@comfyorg/account-core 1.0.0-alpha.0 → 1.0.0-alpha.1

package/dist/firebase/index.d.ts

@@ -13,36 +13,69 @@
  * importGuard.test.ts holds `./core` to that boundary.
  */
 import type { FirebaseOptions } from 'firebase/app';
-import type { Auth, Persistence, User, UserCredential } from 'firebase/auth';
+import type { Auth, Dependencies, User, UserCredential } from 'firebase/auth';
 import type { AccountIdentity } from '../core/identity.js';
+import type { CloudFeatures } from './configSource.js';
+export { watchedPopupRedirectResolver } from './popupWatch.js';
 export interface FirebaseIdentityAppConfig {
-    readonly options: FirebaseOptions;
+    readonly options: FirebaseOptions | (() => FirebaseOptions);
     /** Named app: never contend with a default app another script creates. */
     readonly appName?: string;
-    /** Host-selected persistence; Firebase's default when omitted. */
-    readonly persistence?: Persistence;
+    /** One persistence or an ordered hierarchy, handed to `initializeAuth` as is; Firebase's default when omitted. */
+    readonly persistence?: Dependencies['persistence'];
+    /**
+     * Report a closed popup at once instead of after Firebase's 8-10s wait (see
+     * `PopupSignInOptions`). Auth is then created with the dependencies `getAuth`
+     * would pick, plus `watchedPopupRedirectResolver`.
+     */
+    readonly watchPopupSignIn?: boolean;
     /** A host-owned `Auth` and package-owned app options are exclusive. */
     readonly auth?: never;
 }
 /**
- * A host that already holds an `Auth` (the cloud app's vuefire instance)
- * binds the entry to it: no second app, no second persistence store.
+ * A host that already holds an `Auth` binds the entry to it: no second app,
+ * no second persistence store.
  */
 export interface FirebaseIdentityAuthConfig {
     readonly auth: Auth;
+    /** Only when the host created `auth` with `watchedPopupRedirectResolver`. */
+    readonly watchPopupSignIn?: boolean;
     readonly options?: never;
     readonly appName?: never;
     readonly persistence?: never;
 }
 export type FirebaseIdentityConfig = FirebaseIdentityAppConfig | FirebaseIdentityAuthConfig;
+/**
+ * On a watched identity a popup the visitor closes rejects at once with
+ * `auth/popup-closed-by-user`, the same error Firebase raises 8-10s later, so
+ * a host's usual handling applies. Rarely the sign-in result still arrives
+ * after that; these decide whether it is finished or discarded unused.
+ */
+export interface PopupSignInOptions {
+    /**
+     * Finishes a result that arrived after the popup was reported closed, given
+     * the credential still being exchanged. Without it such a result is
+     * discarded. It is also discarded when another sign-in started since or
+     * someone else is now signed in.
+     */
+    readonly onResumed?: (credential: Promise<UserCredential>) => void;
+    /** Asked before a late result is kept; false discards it. */
+    readonly keepLateResult?: () => boolean;
+}
 export interface FirebaseIdentity extends AccountIdentity<User> {
     /**
      * Fires with the restored user (or null) once Firebase settles, then on
      * every change. This is the identity the session core binds to.
      */
     onUserChanged: (callback: (user: User | null) => void) => () => void;
-    signInWithGoogle: () => Promise<UserCredential>;
-    signInWithGitHub: () => Promise<UserCredential>;
+    /** Fires on every ID token change, refreshes included. */
+    onTokenChanged: (callback: (user: User | null) => void) => () => void;
+    /** Resolves the app and `Auth` now; a no-op once resolved. */
+    initialize: () => void;
+    /** Null until `initialize()` or a subscribing/sign-in call has resolved `Auth`. */
+    currentUser: () => User | null;
+    signInWithGoogle: (options?: PopupSignInOptions) => Promise<UserCredential>;
+    signInWithGitHub: (options?: PopupSignInOptions) => Promise<UserCredential>;
     signInWithEmail: (email: string, password: string) => Promise<UserCredential>;
     createUserWithEmail: (email: string, password: string) => Promise<UserCredential>;
     sendPasswordReset: (email: string) => Promise<void>;
@@ -51,3 +84,33 @@ export interface FirebaseIdentity extends AccountIdentity<User> {
     signOut: () => Promise<void>;
 }
 export declare function createFirebaseIdentity(config: FirebaseIdentityConfig): FirebaseIdentity;
+export interface ResolveFirebaseIdentityOptions {
+    /** The Cloud origin whose `/api/features` names this app's Firebase project. */
+    readonly cloudBaseUrl: string;
+    /** Named app: never contend with a default app another script creates. */
+    readonly appName: string;
+    readonly persistence?: Dependencies['persistence'];
+    readonly timeoutMs?: number;
+}
+export declare function resolveFirebaseIdentity(options: ResolveFirebaseIdentityOptions): Promise<FirebaseIdentity | undefined>;
+export interface ResolveStripePublishableKeyOptions {
+    /** The Cloud origin whose `/api/features` names this app's Stripe key. */
+    readonly cloudBaseUrl: string;
+    readonly timeoutMs?: number;
+}
+/**
+ * The Stripe publishable key from the same `/api/features` document
+ * `resolveFirebaseIdentity` reads. A host that calls both with the same
+ * `cloudBaseUrl`/`timeoutMs` pays for one fetch, not two, `resolveCloudFeatures`
+ * dedupes by that pair regardless of which field a caller asked for first.
+ * Settles `undefined` on any failure and never rejects.
+ */
+export declare function resolveStripePublishableKey(options: ResolveStripePublishableKeyOptions): Promise<string | undefined>;
+export type CloudTelemetryConfig = Pick<CloudFeatures, 'posthogProjectToken' | 'posthogApiHost' | 'telemetryDisabledEvents'>;
+/** The Cloud app's PostHog settings from the same shared `/api/features` document. */
+export declare function resolveCloudTelemetryConfig(options: Pick<ResolveFirebaseIdentityOptions, 'cloudBaseUrl' | 'timeoutMs'>): Promise<CloudTelemetryConfig>;
+/**
+ * `web_session_probe` from the same shared `/api/features` document, so a
+ * host that already reads it for Firebase or Stripe pays no extra request.
+ */
+export declare function resolveWebSessionProbe(options: Pick<ResolveFirebaseIdentityOptions, 'cloudBaseUrl' | 'timeoutMs'>): Promise<boolean>;

package/dist/firebase/index.js

@@ -1,7 +1,10 @@
-import { getApps, initializeApp } from 'firebase/app';
-import { GithubAuthProvider, GoogleAuthProvider, createUserWithEmailAndPassword, getAuth, initializeAuth, onAuthStateChanged, sendPasswordResetEmail, signInWithEmailAndPassword, signInWithPopup, signOut, updatePassword } from 'firebase/auth';
-import { identityBrand } from '../core/identity.js';
+import { FirebaseError, getApps, initializeApp } from 'firebase/app';
+import { GithubAuthProvider, GoogleAuthProvider, browserLocalPersistence, browserPopupRedirectResolver, browserSessionPersistence, createUserWithEmailAndPassword, getAuth, indexedDBLocalPersistence, initializeAuth, onAuthStateChanged, onIdTokenChanged, sendPasswordResetEmail, signInWithEmailAndPassword, signInWithPopup, signOut, updatePassword } from 'firebase/auth';
+import { brandIdentity } from '../core/identity.js';
 import { isFirebaseAuthErrorLike } from '../firebaseAuthError.js';
+import { fetchCloudFeatures } from './configSource.js';
+import { runWatchedPopup, watchedPopupRedirectResolver } from './popupWatch.js';
+export { watchedPopupRedirectResolver } from './popupWatch.js';
 function googleProvider() {
     const provider = new GoogleAuthProvider();
     provider.addScope('email');
@@ -25,43 +28,142 @@ function resolveUnknownEmailAsSent(error) {
     }
     throw error;
 }
+/** What `getAuth` hands `initializeAuth` in a browser; read only when needed. */
+function getAuthPersistence() {
+    return [
+        indexedDBLocalPersistence,
+        browserLocalPersistence,
+        browserSessionPersistence
+    ];
+}
+/**
+ * A pre-existing app under this name must be the same Firebase project, or
+ * `Auth` binds to another project's session. Deliberately a "same project"
+ * check on the fields that pick a session, not the SDK's byte-identical
+ * compare: `appId` is Installations/Analytics, so omitting it from a partial
+ * same-project config still binds rather than failing boot.
+ */
+function assertSameProject(existing, requested, appName) {
+    const mismatch = ['projectId', 'apiKey', 'authDomain']
+        .filter((key) => existing[key] !== requested[key])
+        .join(', ');
+    if (mismatch) {
+        throw new Error(`Firebase app "${appName}" already exists for a different project (${mismatch})`);
+    }
+}
+/** What `initializeAuth` needs beyond `getAuth`'s defaults; none means `getAuth`. */
+function authDependencies(persistence, watchPopupSignIn) {
+    if (!persistence && !watchPopupSignIn)
+        return undefined;
+    return {
+        persistence: persistence ?? getAuthPersistence(),
+        popupRedirectResolver: watchPopupSignIn
+            ? watchedPopupRedirectResolver
+            : browserPopupRedirectResolver
+    };
+}
+/**
+ * When only the popup watch asked for `initializeAuth`, an Auth that already
+ * exists for the app is reused as `getAuth` would, unwatched, rather than
+ * failing sign-in.
+ */
+function initializeOrReuse(app, dependencies, mayReuse) {
+    try {
+        return initializeAuth(app, dependencies);
+    }
+    catch (error) {
+        if (mayReuse &&
+            isFirebaseAuthErrorLike(error) &&
+            error.code === 'auth/already-initialized') {
+            return getAuth(app);
+        }
+        throw error;
+    }
+}
 /**
- * Resolved once per identity. A named app this entry creates gets the
- * host's persistence through `initializeAuth`; an app another entry already
- * created keeps the persistence its creator chose, since Firebase allows one
- * Auth per app.
+ * Host persistence goes through `initializeAuth`, whether this entry creates
+ * the named app or another script already did: Firebase allows one Auth per
+ * app, so an Auth another module initialized with different dependencies
+ * fails with `auth/already-initialized` instead of silently winning. Unlike
+ * `getAuth`, `initializeAuth` wires no popup resolver of its own, and popup
+ * sign-in throws `auth/argument-error` without one.
  */
 function authResolver(config) {
     if (config.auth) {
         const { auth } = config;
-        return () => auth;
+        return { resolve: () => auth, peek: () => auth };
     }
     const appName = config.appName ?? 'comfy-account';
     let resolved;
-    return () => {
+    const resolve = () => {
         if (resolved)
             return resolved;
+        // Resolve options before the lookup so the host's config thunk (its
+        // unloaded-remote-config guard) always runs, even when reusing an app.
+        const options = typeof config.options === 'function' ? config.options() : config.options;
         const existing = getApps().find((app) => app.name === appName);
-        if (existing) {
-            resolved = getAuth(existing);
-            return resolved;
-        }
-        const app = initializeApp(config.options, appName);
-        resolved = config.persistence
-            ? initializeAuth(app, { persistence: config.persistence })
+        if (existing)
+            assertSameProject(existing.options, options, appName);
+        const app = existing ?? initializeApp(options, appName);
+        const dependencies = authDependencies(config.persistence, config.watchPopupSignIn);
+        resolved = dependencies
+            ? initializeOrReuse(app, dependencies, !config.persistence)
             : getAuth(app);
         return resolved;
     };
+    return { resolve, peek: () => resolved };
 }
 export function createFirebaseIdentity(config) {
-    const auth = authResolver(config);
+    const { resolve: auth, peek } = authResolver(config);
+    let signInsStarted = 0;
+    function popupSignIn(createProvider, options) {
+        const started = ++signInsStarted;
+        const provider = createProvider();
+        const signIn = () => signInWithPopup(auth(), provider);
+        if (!config.watchPopupSignIn)
+            return signIn();
+        // Read once the session has restored, so a restore landing after the
+        // popup opened is not taken for someone else signing in.
+        let userAtStart = null;
+        // Never on the sign-in path: if the restore cannot be read, late results
+        // stay discarded.
+        void Promise.resolve()
+            .then(() => auth().authStateReady())
+            .then(() => {
+            userAtStart = auth().currentUser?.uid;
+        })
+            .catch(() => { });
+        return new Promise((resolve, reject) => {
+            const firebaseCall = runWatchedPopup(provider, signIn, {
+                onAbandoned: () => reject(new FirebaseError('auth/popup-closed-by-user', 'The popup has been closed by the user before finalizing the operation.')),
+                discardLateResult: () => !options?.onResumed ||
+                    signInsStarted !== started ||
+                    auth().currentUser?.uid !== userAtStart ||
+                    options.keepLateResult?.() === false,
+                onResumed: () => options?.onResumed?.(firebaseCall)
+            });
+            firebaseCall.then(resolve, reject);
+        });
+    }
     return {
-        [identityBrand]: true,
-        onUserChanged: (callback) => onAuthStateChanged(auth(), callback),
-        signInWithGoogle: () => signInWithPopup(auth(), googleProvider()),
-        signInWithGitHub: () => signInWithPopup(auth(), githubProvider()),
-        signInWithEmail: (email, password) => signInWithEmailAndPassword(auth(), email, password),
-        createUserWithEmail: (email, password) => createUserWithEmailAndPassword(auth(), email, password),
+        ...brandIdentity({
+            onUserChanged: (callback) => onAuthStateChanged(auth(), callback)
+        }),
+        onTokenChanged: (callback) => onIdTokenChanged(auth(), callback),
+        initialize: () => {
+            auth();
+        },
+        currentUser: () => peek()?.currentUser ?? null,
+        signInWithGoogle: (options) => popupSignIn(googleProvider, options),
+        signInWithGitHub: (options) => popupSignIn(githubProvider, options),
+        signInWithEmail: (email, password) => {
+            signInsStarted += 1;
+            return signInWithEmailAndPassword(auth(), email, password);
+        },
+        createUserWithEmail: (email, password) => {
+            signInsStarted += 1;
+            return createUserWithEmailAndPassword(auth(), email, password);
+        },
         sendPasswordReset: (email) => sendPasswordResetEmail(auth(), email).catch(resolveUnknownEmailAsSent),
         updatePassword: (newPassword) => {
             const user = auth().currentUser;
@@ -72,3 +174,114 @@ export function createFirebaseIdentity(config) {
         signOut: () => signOut(auth())
     };
 }
+/**
+ * One `/api/features` fetch per `cloudBaseUrl`/`timeoutMs` pair, shared by
+ * every reader of the document: `resolveFirebaseIdentity` and
+ * `resolveStripePublishableKey` on the same pair read the same fetch instead
+ * of each starting their own. Never rejects, a failed fetch settles `{}`,
+ * which each field reader treats as absent.
+ *
+ * Memoized while a fetch is in flight or has produced a document with either
+ * field present. A document with neither field is treated the same as a
+ * failed fetch and evicts, matching `identityResolutions` below: this cache
+ * cannot tell a transient failure (network error, timeout, malformed body)
+ * from a Cloud origin that genuinely has neither Firebase nor Stripe
+ * configured, and caching that ambiguity would silently defeat
+ * `identityResolutions`'s own eviction once a caller retries through it.
+ */
+const featureResolutions = new Map();
+function resolveCloudFeatures(cloudBaseUrl, timeoutMs) {
+    const key = `${cloudBaseUrl} ${timeoutMs ?? ''}`;
+    let resolution = featureResolutions.get(key);
+    if (!resolution) {
+        resolution = fetchCloudFeatures(cloudBaseUrl, { timeoutMs });
+        // Evict on an unsuccessful settle so a transient failure does not wedge
+        // every reader of this pair for the module's lifetime. Callers already
+        // hold this promise directly, not a map lookup, so deleting it here
+        // never orphans one.
+        void resolution.then((features) => {
+            if (!features.firebaseConfig &&
+                !features.stripePublishableKey &&
+                featureResolutions.get(key) === resolution) {
+                featureResolutions.delete(key);
+            }
+        });
+        featureResolutions.set(key, resolution);
+    }
+    return resolution;
+}
+/**
+ * The single entry a host needs to go from a Cloud origin to a ready
+ * identity: fetch `/api/features`, construct the app, and force `Auth` to
+ * resolve now rather than on whichever caller first touches the identity, so
+ * a config that fails the SDK's own checks (a bad key, a project mismatch on
+ * `appName`) surfaces here instead of downstream. Settles `undefined` on any
+ * failure along the way and never rejects, so a caller always gets either a
+ * ready identity or a definite absence.
+ *
+ * Memoized per `appName`/`cloudBaseUrl` pair while a fetch is in flight or
+ * has produced a ready identity, so every caller with the same pair shares
+ * one fetch and one identity, and two pairs (two hosts, or two Cloud origins
+ * in one process, as this package's own tests run) never share a result. An
+ * unsuccessful settle evicts its entry, so a later call re-fetches rather
+ * than replaying the same absence for the module's lifetime.
+ */
+const identityResolutions = new Map();
+export function resolveFirebaseIdentity(options) {
+    const { cloudBaseUrl, appName, persistence, timeoutMs } = options;
+    const key = `${appName} ${cloudBaseUrl}`;
+    let resolution = identityResolutions.get(key);
+    if (!resolution) {
+        resolution = resolveCloudFeatures(cloudBaseUrl, timeoutMs).then(({ firebaseConfig }) => {
+            if (!firebaseConfig)
+                return undefined;
+            try {
+                const identity = createFirebaseIdentity({
+                    options: firebaseConfig,
+                    appName,
+                    persistence
+                });
+                identity.initialize();
+                return identity;
+            }
+            catch {
+                return undefined;
+            }
+        });
+        // Evict on an unsuccessful settle so a transient failure does not wedge
+        // sign-in for the module's lifetime. Callers already hold this promise
+        // directly, not a map lookup, so deleting it here never orphans one.
+        void resolution.then((identity) => {
+            if (!identity && identityResolutions.get(key) === resolution) {
+                identityResolutions.delete(key);
+            }
+        });
+        identityResolutions.set(key, resolution);
+    }
+    return resolution;
+}
+/**
+ * The Stripe publishable key from the same `/api/features` document
+ * `resolveFirebaseIdentity` reads. A host that calls both with the same
+ * `cloudBaseUrl`/`timeoutMs` pays for one fetch, not two, `resolveCloudFeatures`
+ * dedupes by that pair regardless of which field a caller asked for first.
+ * Settles `undefined` on any failure and never rejects.
+ */
+export function resolveStripePublishableKey(options) {
+    return resolveCloudFeatures(options.cloudBaseUrl, options.timeoutMs).then(({ stripePublishableKey }) => stripePublishableKey);
+}
+/** The Cloud app's PostHog settings from the same shared `/api/features` document. */
+export function resolveCloudTelemetryConfig(options) {
+    return resolveCloudFeatures(options.cloudBaseUrl, options.timeoutMs).then(({ posthogProjectToken, posthogApiHost, telemetryDisabledEvents }) => ({
+        posthogProjectToken,
+        posthogApiHost,
+        telemetryDisabledEvents
+    }));
+}
+/**
+ * `web_session_probe` from the same shared `/api/features` document, so a
+ * host that already reads it for Firebase or Stripe pays no extra request.
+ */
+export function resolveWebSessionProbe(options) {
+    return resolveCloudFeatures(options.cloudBaseUrl, options.timeoutMs).then(({ webSessionProbe }) => webSessionProbe === true);
+}

package/dist/firebase/popupWatch.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Tells, from facts rather than a timer, whether a popup sign-in was
+ * abandoned. Firebase itself cannot: after the window closes it waits a
+ * hardcoded 8s (on a 2s poll) before rejecting with `popup-closed-by-user`,
+ * because a closed window alone does not say whether the sign-in result had
+ * already been handed over.
+ *
+ * The result is handed over through the resolver's event manager, and
+ * Firebase's hosted handler page waits for the page to acknowledge it before
+ * closing the popup. So "window closed and no result for this operation" means
+ * the visitor gave up, and "result received" means the sign-in is completing,
+ * however long the token exchange then takes.
+ *
+ * This subclasses the SDK's public `browserPopupRedirectResolver` and reads two
+ * of its internals: the event manager `_initialize` resolves to, and the
+ * provider, event id and window `_openPopup` works with
+ * (popupWatchSdkContract.test.ts pins them). When they are not what this
+ * expects, nothing is watched and sign-in keeps Firebase's own timing.
+ */
+import type { PopupRedirectResolver } from 'firebase/auth';
+export interface PopupWatchCallbacks {
+    /** The popup closed before any sign-in result reached the page: the visitor gave up. */
+    readonly onAbandoned?: () => void;
+    /** A result arrived after `onAbandoned` and was kept: the sign-in completes after all. */
+    readonly onResumed?: () => void;
+    /**
+     * Asked when a result arrives after `onAbandoned`. True discards it before
+     * Firebase exchanges it, so no account is signed in or created.
+     */
+    readonly discardLateResult?: () => boolean;
+}
+/**
+ * The resolver a watched identity's Auth is created with. One for the whole
+ * page, so Auth created again for the same app is handed the same resolver.
+ * Firebase's own when its resolver cannot be extended.
+ */
+export declare const watchedPopupRedirectResolver: PopupRedirectResolver;
+/**
+ * Runs one popup sign-in for `provider`, the object passed to
+ * `signInWithPopup`, reporting through `callbacks` while it is pending.
+ */
+export declare function runWatchedPopup<T>(provider: object, signIn: () => Promise<T>, callbacks: PopupWatchCallbacks): Promise<T>;

package/dist/firebase/popupWatch.js

@@ -0,0 +1,140 @@
+import { browserPopupRedirectResolver } from 'firebase/auth';
+/** Frequent enough to feel immediate; one `closed` read per tick. */
+const CLOSED_POLL_MS = 100;
+// Keyed by the provider object each sign-in hands to `signInWithPopup`, which
+// Firebase passes on to `_openPopup`, so a popup Firebase still opens for an
+// operation it already cancelled is never taken for a newer one.
+const attemptsByProvider = new WeakMap();
+const attemptsByEventId = new Map();
+const wrappedManagers = new WeakSet();
+// Only an Auth whose event manager is wrapped has results this can see.
+const observedAuths = new WeakSet();
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function isResolverClass(value) {
+    if (typeof value !== 'function')
+        return false;
+    const prototype = value.prototype;
+    return (typeof prototype === 'object' &&
+        prototype !== null &&
+        '_initialize' in prototype &&
+        '_openPopup' in prototype);
+}
+function isEventManager(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'onEvent' in value &&
+        typeof value.onEvent === 'function');
+}
+function popupWindowOf(popup) {
+    if (typeof popup !== 'object' || popup === null || !('window' in popup))
+        return undefined;
+    const { window } = popup;
+    return typeof window === 'object' && window !== null && 'closed' in window
+        ? window
+        : undefined;
+}
+function stopPolling(attempt) {
+    clearInterval(attempt.poll);
+    attempt.poll = undefined;
+}
+function deliver(original, event) {
+    const attempt = event.type === 'signInViaPopup' && typeof event.eventId === 'string'
+        ? attemptsByEventId.get(event.eventId)
+        : undefined;
+    if (!attempt)
+        return original(event);
+    stopPolling(attempt);
+    // A late failure is Firebase's to report; the host already heard the close.
+    if (!attempt.abandoned || event.error)
+        return original(event);
+    // Acknowledged so the handler page stops, never handed to Firebase.
+    if (shouldDiscard(attempt))
+        return true;
+    attempt.abandoned = false;
+    try {
+        attempt.callbacks.onResumed?.();
+    }
+    catch {
+        // The result is kept either way; a host bug must not stall Firebase.
+    }
+    return original(event);
+}
+function shouldDiscard(attempt) {
+    try {
+        return attempt.callbacks.discardLateResult?.() ?? false;
+    }
+    catch {
+        return true;
+    }
+}
+/** Ties the attempt to its latest popup, dropping any earlier one's watch. */
+function watchWindow(attempt, eventId, popup) {
+    stopPolling(attempt);
+    if (attempt.eventId)
+        attemptsByEventId.delete(attempt.eventId);
+    attempt.eventId = eventId;
+    attemptsByEventId.set(eventId, attempt);
+    attempt.poll = setInterval(() => {
+        if (popup.closed !== true)
+            return;
+        stopPolling(attempt);
+        attempt.abandoned = true;
+        attempt.callbacks.onAbandoned?.();
+    }, CLOSED_POLL_MS);
+}
+function watchingResolver(Base) {
+    return class WatchingPopupRedirectResolver extends Base {
+        async _initialize(auth) {
+            const manager = await super._initialize(auth);
+            if (!isEventManager(manager))
+                return manager;
+            if (!wrappedManagers.has(manager)) {
+                const original = manager.onEvent.bind(manager);
+                manager.onEvent = (event) => deliver(original, event);
+                wrappedManagers.add(manager);
+            }
+            if (isObject(auth))
+                observedAuths.add(auth);
+            return manager;
+        }
+        async _openPopup(auth, provider, authType, eventId) {
+            const popup = await super._openPopup(auth, provider, authType, eventId);
+            const attempt = isObject(provider)
+                ? attemptsByProvider.get(provider)
+                : undefined;
+            const popupWindow = popupWindowOf(popup);
+            // Without results to compare against, a closed window proves nothing.
+            const observed = isObject(auth) && observedAuths.has(auth);
+            if (attempt && observed && eventId && popupWindow)
+                watchWindow(attempt, eventId, popupWindow);
+            return popup;
+        }
+    };
+}
+/**
+ * The resolver a watched identity's Auth is created with. One for the whole
+ * page, so Auth created again for the same app is handed the same resolver.
+ * Firebase's own when its resolver cannot be extended.
+ */
+export const watchedPopupRedirectResolver = isResolverClass(browserPopupRedirectResolver)
+    ? watchingResolver(browserPopupRedirectResolver)
+    : browserPopupRedirectResolver;
+/**
+ * Runs one popup sign-in for `provider`, the object passed to
+ * `signInWithPopup`, reporting through `callbacks` while it is pending.
+ */
+export async function runWatchedPopup(provider, signIn, callbacks) {
+    const attempt = { callbacks, abandoned: false };
+    attemptsByProvider.set(provider, attempt);
+    try {
+        return await signIn();
+    }
+    finally {
+        stopPolling(attempt);
+        attemptsByProvider.delete(provider);
+        if (attempt.eventId)
+            attemptsByEventId.delete(attempt.eventId);
+    }
+}

package/dist/testing.d.ts

@@ -2,6 +2,44 @@
  * The test seam for fakes: a hand-written port becomes an identity the
  * session client accepts. Production hosts use `@comfyorg/account-core/firebase`.
  */
+import type { WebSessionUser } from './core/sessionContracts.js';
 export type { IdentityPort } from './core/identity.js';
 export { brandIdentity as createTestIdentity } from './core/identity.js';
 export declare const ENUMERATION_ORACLE: RegExp;
+export type { WebSessionUser } from './core/sessionContracts.js';
+export declare function fakeWebSessionUser(overrides?: Partial<WebSessionUser>): WebSessionUser;
+/** The five boot cases, plus any other transient status. */
+export type FakeWebSessionState = {
+    readonly kind: 'live';
+    readonly user: WebSessionUser;
+} | {
+    readonly kind: 'dead';
+    readonly code: 'no_session' | 'session_expired' | 'session_revoked';
+} | {
+    readonly kind: 'network_error';
+} | {
+    readonly kind: 'unavailable';
+    readonly status: number;
+};
+export interface FakeWebSessionRequest {
+    readonly method: string;
+    readonly path: string;
+    readonly credentials: RequestCredentials | undefined;
+    readonly cache: RequestCache | undefined;
+    readonly headers: Readonly<Record<string, string>>;
+}
+export interface FakeWebSessionEndpoint {
+    readonly fetch: typeof fetch;
+    readonly requests: readonly FakeWebSessionRequest[];
+    state: FakeWebSessionState;
+}
+/**
+ * A `fetch` serving ingest's session routes under `/api/auth`. POST with a
+ * bearer proof signs `signInUser` in; DELETE and revoke-all leave the cookie
+ * revoked, as the real endpoint does.
+ */
+export declare function createFakeWebSessionEndpoint({ state, signInUser, now }: {
+    state: FakeWebSessionState;
+    signInUser?: WebSessionUser;
+    now?: () => number;
+}): FakeWebSessionEndpoint;