@dereekb/dbx-cli 14.3.0 → 14.5.0

package/lint-cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli-lint-cache",
-  "version": "14.3.0",
+  "version": "14.5.0",
   "sideEffects": false,
   "private": true,
   "type": "module",
@@ -9,7 +9,7 @@
     "eslint": "10.9.1"
   },
   "peerDependencies": {
-    "@dereekb/util": "14.3.0",
+    "@dereekb/util": "14.5.0",
     "yargs": "^18.0.0"
   }
 }

package/manifest-extract/package.json

@@ -1,18 +1,22 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "14.3.0",
+  "version": "14.5.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "14.3.0",
-    "@dereekb/dbx-cli": "14.3.0",
-    "@dereekb/firebase": "14.3.0",
-    "@dereekb/model": "14.3.0",
-    "@dereekb/nestjs": "14.3.0",
-    "@dereekb/rxjs": "14.3.0",
-    "@dereekb/util": "14.3.0",
+    "@dereekb/date": "14.5.0",
+    "@dereekb/dbx-cli": "14.5.0",
+    "@dereekb/firebase": "14.5.0",
+    "@dereekb/model": "14.5.0",
+    "@dereekb/nestjs": "14.5.0",
+    "@dereekb/oauth-resource": "14.5.0",
+    "@dereekb/rxjs": "14.5.0",
+    "@dereekb/util": "14.5.0",
     "ts-morph": "^28.0.0"
   },
+  "devDependencies": {
+    "@dereekb/firebase": "14.5.0"
+  },
   "exports": {
     "./package.json": "./package.json",
     ".": {

package/model-test/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli/model-test",
-  "version": "14.3.0",
+  "version": "14.5.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/util": "14.3.0",
+    "@dereekb/util": "14.5.0",
     "ts-morph": "^28.0.0"
   },
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "14.3.0",
+  "version": "14.5.0",
   "type": "module",
   "sideEffects": false,
   "bin": {
@@ -66,11 +66,12 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "14.3.0",
-    "@dereekb/firebase": "14.3.0",
-    "@dereekb/model": "14.3.0",
-    "@dereekb/nestjs": "14.3.0",
-    "@dereekb/util": "14.3.0",
+    "@dereekb/date": "14.5.0",
+    "@dereekb/firebase": "14.5.0",
+    "@dereekb/model": "14.5.0",
+    "@dereekb/nestjs": "14.5.0",
+    "@dereekb/oauth-resource": "14.5.0",
+    "@dereekb/util": "14.5.0",
     "@nestjs/common": "^12.0.1",
     "arktype": "^2.2.0",
     "firebase": "^12.18.0",
@@ -83,7 +84,9 @@
   "devDependencies": {
     "@angular/core": "22.1.4",
     "@types/yargs": "^17.0.35",
-    "eslint": "10.9.1"
+    "@typescript-eslint/parser": "8.69.0",
+    "eslint": "10.9.1",
+    "firebase": "^12.18.0"
   },
   "module": "./index.esm.js",
   "main": "./index.esm.js",

package/route/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@dereekb/dbx-cli/route",
-  "version": "14.3.0",
+  "version": "14.5.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "14.3.0",
-    "@dereekb/dbx-cli": "14.3.0",
-    "@dereekb/firebase": "14.3.0",
-    "@dereekb/model": "14.3.0",
-    "@dereekb/nestjs": "14.3.0",
-    "@dereekb/util": "14.3.0"
+    "@dereekb/date": "14.5.0",
+    "@dereekb/dbx-cli": "14.5.0",
+    "@dereekb/firebase": "14.5.0",
+    "@dereekb/model": "14.5.0",
+    "@dereekb/nestjs": "14.5.0",
+    "@dereekb/oauth-resource": "14.5.0",
+    "@dereekb/util": "14.5.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/lib/api/firestore-session.client.d.ts

@@ -1,33 +1,20 @@
+import { type FirestoreSessionCredentials, type FirestoreSessionErrorFactory } from '@dereekb/oauth-resource/firebase';
+export { FIRESTORE_SESSION_API_PATH } from '@dereekb/oauth-resource/firebase';
 /**
- * Path (relative to the API base URL) of the direct-Firestore session endpoint served by
- * `@dereekb/firebase-server`'s `SessionApiController`.
+ * The credential bundle `GET <apiBaseUrl>/session/firestore` returns.
  *
- * Duplicated here rather than imported so `dbx-cli` keeps no dependency on the server package —
- * the same arrangement `CALL_MODEL_API_PATH` uses.
+ * The CLI's name for {@link FirestoreSessionCredentials}, which is the shared implementation in
+ * `@dereekb/oauth-resource/firebase`.
  */
-export declare const FIRESTORE_SESSION_API_PATH = "/session/firestore";
+export type CliFirestoreSession = FirestoreSessionCredentials;
 /**
- * The credential bundle `GET <apiBaseUrl>/session/firestore` returns.
+ * Maps a generic session failure onto a {@link CliError}, re-attaching the CLI-flavored remediation
+ * an operator can act on (`<cli> auth login --env <env>` and friends).
+ *
+ * @param input - The generic failure.
+ * @returns The `CliError` to throw.
  */
-export interface CliFirestoreSession {
-    /**
-     * The uid the session was minted for.
-     */
-    readonly uid: string;
-    /**
-     * A Firebase Auth custom token to exchange via `signInWithCustomToken`.
-     */
-    readonly customToken: string;
-    /**
-     * An App Check attestation minted server-side for the project's registered web app. Absent when
-     * the API has no `appCheckAppId` configured (a project that does not enforce App Check).
-     */
-    readonly appCheckToken?: string;
-    /**
-     * ISO timestamp at which the session's shortest-lived credential expires.
-     */
-    readonly expiresAt: string;
-}
+export declare const cliFirestoreSessionErrorFactory: FirestoreSessionErrorFactory;
 export interface FetchFirestoreSessionInput {
     /**
      * The API base URL — typically `<host>/<project>/us-central1/api` or `https://<domain>/api`.
@@ -44,11 +31,18 @@ export interface FetchFirestoreSessionInput {
 /**
  * Fetches a direct-Firestore session from the API with the cached Bearer access token.
  *
- * The endpoint is admin-only and additionally gated on the `session.firestore` OIDC scope, so a 403
- * here usually means the logged-in user is not an admin or logged in without that scope.
+ * The thin CLI wrapper over `@dereekb/oauth-resource/firebase`'s `fetchFirestoreSession`: it binds
+ * the CLI's `tracedFetch` (so `--verbose` and `--timeout` apply) and the `CliError` factory.
  *
  * @param input - The API target, access token, and optional fetch override.
  * @returns The parsed {@link CliFirestoreSession}.
  * @throws {CliError} When the endpoint answers non-2xx or returns an unusable body.
  */
 export declare function fetchFirestoreSession(input: FetchFirestoreSessionInput): Promise<CliFirestoreSession>;
+/**
+ * Binds the CLI's verbose-trace + `--timeout` fetch behavior onto the supplied (or global) fetch.
+ *
+ * @param fetcher - The underlying fetch impl, when one was injected.
+ * @returns A `fetch`-shaped function carrying the CLI's tracing.
+ */
+export declare function cliFirestoreSessionFetcher(fetcher?: typeof fetch): typeof fetch;

package/src/lib/auth/auth.command.factory.d.ts

@@ -13,13 +13,39 @@ export interface CreateAuthCommandInput {
      */
     readonly defaultEnvs?: readonly CliEnvDefault[];
 }
+/**
+ * Env name a handoff falls back to when nothing else names one — no `--env`, no `envName` from the
+ * minting deployment, no active env, and no single built-in default to borrow a name from.
+ *
+ * Only reachable on an unconfigured machine redeeming against a server that declares no
+ * `CliTokenApiModuleConfig.envName`. A neutral name is better than refusing: the credential is
+ * already spent by this point, so failing here would burn a one-time code.
+ */
+export declare const DEFAULT_HANDOFF_ENV_NAME = "default";
+/**
+ * Whether two OIDC issuer URLs name the same provider, ignoring the differences that carry no
+ * meaning — a trailing slash, case in the scheme/host, and a default port for the scheme.
+ *
+ * Used to decide whether redeeming a claim would REPOINT an existing env at a different deployment.
+ * Anything unparseable falls back to a trimmed string compare rather than reporting a match, so a
+ * malformed value fails closed into the guard.
+ *
+ * @param a - The env's currently configured issuer.
+ * @param b - The issuer the claimed bundle came from.
+ * @returns True when both resolve to the same origin and path.
+ */
+export declare function cliIssuersMatch(a: string, b: string): boolean;
 /**
  * Factory for the built-in `auth` command tree.
  *
- * Wires `setup`, `login`, `logout`, `status`, `show`, and `check` subcommands that drive the OIDC
- * PKCE flow against the active env, persist tokens via the per-CLI token cache, and print a
+ * Wires `setup`, `login`, `handoff`, `logout`, `status`, `show`, and `check` subcommands that drive
+ * the OIDC PKCE flow against the active env, persist tokens via the per-CLI token cache, and print a
  * structured envelope.
  *
+ * `handoff` is the non-interactive counterpart to `login`: it redeems a one-time claim code minted by
+ * an already-authenticated MCP session, so an agent can bring a CLI up on a bare machine with no
+ * browser and no prior `auth setup`.
+ *
  * @param input - Factory configuration.
  * @param input.cliName - The CLI's binary name. Used for the per-user config dir, env-var prefix, and error messages.
  * @param input.envVarName - Override for the env-name env var. Defaults to `<CLINAME>_ENV` (e.g. `DEMO_CLI_ENV`).

package/src/lib/auth/cli-handoff.client.d.ts

@@ -0,0 +1,62 @@
+import { type ISO8601DateString } from '@dereekb/util';
+/**
+ * Path, relative to the OIDC issuer, of the one-time claim redemption endpoint.
+ *
+ * Mirrors `FIREBASE_SERVER_CLI_TOKEN_CLAIM_PATH` on the server. Duplicated rather than imported so
+ * `@dereekb/dbx-cli` keeps taking no dependency on `@dereekb/firebase-server`.
+ */
+export declare const CLI_TOKEN_CLAIM_ENDPOINT_PATH_PART = "/cli-token/claim";
+/**
+ * The credential bundle `POST <issuer>/cli-token/claim` returns — everything a bare machine needs to
+ * create an env and be logged in.
+ *
+ * The server-side shape is `CliTokenHandoffBundle` in `@dereekb/firebase-server/oidc`.
+ */
+export interface CliHandoffBundle {
+    readonly uid: string;
+    readonly issuer: string;
+    readonly apiBaseUrl?: string;
+    /**
+     * The env name the minting deployment says it is. Advisory — an explicit `--env` still wins — but
+     * it is what lets the rendered one-line handoff command work on a machine with no config at all.
+     */
+    readonly envName?: string;
+    readonly clientId: string;
+    readonly refreshToken: string;
+    readonly scope: string;
+    readonly expiresAt: ISO8601DateString;
+}
+/**
+ * Inputs to {@link claimCliHandoff}.
+ */
+export interface ClaimCliHandoffInput {
+    /**
+     * The env's OIDC issuer URL, e.g. `https://example.com/oidc`.
+     */
+    readonly oidcIssuer: string;
+    /**
+     * The one-time claim code an MCP session's `cli-token` tool produced.
+     */
+    readonly code: string;
+}
+/**
+ * Builds the claim endpoint URL from an OIDC issuer.
+ *
+ * @param oidcIssuer - The env's OIDC issuer URL.
+ * @returns The claim endpoint URL.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function buildCliHandoffClaimEndpoint(oidcIssuer: string): string;
+/**
+ * Redeems a one-time claim code for the credential bundle it wraps.
+ *
+ * The request carries no credential of its own — the code IS the credential, which is the entire
+ * point: the machine running this has nothing yet. The server answers every failure (unknown code,
+ * expired code, already-redeemed code) with the same generic error, so this reports one message too
+ * rather than inventing a distinction the server deliberately withholds.
+ *
+ * @param input - The issuer and the claim code.
+ * @returns The parsed {@link CliHandoffBundle}.
+ * @throws {CliError} `AUTH_HANDOFF_FAILED` when the code is rejected or the response is unusable.
+ */
+export declare function claimCliHandoff(input: ClaimCliHandoffInput): Promise<CliHandoffBundle>;

package/src/lib/auth/index.d.ts

@@ -1,4 +1,5 @@
 export * from './auth.command.factory';
+export * from './cli-handoff.client';
 export * from './oidc.client';
 export * from './oidc.flow';
 export * from './oidc.loopback';

package/src/lib/config/cli.config.d.ts

@@ -51,6 +51,14 @@ export interface SaveCliConfigInput extends LoadCliConfigInput {
     readonly configDir: string;
     readonly config: CliConfig;
 }
+/**
+ * File mode `config.json` is written with.
+ *
+ * Owner-only, matching `.tokens.json`: the config holds `clientSecret` for a confidential client,
+ * which is every bit as sensitive as a cached token. It previously inherited the umask (0644 in the
+ * usual case), leaving a real credential world-readable on a shared machine.
+ */
+export declare const CLI_CONFIG_FILE_MODE = 384;
 /**
  * Writes the full {@link CliConfig} to disk, creating the parent directory if needed.
  *

package/src/lib/config/env.d.ts

@@ -1,4 +1,5 @@
 import { type Maybe, type OidcClientAuthMethod } from '@dereekb/util';
+import { type FirebaseClientConfig, type FirebaseClientEmulatorsConfig, firebaseClientEmulatorsInUse, isFirebaseClientConfigComplete } from '@dereekb/oauth-resource/firebase';
 import { type CliTokenEntry } from './token.cache';
 /**
  * The default OAuth/OIDC scopes requested by the CLI when none are configured.
@@ -117,67 +118,22 @@ export declare function mergeCliEnvWithDefault(input: MergeCliEnvWithDefaultInpu
  */
 export declare function mergeCliFirebaseConfig(env: Maybe<CliFirebaseConfig>, defaultEnv: Maybe<CliFirebaseConfig>): CliFirebaseConfig | undefined;
 /**
- * Local Firebase emulator targets for a CLI env.
- *
- * Mirrors the semantics of `DbxFirebaseEmulatorsConfig` in `@dereekb/dbx-firebase` (whose parse
- * helper is Angular-bound and not reusable here): the presence of this object means "use emulators"
- * unless {@link useEmulators} is explicitly `false`.
- *
- * App Check is auto-disabled whenever emulators are in use — the emulators do not verify
- * attestations, and `initializeAppCheck` against a fake project only gets in the way.
+ * Local Firebase emulator targets for a CLI env. The CLI's name for
+ * {@link FirebaseClientEmulatorsConfig}.
  */
-export interface CliFirebaseEmulatorsConfig {
-    /**
-     * Set `false` to keep the emulator targets configured but inactive. Defaults to `true`.
-     */
-    readonly useEmulators?: boolean;
-    /**
-     * Host the emulators are reachable at. Defaults to {@link DEFAULT_CLI_FIREBASE_EMULATOR_HOST}.
-     */
-    readonly host?: string;
-    /**
-     * Port of the Auth emulator. When unset, Auth is not redirected to an emulator.
-     */
-    readonly authPort?: number;
-    /**
-     * Port of the Firestore emulator. When unset, Firestore is not redirected to an emulator.
-     */
-    readonly firestorePort?: number;
-}
+export type CliFirebaseEmulatorsConfig = FirebaseClientEmulatorsConfig;
 /**
  * Firebase client-SDK configuration for a CLI env, used only by the direct-Firestore session
  * (`CliContext.getFirestoreContext`). Everything else the CLI does goes over the model HTTP API and
  * needs none of this.
  *
- * These are the same public values the app's browser client initializes with — copy them from the
- * target app's environment file. `appId` in particular must be the registered **web** app, since the
- * server mints its App Check attestation for that app.
+ * The CLI's name for {@link FirebaseClientConfig}: the same shape any resource server opening a
+ * user-scoped Firestore session supplies.
  */
-export interface CliFirebaseConfig {
-    /**
-     * The Firebase web API key.
-     */
-    readonly apiKey?: string;
-    /**
-     * The project's auth domain (e.g. `my-project.firebaseapp.com`).
-     */
-    readonly authDomain?: string;
-    /**
-     * The Firebase project id.
-     */
-    readonly projectId?: string;
-    /**
-     * The registered **web** app id (e.g. `1:1234567890:web:abcdef`).
-     */
-    readonly appId?: string;
-    /**
-     * Optional emulator targets for local development.
-     */
-    readonly emulators?: CliFirebaseEmulatorsConfig;
-}
+export type CliFirebaseConfig = FirebaseClientConfig;
 /**
  * Default host used for Firebase emulator connections when a {@link CliFirebaseEmulatorsConfig}
- * omits one.
+ * omits one. See {@link DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST}.
  */
 export declare const DEFAULT_CLI_FIREBASE_EMULATOR_HOST = "localhost";
 /**
@@ -187,17 +143,14 @@ export declare const DEFAULT_CLI_FIREBASE_EMULATOR_HOST = "localhost";
  * Deliberately separate from {@link isCliEnvConfigComplete}: the Firebase config is optional, and
  * folding it into the general completeness check would break every CLI that only uses the model API.
  *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when `apiKey`, `projectId`, and `appId` are all present and non-empty.
+ * See {@link isFirebaseClientConfigComplete}.
  */
-export declare function isCliFirebaseConfigComplete(firebase: Maybe<CliFirebaseConfig>): firebase is Required<Pick<CliFirebaseConfig, 'apiKey' | 'projectId' | 'appId'>> & CliFirebaseConfig;
+export declare const isCliFirebaseConfigComplete: typeof isFirebaseClientConfigComplete;
 /**
- * Returns true when the env's emulator config is present and active.
- *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when emulators are configured and not explicitly disabled.
+ * Returns true when the env's emulator config is present and active. See
+ * {@link firebaseClientEmulatorsInUse}.
  */
-export declare function cliFirebaseEmulatorsInUse(firebase: Maybe<CliFirebaseConfig>): boolean;
+export declare const cliFirebaseEmulatorsInUse: typeof firebaseClientEmulatorsInUse;
 /**
  * The OAuth client's registered `token_endpoint_auth_method`, as far as the CLI needs to model it.
  *

package/src/lib/config/firestore-session.cache.d.ts

@@ -1,40 +1,19 @@
-import { type AsyncKeyedValueCache, type Maybe } from '@dereekb/util';
-import { type CliFirestoreSession } from '../api/firestore-session.client';
+import { type FirestoreSessionCacheEntry, type FirestoreSessionCredentialsCache, firestoreSessionEntryExpiresAt, isFirestoreSessionExpired } from '@dereekb/oauth-resource/firebase';
 /**
  * Hard ceiling on how long a minted direct-Firestore session may be reused, regardless of what the
- * API reported in `expiresAt`.
- *
- * One hour, because that is the Firebase ceiling the credentials themselves sit under: a custom
- * token is exchangeable for one hour, and the ID token it mints lives one hour. Holding a session
- * past that buys nothing — the sign-in would fail — and re-minting is one HTTP round-trip.
+ * API reported in `expiresAt`. See {@link FIRESTORE_SESSION_MAX_CACHE_MS}.
  */
 export declare const CLI_FIRESTORE_SESSION_MAX_CACHE_MS: number;
 /**
- * Default skew/latency buffer applied when deciding whether a cached session is still usable.
+ * Default skew/latency buffer applied when deciding whether a cached session is still usable. See
+ * {@link FIRESTORE_SESSION_EXPIRY_BUFFER_MS}.
  */
-export declare const CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS = 60000;
+export declare const CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS: number;
 /**
- * A cached direct-Firestore session for a single env.
- *
- * Stores the credential envelope the API minted, not the live Firebase objects — those are
- * per-process and cannot be serialized. A cache hit still signs in; it just skips the
- * `GET /session/firestore` round-trip.
+ * A cached direct-Firestore session for a single env. The CLI's name for
+ * {@link FirestoreSessionCacheEntry}.
  */
-export interface CliFirestoreSessionEntry {
-    /**
-     * The credential bundle returned by `GET /session/firestore`.
-     */
-    readonly session: CliFirestoreSession;
-    /**
-     * Unix epoch milliseconds at which the entry was written.
-     */
-    readonly cachedAt: number;
-    /**
-     * The uid the entry was minted for, denormalized so a stale entry belonging to a different user
-     * can be detected without parsing the custom token.
-     */
-    readonly uid: string;
-}
+export type CliFirestoreSessionEntry = FirestoreSessionCacheEntry;
 /**
  * Firestore session cache shape on disk — keyed by env name.
  */
@@ -45,13 +24,18 @@ export type CliFirestoreSessionCache = Record<string, CliFirestoreSessionEntry>;
  * Backed by a single JSON file with per-process in-memory memoization, exactly like the token
  * cache — see {@link createMemoizedJsonFileAsyncKeyedValueCache}.
  */
-export type CliFirestoreSessionCacheStore = AsyncKeyedValueCache<CliFirestoreSessionEntry>;
+export type CliFirestoreSessionCacheStore = FirestoreSessionCredentialsCache;
 export interface CreateCliFirestoreSessionCacheStoreInput {
     readonly firestoreSessionCachePath: string;
 }
 /**
  * Creates a per-env direct-Firestore session cache store backed by a single JSON file.
  *
+ * The file-backed half of the session cache stays HERE rather than moving to
+ * `@dereekb/oauth-resource/firebase`: it depends on `@dereekb/nestjs`, and a Nest peer has no business
+ * in a package whose whole point is a clean install graph. Only the expiry policy and the
+ * {@link FirestoreSessionCredentialsCache} port are shared.
+ *
  * Entries are written with mode 0o600 — they hold a Firebase custom token, which is a bearer
  * credential for the user it was minted for.
  *
@@ -62,25 +46,12 @@ export interface CreateCliFirestoreSessionCacheStoreInput {
  */
 export declare function createCliFirestoreSessionCacheStore(input: CreateCliFirestoreSessionCacheStoreInput): CliFirestoreSessionCacheStore;
 /**
- * Resolves the epoch-millis instant at which a cached session stops being usable.
- *
- * The effective expiry is the EARLIER of the API-reported `expiresAt` and
- * {@link CLI_FIRESTORE_SESSION_MAX_CACHE_MS} past the write. Taking the earlier of the two means a
- * server that reports an over-long (or unparsable) window still cannot push a session past the
- * Firebase credential ceiling.
- *
- * @param entry - The cached entry.
- * @returns The effective expiry in unix epoch milliseconds.
- *
- * @__NO_SIDE_EFFECTS__
+ * Resolves the epoch-millis instant at which a cached session stops being usable. See
+ * {@link firestoreSessionEntryExpiresAt}.
  */
-export declare function cliFirestoreSessionEntryExpiresAt(entry: CliFirestoreSessionEntry): number;
+export declare const cliFirestoreSessionEntryExpiresAt: typeof firestoreSessionEntryExpiresAt;
 /**
- * Returns true when the cached session is at or near its effective expiry.
- *
- * @param entry - The cached entry (`null`/`undefined` is treated as expired).
- * @param nowMs - The current time in unix epoch milliseconds. Defaults to `Date.now()`.
- * @param bufferMs - Skew/latency buffer; the entry is treated as expired this far ahead of its effective expiry.
- * @returns `true` when the entry is unusable, otherwise `false`.
+ * Returns true when the cached session is at or near its effective expiry. See
+ * {@link isFirestoreSessionExpired}.
  */
-export declare function isCliFirestoreSessionExpired(entry: Maybe<CliFirestoreSessionEntry>, nowMs?: number, bufferMs?: number): boolean;
+export declare const isCliFirestoreSessionExpired: typeof isFirestoreSessionExpired;