denied` counts it, and it takes a whole budget's worth\n   * in a row, so it cannot fire offline and cannot fire on the AGL-216/217\n   * post-sign-in token race.\n   *\n   * It is what `status` would say if the retry budget were spendable. It is\n   * carried separately because correcting `status` in place would blank\n   * every surface that renders cached data through an `error` branch — see\n   * the note on `attempt = 0` in `use-firestore-collection`.\n   */\n  serverDenied: boolean\n}\n\n/** Replaces reactfire's `ReactFireOptions<T>` — drops the `suspense` field, which was never read. */\nexport interface FirestoreDocOptions<T> {\n  idField?: string\n  initialData?: T\n}\n\n/**\n * The Firebase products this provider builds, and therefore the ones every\n * page that renders it downloads.\n *\n * ⛔ NO Realtime Database and NO Cloud Storage (AGL-2706). Both were built\n * here and published as `useDatabase()` / `useStorage()`, and neither hook had\n * a single caller anywhere in the repo — so `@firebase/database` (125.9 KB\n * raw) and `@firebase/storage` (13.9 KB) were in the first load of every\n * console route to satisfy a context field nothing read.\n *\n * Realtime Database IS used, by `apps/console/hooks/use-presence.ts` and\n * `use-coediting.ts` — on their own Firebase app, with their own\n * `getDatabase`, behind the editor routes that need presence. That is the\n * shape to copy if a surface needs one of these: reach for the product where\n * the feature is, not in the provider every page mounts. A field here is paid\n * for by every route, used or not.\n */\ninterface FirebaseServices {\n  app: FirebaseApp\n  firestore: Firestore\n  auth: Auth\n  analytics: Analytics\n  remoteConfig: RemoteConfig\n  /**\n   * The persistence class `auth` was actually created with (AGL-1379).\n   *\n   * Published so a **second** auth instance derives its class from the\n   * primary rather than re-deciding it. `apps/console/hooks/use-presence.ts`\n   * builds its own Firebase app and its own `Auth`; before this it took the\n   * SDK default unconditionally, so configuring only the provider would have\n   * left presence persisting a refresh token on an origin the provider had\n   * just been careful not to persist one on.\n   */\n  authPersistence: AuthPersistenceClass\n}\n\nconst FirebaseServicesContext = createContext<FirebaseServices | undefined>(undefined)\n\n// Module-scope guards so HMR / remounts don't re-run emulator connection\n// (which throws if called twice) or double-initialize Firestore's\n// persistent cache.\n//\n// Firestore's is keyed by app NAME, not a bare boolean (AGL-1456): Firestore\n// initialization is once-per-app, so a module-global flag made the FIRST app\n// to mount decide for every later one — a second app would silently skip\n// `initializeFirestore` and take SDK defaults. That mattered the moment the\n// cache stopped being the same on every host.\nconst firestoreInitialized = new Set<string>()\nlet connectedAuth = false\n\n/**\n * True when THIS Chrome instance is under WebDriver automation control\n * (Puppeteer, Playwright, Selenium, or a raw CDP client) — never true for a\n * person's own browser.\n *\n * The `initializeFirestore` call below already documents the fault this\n * exists for: \"the emulator's WebChannel streaming misbehaves in automated\n * Chrome — listeners serve the initial empty from-cache snapshot and the\n * server sync never arrives\" (AGL-217). That mitigation only reaches\n * `FIREBASE_FIRESTORE_EMULATOR_ENABLED`, so an automated session against a\n * REAL, deployed backend — a browser-automation agent driving a live\n * console, which is exactly what `navigator.webdriver` detects — stayed\n * exposed. `getDocs`/`getDoc` and `onSnapshot` all resolve over the same\n * Watch stream internally, so a one-shot read wedges exactly like a listener\n * does: no error, nothing to catch, `loading` simply never gets its\n * settling event. That is the Media Library grid spinning on \"Loading\n * media…\" indefinitely with a perfectly healthy account and a perfectly\n * healthy network.\n *\n * `undefined` during SSR reads as `false` — `navigator` does not exist in\n * Node, and a server render can only ever produce the auto-detected\n * transport, never the forced one.\n */\nconst isAutomatedChromeSession = (): boolean =>\n  typeof navigator !== 'undefined' && navigator.webdriver === true\n\n/**\n * The console tag's gtag config — ONE object, at module scope, deliberately\n * (AGL-1979).\n *\n * `initializeAnalytics(app, options)` throws `already-initialized` unless the\n * options `deepEqual` the ones the instance was first created with, and the\n * provider re-enters this block on every mount, every StrictMode double\n * invoke and every Fast Refresh. A fresh object literal per call survives\n * that only by *value*; a shared constant survives it by *identity*, which is\n * the first branch of the SDK's own comparison and cannot drift when someone\n * edits one call site and not another.\n *\n * ⚠️ The SDK MUTATES this object: `_initializeAnalytics` reads `options.config`\n * and writes `origin`, `update` and the installation id onto it in place.\n * That is precisely why sharing it is safe rather than dangerous — the object\n * the provider holds and the object the SDK stored are the same one, so they\n * cannot disagree.\n */\nconst CONSOLE_ANALYTICS_OPTIONS = {\n  config: { send_page_view: false, content_group: 'console' },\n}\n\n/**\n * A surface's answer to \"may an analytics tag exist for this visitor at all?\".\n *\n * Registered from the app, at module scope, in the same shape as\n * `setFirestoreSessionReporters` and `setStaleSessionCheck` — and for a\n * sharper version of the same reason. This is consulted during the provider's\n * FIRST render, before any effect anywhere has run, so a gate installed from\n * an effect would arrive after the decision it exists to make.\n *\n * Answering `false` means the SDK is never asked to initialize: `gtag.js` is\n * never fetched, `window.gtag` never comes into existence, and the shared\n * `deliver()` in `analytics-events.ts` — whose fallback IS `window.gtag` —\n * therefore has nowhere to put a hit. That is the difference between a gate\n * and a suppression, and it is the difference AGL-1608 paid for: a resident\n * tag reports on its own, through enhanced measurement, whatever any flag\n * says afterwards.\n */\nexport type AnalyticsConsentGate = () => boolean\n\nlet analyticsConsentGate: AnalyticsConsentGate | null = null\n\n/**\n * Install the consent gate for this document, or clear it with `null`.\n *\n * UNREGISTERED MEANS ALLOWED, which is deliberate and is the only default that\n * is safe here. The tenant runtime does not use this provider's analytics\n * branch at all (it builds its own tag in `site-analytics.tsx`, behind the\n * AGL-1498 gate), and a self-hosted console points at the operator's own GA\n * property — silencing an operator's analytics because Aglyn's own surface\n * grew a gate is a failure they cannot diagnose. The surface that needs the\n * gate is the one that registers it.\n */\nexport function setAnalyticsConsentGate(\n  gate: AnalyticsConsentGate | null,\n): void {\n  analyticsConsentGate = gate\n}\n\n/** The gate's verdict, with an unregistered gate reading as \"allowed\". */\nfunction analyticsConsentAllows(): boolean {\n  if (analyticsConsentGate === null) return true\n  try {\n    return analyticsConsentGate() === true\n  } catch {\n    // A gate that throws cannot be read as consent. Storage can throw in\n    // private mode, and \"we could not tell\" is the one state this whole\n    // mechanism resolves to \"no\".\n    return false\n  }\n}\n\n/**\n * The Analytics instance per Firebase app, so a re-boot after a consent change\n * hands back the tag that is already resident rather than asking the SDK for a\n * second one.\n *\n * `initializeAnalytics` is idempotent while the options match, so this is not\n * what makes re-entry safe — `CONSOLE_ANALYTICS_OPTIONS` being a shared\n * constant is. What this avoids is the noisy path: once anything has\n * initialized the provider with different options, every later call throws and\n * is logged, and a withdrawal followed by a re-grant would log it again.\n */\nconst analyticsByApp = new WeakMap<FirebaseApp, Analytics>()\n\n/**\n * Boot the console's Analytics tag, or return the one already booted.\n *\n * Extracted from the provider body so that \"when is the tag created\" and \"may\n * it be created\" are separable: the consent gate can defer this call to a\n * later render without the ordering below moving.\n */\nfunction bootAnalytics(app: FirebaseApp): Analytics | undefined {\n  const existing = analyticsByApp.get(app)\n  if (existing) return existing\n  let analytics: Analytics\n  // The region-conditional consent default (AGL-1597), declared BEFORE the\n  // SDK boots the tag. Ordering is the whole of it: a `default` read after\n  // `config` is not a default, and the SDK issues `config` inside\n  // `initializeAnalytics` on the next line. Pushing onto `dataLayer` here\n  // works even though gtag.js is not loaded yet — the queue is what makes the\n  // ordering expressible.\n  //\n  // Still declared even though the gate above has already said yes, and the\n  // two are not redundant. The gate answers \"may a tag exist\"; the default\n  // answers \"what may the tag that does exist do\", per region, from its very\n  // first hit. Ad storage stays denied everywhere on this surface.\n  pushPlatformConsentDefault(\n    typeof window === 'undefined' ? null : (window as never),\n  )\n  try {\n    analytics = initializeAnalyticsInstance(app, CONSOLE_ANALYTICS_OPTIONS)\n  } catch (error) {\n    console.error(error)\n    try {\n      // Already initialized by someone else, with someone else's options:\n      // take THAT instance rather than leaving consumers with nothing. The\n      // tag it is attached to was configured without `send_page_view: false`\n      // and without `content_group`, so this session reports a duplicate\n      // startup page_view and an unstamped surface — degraded, and loudly so,\n      // instead of silently dead.\n      analytics = getAnalyticsInstance(app)\n    } catch (fallbackError) {\n      console.error(fallbackError)\n    }\n  }\n  if (analytics) analyticsByApp.set(app, analytics)\n  return analytics\n}\n\n/**\n * The tag this document may have right now: none outside a real production\n * deployment, none while consent is absent, otherwise the booted instance.\n */\nfunction analyticsForConsentState(app: FirebaseApp): Analytics | undefined {\n  if (!analyticsMayEmit()) return undefined\n  if (!analyticsConsentAllows()) return undefined\n  return bootAnalytics(app)\n}\n\nexport interface FirebaseServicesProviderProps {\n  firebaseConfig: FirebaseOptions\n  appName: string\n  /**\n   * How much of *anything* this origin may keep on disk. Defaults to\n   * `durable`, which is what every host serving this provider today is:\n   * `*.aglyn.com` and `*.aglyn.app`, whose DNS we own and whose 14-day\n   * session is the product.\n   *\n   * A **custom console domain** (AGL-1099c) must pass `ephemeral`. That is\n   * the whole reason this is a prop rather than a constant: the class differs\n   * per origin, not per build, and the decision belongs to whoever knows\n   * which origin is being served.\n   *\n   * **It governs two things, and the name only names one.** It selects the\n   * `Auth` persistence class (AGL-1379) *and* the Firestore `localCache`\n   * (AGL-1456) — because both answer the same question about the same origin,\n   * and splitting them into two props is precisely how the cache came to be\n   * unconditional while the credential was hardened. See `firestore-cache.ts`.\n   */\n  authPersistence?: AuthPersistenceClass\n  children?: ReactNode\n}\n\n/** The services every surface boots, before the per-document analytics verdict. */\ninterface FirebaseCoreServices {\n  app: FirebaseApp\n  firestore: Firestore\n  auth: Auth\n  remoteConfig: RemoteConfig\n}\n\n/**\n * Create (or adopt) the app, Auth, Firestore, App Check and Remote Config for\n * one Firebase app: everything the provider used to build in its first render\n * except Analytics, whose consent verdict belongs to the render that reads it.\n */\nfunction bootFirebaseCore(\n  firebaseConfig: FirebaseOptions,\n  appName: string,\n  authPersistence: AuthPersistenceClass,\n): FirebaseCoreServices {\n  const app =\n    getApps().find((existing) => existing.name === appName) ??\n    initializeApp(firebaseConfig, appName)\n  // `durable` resolves to the same `getAuth(app)` this always called.\n  const auth = createAuthInstance(app, authPersistence)\n\n  // The origin's class, unless this tab fell back to the memory cache\n  // because another tab locked the shared one (AGL-3428). Firestore only:\n  // `auth` above keeps the origin's class.\n  const firestoreCacheClass = firestoreCacheClassFor(authPersistence)\n  if (!firestoreInitialized.has(appName)) {\n    try {\n      // Under the emulator (dev/e2e only): force long-polling and skip\n      // the persistent multi-tab cache. The emulator's WebChannel\n      // streaming misbehaves in automated Chrome — listeners serve the\n      // initial empty from-cache snapshot and the server sync never\n      // arrives, which looks like \"empty pages with zero errors\"\n      // (the AGL-217 mystery). Real traffic keeps the default transport\n      // and persistent cache — except a WebDriver-controlled Chrome\n      // against a real backend, which forces long-polling for the same\n      // reason without giving up the cache (see `isAutomatedChromeSession`\n      // below).\n      //\n      // ⚠️ CONSEQUENCE, and it will cost you hours if you do not know it\n      // (AGL-1066): every stale-session/stale-cache fault is UNREPRODUCIBLE\n      // locally through the app, because the cache that causes them is off\n      // in exactly the configuration you would reach for to reproduce one.\n      // A listener that keeps serving arbitrarily-old data while the server\n      // refuses it, a `noDocument` tombstone that 404s a live host, the\n      // retry budget that never spends because a cached emission resets it\n      // — none of them can happen here. Test that behaviour with the unit\n      // seams instead (`use-firestore-collection-cached-retry.spec.ts`\n      // drives cached emissions and denials directly), or against a\n      // deployed environment. Do NOT \"fix\" it by turning the cache on for\n      // the emulator: the AGL-217 empty-pages-with-zero-errors mystery is\n      // what that produces.\n      initializeFirestore(\n        app,\n        FIREBASE_FIRESTORE_EMULATOR_ENABLED\n          ? { experimentalForceLongPolling: true }\n          : {\n              // NOT unconditional (AGL-1456). `persistentLocalCache` writes\n              // document bodies to this origin's IndexedDB, so on a custom\n              // console domain it is the same exposure D6 removed from the\n              // refresh token — see `firestore-cache.ts` for why one\n              // declaration governs both.\n              localCache: localCacheFor(firestoreCacheClass),\n              // The real-backend half of the AGL-217 mitigation above: force\n              // long-polling for a WebDriver-controlled Chrome even when it\n              // is NOT talking to the emulator, because the WebChannel wedge\n              // is a property of automated Chrome, not of which backend it\n              // is automating against. Never true for a real visitor, so\n              // production traffic keeps the SDK's own auto-detected\n              // transport untouched.\n              ...(isAutomatedChromeSession()\n                ? { experimentalForceLongPolling: true }\n                : {}),\n            },\n      )\n      if (FIREBASE_FIRESTORE_EMULATOR_ENABLED) {\n        // Where the server was told the emulator is, rather than a default\n        // port another session's stack may hold (AGL-2834).\n        const emulator = firestoreEmulatorHost()\n        connectFirestoreEmulator(\n          getFirestore(app),\n          emulator.host,\n          emulator.port,\n        )\n      } else {\n        // The SDK never sweeps the multi-tab records the durable cache\n        // strands in localStorage, and a full localStorage fails the whole\n        // Firestore client — see `firestore-shared-client-state.ts`.\n        void pruneSharedClientStateFor(firestoreCacheClass, app)\n        // Only the durable multi-tab cache can be locked by another tab,\n        // so only it gets the lease check after a stalled recovery.\n        if (firestoreCacheClass === 'durable' && app.options?.projectId) {\n          const prefix = firestorePersistencePrefix(app.name, app.options.projectId)\n          markMultiTabFirestore(getFirestore(app), `${prefix}main`)\n          // A visible tab opened while a background tab holds the shared\n          // cache's lease takes the lease at boot instead of routing every\n          // query through the background tab until its lease lapses\n          // (AGL-3660). In initializeFirestore's task: its first step\n          // snapshots the other tabs before this tab's client can start.\n          void startFirestoreTabHandoff(getFirestore(app), prefix)\n        }\n      }\n    } catch {\n      // already initialized (e.g. HMR reset the module flag) — getFirestore() returns the existing instance\n    } finally {\n      firestoreInitialized.add(appName)\n    }\n  }\n  const firestore = getFirestore(app)\n\n  if (!connectedAuth) {\n    try {\n      if (FIREBASE_AUTH_EMULATOR_ENABLED) {\n        // The emulator the server was started with (AGL-2834).\n        connectAuthEmulator(auth, authEmulatorUrl())\n      }\n      connectedAuth = true\n    } catch (error) {\n      console.error(error)\n    }\n  }\n  // App Check must be skipped under the emulators: there is no App\n  // Check emulator, so ReCaptcha would hit the real backend and its\n  // 403s break emulator auth (the AGL-216 emulator sessions hit this).\n  if (\n    !FIREBASE_AUTH_EMULATOR_ENABLED &&\n    !FIREBASE_FIRESTORE_EMULATOR_ENABLED\n  ) {\n    // No site key means no provider (AGL-2049). Registering one built on\n    // `undefined` does not throw — it fails asynchronously inside the SDK,\n    // where the catch below cannot see it — so this has to be a pre-check.\n    const siteKey = appCheckSiteKey()\n    if (!siteKey) {\n      console.warn(APP_CHECK_KEY_MISSING_MESSAGE)\n    } else {\n      try {\n        initializeAppCheck(app, {\n          provider: new ReCaptchaV3Provider(siteKey),\n          isTokenAutoRefreshEnabled: true,\n        })\n      } catch (error) {\n        console.error(error)\n      }\n    }\n  }\n  // Remote Config (AGL-228): release-flag delivery. Browser-only like\n  // analytics; consumers set defaultConfig before their first getValue so\n  // gating never blocks on the network.\n  let remoteConfig: RemoteConfig\n  try {\n    remoteConfig = getRemoteConfigInstance(app)\n    remoteConfig.settings.minimumFetchIntervalMillis =\n      process.env.NODE_ENV === 'production' ? 3_600_000 : 60_000\n  } catch (error) {\n    console.error(error)\n  }\n\n  return { app, firestore, auth, remoteConfig }\n}\n\n/**\n * Services booted before React rendered anything, waiting for the provider to\n * adopt them (AGL-3660).\n *\n * The provider builds its services in its first render, and on the console\n * that render comes late: after every chunk of the route has executed, after\n * hydration, and after the `NoSsr` boundary above it has committed its\n * fallback and rendered again. Auth's persistence read and `accounts:lookup`,\n * and App Check's reCAPTCHA chain (script, script, iframe, token exchange),\n * which Auth AND Firestore requests both wait on whenever the cached App Check\n * token has expired, only started then. None of it depends on React, so a\n * surface that knows its config at module scope can start it there.\n *\n * Taken once, by the first provider that renders with the same app name and\n * persistence class; any later mount boots exactly as it always did. A\n * mismatched key is never adopted, so a preboot cannot hand a provider a\n * different persistence class than the one it was given.\n */\nconst prebooted = new Map<string, FirebaseCoreServices>()\nconst prebootKey = (appName: string, authPersistence: AuthPersistenceClass) =>\n  `${appName}|${authPersistence}`\n\n/**\n * Start Firebase for this document now rather than at the provider's first\n * render. Browser only, once per app name and persistence class, and it never\n * throws: a failure here leaves the provider to boot as it always did.\n *\n * The Analytics consent gate is NOT read here (the provider reads it), so the\n * gate's module-scope registration does not have to precede this call.\n */\nexport function prebootFirebaseServices(options: {\n  firebaseConfig: FirebaseOptions\n  appName: string\n  authPersistence?: AuthPersistenceClass\n}): void {\n  if (typeof window === 'undefined') return\n  const { firebaseConfig, appName, authPersistence = 'durable' } = options\n  const key = prebootKey(appName, authPersistence)\n  if (prebooted.has(key)) return\n  try {\n    prebooted.set(key, bootFirebaseCore(firebaseConfig, appName, authPersistence))\n  } catch (error) {\n    console.error(error)\n  }\n}\n\nfunction takePrebootedFirebaseCore(\n  appName: string,\n  authPersistence: AuthPersistenceClass,\n): FirebaseCoreServices | undefined {\n  const key = prebootKey(appName, authPersistence)\n  const core = prebooted.get(key)\n  if (core) prebooted.delete(key)\n  return core\n}\n\nexport function FirebaseServicesProvider(props: FirebaseServicesProviderProps) {\n  const { firebaseConfig, appName, authPersistence = 'durable', children } = props\n  const servicesRef = useRef<FirebaseServices | undefined>(undefined)\n\n  if (!servicesRef.current) {\n    const core =\n      takePrebootedFirebaseCore(appName, authPersistence) ??\n      bootFirebaseCore(firebaseConfig, appName, authPersistence)\n    // `initializeAnalytics`, not `getAnalytics`, for exactly one reason: it is\n    // the only form that can pass `config`, and `send_page_view: false` is the\n    // only way to stop the SDK's own startup `page_view` (AGL-1643).\n    //\n    // Booting Analytics issues `gtag('config', <id>, configProperties)`, and\n    // the vendored SDK's own comment on that line reads \"This will trigger a\n    // page_view event unless 'send_page_view' is set to false in\n    // configProperties\". `getAnalytics(app)` passes no config at all, so the\n    // key was never there and the hit always fired — on top of the manual\n    // `page_view` the console's layout sends on mount. Two hits, one page.\n    //\n    // The SDK's is the one suppressed rather than the layout's, and the\n    // direction is the whole decision: the SDK fires ONCE per document load,\n    // while the layout fires on mount AND on every `usePathname` change. In a\n    // client-routed app the layout's is a superset — killing it instead would\n    // have left every in-app navigation unreported, halving console pageviews\n    // rather than correcting them, and the reports would have looked fine.\n    //\n    // Nothing else about attribution moves: the surviving hit is sent from the\n    // same document at mount, so `document.referrer` — which gtag resolves for\n    // `page_referrer` itself, and which is what carries marketing traffic\n    // source into the session — is still the external referrer at that moment.\n    //\n    // Re-entry is safe *only* while the options match. `initializeAnalytics`\n    // returns the existing instance when they deep-equal the first call's and\n    // throws `already-initialized` otherwise — and the options can be made to\n    // differ by things no call site here controls (AGL-1979):\n    //\n    //   * anything that touches the analytics provider WITHOUT options first\n    //     initializes it with `{}`. `getAnalytics()` is the obvious one, but\n    //     `@firebase/remote-config` reaches the same code path on its own —\n    //     `addExperimentToAnalytics` calls `analyticsProvider.getImmediate({\n    //     optional: true })`, and `optional` only suppresses the throw, it\n    //     does not stop the initialization.\n    //   * in dev, a module instance carrying a PREVIOUS version of these\n    //     options (this config changed under AGL-1857) surviving a Fast\n    //     Refresh alongside the new one.\n    //\n    // Once that happens the conflict is permanent for the document: every\n    // later call throws, so without the fallback below `analytics` stayed\n    // undefined forever and the next consumer — `logEvent(analytics, …)` —\n    // read `.app` off it and threw a TypeError two frames away, which is how\n    // this surfaced (top Cloud Error Reporting group, and reproduced live on\n    // app.aglyn.com).\n    //\n    // `getAnalytics(app)` is the remedy the SDK's own error message names. It\n    // cannot cost us the config on a healthy document: it only runs after\n    // `initializeAnalytics` threw, and on a first init that throw can only be\n    // `no-app-id` / `no-api-key` / `already-exists`, none of which\n    // `getAnalytics` can rescue either — it re-throws and we fall through to\n    // an undefined instance, which every consumer must now tolerate.\n    // `content_group: 'console'` (AGL-1857) rides the same config: it is the\n    // first-class GA4 axis that separates console traffic from `marketing`\n    // (stamped by the tenant runtime on aglyn.com's own tag) and `docs`\n    // (stamped by the Docusaurus head snippet) in standard reports, without\n    // reaching for the Hostname dimension. The console is this provider's\n    // only consumer, verified by grep — the tenant runtime builds its tag in\n    // `site-analytics.tsx` and never passes through here.\n    //\n    // AND NOT AT ALL outside a real production deployment (AGL-2067). This\n    // provider used to boot Analytics unconditionally, while\n    // `apps/console/.env.development.local` points at the PRODUCTION\n    // measurement id — so every `next dev` session and every Vercel preview\n    // build produced genuine `session_start` / `first_visit` / `page_view`\n    // hits in the live property. Not a theory: the archived Marketing\n    // property's entire year-to-date history is 30 views / 6 users, ~24 of\n    // them `/signin` on preview urls (docs/ANALYTICS.md).\n    //\n    // Not initialized rather than initialized-and-suppressed, because a\n    // resident tag reports on its own — AGL-1608 is the same lesson from the\n    // consent side. `useAnalytics()` returning undefined is already a\n    // supported state everywhere (AGL-1979), which is what makes this a\n    // two-line gate instead of an audit.\n    //\n    // `analyticsMayEmit` leans LOUD on an unknown deployment: a self-hosted\n    // build points at the operator's own Firebase project and their own GA\n    // property, and silencing a customer's analytics to protect ours is the\n    // worse failure. See the module for the escape hatch.\n    //\n    // AND NOT while a registered consent gate says no (AGL-1498 posture,\n    // applied to Aglyn's own console). `analyticsForConsentState` is where\n    // both conditions and the boot itself now live, because the boot has to\n    // be repeatable: a visitor whose region has not resolved yet is undecided\n    // at this instant and may be granted a moment later, and a visitor who\n    // withdraws mid-session has to lose the instance without the page\n    // reloading. See the effect below.\n    //\n    // SCOPE. This is the console's tag and only the console's:\n    // `CONSOLE_ANALYTICS_OPTIONS`, `content_group: 'console'`, and this\n    // provider's analytics branch has no other consumer (the tenant runtime\n    // builds its tag in `site-analytics.tsx` and never passes through here).\n    // Customer sites keep the AGL-1498 gate and the host's own\n    // `consent.mode`; nothing here reaches them.\n    const initialAnalytics = analyticsForConsentState(core.app)\n\n    servicesRef.current = {\n      ...core,\n      analytics: initialAnalytics,\n      authPersistence,\n    }\n  }\n\n  const services = servicesRef.current\n\n  // The consent gate's other half: the verdict can CHANGE within one document,\n  // in both directions, and everything else in this provider is built exactly\n  // once by design.\n  //\n  // Deferred grant. A visitor with no stored record is undecided at the\n  // instant this provider first renders, because resolving them needs the\n  // region endpoint and that is a network call. Outside the prior-consent\n  // regions the answer is implied consent, and it lands a few hundred\n  // milliseconds later — same document, so `document.referrer` is still the\n  // external referrer and the pageview's attribution is unaffected. Without\n  // this, \"the gate is synchronous\" would have quietly meant \"the rest of the\n  // world is never measured on a first visit\".\n  //\n  // Withdrawal. Dropping the instance unmounts every binding hung off it,\n  // which is what unregisters the analytics transport — after that\n  // `deliver()` falls through to `window.gtag`, and the shared consent writer\n  // has already set `ga-disable-<id>` and sent a denied `consent update` on\n  // that exact tag (AGL-1608). The resident tag cannot be unloaded; it can be\n  // made to send nothing, and both halves are needed because either alone\n  // leaks — enhanced measurement fires with no call site at all.\n  const [analytics, setAnalytics] = useState<Analytics | undefined>(\n    () => services.analytics,\n  )\n  useEffect(() => {\n    const sync = () => setAnalytics(analyticsForConsentState(services.app))\n    // Once on mount as well as on the event: the priming pass can resolve a\n    // visitor between this provider's render and this effect, and the event it\n    // dispatched then had no listener yet.\n    sync()\n    window.addEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n    return () =>\n      window.removeEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n  }, [services])\n\n  // Identity changes only when the tag comes or goes, so a consent-stable\n  // document re-renders nothing.\n  const value = useMemo(\n    () =>\n      services.analytics === analytics ? services : { ...services, analytics },\n    [services, analytics],\n  )\n\n  return (\n    <FirebaseServicesContext.Provider value={value}>\n      {children}\n    </FirebaseServicesContext.Provider>\n  )\n}\nFirebaseServicesProvider.displayName = 'FirebaseServicesProvider'\n\nfunction useFirebaseServices(): FirebaseServices {\n  const services = useContext(FirebaseServicesContext)\n  if (!services) {\n    throw new Error(\n      'Firebase hooks must be used within a <FirebaseServicesProvider>',\n    )\n  }\n  return services\n}\n\nexport function useFirebaseApp(): FirebaseApp {\n  return useFirebaseServices().app\n}\nexport function useFirestore(): Firestore {\n  return useFirebaseServices().firestore\n}\nexport function useAuth(): Auth {\n  return useFirebaseServices().auth\n}\n/**\n * The persistence class the provider's `Auth` was created with (AGL-1379).\n *\n * Read it — never re-derive it — when building a **second** Firebase app on\n * the same origin, so the second instance cannot end up more persistent than\n * the first. `apps/console/hooks/use-presence.ts` is the existing case.\n */\nexport function useAuthPersistence(): AuthPersistenceClass {\n  return useFirebaseServices().authPersistence\n}\nexport function useAnalytics(): Analytics {\n  return useFirebaseServices().analytics\n}\nexport function useRemoteConfig(): RemoteConfig {\n  return useFirebaseServices().remoteConfig\n}\n\n/**\n * Replaces reactfire's `useUser()`. Reactfire subscribes via\n * `onIdTokenChanged` rather than `onAuthStateChanged` so fields like\n * `emailVerified` stay live across token refresh (e.g. after\n * `user.reload()` post-email-verification), not just sign-in/out — matched\n * here for behavioral parity.\n *\n * THREE states, not two (AGL-1261): `undefined` = auth has not resolved yet,\n * `null` = resolved, signed OUT, a `User` = resolved, signed in. This used to\n * collapse the emitted `null` into `undefined`, which made \"signed out\" and\n * \"still loading\" the same value — a state that, for a signed-out visitor,\n * never left \"loading\". `useSessionCookie` gates its whole body on\n * `user === undefined`, so its silent restore from the shared `__session`\n * cookie could never run: the cookie exchange returned a valid custom token\n * and nothing ever asked for it.\n */\nexport function useUser(): { data: User | null | undefined } {\n  const auth = useAuth()\n  const [user, setUser] = useState<User | null | undefined>(\n    auth.currentUser ?? undefined,\n  )\n\n  useEffect(() => {\n    return onIdTokenChanged(auth, (nextUser) => {\n      // `?? null`, never `?? undefined` — see the note above.\n      setUser(nextUser ?? null)\n    })\n  }, [auth])\n\n  return { data: user }\n}\n\nexport interface SigninCheckResult {\n  signedIn: boolean\n  user: User | null\n}\n\n/** Replaces reactfire's `useSigninCheck()` — same `onIdTokenChanged` basis as `useUser()`. */\nexport function useSigninCheck(): {\n  status: 'loading' | 'success' | 'error'\n  data: SigninCheckResult | undefined\n  error: Error | undefined\n} {\n  const auth = useAuth()\n  const [status, setStatus] = useState<'loading' | 'success' | 'error'>('loading')\n  const [data, setData] = useState<SigninCheckResult | undefined>(undefined)\n  const [error, setError] = useState<Error | undefined>(undefined)\n\n  useEffect(() => {\n    return onIdTokenChanged(\n      auth,\n      (user) => {\n        setStatus('success')\n        setError(undefined)\n        setData({ signedIn: !!user, user: user ?? null })\n      },\n      (err) => {\n        setStatus('error')\n        setError(err)\n      },\n    )\n  }, [auth])\n\n  return { status, data, error }\n}\n"],"names":["getApps","initializeApp","getAnalytics","getAnalyticsInstance","initializeAnalytics","initializeAnalyticsInstance","initializeAppCheck","ReCaptchaV3Provider","analyticsMayEmit","pushPlatformConsentDefault","VISITOR_CONSENT_CHANGED_EVENT","connectAuthEmulator","onIdTokenChanged","connectFirestoreEmulator","getFirestore","initializeFirestore","getRemoteConfig","getRemoteConfigInstance","createContext","useContext","useEffect","useMemo","useRef","useState","FIREBASE_AUTH_EMULATOR_ENABLED","FIREBASE_FIRESTORE_EMULATOR_ENABLED","APP_CHECK_KEY_MISSING_MESSAGE","appCheckSiteKey","authEmulatorUrl","firestoreEmulatorHost","createAuthInstance","firestoreCacheClassFor","localCacheFor","pruneSharedClientStateFor","markMultiTabFirestore","firestorePersistencePrefix","startFirestoreTabHandoff","FirebaseServicesContext","undefined","firestoreInitialized","Set","connectedAuth","isAutomatedChromeSession","navigator","webdriver","CONSOLE_ANALYTICS_OPTIONS","config","send_page_view","content_group","analyticsConsentGate","setAnalyticsConsentGate","gate","analyticsConsentAllows","analyticsByApp","WeakMap","bootAnalytics","app","existing","get","analytics","window","error","console","fallbackError","set","analyticsForConsentState","bootFirebaseCore","firebaseConfig","appName","authPersistence","find","name","auth","firestoreCacheClass","has","experimentalForceLongPolling","localCache","emulator","host","port","options","projectId","prefix","add","firestore","siteKey","warn","provider","isTokenAutoRefreshEnabled","remoteConfig","settings","minimumFetchIntervalMillis","process","env","NODE_ENV","prebooted","Map","prebootKey","prebootFirebaseServices","key","takePrebootedFirebaseCore","core","delete","FirebaseServicesProvider","props","children","servicesRef","current","initialAnalytics","services","setAnalytics","sync","addEventListener","removeEventListener","value","Provider","displayName","useFirebaseServices","Error","useFirebaseApp","useFirestore","useAuth","useAuthPersistence","useAnalytics","useRemoteConfig","useUser","user","setUser","currentUser","nextUser","data","useSigninCheck","status","setStatus","setData","setError","signedIn","err"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA,SAGEA,OAAO,EACPC,aAAa,QACR,eAAc;AACrB,SAEEC,gBAAgBC,oBAAoB,EACpCC,uBAAuBC,2BAA2B,QAC7C,qBAAoB;AAC3B,SAASC,kBAAkB,EAAEC,mBAAmB,QAAQ,qBAAoB;AAC5E,SAASC,gBAAgB,QAAQ,+CAA8C;AAC/E,SAASC,0BAA0B,QAAQ,kDAAiD;AAC5F,SAASC,6BAA6B,QAAQ,yCAAwC;AACtF,SAEEC,mBAAmB,EACnBC,gBAAgB,QAEX,gBAAe;AACtB,SAEEC,wBAAwB,EACxBC,YAAY,EACZC,mBAAmB,QACd,qBAAoB;AAC3B,SAEEC,mBAAmBC,uBAAuB,QACrC,yBAAwB;AAC/B,SACEC,aAAa,EACbC,UAAU,EACVC,SAAS,EACTC,OAAO,EACPC,MAAM,EACNC,QAAQ,QAEH,QAAO;AACd,SACEC,8BAA8B,EAC9BC,mCAAmC,QAC9B,2BAA0B;AACjC,SACEC,6BAA6B,EAC7BC,eAAe,QACV,qCAAiC;AACxC,SACEC,eAAe,EACfC,qBAAqB,QAChB,6CAAyC;AAChD,SAEEC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,sBAAsB,EACtBC,aAAa,EACbC,yBAAyB,QACpB,uBAAmB;AAC1B,SAASC,qBAAqB,QAAQ,gCAA4B;AAClE,SAASC,0BAA0B,QAAQ,qCAAiC;AAC5E,SAASC,wBAAwB,QAAQ,6BAAyB;AA0GlE,MAAMC,wCAA0BnB,cAA4CoB;AAE5E,yEAAyE;AACzE,kEAAkE;AAClE,oBAAoB;AACpB,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAMC,uBAAuB,IAAIC;AACjC,IAAIC,gBAAgB;AAEpB;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,MAAMC,2BAA2B,IAC/B,OAAOC,cAAc,eAAeA,UAAUC,SAAS,KAAK;AAE9D;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMC,4BAA4B;IAChCC,QAAQ;QAAEC,gBAAgB;QAAOC,eAAe;IAAU;AAC5D;AAqBA,IAAIC,uBAAoD;AAExD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,wBACdC,IAAiC;IAEjCF,uBAAuBE;AACzB;AAEA,wEAAwE,GACxE,SAASC;IACP,IAAIH,yBAAyB,MAAM,OAAO;IAC1C,IAAI;QACF,OAAOA,2BAA2B;IACpC,EAAE,eAAM;QACN,qEAAqE;QACrE,oEAAoE;QACpE,8BAA8B;QAC9B,OAAO;IACT;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,iBAAiB,IAAIC;AAE3B;;;;;;CAMC,GACD,SAASC,cAAcC,GAAgB;IACrC,MAAMC,WAAWJ,eAAeK,GAAG,CAACF;IACpC,IAAIC,UAAU,OAAOA;IACrB,IAAIE;IACJ,yEAAyE;IACzE,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,wBAAwB;IACxB,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjElD,2BACE,OAAOmD,WAAW,cAAc,OAAQA;IAE1C,IAAI;QACFD,YAAYtD,4BAA4BmD,KAAKX;IAC/C,EAAE,OAAOgB,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,IAAI;YACF,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,4BAA4B;YAC5BF,YAAYxD,qBAAqBqD;QACnC,EAAE,OAAOO,eAAe;YACtBD,QAAQD,KAAK,CAACE;QAChB;IACF;IACA,IAAIJ,WAAWN,eAAeW,GAAG,CAACR,KAAKG;IACvC,OAAOA;AACT;AAEA;;;CAGC,GACD,SAASM,yBAAyBT,GAAgB;IAChD,IAAI,CAAChD,oBAAoB,OAAO8B;IAChC,IAAI,CAACc,0BAA0B,OAAOd;IACtC,OAAOiB,cAAcC;AACvB;AAkCA;;;;CAIC,GACD,SAASU,iBACPC,cAA+B,EAC/BC,OAAe,EACfC,eAAqC;QAGnCrE;IADF,MAAMwD,OACJxD,gBAAAA,UAAUsE,IAAI,CAAC,CAACb,WAAaA,SAASc,IAAI,KAAKH,oBAA/CpE,gBACAC,cAAckE,gBAAgBC;IAChC,oEAAoE;IACpE,MAAMI,OAAO1C,mBAAmB0B,KAAKa;IAErC,oEAAoE;IACpE,wEAAwE;IACxE,yCAAyC;IACzC,MAAMI,sBAAsB1C,uBAAuBsC;IACnD,IAAI,CAAC9B,qBAAqBmC,GAAG,CAACN,UAAU;QACtC,IAAI;YACF,iEAAiE;YACjE,4DAA4D;YAC5D,iEAAiE;YACjE,8DAA8D;YAC9D,2DAA2D;YAC3D,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,qEAAqE;YACrE,UAAU;YACV,EAAE;YACF,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,8DAA8D;YAC9D,oEAAoE;YACpE,oEAAoE;YACpE,sBAAsB;YACtBrD,oBACEyC,KACA/B,sCACI;gBAAEkD,8BAA8B;YAAK,IACrC;gBACE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,6DAA6D;gBAC7D,uDAAuD;gBACvD,4BAA4B;gBAC5BC,YAAY5C,cAAcyC;eAQtB/B,6BACA;gBAAEiC,8BAA8B;YAAK,IACrC,CAAC;YAGb,IAAIlD,qCAAqC;gBACvC,mEAAmE;gBACnE,oDAAoD;gBACpD,MAAMoD,WAAWhD;gBACjBhB,yBACEC,aAAa0C,MACbqB,SAASC,IAAI,EACbD,SAASE,IAAI;YAEjB,OAAO;oBAOoCvB;gBANzC,+DAA+D;gBAC/D,mEAAmE;gBACnE,6DAA6D;gBAC7D,KAAKvB,0BAA0BwC,qBAAqBjB;gBACpD,iEAAiE;gBACjE,4DAA4D;gBAC5D,IAAIiB,wBAAwB,eAAajB,eAAAA,IAAIwB,OAAO,qBAAXxB,aAAayB,SAAS,GAAE;oBAC/D,MAAMC,SAAS/C,2BAA2BqB,IAAIe,IAAI,EAAEf,IAAIwB,OAAO,CAACC,SAAS;oBACzE/C,sBAAsBpB,aAAa0C,MAAM,GAAG0B,OAAO,IAAI,CAAC;oBACxD,+DAA+D;oBAC/D,iEAAiE;oBACjE,0DAA0D;oBAC1D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,KAAK9C,yBAAyBtB,aAAa0C,MAAM0B;gBACnD;YACF;QACF,EAAE,eAAM;QACN,sGAAsG;QACxG,SAAU;YACR3C,qBAAqB4C,GAAG,CAACf;QAC3B;IACF;IACA,MAAMgB,YAAYtE,aAAa0C;IAE/B,IAAI,CAACf,eAAe;QAClB,IAAI;YACF,IAAIjB,gCAAgC;gBAClC,uDAAuD;gBACvDb,oBAAoB6D,MAAM5C;YAC5B;YACAa,gBAAgB;QAClB,EAAE,OAAOoB,OAAO;YACdC,QAAQD,KAAK,CAACA;QAChB;IACF;IACA,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,IACE,CAACrC,kCACD,CAACC,qCACD;QACA,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM4D,UAAU1D;QAChB,IAAI,CAAC0D,SAAS;YACZvB,QAAQwB,IAAI,CAAC5D;QACf,OAAO;YACL,IAAI;gBACFpB,mBAAmBkD,KAAK;oBACtB+B,UAAU,IAAIhF,oBAAoB8E;oBAClCG,2BAA2B;gBAC7B;YACF,EAAE,OAAO3B,OAAO;gBACdC,QAAQD,KAAK,CAACA;YAChB;QACF;IACF;IACA,oEAAoE;IACpE,wEAAwE;IACxE,sCAAsC;IACtC,IAAI4B;IACJ,IAAI;QACFA,eAAexE,wBAAwBuC;QACvCiC,aAAaC,QAAQ,CAACC,0BAA0B,GAC9CC,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe,UAAY;IACxD,EAAE,OAAOjC,OAAO;QACdC,QAAQD,KAAK,CAACA;IAChB;IAEA,OAAO;QAAEL;QAAK4B;QAAWZ;QAAMiB;IAAa;AAC9C;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMM,YAAY,IAAIC;AACtB,MAAMC,aAAa,CAAC7B,SAAiBC,kBACnC,GAAGD,QAAQ,CAAC,EAAEC,iBAAiB;AAEjC;;;;;;;CAOC,GACD,OAAO,SAAS6B,wBAAwBlB,OAIvC;IACC,IAAI,OAAOpB,WAAW,aAAa;IACnC,MAAM,EAAEO,cAAc,EAAEC,OAAO,EAAEC,kBAAkB,SAAS,EAAE,GAAGW;IACjE,MAAMmB,MAAMF,WAAW7B,SAASC;IAChC,IAAI0B,UAAUrB,GAAG,CAACyB,MAAM;IACxB,IAAI;QACFJ,UAAU/B,GAAG,CAACmC,KAAKjC,iBAAiBC,gBAAgBC,SAASC;IAC/D,EAAE,OAAOR,OAAO;QACdC,QAAQD,KAAK,CAACA;IAChB;AACF;AAEA,SAASuC,0BACPhC,OAAe,EACfC,eAAqC;IAErC,MAAM8B,MAAMF,WAAW7B,SAASC;IAChC,MAAMgC,OAAON,UAAUrC,GAAG,CAACyC;IAC3B,IAAIE,MAAMN,UAAUO,MAAM,CAACH;IAC3B,OAAOE;AACT;AAEA,OAAO,SAASE,yBAAyBC,KAAoC;IAC3E,MAAM,EAAErC,cAAc,EAAEC,OAAO,EAAEC,kBAAkB,SAAS,EAAEoC,QAAQ,EAAE,GAAGD;IAC3E,MAAME,cAAcpF,OAAqCgB;IAEzD,IAAI,CAACoE,YAAYC,OAAO,EAAE;YAEtBP;QADF,MAAMC,QACJD,6BAAAA,0BAA0BhC,SAASC,4BAAnC+B,6BACAlC,iBAAiBC,gBAAgBC,SAASC;QAC5C,2EAA2E;QAC3E,2EAA2E;QAC3E,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wCAAwC;QACxC,qEAAqE;QACrE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,kBAAkB;QAClB,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,yEAAyE;QACzE,iEAAiE;QACjE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,EAAE;QACF,uEAAuE;QACvE,yDAAyD;QACzD,iEAAiE;QACjE,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,mCAAmC;QACnC,EAAE;QACF,2DAA2D;QAC3D,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAMuC,mBAAmB3C,yBAAyBoC,KAAK7C,GAAG;QAE1DkD,YAAYC,OAAO,GAAG,aACjBN;YACH1C,WAAWiD;YACXvC;;IAEJ;IAEA,MAAMwC,WAAWH,YAAYC,OAAO;IAEpC,6EAA6E;IAC7E,4EAA4E;IAC5E,kBAAkB;IAClB,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,wEAAwE;IACxE,iEAAiE;IACjE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,CAAChD,WAAWmD,aAAa,GAAGvF,SAChC,IAAMsF,SAASlD,SAAS;IAE1BvC,UAAU;QACR,MAAM2F,OAAO,IAAMD,aAAa7C,yBAAyB4C,SAASrD,GAAG;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,uCAAuC;QACvCuD;QACAnD,OAAOoD,gBAAgB,CAACtG,+BAA+BqG;QACvD,OAAO,IACLnD,OAAOqD,mBAAmB,CAACvG,+BAA+BqG;IAC9D,GAAG;QAACF;KAAS;IAEb,wEAAwE;IACxE,+BAA+B;IAC/B,MAAMK,QAAQ7F,QACZ,IACEwF,SAASlD,SAAS,KAAKA,YAAYkD,WAAW,aAAKA;YAAUlD;YAC/D;QAACkD;QAAUlD;KAAU;IAGvB,qBACE,KAACtB,wBAAwB8E,QAAQ;QAACD,OAAOA;kBACtCT;;AAGP;AACAF,yBAAyBa,WAAW,GAAG;AAEvC,SAASC;IACP,MAAMR,WAAW1F,WAAWkB;IAC5B,IAAI,CAACwE,UAAU;QACb,MAAM,IAAIS,MACR;IAEJ;IACA,OAAOT;AACT;AAEA,OAAO,SAASU;IACd,OAAOF,sBAAsB7D,GAAG;AAClC;AACA,OAAO,SAASgE;IACd,OAAOH,sBAAsBjC,SAAS;AACxC;AACA,OAAO,SAASqC;IACd,OAAOJ,sBAAsB7C,IAAI;AACnC;AACA;;;;;;CAMC,GACD,OAAO,SAASkD;IACd,OAAOL,sBAAsBhD,eAAe;AAC9C;AACA,OAAO,SAASsD;IACd,OAAON,sBAAsB1D,SAAS;AACxC;AACA,OAAO,SAASiE;IACd,OAAOP,sBAAsB5B,YAAY;AAC3C;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASoC;QAGZrD;IAFF,MAAMA,OAAOiD;IACb,MAAM,CAACK,MAAMC,QAAQ,GAAGxG,UACtBiD,oBAAAA,KAAKwD,WAAW,YAAhBxD,oBAAoBlC;IAGtBlB,UAAU;QACR,OAAOR,iBAAiB4D,MAAM,CAACyD;YAC7B,wDAAwD;YACxDF,QAAQE,mBAAAA,WAAY;QACtB;IACF,GAAG;QAACzD;KAAK;IAET,OAAO;QAAE0D,MAAMJ;IAAK;AACtB;AAOA,4FAA4F,GAC5F,OAAO,SAASK;IAKd,MAAM3D,OAAOiD;IACb,MAAM,CAACW,QAAQC,UAAU,GAAG9G,SAA0C;IACtE,MAAM,CAAC2G,MAAMI,QAAQ,GAAG/G,SAAwCe;IAChE,MAAM,CAACuB,OAAO0E,SAAS,GAAGhH,SAA4Be;IAEtDlB,UAAU;QACR,OAAOR,iBACL4D,MACA,CAACsD;YACCO,UAAU;YACVE,SAASjG;YACTgG,QAAQ;gBAAEE,UAAU,CAAC,CAACV;gBAAMA,IAAI,EAAEA,eAAAA,OAAQ;YAAK;QACjD,GACA,CAACW;YACCJ,UAAU;YACVE,SAASE;QACX;IAEJ,GAAG;QAACjE;KAAK;IAET,OAAO;QAAE4D;QAAQF;QAAMrE;IAAM;AAC/B"}
+{"version":3,"sources":["../../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/firebase/firebase-services.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport {\n  type FirebaseApp,\n  type FirebaseOptions,\n  getApps,\n  initializeApp,\n} from 'firebase/app'\nimport {\n  type Analytics,\n  getAnalytics as getAnalyticsInstance,\n  initializeAnalytics as initializeAnalyticsInstance,\n} from 'firebase/analytics'\nimport { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check'\nimport { analyticsMayEmit } from '@aglyn/aglyn/app-utils/analytics-environment'\nimport { pushPlatformConsentDefault } from '@aglyn/aglyn/app-utils/platform-consent-default'\nimport { VISITOR_CONSENT_CHANGED_EVENT } from '@aglyn/aglyn/app-utils/visitor-consent'\nimport {\n  type Auth,\n  connectAuthEmulator,\n  onIdTokenChanged,\n  type User,\n} from 'firebase/auth'\nimport {\n  type Firestore,\n  connectFirestoreEmulator,\n  getFirestore,\n  initializeFirestore,\n} from 'firebase/firestore'\nimport {\n  type RemoteConfig,\n  getRemoteConfig as getRemoteConfigInstance,\n} from 'firebase/remote-config'\nimport {\n  createContext,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react'\nimport {\n  FIREBASE_AUTH_EMULATOR_ENABLED,\n  FIREBASE_FIRESTORE_EMULATOR_ENABLED,\n} from '@aglyn/shared-data-enums'\nimport {\n  APP_CHECK_KEY_MISSING_MESSAGE,\n  appCheckSiteKey,\n} from '../../constants/firebase-config'\nimport {\n  authEmulatorUrl,\n  firestoreEmulatorHost,\n} from '../../constants/firebase-emulator-hosts'\nimport {\n  type AuthPersistenceClass,\n  createAuthInstance,\n} from './auth-persistence'\nimport {\n  firestoreCacheClassFor,\n  localCacheFor,\n  pruneSharedClientStateFor,\n} from './firestore-cache'\nimport { keepAppCheckRecaptchaContainer } from './app-check-recaptcha-container'\nimport { markMultiTabFirestore } from './firestore-multitab-wedge'\nimport { firestorePersistencePrefix } from './firestore-shared-client-state'\nimport { startFirestoreTabHandoff } from './firestore-tab-handoff'\n\n/**\n * Drop-in replacement for reactfire's `ObservableStatus<T>` — reactfire is\n * unmaintained against firebase majors past v9, but its shape is preserved\n * here so `helpers/use-doc.ts`'s already-battle-tested onSnapshot+retry\n * implementation (AGL-216/223) didn't need to change.\n */\nexport interface ObservableStatus<T> {\n  status: 'loading' | 'error' | 'success'\n  hasEmitted: boolean\n  isComplete: boolean\n  data: T\n  error: Error | undefined\n  firstValuePromise: Promise<void>\n  /**\n   * The emitted `data` includes local writes the server has NOT\n   * acknowledged (`snapshot.metadata.hasPendingWrites`).\n   *\n   * Carried rather than dropped because a caller cannot otherwise tell \"the\n   * store holds this\" from \"my browser holds this\". `persistentLocalCache`\n   * replays a queued write into the very first snapshot after a reload, so a\n   * caller that treats every snapshot as authoritative will adopt its own\n   * unacknowledged edit as the saved state — which is how the besigner ended\n   * up unable to save real changes (AGL-1262).\n   */\n  hasPendingWrites: boolean\n  /**\n   * The emitted `data` came from the local cache and the server has NOT\n   * confirmed it (`snapshot.metadata.fromCache`).\n   *\n   * Carried because it is the only per-listener ground truth about\n   * freshness the SDK offers, and the console needs it (AGL-1066). Under\n   * `persistentLocalCache` a listener whose server listen is being REFUSED\n   * still emits cached snapshots and still reports `status: 'success'` —\n   * the retry budget is reset by each cached emission and never spends, so\n   * `status` can never reveal the fault (see\n   * `use-firestore-collection-cached-retry.spec.ts`).\n   *\n   * Prefer this over `session-health`'s `staleSession` for anything that\n   * asks \"is what I am looking at live?\". `staleSession` is a heuristic\n   * needing two denied collections inside a window, and it is unreachable\n   * on listener-only pages; this is a fact about THIS listener, costs\n   * nothing, and clears itself the instant a server snapshot lands.\n   */\n  fromCache: boolean\n  /**\n   * The server has REFUSED this listen for longer than the retry budget, and\n   * no server snapshot has arrived since (AGL-1066).\n   *\n   * `fromCache` says \"unconfirmed\", which is also true offline and true for\n   * the first snapshot of a perfectly healthy load. This says \"refused\" —\n   * only `permission-denied` counts it, and it takes a whole budget's worth\n   * in a row, so it cannot fire offline and cannot fire on the AGL-216/217\n   * post-sign-in token race.\n   *\n   * It is what `status` would say if the retry budget were spendable. It is\n   * carried separately because correcting `status` in place would blank\n   * every surface that renders cached data through an `error` branch — see\n   * the note on `attempt = 0` in `use-firestore-collection`.\n   */\n  serverDenied: boolean\n}\n\n/** Replaces reactfire's `ReactFireOptions<T>` — drops the `suspense` field, which was never read. */\nexport interface FirestoreDocOptions<T> {\n  idField?: string\n  initialData?: T\n}\n\n/**\n * The Firebase products this provider builds, and therefore the ones every\n * page that renders it downloads.\n *\n * ⛔ NO Realtime Database and NO Cloud Storage (AGL-2706). Both were built\n * here and published as `useDatabase()` / `useStorage()`, and neither hook had\n * a single caller anywhere in the repo — so `@firebase/database` (125.9 KB\n * raw) and `@firebase/storage` (13.9 KB) were in the first load of every\n * console route to satisfy a context field nothing read.\n *\n * Realtime Database IS used, by `apps/console/hooks/use-presence.ts` and\n * `use-coediting.ts` — on their own Firebase app, with their own\n * `getDatabase`, behind the editor routes that need presence. That is the\n * shape to copy if a surface needs one of these: reach for the product where\n * the feature is, not in the provider every page mounts. A field here is paid\n * for by every route, used or not.\n */\ninterface FirebaseServices {\n  app: FirebaseApp\n  firestore: Firestore\n  auth: Auth\n  analytics: Analytics\n  remoteConfig: RemoteConfig\n  /**\n   * The persistence class `auth` was actually created with (AGL-1379).\n   *\n   * Published so a **second** auth instance derives its class from the\n   * primary rather than re-deciding it. `apps/console/hooks/use-presence.ts`\n   * builds its own Firebase app and its own `Auth`; before this it took the\n   * SDK default unconditionally, so configuring only the provider would have\n   * left presence persisting a refresh token on an origin the provider had\n   * just been careful not to persist one on.\n   */\n  authPersistence: AuthPersistenceClass\n}\n\nconst FirebaseServicesContext = createContext<FirebaseServices | undefined>(undefined)\n\n// Module-scope guards so HMR / remounts don't re-run emulator connection\n// (which throws if called twice) or double-initialize Firestore's\n// persistent cache.\n//\n// Firestore's is keyed by app NAME, not a bare boolean (AGL-1456): Firestore\n// initialization is once-per-app, so a module-global flag made the FIRST app\n// to mount decide for every later one — a second app would silently skip\n// `initializeFirestore` and take SDK defaults. That mattered the moment the\n// cache stopped being the same on every host.\nconst firestoreInitialized = new Set<string>()\nlet connectedAuth = false\n\n/**\n * True when THIS Chrome instance is under WebDriver automation control\n * (Puppeteer, Playwright, Selenium, or a raw CDP client) — never true for a\n * person's own browser.\n *\n * The `initializeFirestore` call below already documents the fault this\n * exists for: \"the emulator's WebChannel streaming misbehaves in automated\n * Chrome — listeners serve the initial empty from-cache snapshot and the\n * server sync never arrives\" (AGL-217). That mitigation only reaches\n * `FIREBASE_FIRESTORE_EMULATOR_ENABLED`, so an automated session against a\n * REAL, deployed backend — a browser-automation agent driving a live\n * console, which is exactly what `navigator.webdriver` detects — stayed\n * exposed. `getDocs`/`getDoc` and `onSnapshot` all resolve over the same\n * Watch stream internally, so a one-shot read wedges exactly like a listener\n * does: no error, nothing to catch, `loading` simply never gets its\n * settling event. That is the Media Library grid spinning on \"Loading\n * media…\" indefinitely with a perfectly healthy account and a perfectly\n * healthy network.\n *\n * `undefined` during SSR reads as `false` — `navigator` does not exist in\n * Node, and a server render can only ever produce the auto-detected\n * transport, never the forced one.\n */\nconst isAutomatedChromeSession = (): boolean =>\n  typeof navigator !== 'undefined' && navigator.webdriver === true\n\n/**\n * The console tag's gtag config — ONE object, at module scope, deliberately\n * (AGL-1979).\n *\n * `initializeAnalytics(app, options)` throws `already-initialized` unless the\n * options `deepEqual` the ones the instance was first created with, and the\n * provider re-enters this block on every mount, every StrictMode double\n * invoke and every Fast Refresh. A fresh object literal per call survives\n * that only by *value*; a shared constant survives it by *identity*, which is\n * the first branch of the SDK's own comparison and cannot drift when someone\n * edits one call site and not another.\n *\n * ⚠️ The SDK MUTATES this object: `_initializeAnalytics` reads `options.config`\n * and writes `origin`, `update` and the installation id onto it in place.\n * That is precisely why sharing it is safe rather than dangerous — the object\n * the provider holds and the object the SDK stored are the same one, so they\n * cannot disagree.\n */\nconst CONSOLE_ANALYTICS_OPTIONS = {\n  config: { send_page_view: false, content_group: 'console' },\n}\n\n/**\n * A surface's answer to \"may an analytics tag exist for this visitor at all?\".\n *\n * Registered from the app, at module scope, in the same shape as\n * `setFirestoreSessionReporters` and `setStaleSessionCheck` — and for a\n * sharper version of the same reason. This is consulted during the provider's\n * FIRST render, before any effect anywhere has run, so a gate installed from\n * an effect would arrive after the decision it exists to make.\n *\n * Answering `false` means the SDK is never asked to initialize: `gtag.js` is\n * never fetched, `window.gtag` never comes into existence, and the shared\n * `deliver()` in `analytics-events.ts` — whose fallback IS `window.gtag` —\n * therefore has nowhere to put a hit. That is the difference between a gate\n * and a suppression, and it is the difference AGL-1608 paid for: a resident\n * tag reports on its own, through enhanced measurement, whatever any flag\n * says afterwards.\n */\nexport type AnalyticsConsentGate = () => boolean\n\nlet analyticsConsentGate: AnalyticsConsentGate | null = null\n\n/**\n * Install the consent gate for this document, or clear it with `null`.\n *\n * UNREGISTERED MEANS ALLOWED, which is deliberate and is the only default that\n * is safe here. The tenant runtime does not use this provider's analytics\n * branch at all (it builds its own tag in `site-analytics.tsx`, behind the\n * AGL-1498 gate), and a self-hosted console points at the operator's own GA\n * property — silencing an operator's analytics because Aglyn's own surface\n * grew a gate is a failure they cannot diagnose. The surface that needs the\n * gate is the one that registers it.\n */\nexport function setAnalyticsConsentGate(\n  gate: AnalyticsConsentGate | null,\n): void {\n  analyticsConsentGate = gate\n}\n\n/** The gate's verdict, with an unregistered gate reading as \"allowed\". */\nfunction analyticsConsentAllows(): boolean {\n  if (analyticsConsentGate === null) return true\n  try {\n    return analyticsConsentGate() === true\n  } catch {\n    // A gate that throws cannot be read as consent. Storage can throw in\n    // private mode, and \"we could not tell\" is the one state this whole\n    // mechanism resolves to \"no\".\n    return false\n  }\n}\n\n/**\n * The Analytics instance per Firebase app, so a re-boot after a consent change\n * hands back the tag that is already resident rather than asking the SDK for a\n * second one.\n *\n * `initializeAnalytics` is idempotent while the options match, so this is not\n * what makes re-entry safe — `CONSOLE_ANALYTICS_OPTIONS` being a shared\n * constant is. What this avoids is the noisy path: once anything has\n * initialized the provider with different options, every later call throws and\n * is logged, and a withdrawal followed by a re-grant would log it again.\n */\nconst analyticsByApp = new WeakMap<FirebaseApp, Analytics>()\n\n/**\n * Boot the console's Analytics tag, or return the one already booted.\n *\n * Extracted from the provider body so that \"when is the tag created\" and \"may\n * it be created\" are separable: the consent gate can defer this call to a\n * later render without the ordering below moving.\n */\nfunction bootAnalytics(app: FirebaseApp): Analytics | undefined {\n  const existing = analyticsByApp.get(app)\n  if (existing) return existing\n  let analytics: Analytics\n  // The region-conditional consent default (AGL-1597), declared BEFORE the\n  // SDK boots the tag. Ordering is the whole of it: a `default` read after\n  // `config` is not a default, and the SDK issues `config` inside\n  // `initializeAnalytics` on the next line. Pushing onto `dataLayer` here\n  // works even though gtag.js is not loaded yet — the queue is what makes the\n  // ordering expressible.\n  //\n  // Still declared even though the gate above has already said yes, and the\n  // two are not redundant. The gate answers \"may a tag exist\"; the default\n  // answers \"what may the tag that does exist do\", per region, from its very\n  // first hit. Ad storage stays denied everywhere on this surface.\n  pushPlatformConsentDefault(\n    typeof window === 'undefined' ? null : (window as never),\n  )\n  try {\n    analytics = initializeAnalyticsInstance(app, CONSOLE_ANALYTICS_OPTIONS)\n  } catch (error) {\n    console.error(error)\n    try {\n      // Already initialized by someone else, with someone else's options:\n      // take THAT instance rather than leaving consumers with nothing. The\n      // tag it is attached to was configured without `send_page_view: false`\n      // and without `content_group`, so this session reports a duplicate\n      // startup page_view and an unstamped surface — degraded, and loudly so,\n      // instead of silently dead.\n      analytics = getAnalyticsInstance(app)\n    } catch (fallbackError) {\n      console.error(fallbackError)\n    }\n  }\n  if (analytics) analyticsByApp.set(app, analytics)\n  return analytics\n}\n\n/**\n * The tag this document may have right now: none outside a real production\n * deployment, none while consent is absent, otherwise the booted instance.\n */\nfunction analyticsForConsentState(app: FirebaseApp): Analytics | undefined {\n  if (!analyticsMayEmit()) return undefined\n  if (!analyticsConsentAllows()) return undefined\n  return bootAnalytics(app)\n}\n\nexport interface FirebaseServicesProviderProps {\n  firebaseConfig: FirebaseOptions\n  appName: string\n  /**\n   * How much of *anything* this origin may keep on disk. Defaults to\n   * `durable`, which is what every host serving this provider today is:\n   * `*.aglyn.com` and `*.aglyn.app`, whose DNS we own and whose 14-day\n   * session is the product.\n   *\n   * A **custom console domain** (AGL-1099c) must pass `ephemeral`. That is\n   * the whole reason this is a prop rather than a constant: the class differs\n   * per origin, not per build, and the decision belongs to whoever knows\n   * which origin is being served.\n   *\n   * **It governs two things, and the name only names one.** It selects the\n   * `Auth` persistence class (AGL-1379) *and* the Firestore `localCache`\n   * (AGL-1456) — because both answer the same question about the same origin,\n   * and splitting them into two props is precisely how the cache came to be\n   * unconditional while the credential was hardened. See `firestore-cache.ts`.\n   */\n  authPersistence?: AuthPersistenceClass\n  children?: ReactNode\n}\n\n/** The services every surface boots, before the per-document analytics verdict. */\ninterface FirebaseCoreServices {\n  app: FirebaseApp\n  firestore: Firestore\n  auth: Auth\n  remoteConfig: RemoteConfig\n}\n\n/**\n * Create (or adopt) the app, Auth, Firestore, App Check and Remote Config for\n * one Firebase app: everything the provider used to build in its first render\n * except Analytics, whose consent verdict belongs to the render that reads it.\n */\nfunction bootFirebaseCore(\n  firebaseConfig: FirebaseOptions,\n  appName: string,\n  authPersistence: AuthPersistenceClass,\n): FirebaseCoreServices {\n  const app =\n    getApps().find((existing) => existing.name === appName) ??\n    initializeApp(firebaseConfig, appName)\n  // `durable` resolves to the same `getAuth(app)` this always called.\n  const auth = createAuthInstance(app, authPersistence)\n\n  // The origin's class, unless this tab fell back to the memory cache\n  // because another tab locked the shared one (AGL-3428). Firestore only:\n  // `auth` above keeps the origin's class.\n  const firestoreCacheClass = firestoreCacheClassFor(authPersistence)\n  if (!firestoreInitialized.has(appName)) {\n    try {\n      // Under the emulator (dev/e2e only): force long-polling and skip\n      // the persistent multi-tab cache. The emulator's WebChannel\n      // streaming misbehaves in automated Chrome — listeners serve the\n      // initial empty from-cache snapshot and the server sync never\n      // arrives, which looks like \"empty pages with zero errors\"\n      // (the AGL-217 mystery). Real traffic keeps the default transport\n      // and persistent cache — except a WebDriver-controlled Chrome\n      // against a real backend, which forces long-polling for the same\n      // reason without giving up the cache (see `isAutomatedChromeSession`\n      // below).\n      //\n      // ⚠️ CONSEQUENCE, and it will cost you hours if you do not know it\n      // (AGL-1066): every stale-session/stale-cache fault is UNREPRODUCIBLE\n      // locally through the app, because the cache that causes them is off\n      // in exactly the configuration you would reach for to reproduce one.\n      // A listener that keeps serving arbitrarily-old data while the server\n      // refuses it, a `noDocument` tombstone that 404s a live host, the\n      // retry budget that never spends because a cached emission resets it\n      // — none of them can happen here. Test that behaviour with the unit\n      // seams instead (`use-firestore-collection-cached-retry.spec.ts`\n      // drives cached emissions and denials directly), or against a\n      // deployed environment. Do NOT \"fix\" it by turning the cache on for\n      // the emulator: the AGL-217 empty-pages-with-zero-errors mystery is\n      // what that produces.\n      initializeFirestore(\n        app,\n        FIREBASE_FIRESTORE_EMULATOR_ENABLED\n          ? { experimentalForceLongPolling: true }\n          : {\n              // NOT unconditional (AGL-1456). `persistentLocalCache` writes\n              // document bodies to this origin's IndexedDB, so on a custom\n              // console domain it is the same exposure D6 removed from the\n              // refresh token — see `firestore-cache.ts` for why one\n              // declaration governs both.\n              localCache: localCacheFor(firestoreCacheClass),\n              // The real-backend half of the AGL-217 mitigation above: force\n              // long-polling for a WebDriver-controlled Chrome even when it\n              // is NOT talking to the emulator, because the WebChannel wedge\n              // is a property of automated Chrome, not of which backend it\n              // is automating against. Never true for a real visitor, so\n              // production traffic keeps the SDK's own auto-detected\n              // transport untouched.\n              ...(isAutomatedChromeSession()\n                ? { experimentalForceLongPolling: true }\n                : {}),\n            },\n      )\n      if (FIREBASE_FIRESTORE_EMULATOR_ENABLED) {\n        // Where the server was told the emulator is, rather than a default\n        // port another session's stack may hold (AGL-2834).\n        const emulator = firestoreEmulatorHost()\n        connectFirestoreEmulator(\n          getFirestore(app),\n          emulator.host,\n          emulator.port,\n        )\n      } else {\n        // The SDK never sweeps the multi-tab records the durable cache\n        // strands in localStorage, and a full localStorage fails the whole\n        // Firestore client — see `firestore-shared-client-state.ts`.\n        void pruneSharedClientStateFor(firestoreCacheClass, app)\n        // Only the durable multi-tab cache can be locked by another tab,\n        // so only it gets the lease check after a stalled recovery.\n        if (firestoreCacheClass === 'durable' && app.options?.projectId) {\n          const prefix = firestorePersistencePrefix(app.name, app.options.projectId)\n          markMultiTabFirestore(getFirestore(app), `${prefix}main`)\n          // A visible tab opened while a background tab holds the shared\n          // cache's lease takes the lease at boot instead of routing every\n          // query through the background tab until its lease lapses\n          // (AGL-3660). In initializeFirestore's task: its first step\n          // snapshots the other tabs before this tab's client can start.\n          void startFirestoreTabHandoff(getFirestore(app), prefix)\n        }\n      }\n    } catch {\n      // already initialized (e.g. HMR reset the module flag) — getFirestore() returns the existing instance\n    } finally {\n      firestoreInitialized.add(appName)\n    }\n  }\n  const firestore = getFirestore(app)\n\n  if (!connectedAuth) {\n    try {\n      if (FIREBASE_AUTH_EMULATOR_ENABLED) {\n        // The emulator the server was started with (AGL-2834).\n        connectAuthEmulator(auth, authEmulatorUrl())\n      }\n      connectedAuth = true\n    } catch (error) {\n      console.error(error)\n    }\n  }\n  // App Check must be skipped under the emulators: there is no App\n  // Check emulator, so ReCaptcha would hit the real backend and its\n  // 403s break emulator auth (the AGL-216 emulator sessions hit this).\n  if (\n    !FIREBASE_AUTH_EMULATOR_ENABLED &&\n    !FIREBASE_FIRESTORE_EMULATOR_ENABLED\n  ) {\n    // No site key means no provider (AGL-2049). Registering one built on\n    // `undefined` does not throw — it fails asynchronously inside the SDK,\n    // where the catch below cannot see it — so this has to be a pre-check.\n    const siteKey = appCheckSiteKey()\n    if (!siteKey) {\n      console.warn(APP_CHECK_KEY_MISSING_MESSAGE)\n    } else {\n      try {\n        initializeAppCheck(app, {\n          provider: new ReCaptchaV3Provider(siteKey),\n          isTokenAutoRefreshEnabled: true,\n        })\n        // The widget renders into the SDK's <body> div only once Google's\n        // script loads; a body cleared before then (hydration fallback,\n        // global-error) made that render throw unhandled.\n        keepAppCheckRecaptchaContainer(app.name)\n      } catch (error) {\n        console.error(error)\n      }\n    }\n  }\n  // Remote Config (AGL-228): release-flag delivery. Browser-only like\n  // analytics; consumers set defaultConfig before their first getValue so\n  // gating never blocks on the network.\n  let remoteConfig: RemoteConfig\n  try {\n    remoteConfig = getRemoteConfigInstance(app)\n    remoteConfig.settings.minimumFetchIntervalMillis =\n      process.env.NODE_ENV === 'production' ? 3_600_000 : 60_000\n  } catch (error) {\n    console.error(error)\n  }\n\n  return { app, firestore, auth, remoteConfig }\n}\n\n/**\n * Services booted before React rendered anything, waiting for the provider to\n * adopt them (AGL-3660).\n *\n * The provider builds its services in its first render, and on the console\n * that render comes late: after every chunk of the route has executed, after\n * hydration, and after the `NoSsr` boundary above it has committed its\n * fallback and rendered again. Auth's persistence read and `accounts:lookup`,\n * and App Check's reCAPTCHA chain (script, script, iframe, token exchange),\n * which Auth AND Firestore requests both wait on whenever the cached App Check\n * token has expired, only started then. None of it depends on React, so a\n * surface that knows its config at module scope can start it there.\n *\n * Taken once, by the first provider that renders with the same app name and\n * persistence class; any later mount boots exactly as it always did. A\n * mismatched key is never adopted, so a preboot cannot hand a provider a\n * different persistence class than the one it was given.\n */\nconst prebooted = new Map<string, FirebaseCoreServices>()\nconst prebootKey = (appName: string, authPersistence: AuthPersistenceClass) =>\n  `${appName}|${authPersistence}`\n\n/**\n * Start Firebase for this document now rather than at the provider's first\n * render. Browser only, once per app name and persistence class, and it never\n * throws: a failure here leaves the provider to boot as it always did.\n *\n * The Analytics consent gate is NOT read here (the provider reads it), so the\n * gate's module-scope registration does not have to precede this call.\n */\nexport function prebootFirebaseServices(options: {\n  firebaseConfig: FirebaseOptions\n  appName: string\n  authPersistence?: AuthPersistenceClass\n}): void {\n  if (typeof window === 'undefined') return\n  const { firebaseConfig, appName, authPersistence = 'durable' } = options\n  const key = prebootKey(appName, authPersistence)\n  if (prebooted.has(key)) return\n  try {\n    prebooted.set(key, bootFirebaseCore(firebaseConfig, appName, authPersistence))\n  } catch (error) {\n    console.error(error)\n  }\n}\n\nfunction takePrebootedFirebaseCore(\n  appName: string,\n  authPersistence: AuthPersistenceClass,\n): FirebaseCoreServices | undefined {\n  const key = prebootKey(appName, authPersistence)\n  const core = prebooted.get(key)\n  if (core) prebooted.delete(key)\n  return core\n}\n\nexport function FirebaseServicesProvider(props: FirebaseServicesProviderProps) {\n  const { firebaseConfig, appName, authPersistence = 'durable', children } = props\n  const servicesRef = useRef<FirebaseServices | undefined>(undefined)\n\n  if (!servicesRef.current) {\n    const core =\n      takePrebootedFirebaseCore(appName, authPersistence) ??\n      bootFirebaseCore(firebaseConfig, appName, authPersistence)\n    // `initializeAnalytics`, not `getAnalytics`, for exactly one reason: it is\n    // the only form that can pass `config`, and `send_page_view: false` is the\n    // only way to stop the SDK's own startup `page_view` (AGL-1643).\n    //\n    // Booting Analytics issues `gtag('config', <id>, configProperties)`, and\n    // the vendored SDK's own comment on that line reads \"This will trigger a\n    // page_view event unless 'send_page_view' is set to false in\n    // configProperties\". `getAnalytics(app)` passes no config at all, so the\n    // key was never there and the hit always fired — on top of the manual\n    // `page_view` the console's layout sends on mount. Two hits, one page.\n    //\n    // The SDK's is the one suppressed rather than the layout's, and the\n    // direction is the whole decision: the SDK fires ONCE per document load,\n    // while the layout fires on mount AND on every `usePathname` change. In a\n    // client-routed app the layout's is a superset — killing it instead would\n    // have left every in-app navigation unreported, halving console pageviews\n    // rather than correcting them, and the reports would have looked fine.\n    //\n    // Nothing else about attribution moves: the surviving hit is sent from the\n    // same document at mount, so `document.referrer` — which gtag resolves for\n    // `page_referrer` itself, and which is what carries marketing traffic\n    // source into the session — is still the external referrer at that moment.\n    //\n    // Re-entry is safe *only* while the options match. `initializeAnalytics`\n    // returns the existing instance when they deep-equal the first call's and\n    // throws `already-initialized` otherwise — and the options can be made to\n    // differ by things no call site here controls (AGL-1979):\n    //\n    //   * anything that touches the analytics provider WITHOUT options first\n    //     initializes it with `{}`. `getAnalytics()` is the obvious one, but\n    //     `@firebase/remote-config` reaches the same code path on its own —\n    //     `addExperimentToAnalytics` calls `analyticsProvider.getImmediate({\n    //     optional: true })`, and `optional` only suppresses the throw, it\n    //     does not stop the initialization.\n    //   * in dev, a module instance carrying a PREVIOUS version of these\n    //     options (this config changed under AGL-1857) surviving a Fast\n    //     Refresh alongside the new one.\n    //\n    // Once that happens the conflict is permanent for the document: every\n    // later call throws, so without the fallback below `analytics` stayed\n    // undefined forever and the next consumer — `logEvent(analytics, …)` —\n    // read `.app` off it and threw a TypeError two frames away, which is how\n    // this surfaced (top Cloud Error Reporting group, and reproduced live on\n    // app.aglyn.com).\n    //\n    // `getAnalytics(app)` is the remedy the SDK's own error message names. It\n    // cannot cost us the config on a healthy document: it only runs after\n    // `initializeAnalytics` threw, and on a first init that throw can only be\n    // `no-app-id` / `no-api-key` / `already-exists`, none of which\n    // `getAnalytics` can rescue either — it re-throws and we fall through to\n    // an undefined instance, which every consumer must now tolerate.\n    // `content_group: 'console'` (AGL-1857) rides the same config: it is the\n    // first-class GA4 axis that separates console traffic from `marketing`\n    // (stamped by the tenant runtime on aglyn.com's own tag) and `docs`\n    // (stamped by the Docusaurus head snippet) in standard reports, without\n    // reaching for the Hostname dimension. The console is this provider's\n    // only consumer, verified by grep — the tenant runtime builds its tag in\n    // `site-analytics.tsx` and never passes through here.\n    //\n    // AND NOT AT ALL outside a real production deployment (AGL-2067). This\n    // provider used to boot Analytics unconditionally, while\n    // `apps/console/.env.development.local` points at the PRODUCTION\n    // measurement id — so every `next dev` session and every Vercel preview\n    // build produced genuine `session_start` / `first_visit` / `page_view`\n    // hits in the live property. Not a theory: the archived Marketing\n    // property's entire year-to-date history is 30 views / 6 users, ~24 of\n    // them `/signin` on preview urls (docs/ANALYTICS.md).\n    //\n    // Not initialized rather than initialized-and-suppressed, because a\n    // resident tag reports on its own — AGL-1608 is the same lesson from the\n    // consent side. `useAnalytics()` returning undefined is already a\n    // supported state everywhere (AGL-1979), which is what makes this a\n    // two-line gate instead of an audit.\n    //\n    // `analyticsMayEmit` leans LOUD on an unknown deployment: a self-hosted\n    // build points at the operator's own Firebase project and their own GA\n    // property, and silencing a customer's analytics to protect ours is the\n    // worse failure. See the module for the escape hatch.\n    //\n    // AND NOT while a registered consent gate says no (AGL-1498 posture,\n    // applied to Aglyn's own console). `analyticsForConsentState` is where\n    // both conditions and the boot itself now live, because the boot has to\n    // be repeatable: a visitor whose region has not resolved yet is undecided\n    // at this instant and may be granted a moment later, and a visitor who\n    // withdraws mid-session has to lose the instance without the page\n    // reloading. See the effect below.\n    //\n    // SCOPE. This is the console's tag and only the console's:\n    // `CONSOLE_ANALYTICS_OPTIONS`, `content_group: 'console'`, and this\n    // provider's analytics branch has no other consumer (the tenant runtime\n    // builds its tag in `site-analytics.tsx` and never passes through here).\n    // Customer sites keep the AGL-1498 gate and the host's own\n    // `consent.mode`; nothing here reaches them.\n    const initialAnalytics = analyticsForConsentState(core.app)\n\n    servicesRef.current = {\n      ...core,\n      analytics: initialAnalytics,\n      authPersistence,\n    }\n  }\n\n  const services = servicesRef.current\n\n  // The consent gate's other half: the verdict can CHANGE within one document,\n  // in both directions, and everything else in this provider is built exactly\n  // once by design.\n  //\n  // Deferred grant. A visitor with no stored record is undecided at the\n  // instant this provider first renders, because resolving them needs the\n  // region endpoint and that is a network call. Outside the prior-consent\n  // regions the answer is implied consent, and it lands a few hundred\n  // milliseconds later — same document, so `document.referrer` is still the\n  // external referrer and the pageview's attribution is unaffected. Without\n  // this, \"the gate is synchronous\" would have quietly meant \"the rest of the\n  // world is never measured on a first visit\".\n  //\n  // Withdrawal. Dropping the instance unmounts every binding hung off it,\n  // which is what unregisters the analytics transport — after that\n  // `deliver()` falls through to `window.gtag`, and the shared consent writer\n  // has already set `ga-disable-<id>` and sent a denied `consent update` on\n  // that exact tag (AGL-1608). The resident tag cannot be unloaded; it can be\n  // made to send nothing, and both halves are needed because either alone\n  // leaks — enhanced measurement fires with no call site at all.\n  const [analytics, setAnalytics] = useState<Analytics | undefined>(\n    () => services.analytics,\n  )\n  useEffect(() => {\n    const sync = () => setAnalytics(analyticsForConsentState(services.app))\n    // Once on mount as well as on the event: the priming pass can resolve a\n    // visitor between this provider's render and this effect, and the event it\n    // dispatched then had no listener yet.\n    sync()\n    window.addEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n    return () =>\n      window.removeEventListener(VISITOR_CONSENT_CHANGED_EVENT, sync)\n  }, [services])\n\n  // Identity changes only when the tag comes or goes, so a consent-stable\n  // document re-renders nothing.\n  const value = useMemo(\n    () =>\n      services.analytics === analytics ? services : { ...services, analytics },\n    [services, analytics],\n  )\n\n  return (\n    <FirebaseServicesContext.Provider value={value}>\n      {children}\n    </FirebaseServicesContext.Provider>\n  )\n}\nFirebaseServicesProvider.displayName = 'FirebaseServicesProvider'\n\nfunction useFirebaseServices(): FirebaseServices {\n  const services = useContext(FirebaseServicesContext)\n  if (!services) {\n    throw new Error(\n      'Firebase hooks must be used within a <FirebaseServicesProvider>',\n    )\n  }\n  return services\n}\n\nexport function useFirebaseApp(): FirebaseApp {\n  return useFirebaseServices().app\n}\nexport function useFirestore(): Firestore {\n  return useFirebaseServices().firestore\n}\nexport function useAuth(): Auth {\n  return useFirebaseServices().auth\n}\n/**\n * The persistence class the provider's `Auth` was created with (AGL-1379).\n *\n * Read it — never re-derive it — when building a **second** Firebase app on\n * the same origin, so the second instance cannot end up more persistent than\n * the first. `apps/console/hooks/use-presence.ts` is the existing case.\n */\nexport function useAuthPersistence(): AuthPersistenceClass {\n  return useFirebaseServices().authPersistence\n}\nexport function useAnalytics(): Analytics {\n  return useFirebaseServices().analytics\n}\nexport function useRemoteConfig(): RemoteConfig {\n  return useFirebaseServices().remoteConfig\n}\n\n/**\n * Replaces reactfire's `useUser()`. Reactfire subscribes via\n * `onIdTokenChanged` rather than `onAuthStateChanged` so fields like\n * `emailVerified` stay live across token refresh (e.g. after\n * `user.reload()` post-email-verification), not just sign-in/out — matched\n * here for behavioral parity.\n *\n * THREE states, not two (AGL-1261): `undefined` = auth has not resolved yet,\n * `null` = resolved, signed OUT, a `User` = resolved, signed in. This used to\n * collapse the emitted `null` into `undefined`, which made \"signed out\" and\n * \"still loading\" the same value — a state that, for a signed-out visitor,\n * never left \"loading\". `useSessionCookie` gates its whole body on\n * `user === undefined`, so its silent restore from the shared `__session`\n * cookie could never run: the cookie exchange returned a valid custom token\n * and nothing ever asked for it.\n */\nexport function useUser(): { data: User | null | undefined } {\n  const auth = useAuth()\n  const [user, setUser] = useState<User | null | undefined>(\n    auth.currentUser ?? undefined,\n  )\n\n  useEffect(() => {\n    return onIdTokenChanged(auth, (nextUser) => {\n      // `?? null`, never `?? undefined` — see the note above.\n      setUser(nextUser ?? null)\n    })\n  }, [auth])\n\n  return { data: user }\n}\n\nexport interface SigninCheckResult {\n  signedIn: boolean\n  user: User | null\n}\n\n/** Replaces reactfire's `useSigninCheck()` — same `onIdTokenChanged` basis as `useUser()`. */\nexport function useSigninCheck(): {\n  status: 'loading' | 'success' | 'error'\n  data: SigninCheckResult | undefined\n  error: Error | undefined\n} {\n  const auth = useAuth()\n  const [status, setStatus] = useState<'loading' | 'success' | 'error'>('loading')\n  const [data, setData] = useState<SigninCheckResult | undefined>(undefined)\n  const [error, setError] = useState<Error | undefined>(undefined)\n\n  useEffect(() => {\n    return onIdTokenChanged(\n      auth,\n      (user) => {\n        setStatus('success')\n        setError(undefined)\n        setData({ signedIn: !!user, user: user ?? null })\n      },\n      (err) => {\n        setStatus('error')\n        setError(err)\n      },\n    )\n  }, [auth])\n\n  return { status, data, error }\n}\n"],"names":["getApps","initializeApp","getAnalytics","getAnalyticsInstance","initializeAnalytics","initializeAnalyticsInstance","initializeAppCheck","ReCaptchaV3Provider","analyticsMayEmit","pushPlatformConsentDefault","VISITOR_CONSENT_CHANGED_EVENT","connectAuthEmulator","onIdTokenChanged","connectFirestoreEmulator","getFirestore","initializeFirestore","getRemoteConfig","getRemoteConfigInstance","createContext","useContext","useEffect","useMemo","useRef","useState","FIREBASE_AUTH_EMULATOR_ENABLED","FIREBASE_FIRESTORE_EMULATOR_ENABLED","APP_CHECK_KEY_MISSING_MESSAGE","appCheckSiteKey","authEmulatorUrl","firestoreEmulatorHost","createAuthInstance","firestoreCacheClassFor","localCacheFor","pruneSharedClientStateFor","keepAppCheckRecaptchaContainer","markMultiTabFirestore","firestorePersistencePrefix","startFirestoreTabHandoff","FirebaseServicesContext","undefined","firestoreInitialized","Set","connectedAuth","isAutomatedChromeSession","navigator","webdriver","CONSOLE_ANALYTICS_OPTIONS","config","send_page_view","content_group","analyticsConsentGate","setAnalyticsConsentGate","gate","analyticsConsentAllows","analyticsByApp","WeakMap","bootAnalytics","app","existing","get","analytics","window","error","console","fallbackError","set","analyticsForConsentState","bootFirebaseCore","firebaseConfig","appName","authPersistence","find","name","auth","firestoreCacheClass","has","experimentalForceLongPolling","localCache","emulator","host","port","options","projectId","prefix","add","firestore","siteKey","warn","provider","isTokenAutoRefreshEnabled","remoteConfig","settings","minimumFetchIntervalMillis","process","env","NODE_ENV","prebooted","Map","prebootKey","prebootFirebaseServices","key","takePrebootedFirebaseCore","core","delete","FirebaseServicesProvider","props","children","servicesRef","current","initialAnalytics","services","setAnalytics","sync","addEventListener","removeEventListener","value","Provider","displayName","useFirebaseServices","Error","useFirebaseApp","useFirestore","useAuth","useAuthPersistence","useAnalytics","useRemoteConfig","useUser","user","setUser","currentUser","nextUser","data","useSigninCheck","status","setStatus","setData","setError","signedIn","err"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA,SAGEA,OAAO,EACPC,aAAa,QACR,eAAc;AACrB,SAEEC,gBAAgBC,oBAAoB,EACpCC,uBAAuBC,2BAA2B,QAC7C,qBAAoB;AAC3B,SAASC,kBAAkB,EAAEC,mBAAmB,QAAQ,qBAAoB;AAC5E,SAASC,gBAAgB,QAAQ,+CAA8C;AAC/E,SAASC,0BAA0B,QAAQ,kDAAiD;AAC5F,SAASC,6BAA6B,QAAQ,yCAAwC;AACtF,SAEEC,mBAAmB,EACnBC,gBAAgB,QAEX,gBAAe;AACtB,SAEEC,wBAAwB,EACxBC,YAAY,EACZC,mBAAmB,QACd,qBAAoB;AAC3B,SAEEC,mBAAmBC,uBAAuB,QACrC,yBAAwB;AAC/B,SACEC,aAAa,EACbC,UAAU,EACVC,SAAS,EACTC,OAAO,EACPC,MAAM,EACNC,QAAQ,QAEH,QAAO;AACd,SACEC,8BAA8B,EAC9BC,mCAAmC,QAC9B,2BAA0B;AACjC,SACEC,6BAA6B,EAC7BC,eAAe,QACV,qCAAiC;AACxC,SACEC,eAAe,EACfC,qBAAqB,QAChB,6CAAyC;AAChD,SAEEC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,sBAAsB,EACtBC,aAAa,EACbC,yBAAyB,QACpB,uBAAmB;AAC1B,SAASC,8BAA8B,QAAQ,qCAAiC;AAChF,SAASC,qBAAqB,QAAQ,gCAA4B;AAClE,SAASC,0BAA0B,QAAQ,qCAAiC;AAC5E,SAASC,wBAAwB,QAAQ,6BAAyB;AA0GlE,MAAMC,wCAA0BpB,cAA4CqB;AAE5E,yEAAyE;AACzE,kEAAkE;AAClE,oBAAoB;AACpB,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAMC,uBAAuB,IAAIC;AACjC,IAAIC,gBAAgB;AAEpB;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,MAAMC,2BAA2B,IAC/B,OAAOC,cAAc,eAAeA,UAAUC,SAAS,KAAK;AAE9D;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMC,4BAA4B;IAChCC,QAAQ;QAAEC,gBAAgB;QAAOC,eAAe;IAAU;AAC5D;AAqBA,IAAIC,uBAAoD;AAExD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,wBACdC,IAAiC;IAEjCF,uBAAuBE;AACzB;AAEA,wEAAwE,GACxE,SAASC;IACP,IAAIH,yBAAyB,MAAM,OAAO;IAC1C,IAAI;QACF,OAAOA,2BAA2B;IACpC,EAAE,eAAM;QACN,qEAAqE;QACrE,oEAAoE;QACpE,8BAA8B;QAC9B,OAAO;IACT;AACF;AAEA;;;;;;;;;;CAUC,GACD,MAAMI,iBAAiB,IAAIC;AAE3B;;;;;;CAMC,GACD,SAASC,cAAcC,GAAgB;IACrC,MAAMC,WAAWJ,eAAeK,GAAG,CAACF;IACpC,IAAIC,UAAU,OAAOA;IACrB,IAAIE;IACJ,yEAAyE;IACzE,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,wBAAwB;IACxB,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjEnD,2BACE,OAAOoD,WAAW,cAAc,OAAQA;IAE1C,IAAI;QACFD,YAAYvD,4BAA4BoD,KAAKX;IAC/C,EAAE,OAAOgB,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,IAAI;YACF,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,4BAA4B;YAC5BF,YAAYzD,qBAAqBsD;QACnC,EAAE,OAAOO,eAAe;YACtBD,QAAQD,KAAK,CAACE;QAChB;IACF;IACA,IAAIJ,WAAWN,eAAeW,GAAG,CAACR,KAAKG;IACvC,OAAOA;AACT;AAEA;;;CAGC,GACD,SAASM,yBAAyBT,GAAgB;IAChD,IAAI,CAACjD,oBAAoB,OAAO+B;IAChC,IAAI,CAACc,0BAA0B,OAAOd;IACtC,OAAOiB,cAAcC;AACvB;AAkCA;;;;CAIC,GACD,SAASU,iBACPC,cAA+B,EAC/BC,OAAe,EACfC,eAAqC;QAGnCtE;IADF,MAAMyD,OACJzD,gBAAAA,UAAUuE,IAAI,CAAC,CAACb,WAAaA,SAASc,IAAI,KAAKH,oBAA/CrE,gBACAC,cAAcmE,gBAAgBC;IAChC,oEAAoE;IACpE,MAAMI,OAAO3C,mBAAmB2B,KAAKa;IAErC,oEAAoE;IACpE,wEAAwE;IACxE,yCAAyC;IACzC,MAAMI,sBAAsB3C,uBAAuBuC;IACnD,IAAI,CAAC9B,qBAAqBmC,GAAG,CAACN,UAAU;QACtC,IAAI;YACF,iEAAiE;YACjE,4DAA4D;YAC5D,iEAAiE;YACjE,8DAA8D;YAC9D,2DAA2D;YAC3D,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,qEAAqE;YACrE,UAAU;YACV,EAAE;YACF,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,8DAA8D;YAC9D,oEAAoE;YACpE,oEAAoE;YACpE,sBAAsB;YACtBtD,oBACE0C,KACAhC,sCACI;gBAAEmD,8BAA8B;YAAK,IACrC;gBACE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,6DAA6D;gBAC7D,uDAAuD;gBACvD,4BAA4B;gBAC5BC,YAAY7C,cAAc0C;eAQtB/B,6BACA;gBAAEiC,8BAA8B;YAAK,IACrC,CAAC;YAGb,IAAInD,qCAAqC;gBACvC,mEAAmE;gBACnE,oDAAoD;gBACpD,MAAMqD,WAAWjD;gBACjBhB,yBACEC,aAAa2C,MACbqB,SAASC,IAAI,EACbD,SAASE,IAAI;YAEjB,OAAO;oBAOoCvB;gBANzC,+DAA+D;gBAC/D,mEAAmE;gBACnE,6DAA6D;gBAC7D,KAAKxB,0BAA0ByC,qBAAqBjB;gBACpD,iEAAiE;gBACjE,4DAA4D;gBAC5D,IAAIiB,wBAAwB,eAAajB,eAAAA,IAAIwB,OAAO,qBAAXxB,aAAayB,SAAS,GAAE;oBAC/D,MAAMC,SAAS/C,2BAA2BqB,IAAIe,IAAI,EAAEf,IAAIwB,OAAO,CAACC,SAAS;oBACzE/C,sBAAsBrB,aAAa2C,MAAM,GAAG0B,OAAO,IAAI,CAAC;oBACxD,+DAA+D;oBAC/D,iEAAiE;oBACjE,0DAA0D;oBAC1D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,KAAK9C,yBAAyBvB,aAAa2C,MAAM0B;gBACnD;YACF;QACF,EAAE,eAAM;QACN,sGAAsG;QACxG,SAAU;YACR3C,qBAAqB4C,GAAG,CAACf;QAC3B;IACF;IACA,MAAMgB,YAAYvE,aAAa2C;IAE/B,IAAI,CAACf,eAAe;QAClB,IAAI;YACF,IAAIlB,gCAAgC;gBAClC,uDAAuD;gBACvDb,oBAAoB8D,MAAM7C;YAC5B;YACAc,gBAAgB;QAClB,EAAE,OAAOoB,OAAO;YACdC,QAAQD,KAAK,CAACA;QAChB;IACF;IACA,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,IACE,CAACtC,kCACD,CAACC,qCACD;QACA,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM6D,UAAU3D;QAChB,IAAI,CAAC2D,SAAS;YACZvB,QAAQwB,IAAI,CAAC7D;QACf,OAAO;YACL,IAAI;gBACFpB,mBAAmBmD,KAAK;oBACtB+B,UAAU,IAAIjF,oBAAoB+E;oBAClCG,2BAA2B;gBAC7B;gBACA,kEAAkE;gBAClE,gEAAgE;gBAChE,kDAAkD;gBAClDvD,+BAA+BuB,IAAIe,IAAI;YACzC,EAAE,OAAOV,OAAO;gBACdC,QAAQD,KAAK,CAACA;YAChB;QACF;IACF;IACA,oEAAoE;IACpE,wEAAwE;IACxE,sCAAsC;IACtC,IAAI4B;IACJ,IAAI;QACFA,eAAezE,wBAAwBwC;QACvCiC,aAAaC,QAAQ,CAACC,0BAA0B,GAC9CC,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe,UAAY;IACxD,EAAE,OAAOjC,OAAO;QACdC,QAAQD,KAAK,CAACA;IAChB;IAEA,OAAO;QAAEL;QAAK4B;QAAWZ;QAAMiB;IAAa;AAC9C;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMM,YAAY,IAAIC;AACtB,MAAMC,aAAa,CAAC7B,SAAiBC,kBACnC,GAAGD,QAAQ,CAAC,EAAEC,iBAAiB;AAEjC;;;;;;;CAOC,GACD,OAAO,SAAS6B,wBAAwBlB,OAIvC;IACC,IAAI,OAAOpB,WAAW,aAAa;IACnC,MAAM,EAAEO,cAAc,EAAEC,OAAO,EAAEC,kBAAkB,SAAS,EAAE,GAAGW;IACjE,MAAMmB,MAAMF,WAAW7B,SAASC;IAChC,IAAI0B,UAAUrB,GAAG,CAACyB,MAAM;IACxB,IAAI;QACFJ,UAAU/B,GAAG,CAACmC,KAAKjC,iBAAiBC,gBAAgBC,SAASC;IAC/D,EAAE,OAAOR,OAAO;QACdC,QAAQD,KAAK,CAACA;IAChB;AACF;AAEA,SAASuC,0BACPhC,OAAe,EACfC,eAAqC;IAErC,MAAM8B,MAAMF,WAAW7B,SAASC;IAChC,MAAMgC,OAAON,UAAUrC,GAAG,CAACyC;IAC3B,IAAIE,MAAMN,UAAUO,MAAM,CAACH;IAC3B,OAAOE;AACT;AAEA,OAAO,SAASE,yBAAyBC,KAAoC;IAC3E,MAAM,EAAErC,cAAc,EAAEC,OAAO,EAAEC,kBAAkB,SAAS,EAAEoC,QAAQ,EAAE,GAAGD;IAC3E,MAAME,cAAcrF,OAAqCiB;IAEzD,IAAI,CAACoE,YAAYC,OAAO,EAAE;YAEtBP;QADF,MAAMC,QACJD,6BAAAA,0BAA0BhC,SAASC,4BAAnC+B,6BACAlC,iBAAiBC,gBAAgBC,SAASC;QAC5C,2EAA2E;QAC3E,2EAA2E;QAC3E,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wCAAwC;QACxC,qEAAqE;QACrE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,kBAAkB;QAClB,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,yEAAyE;QACzE,iEAAiE;QACjE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,EAAE;QACF,uEAAuE;QACvE,yDAAyD;QACzD,iEAAiE;QACjE,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,qCAAqC;QACrC,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,mCAAmC;QACnC,EAAE;QACF,2DAA2D;QAC3D,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAMuC,mBAAmB3C,yBAAyBoC,KAAK7C,GAAG;QAE1DkD,YAAYC,OAAO,GAAG,aACjBN;YACH1C,WAAWiD;YACXvC;;IAEJ;IAEA,MAAMwC,WAAWH,YAAYC,OAAO;IAEpC,6EAA6E;IAC7E,4EAA4E;IAC5E,kBAAkB;IAClB,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,wEAAwE;IACxE,iEAAiE;IACjE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,CAAChD,WAAWmD,aAAa,GAAGxF,SAChC,IAAMuF,SAASlD,SAAS;IAE1BxC,UAAU;QACR,MAAM4F,OAAO,IAAMD,aAAa7C,yBAAyB4C,SAASrD,GAAG;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,uCAAuC;QACvCuD;QACAnD,OAAOoD,gBAAgB,CAACvG,+BAA+BsG;QACvD,OAAO,IACLnD,OAAOqD,mBAAmB,CAACxG,+BAA+BsG;IAC9D,GAAG;QAACF;KAAS;IAEb,wEAAwE;IACxE,+BAA+B;IAC/B,MAAMK,QAAQ9F,QACZ,IACEyF,SAASlD,SAAS,KAAKA,YAAYkD,WAAW,aAAKA;YAAUlD;YAC/D;QAACkD;QAAUlD;KAAU;IAGvB,qBACE,KAACtB,wBAAwB8E,QAAQ;QAACD,OAAOA;kBACtCT;;AAGP;AACAF,yBAAyBa,WAAW,GAAG;AAEvC,SAASC;IACP,MAAMR,WAAW3F,WAAWmB;IAC5B,IAAI,CAACwE,UAAU;QACb,MAAM,IAAIS,MACR;IAEJ;IACA,OAAOT;AACT;AAEA,OAAO,SAASU;IACd,OAAOF,sBAAsB7D,GAAG;AAClC;AACA,OAAO,SAASgE;IACd,OAAOH,sBAAsBjC,SAAS;AACxC;AACA,OAAO,SAASqC;IACd,OAAOJ,sBAAsB7C,IAAI;AACnC;AACA;;;;;;CAMC,GACD,OAAO,SAASkD;IACd,OAAOL,sBAAsBhD,eAAe;AAC9C;AACA,OAAO,SAASsD;IACd,OAAON,sBAAsB1D,SAAS;AACxC;AACA,OAAO,SAASiE;IACd,OAAOP,sBAAsB5B,YAAY;AAC3C;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASoC;QAGZrD;IAFF,MAAMA,OAAOiD;IACb,MAAM,CAACK,MAAMC,QAAQ,GAAGzG,UACtBkD,oBAAAA,KAAKwD,WAAW,YAAhBxD,oBAAoBlC;IAGtBnB,UAAU;QACR,OAAOR,iBAAiB6D,MAAM,CAACyD;YAC7B,wDAAwD;YACxDF,QAAQE,mBAAAA,WAAY;QACtB;IACF,GAAG;QAACzD;KAAK;IAET,OAAO;QAAE0D,MAAMJ;IAAK;AACtB;AAOA,4FAA4F,GAC5F,OAAO,SAASK;IAKd,MAAM3D,OAAOiD;IACb,MAAM,CAACW,QAAQC,UAAU,GAAG/G,SAA0C;IACtE,MAAM,CAAC4G,MAAMI,QAAQ,GAAGhH,SAAwCgB;IAChE,MAAM,CAACuB,OAAO0E,SAAS,GAAGjH,SAA4BgB;IAEtDnB,UAAU;QACR,OAAOR,iBACL6D,MACA,CAACsD;YACCO,UAAU;YACVE,SAASjG;YACTgG,QAAQ;gBAAEE,UAAU,CAAC,CAACV;gBAAMA,IAAI,EAAEA,eAAAA,OAAQ;YAAK;QACjD,GACA,CAACW;YACCJ,UAAU;YACVE,SAASE;QACX;IAEJ,GAAG;QAACjE;KAAK;IAET,OAAO;QAAE4D;QAAQF;QAAMrE;IAAM;AAC/B"}

package/src/lib/tenant.d.ts

@@ -18,6 +18,7 @@ export * from './constants/mock-data';
 export * from './constants/site-paths';
 export * from './constants/firebase-config';
 export * from './constants/firebase-emulator-hosts';
+export * from './hooks/firebase/app-check-recaptcha-container';
 export * from './hooks/firebase/auth-persistence';
 export * from './hooks/firebase/firebase-services';
 export * from './hooks/firebase/firestore-cache';

package/src/lib/tenant.js

@@ -17,6 +17,7 @@
 export * from "./constants/site-paths.js";
 export * from "./constants/firebase-config.js";
 export * from "./constants/firebase-emulator-hosts.js";
+export * from "./hooks/firebase/app-check-recaptcha-container.js";
 export * from "./hooks/firebase/auth-persistence.js";
 export * from "./hooks/firebase/firebase-services.js";
 export * from "./hooks/firebase/firestore-cache.js";

package/src/lib/tenant.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/tenant/feature/instance/src/lib/tenant.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './constants/mock-data'\nexport * from './constants/site-paths'\nexport * from './constants/firebase-config'\nexport * from './constants/firebase-emulator-hosts'\n\nexport * from './hooks/firebase/auth-persistence'\nexport * from './hooks/firebase/firebase-services'\nexport * from './hooks/firebase/firestore-cache'\nexport * from './hooks/firebase/firestore-stall-recovery'\nexport * from './hooks/firebase/firestore-bounded-read'\nexport * from './hooks/helpers/use-doc'\nexport * from './hooks/helpers/use-modify-doc-callback'\nexport * from './hooks/helpers/besigner-nodes-converter'\nexport * from './hooks/helpers/guarded-nodes-save'\nexport * from './hooks/helpers/guarded-seed-write'\n\nexport * from './hooks/firestore-denial-reporter'\nexport * from './hooks/use-firestore-collection'\nexport * from './hooks/use-paged-collection'\nexport * from './hooks/use-sorted-paged-collection'\nexport * from './hooks/sorted-collection-window'\nexport * from './hooks/host-collection-queries'\nexport * from './hooks/list-filter-constraints'\nexport * from './hooks/use-firestore-doc'\nexport * from './hooks/use-switcher-collection'\nexport * from './hooks/use-host-activity-logger'\nexport * from './hooks/use-live-artifact-count'\nexport * from './hooks/use-component'\nexport * from './hooks/use-component-version'\nexport * from './hooks/use-host-document-version'\nexport * from './hooks/use-host-template'\nexport * from './hooks/use-console-host-route'\nexport * from './hooks/use-host-org-id'\nexport * from './hooks/use-container-options'\nexport * from './hooks/use-org-member-options'\nexport * from './hooks/use-org-plan'\nexport * from './hooks/use-scope-tokens'\nexport * from './hooks/use-host-resource-api'\nexport * from './hooks/use-host-version-api'\nexport * from './hooks/use-duplicate-resource-api'\nexport * from './hooks/use-plugin-api-post'\nexport * from './components/duplicate-resource-dialog'\nexport * from './hooks/use-plugin-config'\nexport * from './hooks/use-host'\nexport * from './hooks/use-layout'\nexport * from './hooks/use-layout-version'\nexport * from './hooks/use-screen'\nexport * from './hooks/use-screen-version'\nexport * from './hooks/use-user-name'\nexport * from './hooks/use-user-photo'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,2BAAuB;AACrC,cAAc,4BAAwB;AACtC,cAAc,iCAA6B;AAC3C,cAAc,yCAAqC;AAEnD,cAAc,uCAAmC;AACjD,cAAc,wCAAoC;AAClD,cAAc,sCAAkC;AAChD,cAAc,+CAA2C;AACzD,cAAc,6CAAyC;AACvD,cAAc,6BAAyB;AACvC,cAAc,6CAAyC;AACvD,cAAc,8CAA0C;AACxD,cAAc,wCAAoC;AAClD,cAAc,wCAAoC;AAElD,cAAc,uCAAmC;AACjD,cAAc,sCAAkC;AAChD,cAAc,kCAA8B;AAC5C,cAAc,yCAAqC;AACnD,cAAc,sCAAkC;AAChD,cAAc,qCAAiC;AAC/C,cAAc,qCAAiC;AAC/C,cAAc,+BAA2B;AACzC,cAAc,qCAAiC;AAC/C,cAAc,sCAAkC;AAChD,cAAc,qCAAiC;AAC/C,cAAc,2BAAuB;AACrC,cAAc,mCAA+B;AAC7C,cAAc,uCAAmC;AACjD,cAAc,+BAA2B;AACzC,cAAc,oCAAgC;AAC9C,cAAc,6BAAyB;AACvC,cAAc,mCAA+B;AAC7C,cAAc,oCAAgC;AAC9C,cAAc,0BAAsB;AACpC,cAAc,8BAA0B;AACxC,cAAc,mCAA+B;AAC7C,cAAc,kCAA8B;AAC5C,cAAc,wCAAoC;AAClD,cAAc,iCAA6B;AAC3C,cAAc,4CAAwC;AACtD,cAAc,+BAA2B;AACzC,cAAc,sBAAkB;AAChC,cAAc,wBAAoB;AAClC,cAAc,gCAA4B;AAC1C,cAAc,wBAAoB;AAClC,cAAc,gCAA4B;AAC1C,cAAc,2BAAuB;AACrC,cAAc,4BAAwB"}
+{"version":3,"sources":["../../../../../../../libs/tenant/feature/instance/src/lib/tenant.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './constants/mock-data'\nexport * from './constants/site-paths'\nexport * from './constants/firebase-config'\nexport * from './constants/firebase-emulator-hosts'\n\nexport * from './hooks/firebase/app-check-recaptcha-container'\nexport * from './hooks/firebase/auth-persistence'\nexport * from './hooks/firebase/firebase-services'\nexport * from './hooks/firebase/firestore-cache'\nexport * from './hooks/firebase/firestore-stall-recovery'\nexport * from './hooks/firebase/firestore-bounded-read'\nexport * from './hooks/helpers/use-doc'\nexport * from './hooks/helpers/use-modify-doc-callback'\nexport * from './hooks/helpers/besigner-nodes-converter'\nexport * from './hooks/helpers/guarded-nodes-save'\nexport * from './hooks/helpers/guarded-seed-write'\n\nexport * from './hooks/firestore-denial-reporter'\nexport * from './hooks/use-firestore-collection'\nexport * from './hooks/use-paged-collection'\nexport * from './hooks/use-sorted-paged-collection'\nexport * from './hooks/sorted-collection-window'\nexport * from './hooks/host-collection-queries'\nexport * from './hooks/list-filter-constraints'\nexport * from './hooks/use-firestore-doc'\nexport * from './hooks/use-switcher-collection'\nexport * from './hooks/use-host-activity-logger'\nexport * from './hooks/use-live-artifact-count'\nexport * from './hooks/use-component'\nexport * from './hooks/use-component-version'\nexport * from './hooks/use-host-document-version'\nexport * from './hooks/use-host-template'\nexport * from './hooks/use-console-host-route'\nexport * from './hooks/use-host-org-id'\nexport * from './hooks/use-container-options'\nexport * from './hooks/use-org-member-options'\nexport * from './hooks/use-org-plan'\nexport * from './hooks/use-scope-tokens'\nexport * from './hooks/use-host-resource-api'\nexport * from './hooks/use-host-version-api'\nexport * from './hooks/use-duplicate-resource-api'\nexport * from './hooks/use-plugin-api-post'\nexport * from './components/duplicate-resource-dialog'\nexport * from './hooks/use-plugin-config'\nexport * from './hooks/use-host'\nexport * from './hooks/use-layout'\nexport * from './hooks/use-layout-version'\nexport * from './hooks/use-screen'\nexport * from './hooks/use-screen-version'\nexport * from './hooks/use-user-name'\nexport * from './hooks/use-user-photo'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,2BAAuB;AACrC,cAAc,4BAAwB;AACtC,cAAc,iCAA6B;AAC3C,cAAc,yCAAqC;AAEnD,cAAc,oDAAgD;AAC9D,cAAc,uCAAmC;AACjD,cAAc,wCAAoC;AAClD,cAAc,sCAAkC;AAChD,cAAc,+CAA2C;AACzD,cAAc,6CAAyC;AACvD,cAAc,6BAAyB;AACvC,cAAc,6CAAyC;AACvD,cAAc,8CAA0C;AACxD,cAAc,wCAAoC;AAClD,cAAc,wCAAoC;AAElD,cAAc,uCAAmC;AACjD,cAAc,sCAAkC;AAChD,cAAc,kCAA8B;AAC5C,cAAc,yCAAqC;AACnD,cAAc,sCAAkC;AAChD,cAAc,qCAAiC;AAC/C,cAAc,qCAAiC;AAC/C,cAAc,+BAA2B;AACzC,cAAc,qCAAiC;AAC/C,cAAc,sCAAkC;AAChD,cAAc,qCAAiC;AAC/C,cAAc,2BAAuB;AACrC,cAAc,mCAA+B;AAC7C,cAAc,uCAAmC;AACjD,cAAc,+BAA2B;AACzC,cAAc,oCAAgC;AAC9C,cAAc,6BAAyB;AACvC,cAAc,mCAA+B;AAC7C,cAAc,oCAAgC;AAC9C,cAAc,0BAAsB;AACpC,cAAc,8BAA0B;AACxC,cAAc,mCAA+B;AAC7C,cAAc,kCAA8B;AAC5C,cAAc,wCAAoC;AAClD,cAAc,iCAA6B;AAC3C,cAAc,4CAAwC;AACtD,cAAc,+BAA2B;AACzC,cAAc,sBAAkB;AAChC,cAAc,wBAAoB;AAClC,cAAc,gCAA4B;AAC1C,cAAc,wBAAoB;AAClC,cAAc,gCAA4B;AAC1C,cAAc,2BAAuB;AACrC,cAAc,4BAAwB"}