@dereekb/dbx-firebase 14.0.1 → 14.1.0

package/fesm2022/dereekb-dbx-firebase.mjs

@@ -5,8 +5,8 @@ import { asObservable, timeoutStartWith, filterMaybe, isNot, SubscriptionObject,
 import { Observable, switchMap, of, shareReplay, map, Subject, merge, distinctUntilChanged, EMPTY, catchError, firstValueFrom, tap, BehaviorSubject, combineLatest, first, from, interval, exhaustMap, filter, take, startWith, throttleTime, NEVER, defaultIfEmpty, combineLatestWith, mergeMap, timer, takeWhile, withLatestFrom } from 'rxjs';
 import * as i1$1 from '@dereekb/dbx-core';
 import { loggedInObsFromIsLoggedIn, loggedOutObsFromIsLoggedIn, authUserIdentifier, DbxInjectionContext, DBX_INJECTION_COMPONENT_DATA, DbxInjectionComponent, AbstractForwardDbxInjectionContextDirective, DbxInjectionContextDirective, DbxAuthImpersonationDelegate, DbxAuthService, provideDbxAuthImpersonation, DbxActionButtonDirective, completeOnDestroy, cleanSubscription, DbxActionDirective, DbxActionEnforceModifiedDirective, DbxActionHandlerDirective, DbxActionAutoTriggerDirective, clean, cleanLoadingContext, provideDbxRouteModelIdDirectiveDelegate, provideDbxRouteModelKeyDirectiveDelegate, AbstractIfDirective, LockSetComponentStore, newWithInjector, DbxActionValueDirective, DbxActionDisabledDirective, TimeDistanceCountdownPipe, TimeDistancePipe, DbxActionContextStoreSourceInstance, DbxActionHandlerInstance, cleanSubscriptionWithLockSet, DbxButton, CutTextPipe, SimpleStorageAccessorFactory, dbxRouteParamReaderInstance, DbxRouteParamDefaultRedirectInstance } from '@dereekb/dbx-core';
-import { onAuthStateChanged, onIdTokenChanged, confirmPasswordReset, sendPasswordResetEmail, signInWithPopup, signInWithRedirect, linkWithPopup, linkWithRedirect, linkWithCredential, unlink, createUserWithEmailAndPassword, signInWithEmailAndPassword, signInAnonymously, reauthenticateWithPopup, reauthenticateWithRedirect, getRedirectResult, OAuthProvider, FacebookAuthProvider, GithubAuthProvider, GoogleAuthProvider, TwitterAuthProvider, getAuth, connectAuthEmulator } from 'firebase/auth';
-import { AUTH_ADMIN_ROLE, cachedGetter, urlWithoutParameters, addToSet, removeFromSet, filterMaybeArrayValues, mapIterable, asArray, excludeValuesFromArray, containsStringAnyCase, addToSetCopy, iterableToArray, runAsyncTasksForValues, forEachKeyValue, countAllInNestedArray, invertDecision, useIterableOrValue, filterUniqueValues, reverseCompareFn, sortByNumberFunction, separateValues, readableError, isMaybeSo, firstValue, fixExtraQueryParameters, splitJoinRemainder, MS_IN_HOUR, SECONDS_IN_MINUTE, MS_IN_DAY, unixDateTimeSecondsNumberForNow, MS_IN_MINUTE, addMilliseconds, unixDateTimeSecondsNumberFromDate, dateFromDateOrTimeSecondsNumber, MS_IN_SECOND, isPast, takeFront, areEqualPOJOValues } from '@dereekb/util';
+import { onAuthStateChanged, onIdTokenChanged, confirmPasswordReset, sendPasswordResetEmail, signInWithPopup, signInWithRedirect, linkWithPopup, linkWithRedirect, linkWithCredential, unlink, createUserWithEmailAndPassword, signInWithEmailAndPassword, signInAnonymously, signInWithCustomToken, reauthenticateWithPopup, reauthenticateWithRedirect, getRedirectResult, OAuthProvider, FacebookAuthProvider, GithubAuthProvider, GoogleAuthProvider, TwitterAuthProvider, getAuth, connectAuthEmulator } from 'firebase/auth';
+import { AUTH_ADMIN_ROLE, cachedGetter, urlWithoutParameters, addToSet, removeFromSet, filterMaybeArrayValues, mapIterable, asArray, excludeValuesFromArray, containsStringAnyCase, addToSetCopy, iterableToArray, runAsyncTasksForValues, forEachKeyValue, countAllInNestedArray, invertDecision, useIterableOrValue, filterUniqueValues, reverseCompareFn, sortByNumberFunction, separateValues, readableError, isMaybeSo, firstValue, fixExtraQueryParameters, generatePkceMaterial, splitJoinRemainder, MS_IN_HOUR, SECONDS_IN_MINUTE, MS_IN_DAY, unixDateTimeSecondsNumberForNow, MS_IN_MINUTE, addMilliseconds, unixDateTimeSecondsNumberFromDate, dateFromDateOrTimeSecondsNumber, MS_IN_SECOND, isPast, takeFront, areEqualPOJOValues } from '@dereekb/util';
 import { safeFormatToISO8601DateString, msToSeconds, isSameDate } from '@dereekb/date';
 import { getToken, initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check';
 import * as i1$2 from '@dereekb/dbx-web';
@@ -636,6 +636,25 @@ class DbxFirebaseAuthService {
     logInAsAnonymous() {
         return signInAnonymously(this.firebaseAuth);
     }
+    /**
+     * Signs in with a Firebase custom token minted by this app's server.
+     *
+     * The bridge for a third-party provider Firebase Auth has no native provider for: the server
+     * authenticates the user against that provider, resolves them to a uid, and mints a token for it.
+     *
+     * The resulting user has NO `providerData` entry — there is no Firebase provider behind them — so
+     * the link/unlink surface does not apply. Managing that third-party identity is the external
+     * connection flow's job. The server's stored custom claims are spread to the top level of the
+     * exchanged ID token as usual, so security rules behave exactly as for any other sign-in.
+     *
+     * No `_authUpdate$` nudge is needed: this fires `onAuthStateChanged` like any other sign-in.
+     *
+     * @param token - The custom token from the server.
+     * @returns The credential for the signed-in user.
+     */
+    logInWithCustomToken(token) {
+        return signInWithCustomToken(this.firebaseAuth, token);
+    }
     logOut() {
         return this.firebaseAuth.signOut();
     }
@@ -1327,6 +1346,14 @@ class AbstractConfiguredDbxFirebaseLoginButtonDirective {
     get effectiveLoginMode() {
         return this._injectionData?.loginMode ?? 'login';
     }
+    /**
+     * The registered provider's `componentData`, when the list passed any.
+     *
+     * @returns The component data, or null when the provider declared none.
+     */
+    get injectedComponentData() {
+        return this._injectionData?.componentData;
+    }
     ngOnInit() {
         const assets = this.assetConfig;
         const text = this._textForMode(assets);
@@ -1858,12 +1885,15 @@ function defaultFirebaseAuthLoginProvidersFactory() {
  * @returns EnvironmentProviders.
  */
 function provideDbxFirebaseLogin(config) {
-    const { termsOfServiceUrls: loginTerms, enabledLoginMethods, loginTermsComponentClass, passwordConfig } = config;
+    const { termsOfServiceUrls: loginTerms, enabledLoginMethods, loginTermsComponentClass, passwordConfig, additionalProviders } = config;
     const providers = [
         // Default login providers
         {
             provide: DEFAULT_FIREBASE_AUTH_LOGIN_PROVIDERS_TOKEN,
-            useFactory: defaultFirebaseAuthLoginProvidersFactory
+            // the app's own providers go LAST: the service registers this array with `override: false`, so
+            // an app entry for a type the defaults also carry would be dropped rather than winning — which
+            // is the existing contract, and additional providers are additions, not replacements
+            useFactory: () => [...defaultFirebaseAuthLoginProvidersFactory(), ...(additionalProviders ?? [])]
         },
         // Config for terms
         {
@@ -1899,6 +1929,75 @@ function provideDbxFirebaseLogin(config) {
     return makeEnvironmentProviders(providers);
 }
 
+/**
+ * A source of login method types that are linked to the signed-in user but are NOT Firebase-native
+ * providers.
+ *
+ * The seam exists because `currentLinkedProviderIds$` reads `user.providerData`, which can only ever
+ * describe providers Firebase Auth itself issued. A user signed in with a custom token — the whole
+ * point of the external-connection sign-in direction — has an EMPTY `providerData`, so a link/unlink
+ * list built from it alone can never show the provider they actually signed in with.
+ *
+ * Declared here, in `auth/login`, and contributed to from elsewhere: the externalconnection module
+ * already depends on this one, and a dependency the other way would be a cycle.
+ */
+class DbxFirebaseLinkedLoginMethodsSource {
+}
+/**
+ * Multi-provider token every {@link DbxFirebaseLinkedLoginMethodsSource} registers under.
+ */
+const DBX_FIREBASE_LINKED_LOGIN_METHODS_SOURCES_TOKEN = new InjectionToken('DbxFirebaseLinkedLoginMethodsSources');
+/**
+ * Merges the union of every login method type currently linked to the signed-in user.
+ *
+ * Pure and exported so it is unit-testable without a TestBed.
+ *
+ * @param lists - The per-source lists to merge, most-authoritative first.
+ * @returns The deduped union, in the order the sources reported them.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+function mergeDbxFirebaseLinkedLoginMethodTypes(lists) {
+    const seen = new Set();
+    const result = [];
+    lists.forEach((list) => {
+        (list ?? []).forEach((type) => {
+            if (!seen.has(type)) {
+                seen.add(type);
+                result.push(type);
+            }
+        });
+    });
+    return result;
+}
+/**
+ * The login method types linked to the signed-in user: the Firebase-native ones, plus every
+ * registered {@link DbxFirebaseLinkedLoginMethodsSource}.
+ *
+ * Both the login list and the manage-providers component read from here rather than from
+ * `currentLinkedProviderIds$` directly, so a provider that is a login method without being a Firebase
+ * provider appears in the unlink list and is excluded from the link list — which is what makes the two
+ * lists describe the same set of facts.
+ */
+class DbxFirebaseLinkedLoginMethodsService {
+    _dbxFirebaseAuthService = inject(DbxFirebaseAuthService);
+    _sources = inject(DBX_FIREBASE_LINKED_LOGIN_METHODS_SOURCES_TOKEN, { optional: true });
+    /**
+     * The Firebase-native half: the provider ids on the current user's `providerData`.
+     */
+    nativeLoginMethodTypes$ = this._dbxFirebaseAuthService.currentLinkedProviderIds$.pipe(map((ids) => filterMaybeArrayValues(ids.map(firebaseProviderIdToLoginMethodType))), shareReplay({ bufferSize: 1, refCount: true }));
+    linkedLoginMethodTypes$ = combineLatest([this.nativeLoginMethodTypes$, ...(this._sources ?? []).map((x) => x.linkedLoginMethodTypes$)]).pipe(map(mergeDbxFirebaseLinkedLoginMethodTypes), 
+    // refCount so a source backed by a Firestore listener holds no subscription while nothing is
+    // rendering a link/unlink list
+    shareReplay({ bufferSize: 1, refCount: true }));
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseLinkedLoginMethodsService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseLinkedLoginMethodsService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseLinkedLoginMethodsService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
 /**
  * Renders a list of login provider buttons, filtered by enabled types and categories.
  *
@@ -1907,14 +2006,13 @@ function provideDbxFirebaseLogin(config) {
 class DbxFirebaseLoginListComponent {
     dbxFirebaseAuthLoginService = inject(DbxFirebaseAuthLoginService);
     dbxFirebaseAuthService = inject(DbxFirebaseAuthService);
-    _linkedProviderIds = toSignal(this.dbxFirebaseAuthService.currentLinkedProviderIds$, { initialValue: [] });
+    dbxFirebaseLinkedLoginMethodsService = inject(DbxFirebaseLinkedLoginMethodsService);
     /**
-     * The login method types currently linked to the authenticated user.
+     * The login method types currently linked to the authenticated user — the Firebase-native ones and
+     * every registered non-native source, since a custom-token provider has no `providerData` entry to
+     * be read from.
      */
-    linkedMethodTypesSignal = computed(() => {
-        return filterMaybeArrayValues(this._linkedProviderIds().map(firebaseProviderIdToLoginMethodType));
-    }, /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "linkedMethodTypesSignal" }] : /* istanbul ignore next */ []));
+    linkedMethodTypesSignal = toSignal(this.dbxFirebaseLinkedLoginMethodsService.linkedLoginMethodTypes$, { initialValue: [] });
     loginMode = input('login', /* @ts-ignore */
     ...(ngDevMode ? [{ debugName: "loginMode" }] : /* istanbul ignore next */ []));
     providerTypes = input(/* @ts-ignore */
@@ -1978,15 +2076,18 @@ class DbxFirebaseLoginListComponent {
         switch (loginMode) {
             case 'register':
                 providers = providers.filter((x) => x.registrationComponentClass !== false);
-                mapFn = (x) => ({ componentClass: (x.registrationComponentClass ?? x.componentClass), loginMethodType: x.loginMethodType, data: { loginMode } });
+                mapFn = (x) => ({ componentClass: (x.registrationComponentClass ?? x.componentClass), loginMethodType: x.loginMethodType, data: { loginMode, componentData: x.componentData } });
                 break;
             case 'link':
             case 'unlink':
                 providers = providers.filter((x) => x.allowLinking !== false);
-                mapFn = (x) => ({ componentClass: x.componentClass, loginMethodType: x.loginMethodType, data: { loginMode } });
+                mapFn = (x) => ({ componentClass: x.componentClass, loginMethodType: x.loginMethodType, data: { loginMode, componentData: x.componentData } });
                 break;
             default:
-                mapFn = (x) => ({ componentClass: x.componentClass, loginMethodType: x.loginMethodType, data: { loginMode } });
+                // `componentData` is carried through so a SHARED button component (one class serving several
+                // providers) can learn which provider it is rendering. Without it the field was declared and
+                // never read, and every provider needed a component class of its own.
+                mapFn = (x) => ({ componentClass: x.componentClass, loginMethodType: x.loginMethodType, data: { loginMode, componentData: x.componentData } });
                 break;
         }
         return providers.map(mapFn);
@@ -2257,11 +2358,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImpor
 class DbxFirebaseManageAuthProvidersComponent {
     dbxFirebaseAuthService = inject(DbxFirebaseAuthService);
     dbxFirebaseAuthLoginService = inject(DbxFirebaseAuthLoginService);
-    _linkedProviderIds = toSignal(this.dbxFirebaseAuthService.currentLinkedProviderIds$, { initialValue: [] });
-    linkedMethodTypesSignal = computed(() => {
-        return filterMaybeArrayValues(this._linkedProviderIds().map(firebaseProviderIdToLoginMethodType));
-    }, /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "linkedMethodTypesSignal" }] : /* istanbul ignore next */ []));
+    dbxFirebaseLinkedLoginMethodsService = inject(DbxFirebaseLinkedLoginMethodsService);
+    linkedMethodTypesSignal = toSignal(this.dbxFirebaseLinkedLoginMethodsService.linkedLoginMethodTypes$, { initialValue: [] });
     showLinkSectionSignal = computed(() => {
         const linkedTypes = new Set(this.linkedMethodTypesSignal());
         const oauthProviders = this.dbxFirebaseAuthLoginService.getLinkProviders(this.dbxFirebaseAuthLoginService.getEnabledTypes());
@@ -6704,6 +6802,40 @@ class DbxFirebaseExternalConnectionsConfig {
  * @returns The authorize path.
  */
 const DEFAULT_EXTERNAL_CONNECTION_AUTHORIZE_PATH_FACTORY = (providerType) => `/oauth/${providerType}/authorize`;
+/**
+ * Default sign-in path for a provider: `/oauth/<providerType>/signin`.
+ *
+ * @param providerType - The provider to build a path for.
+ * @returns The sign-in path.
+ */
+const DEFAULT_EXTERNAL_CONNECTION_SIGN_IN_PATH_FACTORY = (providerType) => `/oauth/${providerType}/signin`;
+/**
+ * Default ticket-exchange path for a provider: `/oauth/<providerType>/token`.
+ *
+ * @param providerType - The provider to build a path for.
+ * @returns The token path.
+ */
+const DEFAULT_EXTERNAL_CONNECTION_TOKEN_PATH_FACTORY = (providerType) => `/oauth/${providerType}/token`;
+/**
+ * Query parameter the completed sign-in returns its ticket on. Must match the server's.
+ */
+const EXTERNAL_CONNECTION_SIGN_IN_TICKET_PARAM = 'ticket';
+/**
+ * Query parameter a FAILED sign-in returns its reason code on. Must match the server's
+ * `USER_EXTERNAL_CONNECTION_SIGN_IN_ERROR_PARAM`.
+ *
+ * The value is one of the server's allowlisted `USER_EXTERNAL_CONNECTION_SIGN_IN_*` codes — an app
+ * maps it to its own copy rather than rendering anything the server said.
+ */
+const EXTERNAL_CONNECTION_SIGN_IN_ERROR_PARAM = 'signInError';
+/**
+ * `sessionStorage` key the in-flight sign-in's PKCE verifier is held under.
+ *
+ * `sessionStorage`, not `localStorage`: the verifier is scoped to the tab that started the flow and
+ * must not outlive it. It is the single secret proving the returning page is the one that began the
+ * sign-in, so a verifier shared across tabs would weaken exactly what it exists to establish.
+ */
+const EXTERNAL_CONNECTION_SIGN_IN_VERIFIER_STORAGE_KEY = 'dbx.externalconnection.signin.verifier';
 /**
  * Derives a row's presentation status from its entry.
  *
@@ -6817,7 +6949,7 @@ const DBX_FIREBASE_KNOWN_EXTERNAL_CONNECTION_PROVIDERS = {
  * @throws {Error} When there is no known provider for the given type.
  */
 function dbxFirebaseKnownExternalConnectionProvider(config) {
-    const { providerType, assets, authorizePath, connect, disconnectConfirm } = config;
+    const { providerType, assets, authorizePath, connect, disconnectConfirm, signIn } = config;
     const known = DBX_FIREBASE_KNOWN_EXTERNAL_CONNECTION_PROVIDERS[providerType];
     if (known == null) {
         throw new Error(`dbxFirebaseKnownExternalConnectionProvider(): there is no known provider for "${providerType}".`);
@@ -6827,7 +6959,8 @@ function dbxFirebaseKnownExternalConnectionProvider(config) {
         assets: { ...known.assets, ...assets },
         authorizePath: authorizePath ?? known.authorizePath,
         connect: connect ?? known.connect,
-        disconnectConfirm: disconnectConfirm ?? known.disconnectConfirm
+        disconnectConfirm: disconnectConfirm ?? known.disconnectConfirm,
+        signIn: signIn ?? known.signIn
     };
 }
 /**
@@ -6933,6 +7066,20 @@ class DbxFirebaseExternalConnectionService {
      * missing rather than failing every injection of this service.
      */
     _userExternalConnectionFunctions = inject(UserExternalConnectionFunctions, { optional: true });
+    /**
+     * Optional for the same reason: the connect half of this registry never signs anyone in, and a
+     * spec exercising it should not have to stand up Firebase Auth.
+     */
+    _dbxFirebaseAuthService = inject(DbxFirebaseAuthService, { optional: true });
+    _signInErrorCode = signal(undefined, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "_signInErrorCode" }] : /* istanbul ignore next */ []));
+    /**
+     * The reason the last sign-in redirect reported a failure, when it reported one.
+     *
+     * A signal as well as a returned value because the redirect is handled in the app initializer,
+     * before any view exists to receive the return — the login page reads it when it renders.
+     */
+    signInErrorCode = this._signInErrorCode.asReadonly();
     _providers = new Map();
     _assets = new Map();
     _enableAll = false;
@@ -7030,14 +7177,15 @@ class DbxFirebaseExternalConnectionService {
      * creates it on load; a custom UI that reaches this call by another route has to create it too.
      *
      * @param providerType - The provider the state is for.
+     * @param mode - Which handoff the state begins. Defaults to `connect`.
      * @returns The state to send on the authorize request.
      */
-    async mintAuthorizeStateForProvider(providerType) {
+    async mintAuthorizeStateForProvider(providerType, mode) {
         const userExternalConnectionFunctions = this._userExternalConnectionFunctions;
         if (!userExternalConnectionFunctions) {
             throw new Error(`DbxFirebaseExternalConnectionService: cannot mint an authorize state for "${providerType}" because UserExternalConnectionFunctions was not provided. Add the userExternalConnection functions to the app's functions config map, or configure mintAuthorizeState: false.`);
         }
-        const { state } = await userExternalConnectionFunctions.userExternalConnection.readUserExternalConnection.authorizeState({ providerType });
+        const { state } = await userExternalConnectionFunctions.userExternalConnection.readUserExternalConnection.authorizeState({ providerType, mode: mode ?? undefined });
         return state;
     }
     /**
@@ -7045,13 +7193,14 @@ class DbxFirebaseExternalConnectionService {
      * is enabled.
      *
      * @param providerType - The provider to resolve.
+     * @param mode - Which handoff the state begins. Defaults to `connect`.
      * @returns The authorize url, or null when the provider is not registered.
      */
-    async authorizeUrlWithStateForProvider(providerType) {
+    async authorizeUrlWithStateForProvider(providerType, mode) {
         const authorizeUrl = this.authorizeUrlForProvider(providerType);
         let result = authorizeUrl;
         if (authorizeUrl && this.mintsAuthorizeState) {
-            const state = await this.mintAuthorizeStateForProvider(providerType);
+            const state = await this.mintAuthorizeStateForProvider(providerType, mode);
             // appended as text rather than through URL, since an app that shares an origin with its API
             // configures no authorizeOrigin and the path stays relative
             result = fixExtraQueryParameters(`${authorizeUrl}?state=${encodeURIComponent(state)}`);
@@ -7109,12 +7258,410 @@ class DbxFirebaseExternalConnectionService {
             await navigate(authorizeUrl);
         }
     }
+    /**
+     * Makes a provider a LOGIN METHOD for the already-signed-in user.
+     *
+     * The connect flow's twin, and deliberately a separate round trip rather than a flag on it: the
+     * authorize request runs the provider's SIGN-IN scopes, which are not the data scopes, so one grant
+     * cannot stand in for the other. The server writes only the login link and stores no credentials.
+     *
+     * @param providerType - The provider to link.
+     * @returns Resolves once the authorize page is actually opening, and rejects when it never opened.
+     * @throws {Error} When the provider is not registered, or declares no `signIn` config.
+     */
+    async linkProvider(providerType) {
+        const provider = this.getProvider(providerType);
+        if (!provider) {
+            throw new Error(`DbxFirebaseExternalConnectionService: no provider registered for "${providerType}".`);
+        }
+        if (!provider.signIn) {
+            throw new Error(`DbxFirebaseExternalConnectionService: "${providerType}" is not registered for sign-in, so it cannot be linked as a login method.`);
+        }
+        const authorizeUrl = await this.authorizeUrlWithStateForProvider(providerType, 'link');
+        if (!authorizeUrl) {
+            throw new Error(`DbxFirebaseExternalConnectionService: no authorize url could be resolved for "${providerType}".`);
+        }
+        // awaited exactly as `connectToProvider` awaits it, so the action stays working until the authorize
+        // page is really opening rather than reporting success against a page that has not moved
+        const navigate = this.config.navigate ?? DEFAULT_EXTERNAL_CONNECTION_NAVIGATE_FUNCTION;
+        await navigate(authorizeUrl);
+    }
+    /**
+     * Removes a provider as a login method for the signed-in user.
+     *
+     * Strictly more than a disconnect: the server removes the login link, the data connection, and its
+     * credentials together. Refused server-side when it would leave the account with no way to sign in.
+     *
+     * @param providerType - The provider to remove as a login method.
+     * @returns Resolves once the server has applied the change.
+     */
+    async unlinkProvider(providerType) {
+        const userExternalConnectionFunctions = this._userExternalConnectionFunctions;
+        if (!userExternalConnectionFunctions) {
+            throw new Error(`DbxFirebaseExternalConnectionService: cannot unlink "${providerType}" because UserExternalConnectionFunctions was not provided. Add the userExternalConnection functions to the app's functions config map.`);
+        }
+        await userExternalConnectionFunctions.userExternalConnection.updateUserExternalConnection.unlink({ providerType });
+    }
+    // MARK: Sign In
+    /**
+     * Resolves the sign-in url for a provider.
+     *
+     * @param providerType - The provider to resolve.
+     * @returns The sign-in url, or null when the provider is not registered for sign-in.
+     */
+    signInUrlForProvider(providerType) {
+        const provider = this.getProvider(providerType);
+        let result = null;
+        if (provider?.signIn) {
+            const path = provider.signIn.signInPath ?? DEFAULT_EXTERNAL_CONNECTION_SIGN_IN_PATH_FACTORY(providerType);
+            result = this.config.authorizeOrigin ? `${this.config.authorizeOrigin}${path}` : path;
+        }
+        return result;
+    }
+    /**
+     * Resolves the ticket-exchange url for a provider.
+     *
+     * @param providerType - The provider to resolve.
+     * @returns The token url, or null when the provider is not registered for sign-in.
+     */
+    signInTokenUrlForProvider(providerType) {
+        const provider = this.getProvider(providerType);
+        let result = null;
+        if (provider?.signIn) {
+            const path = DEFAULT_EXTERNAL_CONNECTION_TOKEN_PATH_FACTORY(providerType);
+            result = this.config.authorizeOrigin ? `${this.config.authorizeOrigin}${path}` : path;
+        }
+        return result;
+    }
+    /**
+     * Begins the sign-in flow for a provider.
+     *
+     * Unlike {@link connectToProvider} there is no `state` to mint: the caller is not signed in, so
+     * there is no authenticated call to make. A PKCE verifier is generated instead and kept in
+     * `sessionStorage`; only its challenge travels, and the ticket the server hands back at the end is
+     * redeemable only by whoever still holds the verifier. That is what makes a redirect-borne ticket
+     * safe where a redirect-borne token would not be.
+     *
+     * REQUIRES a secure context: the challenge is derived with `crypto.subtle`, which browsers expose
+     * only over https or on `localhost`. An app served over plain http on a LAN address cannot start a
+     * sign-in — the same constraint every PKCE client in this workspace already carries.
+     *
+     * @param providerType - The provider to sign in with.
+     * @returns Resolves once the provider's consent page is actually opening.
+     */
+    async signInWithProvider(providerType) {
+        const provider = this.getProvider(providerType);
+        if (!provider?.signIn) {
+            throw new Error(`DbxFirebaseExternalConnectionService: "${providerType}" is not registered for sign-in.`);
+        }
+        const signInUrl = this.signInUrlForProvider(providerType);
+        if (!signInUrl) {
+            throw new Error(`DbxFirebaseExternalConnectionService: no sign-in url could be resolved for "${providerType}".`);
+        }
+        const { codeVerifier, codeChallenge } = await generatePkceMaterial();
+        // written BEFORE navigating: once the page is unloading there is no chance to store anything, and
+        // a flow whose verifier never landed is unredeemable at the other end
+        this.storeSignInVerifier(providerType, codeVerifier);
+        const returnPath = provider.signIn.returnPath;
+        const returnPathParam = returnPath ? `&returnPath=${encodeURIComponent(returnPath)}` : '';
+        const url = fixExtraQueryParameters(`${signInUrl}?challenge=${encodeURIComponent(codeChallenge)}${returnPathParam}`);
+        const navigate = this.config.navigate ?? DEFAULT_EXTERNAL_CONNECTION_NAVIGATE_FUNCTION;
+        await navigate(url);
+    }
+    /**
+     * Completes a sign-in that has just redirected back, when the current URL carries a ticket — or
+     * records the reason when it carries a failure instead.
+     *
+     * Safe to call unconditionally on app start: a page carrying neither resolves to a not-signed-in
+     * result without touching the network. A reported failure does NOT throw: it is the server
+     * answering a question the user asked, not a fault, and the login page renders it.
+     *
+     * @param url - The url to read from. Defaults to the current location.
+     * @returns Whether a ticket was redeemed, and the reason when the redirect reported a failure.
+     */
+    async handleSignInRedirectResult(url = window.location.href) {
+        const ticket = readExternalConnectionSignInTicketFromUrl(url);
+        const errorCode = ticket == null ? readExternalConnectionSignInFailureFromUrl(url) : undefined;
+        let result = { signedIn: false };
+        if (ticket != null) {
+            const stored = this.readStoredSignInVerifier();
+            // ALWAYS cleared, success or not: a verifier is single-use, and one left behind would be
+            // offered against whatever ticket arrived next
+            this.clearStoredSignInVerifier();
+            if (stored == null) {
+                throw new Error('DbxFirebaseExternalConnectionService: a sign-in ticket arrived with no stored verifier. The sign-in must be completed in the tab that started it.');
+            }
+            const customToken = await this.exchangeSignInTicket({ providerType: stored.providerType, ticket, verifier: stored.codeVerifier });
+            const dbxFirebaseAuthService = this._dbxFirebaseAuthService;
+            if (!dbxFirebaseAuthService) {
+                throw new Error('DbxFirebaseExternalConnectionService: cannot complete a sign-in because DbxFirebaseAuthService was not provided.');
+            }
+            await dbxFirebaseAuthService.logInWithCustomToken(customToken);
+            result = { signedIn: true };
+        }
+        else if (errorCode != null) {
+            // the flow ended at the provider or the server, so the verifier it was minted for is spent —
+            // leaving it behind would offer a stale one against the NEXT sign-in's ticket
+            this.clearStoredSignInVerifier();
+            this._signInErrorCode.set(errorCode);
+            result = { signedIn: false, errorCode };
+        }
+        return result;
+    }
+    /**
+     * Clears the recorded sign-in failure, e.g. once the login page has shown it.
+     */
+    clearSignInErrorCode() {
+        this._signInErrorCode.set(undefined);
+    }
+    /**
+     * Posts a ticket and its verifier to the provider's token endpoint.
+     *
+     * @param input - The provider, the ticket from the redirect, and the stored verifier.
+     * @param input.providerType - The provider the ticket belongs to.
+     * @param input.ticket - The ticket the redirect carried.
+     * @param input.verifier - The PKCE verifier the browser retained.
+     * @returns The Firebase custom token.
+     */
+    async exchangeSignInTicket(input) {
+        const tokenUrl = this.signInTokenUrlForProvider(input.providerType);
+        if (!tokenUrl) {
+            throw new Error(`DbxFirebaseExternalConnectionService: no token url could be resolved for "${input.providerType}".`);
+        }
+        const response = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({ ticket: input.ticket, verifier: input.verifier })
+        });
+        if (!response.ok) {
+            throw new Error(`DbxFirebaseExternalConnectionService: the "${input.providerType}" sign-in ticket was rejected (${response.status}).`);
+        }
+        const { customToken } = (await response.json());
+        if (!customToken) {
+            throw new Error(`DbxFirebaseExternalConnectionService: the "${input.providerType}" ticket exchange returned no custom token.`);
+        }
+        return customToken;
+    }
+    /**
+     * Stores the in-flight sign-in's verifier and the provider it belongs to.
+     *
+     * @param providerType - The provider the flow was started for.
+     * @param codeVerifier - The PKCE verifier to retain.
+     */
+    storeSignInVerifier(providerType, codeVerifier) {
+        sessionStorage.setItem(EXTERNAL_CONNECTION_SIGN_IN_VERIFIER_STORAGE_KEY, JSON.stringify({ providerType, codeVerifier }));
+    }
+    /**
+     * Reads the stored verifier, treating a corrupt entry as absent — the same contract
+     * `webStorageValueCache` keeps, so a malformed entry never wedges the sign-in.
+     *
+     * @returns The stored provider and verifier, or null when there is none.
+     */
+    readStoredSignInVerifier() {
+        const raw = sessionStorage.getItem(EXTERNAL_CONNECTION_SIGN_IN_VERIFIER_STORAGE_KEY);
+        let result;
+        if (raw != null) {
+            try {
+                const parsed = JSON.parse(raw);
+                result = parsed?.providerType && parsed.codeVerifier ? { providerType: parsed.providerType, codeVerifier: parsed.codeVerifier } : undefined;
+            }
+            catch {
+                result = undefined;
+            }
+        }
+        return result;
+    }
+    clearStoredSignInVerifier() {
+        sessionStorage.removeItem(EXTERNAL_CONNECTION_SIGN_IN_VERIFIER_STORAGE_KEY);
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseExternalConnectionService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseExternalConnectionService });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseExternalConnectionService, decorators: [{
             type: Injectable
         }], ctorParameters: () => [] });
+/**
+ * Reads the sign-in ticket a completed handoff redirected back with.
+ *
+ * @param url - The url to read.
+ * @returns The ticket, or null when the url carries none.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+function readExternalConnectionSignInTicketFromUrl(url) {
+    let result;
+    try {
+        result = new URL(url).searchParams.get(EXTERNAL_CONNECTION_SIGN_IN_TICKET_PARAM) ?? undefined;
+    }
+    catch {
+        // a url that does not parse carries no ticket
+    }
+    return result;
+}
+/**
+ * Reads the reason code a FAILED sign-in redirected back with.
+ *
+ * @param url - The url to read.
+ * @returns The reason code, or null when the url carries none.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+function readExternalConnectionSignInFailureFromUrl(url) {
+    let result;
+    try {
+        result = new URL(url).searchParams.get(EXTERNAL_CONNECTION_SIGN_IN_ERROR_PARAM) ?? undefined;
+    }
+    catch {
+        // a url that does not parse carries no reason
+    }
+    return result;
+}
+
+/**
+ * The login button for a third-party provider that is NOT a Firebase auth provider.
+ *
+ * ONE component class for every such provider, not one per provider like Google or Apple: those each
+ * construct a different `firebase/auth` provider class, which is code; here the only per-provider
+ * variation is a url and some brand colors, which is data. The provider it is rendering arrives as
+ * `componentData`.
+ *
+ * ## How link/unlink work here
+ *
+ * NOT through the Firebase SDK's own `linkWithPopup` and its inverse. A custom-token sign-in produces
+ * a Firebase user with NO `providerData` entry — there is no Firebase provider behind it — so the base
+ * implementations have nothing to act on and `LOGIN_METHOD_TYPE_TO_FIREBASE_PROVIDER_ID_MAP` has no
+ * entry to resolve.
+ *
+ * Both are overridden onto the external-connection service instead: linking runs a second OAuth round
+ * trip in `link` mode, which writes the account's login link server-side; the inverse calls the server
+ * and removes it. To a user these mean exactly what they mean for Google, which is why these providers
+ * belong in the same list rather than being excluded from it.
+ *
+ * Distinct from the CONNECT row `DbxFirebaseExternalConnectionsComponent` renders for the same
+ * provider: that manages the DATA connection, whose credentials can expire and be revoked
+ * independently of whether the provider is still a way to sign in.
+ */
+class DbxFirebaseLoginExternalConnectionComponent extends AbstractConfiguredDbxFirebaseLoginButtonDirective {
+    dbxFirebaseExternalConnectionService = inject(DbxFirebaseExternalConnectionService);
+    /**
+     * The external connection provider this button signs in with.
+     *
+     * @returns The provider type from the registered `componentData`.
+     * @throws {Error} When the component was rendered without it — a registration mistake, and one that
+     *   would otherwise surface as a redirect to an unrelated provider.
+     */
+    get providerType() {
+        const componentData = this.injectedComponentData;
+        if (!componentData?.providerType) {
+            throw new Error('DbxFirebaseLoginExternalConnectionComponent was rendered with no providerType in its componentData.');
+        }
+        return componentData.providerType;
+    }
+    get loginProvider() {
+        return this.providerType;
+    }
+    handleLogin() {
+        return this.dbxFirebaseExternalConnectionService.signInWithProvider(this.providerType);
+    }
+    /**
+     * Links the provider as a login method by starting the `link` OAuth handoff.
+     *
+     * @returns Resolves once the authorize page is opening.
+     */
+    handleLink() {
+        return this.dbxFirebaseExternalConnectionService.linkProvider(this.providerType);
+    }
+    /**
+     * Removes the provider as a login method.
+     *
+     * @returns Resolves once the server has applied the change.
+     */
+    handleUnlink() {
+        return this.dbxFirebaseExternalConnectionService.unlinkProvider(this.providerType);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseLoginExternalConnectionComponent, deps: null, target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "22.1.4", type: DbxFirebaseLoginExternalConnectionComponent, isStandalone: true, selector: "dbx-firebase-login-external-connection", usesInheritance: true, ngImport: i0, template: "\n  <dbx-firebase-login-button-container>\n    <dbx-firebase-login-button [config]=\"configSignal()\"></dbx-firebase-login-button>\n  </dbx-firebase-login-button-container>\n", isInline: true, dependencies: [{ kind: "component", type: DbxFirebaseLoginButtonComponent, selector: "dbx-firebase-login-button", inputs: ["config"], outputs: ["configChange"] }, { kind: "component", type: DbxFirebaseLoginButtonContainerComponent, selector: "dbx-firebase-login-button-container" }] });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseLoginExternalConnectionComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'dbx-firebase-login-external-connection',
+                    imports: DBX_CONFIGURED_DBX_FIREBASE_LOGIN_BUTTON_COMPONENT_CONFIGURATION.imports,
+                    template: DBX_CONFIGURED_DBX_FIREBASE_LOGIN_BUTTON_COMPONENT_CONFIGURATION.template
+                }]
+        }] });
+
+/**
+ * The login category external-connection sign-in providers register under.
+ *
+ * `oauth`, the same category the Firebase-native federated providers use: to a user, "Log in with
+ * Discord" and "Log in with Google" are the same affordance, and a login list filtering by category
+ * should show them together.
+ */
+const DBX_FIREBASE_EXTERNAL_CONNECTION_LOGIN_CATEGORY = 'oauth';
+/**
+ * Derives the {@link DbxFirebaseAuthLoginProvider} for an external-connection provider that declares
+ * a `signIn` config.
+ *
+ * DERIVED rather than declared separately so the login button and the settings row can never disagree
+ * about which providers exist — there is one registration, and this projects it onto the login
+ * registry.
+ *
+ * Linking IS allowed. It is not `linkWithPopup` — a custom-token user has no `providerData` entry for
+ * the Firebase SDK to attach to — it is a second OAuth round trip in `link` mode, which writes the
+ * account's login link server-side. The two mean the same thing to a user, so they belong in the same
+ * list; only the mechanism differs, and that lives in
+ * {@link DbxFirebaseLoginExternalConnectionComponent}.
+ *
+ * Distinct from the CONNECT row on the settings page, which manages the DATA connection. "Discord is
+ * how I log in" and "Discord's token still works" are different facts with different lifecycles, so
+ * they get different buttons.
+ *
+ * `registrationComponentClass` is the same component: "Sign up with Discord" and "Log in with
+ * Discord" are one button pressed by users in two situations, and the server resolves which it is.
+ *
+ * @param provider - The external connection provider to derive from.
+ * @returns The login provider, or null when the provider declares no `signIn`.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+function dbxFirebaseExternalConnectionLoginProvider(provider) {
+    const { providerType, signIn, assets } = provider;
+    let result;
+    if (signIn) {
+        result = {
+            category: DBX_FIREBASE_EXTERNAL_CONNECTION_LOGIN_CATEGORY,
+            loginMethodType: signIn.loginMethodType ?? providerType,
+            componentClass: DbxFirebaseLoginExternalConnectionComponent,
+            registrationComponentClass: DbxFirebaseLoginExternalConnectionComponent,
+            allowLinking: true,
+            componentData: { providerType },
+            assets: {
+                providerName: assets.providerName,
+                loginText: signIn.loginText ?? `Continue with ${assets.providerName}`,
+                linkText: signIn.linkText ?? `Connect ${assets.providerName}`,
+                unlinkText: signIn.unlinkText ?? `Disconnect ${assets.providerName}`,
+                loginIcon: signIn.loginIcon ?? assets.icon ?? undefined,
+                logoUrl: assets.logoUrl ?? undefined,
+                logoFilter: assets.logoFilter ?? undefined,
+                backgroundColor: signIn.backgroundColor ?? undefined,
+                textColor: signIn.textColor ?? undefined
+            }
+        };
+    }
+    return result;
+}
+/**
+ * Derives the login providers for every entry that declares a `signIn` config.
+ *
+ * @param entries - The app's external-connection provider entries.
+ * @returns The derived login providers, in the order the entries were declared.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+function dbxFirebaseExternalConnectionLoginProviders(entries) {
+    return filterMaybeArrayValues(entries.map((x) => dbxFirebaseExternalConnectionLoginProvider(dbxFirebaseExternalConnectionProviderForEntry(x))));
+}
 
 /**
  * Injection token for the app's UserExternalConnection collection.
@@ -7144,9 +7691,14 @@ class UserExternalConnectionDocumentStore extends AbstractDbxFirebaseDocumentSto
      */
     createUserExternalConnection = firebaseDocumentStoreCreateFunction(this, this.userExternalConnectionFunctions.userExternalConnection.createUserExternalConnection);
     /**
-     * Disconnects the user from a provider. The only write a client can make to the connection pair.
+     * Disconnects the user from a provider's DATA connection. The provider's login link is retained.
      */
     disconnectUserExternalConnection = firebaseDocumentStoreUpdateFunction(this, this.userExternalConnectionFunctions.userExternalConnection.updateUserExternalConnection.disconnect);
+    /**
+     * Removes a provider as a login method. Strictly more than a disconnect — it takes the data
+     * connection and its credentials with it.
+     */
+    unlinkUserExternalConnectionLogin = firebaseDocumentStoreUpdateFunction(this, this.userExternalConnectionFunctions.userExternalConnection.updateUserExternalConnection.unlink);
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: UserExternalConnectionDocumentStore, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: UserExternalConnectionDocumentStore });
 }
@@ -7154,6 +7706,74 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImpor
             type: Injectable
         }], ctorParameters: () => [] });
 
+/**
+ * Projects a user's login link map onto the login method types those providers are registered under.
+ *
+ * Only providers that declare a `signIn` config contribute: a link recorded for a provider the app no
+ * longer offers as a login method must not put an unrenderable row in the unlink list. The registered
+ * `signIn.loginMethodType` wins over the provider type, because that is the type the login registry
+ * knows the provider by.
+ *
+ * Pure and exported so it is unit-testable without a TestBed.
+ *
+ * @param logins - The user's login link map.
+ * @param service - The external connection registry, consulted for each provider's registration.
+ * @returns The login method types, in the login map's key order.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+function dbxFirebaseExternalConnectionLinkedLoginMethodTypes(logins, service) {
+    const result = [];
+    Object.keys(logins ?? {}).forEach((providerType) => {
+        const signIn = service.getProvider(providerType)?.signIn;
+        if (signIn) {
+            result.push(signIn.loginMethodType ?? providerType);
+        }
+    });
+    return result;
+}
+/**
+ * Reports the providers the signed-in user has linked as LOGIN METHODS, for the link/unlink lists.
+ *
+ * The `providerData`-backed `currentLinkedProviderIds$` cannot see these: a custom-token user has no
+ * Firebase provider entry at all, so without this source Discord could never appear in "Connected
+ * Providers" and would be offered in "Connect Provider" even after being linked.
+ *
+ * Reads the connection document DIRECTLY off the root-provided collections rather than through
+ * `UserExternalConnectionDocumentStore`, which is component-scoped and only exists while the settings
+ * page is rendered. `refCount` on the shared replay keeps that from becoming an always-open Firestore
+ * listener: nothing subscribes unless a link or unlink list is actually on screen.
+ */
+class DbxFirebaseExternalConnectionLinkedLoginMethodsSource {
+    _dbxFirebaseUserExternalConnectionCollections = inject(DbxFirebaseUserExternalConnectionCollections);
+    _dbxFirebaseAuthService = inject(DbxFirebaseAuthService);
+    _dbxFirebaseExternalConnectionService = inject(DbxFirebaseExternalConnectionService);
+    _connection$ = this._dbxFirebaseAuthService.currentUid$.pipe(
+    // currentUid$ rather than userIdentifier$: the latter substitutes NO_AUTH_USER_IDENTIFIER ('0')
+    // when signed out, which would ask Firestore for uec/0
+    switchMap((uid) => uid
+        ? this._dbxFirebaseUserExternalConnectionCollections.userExternalConnectionCollection
+            .documentAccessor()
+            .loadDocumentForId(uid)
+            .snapshotDataStream(FirestoreAccessorStreamMode.STREAM)
+            .pipe(
+        // a user with no document has nothing linked, and a denied read is a rules question this
+        // list has no answer to — both are "no login links", exactly as the connect list treats them
+        catchError((e) => {
+            if (e?.code !== FIRESTORE_PERMISSION_DENIED_ERROR_CODE) {
+                console.error('DbxFirebaseExternalConnectionLinkedLoginMethodsSource: failed reading the connection document: ', e);
+            }
+            return of(undefined);
+        }))
+        : of(undefined)));
+    linkedLoginMethodTypes$ = this._connection$.pipe(map((connection) => dbxFirebaseExternalConnectionLinkedLoginMethodTypes(connection?.li, this._dbxFirebaseExternalConnectionService)), shareReplay({ bufferSize: 1, refCount: true }));
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseExternalConnectionLinkedLoginMethodsSource, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseExternalConnectionLinkedLoginMethodsSource });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: DbxFirebaseExternalConnectionLinkedLoginMethodsSource, decorators: [{
+            type: Injectable
+        }] });
+
 /**
  * Directive providing a {@link UserExternalConnectionDocumentStore} for a single user's connection document.
  */
@@ -7173,25 +7793,29 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImpor
         }], ctorParameters: () => [] });
 
 /**
- * Maps the document store's loading state into the per-provider entry map the UI renders from.
+ * Maps the document store's loading state into one of the connection document's provider maps.
  *
  * This mapper exists because `dataLoadingState$` turns a MISSING document into
  * `errorResult(modelDoesNotExistError())` — and a user who has never connected anything has no
  * document, which is the common case, not an error. `exists$` catches `permission-denied` but does
  * not feed `dataLoadingState$`, so that case has to be handled here too.
  *
- * Both cases mean the same thing to this UI: an empty connection map.
+ * Both cases mean the same thing to this UI: an empty map.
+ *
+ * Generalized over WHICH map it projects because the document now carries two — `e` (data
+ * connections) and `li` (login links) — and both want identical missing/denied handling.
  *
  * Pure and exported so it is unit-testable without a TestBed.
  *
  * @param state - The document store's data loading state.
- * @returns The loading state of the user's entry map.
+ * @param readMap - Reads the map to project off the loaded document.
+ * @returns The loading state of that map.
  */
-function externalConnectionsLoadingStateFromDocumentLoadingState(state) {
+function externalConnectionMapLoadingStateFromDocumentLoadingState(state, readMap) {
     const errorCode = state.error?.code;
     let result;
     if (state.value) {
-        result = successResult(state.value.e ?? {});
+        result = successResult(readMap(state.value) ?? {});
     }
     else if (errorCode === DBX_FIREBASE_MODEL_DOES_NOT_EXIST_ERROR || errorCode === FIRESTORE_PERMISSION_DENIED_ERROR_CODE) {
         result = successResult({});
@@ -7204,6 +7828,24 @@ function externalConnectionsLoadingStateFromDocumentLoadingState(state) {
     }
     return result;
 }
+/**
+ * Maps the document store's loading state into the per-provider ENTRY map the connect UI renders from.
+ *
+ * @param state - The document store's data loading state.
+ * @returns The loading state of the user's entry map.
+ */
+function externalConnectionsLoadingStateFromDocumentLoadingState(state) {
+    return externalConnectionMapLoadingStateFromDocumentLoadingState(state, (x) => x.e);
+}
+/**
+ * Maps the document store's loading state into the per-provider LOGIN LINK map.
+ *
+ * @param state - The document store's data loading state.
+ * @returns The loading state of the user's login link map.
+ */
+function externalConnectionLoginsLoadingStateFromDocumentLoadingState(state) {
+    return externalConnectionMapLoadingStateFromDocumentLoadingState(state, (x) => x.li);
+}
 /**
  * Decides whether a document load means the user has no connection document and needs one created.
  *
@@ -7231,6 +7873,10 @@ class DbxFirebaseUserExternalConnectionsStore {
      * The user's per-provider entries. A missing document (or a denied read) resolves to an empty map.
      */
     entriesLoadingState$ = this.userExternalConnectionDocumentStore.dataLoadingState$.pipe(map(externalConnectionsLoadingStateFromDocumentLoadingState), shareReplay(1));
+    /**
+     * The user's per-provider LOGIN LINKS. A missing document (or a denied read) resolves to an empty map.
+     */
+    loginsLoadingState$ = this.userExternalConnectionDocumentStore.dataLoadingState$.pipe(map(externalConnectionLoginsLoadingStateFromDocumentLoadingState), shareReplay(1));
     /**
      * Creates the user's connection document if they do not have one, and does nothing if they do.
      *
@@ -7687,7 +8333,30 @@ function provideDbxFirebaseExternalConnections(config) {
         {
             provide: DbxFirebaseExternalConnectionService,
             useClass: DbxFirebaseExternalConnectionService
-        }
+        },
+        {
+            // contributed rather than read directly by `auth/login`, which must not depend on this module —
+            // it is the half that already depends on `auth/login`
+            provide: DBX_FIREBASE_LINKED_LOGIN_METHODS_SOURCES_TOKEN,
+            useClass: DbxFirebaseExternalConnectionLinkedLoginMethodsSource,
+            multi: true
+        },
+        provideAppInitializer(() => {
+            // registered here rather than through `provideDbxFirebaseLogin`'s `additionalProviders` so the
+            // two declarations cannot drift: an app names Discord once, and both the settings row and the
+            // login button follow from it. `override: false` leaves an app's explicit login registration
+            // for the same method type in charge.
+            const loginService = inject(DbxFirebaseAuthLoginService, { optional: true });
+            if (loginService) {
+                dbxFirebaseExternalConnectionLoginProviders(config.providers).forEach((x) => loginService.register(x, false));
+            }
+            if (config.handleSignInRedirectResult ?? true) {
+                // deliberately not awaited: a failed redemption must not block the app from booting, and the
+                // user is already looking at a page that renders fine signed out
+                const externalConnectionService = inject(DbxFirebaseExternalConnectionService);
+                externalConnectionService.handleSignInRedirectResult().catch((e) => console.error('DbxFirebaseExternalConnectionService: failed completing a sign-in redirect: ', e));
+            }
+        })
     ];
     return makeEnvironmentProviders(providers);
 }
@@ -13310,5 +13979,5 @@ function provideDbxFirebase(config) {
  * Generated bundle index. Do not edit.
  */
 
-export { AbstractConfiguredDbxFirebaseLoginButtonDirective, AbstractDbxFirebaseCollectionStore, AbstractDbxFirebaseCollectionWithParentStore, AbstractDbxFirebaseDocumentStore, AbstractDbxFirebaseDocumentWithParentStore, AbstractDbxFirebaseModelEntityWidgetDirective, AbstractDbxFirebaseNotificationItemWidgetComponent, AbstractRootSingleItemDbxFirebaseDocument, AbstractSingleItemDbxFirebaseDocument, AbstractSystemStateDocumentStoreAccessor, CalendarDocumentStore, CalendarDocumentStoreDirective, DBX_CONFIGURED_DBX_FIREBASE_LOGIN_BUTTON_COMPONENT_CONFIGURATION, DBX_FIREBASE_APP_OPTIONS_TOKEN, DBX_FIREBASE_AUTH_FLOW_TOKEN, DBX_FIREBASE_DOCUMENT_STORE_CONTEXT_STORE_TOKEN, DBX_FIREBASE_EXTERNAL_CONNECTION_CALCOM_PROVIDER, DBX_FIREBASE_EXTERNAL_CONNECTION_DISCORD_PROVIDER, DBX_FIREBASE_EXTERNAL_CONNECTION_ZOHO_PROVIDER, DBX_FIREBASE_EXTERNAL_CONNECTION_ZOOM_PROVIDER, DBX_FIREBASE_KNOWN_EXTERNAL_CONNECTION_PROVIDERS, DBX_FIREBASE_MODEL_DOES_NOT_EXIST_ERROR, DBX_FIREBASE_MODEL_ENTITY_WITH_STORE_TOKEN, DBX_FIREBASE_STORAGEFILE_DOWNLOAD_STORAGE_ACCESSOR_TOKEN, DBX_FIREBASE_STORAGE_CONTEXT_CONFIG_TOKEN, DBX_FIREBASE_STORAGE_CONTEXT_TOKEN, DBX_FIREBASE_STORAGE_PDF_MERGE_UPLOAD_FILE_NAME, DBX_FIRESTORE_CONTEXT_TOKEN, DEFAULT_CONFIGURED_DBX_FIREBASE_LOGIN_BUTTON_TEMPLATE, DEFAULT_DBX_FIREBASE_ANALYTICS_USER_PROPERTIES_FACTORY, DEFAULT_DBX_FIREBASE_AUTH_FLOW, DEFAULT_DBX_FIREBASE_AUTH_SERVICE_DELEGATE, DEFAULT_DBX_FIREBASE_FORM_SPACE_STEP_BLOCK_COLOR, DEFAULT_DBX_FIREBASE_FORM_SPACE_STEP_BLOCK_COMPLETE_COLOR, DEFAULT_DBX_FIREBASE_FORM_SPACE_STEP_BLOCK_COMPLETE_ICON, DEFAULT_DBX_FIREBASE_FORM_SPACE_SUBMIT_INCOMPLETE_HINT, DEFAULT_DBX_FIREBASE_ID_ROUTER_PARAM_ID_PARAM_KEY, DEFAULT_DBX_FIREBASE_ID_ROUTER_PARAM_KEY_PARAM_KEY, DEFAULT_DBX_FIREBASE_ID_ROUTER_PARAM_USE_PARAM_VALUE, DEFAULT_DBX_FIREBASE_MODEL_ENTITIES_COMPONENT_POPOVER_KEY, DEFAULT_DBX_FIREBASE_MODEL_HISTORY_COMPONENT_POPOVER_KEY, DEFAULT_DBX_FIREBASE_NOTIFICATION_ITEM_STORE_POPOVER_KEY, DEFAULT_DBX_FIREBASE_STORAGE_FILE_LIST_REMOVE_CONFIRM_CONFIG, DEFAULT_EXTERNAL_CONNECTION_AUTHORIZE_PATH_FACTORY, DEFAULT_EXTERNAL_CONNECTION_NAVIGATE_FUNCTION, DEFAULT_EXTERNAL_CONNECTION_NAVIGATE_TIMEOUT, DEFAULT_FIREBASE_AUTH_LOGIN_PASSWORD_CONFIG, DEFAULT_FIREBASE_AUTH_LOGIN_PASSWORD_CONFIG_TOKEN, DEFAULT_FIREBASE_AUTH_LOGIN_PROVIDERS_TOKEN, DEFAULT_FIREBASE_AUTH_LOGIN_TERMS_COMPONENT_CLASS_TOKEN, DEFAULT_FIREBASE_COLLECTION_CHANGE_TRIGGER_FUNCTION, DEFAULT_FIREBASE_DEVELOPMENT_ENABLED_TOKEN, DEFAULT_FIREBASE_DEVELOPMENT_POPUP_KEY, DEFAULT_FIREBASE_DEVELOPMENT_SCHEDULER_ENABLED_TOKEN, DEFAULT_FIREBASE_DEVELOPMENT_WIDGET_PROVIDERS_TOKEN, DEFAULT_FIREBASE_LOGIN_METHOD_CATEGORY, DEFAULT_FIREBASE_NOTIFICATION_ITEM_WIDGET_TYPE, DEFAULT_NOTIFICATION_HEALTH_CHECK_PRESENTATION_ENTRIES, DEFAULT_NOTIFICATION_HEALTH_CHECK_PROBE_WATCH_MINUTES, DEVELOPMENT_FIREBASE_SERVER_SCHEDULER_WIDGET_KEY, DbxFirebaseAnalyticsUserEventsListenerService, DbxFirebaseAnalyticsUserSource, DbxFirebaseAppCheckHttpInterceptor, DbxFirebaseAuthImpersonationDelegate, DbxFirebaseAuthLoginService, DbxFirebaseAuthService, DbxFirebaseAuthServiceDelegate, DbxFirebaseCalendarIcsRotateButtonComponent, DbxFirebaseCalendarIcsRotateComponent, DbxFirebaseCalendarSubscribeDialogComponent, DbxFirebaseCollectionChangeDirective, DbxFirebaseCollectionChangeTriggerInstance, DbxFirebaseCollectionHasChangeDirective, DbxFirebaseCollectionListDirective, DbxFirebaseCollectionLoaderInstance, DbxFirebaseCollectionStoreDirective, DbxFirebaseCollectionWithParentStoreDirective, DbxFirebaseDevelopmentDirective, DbxFirebaseDevelopmentModule, DbxFirebaseDevelopmentPopupComponent, DbxFirebaseDevelopmentPopupContentComponent, DbxFirebaseDevelopmentPopupContentForgeFormComponent, DbxFirebaseDevelopmentSchedulerListComponent, DbxFirebaseDevelopmentSchedulerListViewComponent, DbxFirebaseDevelopmentSchedulerListViewItemComponent, DbxFirebaseDevelopmentSchedulerService, DbxFirebaseDevelopmentSchedulerWidgetComponent, DbxFirebaseDevelopmentService, DbxFirebaseDevelopmentWidgetService, DbxFirebaseDocumentLoaderInstance, DbxFirebaseDocumentStoreContextModelEntitiesSourceDirective, DbxFirebaseDocumentStoreContextStore, DbxFirebaseDocumentStoreContextStoreDirective, DbxFirebaseDocumentStoreDirective, DbxFirebaseDocumentStoreIdFromTwoWayModelKeyDirective, DbxFirebaseDocumentStoreTwoWayKeyProvider, DbxFirebaseDocumentStoreTwoWayModelKeySourceDirective, DbxFirebaseEmailForgeFormComponent, DbxFirebaseEmailRecoveryForgeFormComponent, DbxFirebaseEmulatorService, DbxFirebaseExternalConnectionListComponent, DbxFirebaseExternalConnectionListViewComponent, DbxFirebaseExternalConnectionListViewItemComponent, DbxFirebaseExternalConnectionService, DbxFirebaseExternalConnectionsComponent, DbxFirebaseExternalConnectionsConfig, DbxFirebaseFormSpaceCollectionStoreDirective, DbxFirebaseFormSpaceDocumentStoreDirective, DbxFirebaseFormSpaceListComponent, DbxFirebaseFormSpaceListViewComponent, DbxFirebaseFormSpaceListViewItemComponent, DbxFirebaseFormSpaceModule, DbxFirebaseFormSpaceSectionComponent, DbxFirebaseFormSpaceSlotUploadComponent, DbxFirebaseFormSpaceSlotUploadDirective, DbxFirebaseFormSpaceStepBlockComponent, DbxFirebaseFormSpaceSubmitButtonComponent, DbxFirebaseFormSpaceUploadInitializeDocumentsDirective, DbxFirebaseLoginAnonymousComponent, DbxFirebaseLoginAppleComponent, DbxFirebaseLoginButtonComponent, DbxFirebaseLoginButtonContainerComponent, DbxFirebaseLoginComponent, DbxFirebaseLoginContext, DbxFirebaseLoginContextBackButtonComponent, DbxFirebaseLoginContextDirective, DbxFirebaseLoginEmailComponent, DbxFirebaseLoginEmailContentComponent, DbxFirebaseLoginFacebookComponent, DbxFirebaseLoginGitHubComponent, DbxFirebaseLoginGoogleComponent, DbxFirebaseLoginListComponent, DbxFirebaseLoginMicrosoftComponent, DbxFirebaseLoginTermsComponent, DbxFirebaseLoginTermsSimpleComponent, DbxFirebaseLoginTwitterComponent, DbxFirebaseManageAuthProvidersComponent, DbxFirebaseModelContextService, DbxFirebaseModelEntitiesComponent, DbxFirebaseModelEntitiesDebugWidgetComponent, DbxFirebaseModelEntitiesPopoverButtonComponent, DbxFirebaseModelEntitiesPopoverComponent, DbxFirebaseModelEntitiesSource, DbxFirebaseModelEntitiesWidgetService, DbxFirebaseModelEntitiesWidgetServiceConfig, DbxFirebaseModelHistoryComponent, DbxFirebaseModelHistoryPopoverButtonComponent, DbxFirebaseModelHistoryPopoverComponent, DbxFirebaseModelKeyComponent, DbxFirebaseModelModule, DbxFirebaseModelStoreModule, DbxFirebaseModelTrackerService, DbxFirebaseModelTypeInstanceListComponent, DbxFirebaseModelTypeInstanceListViewComponent, DbxFirebaseModelTypeInstanceListViewItemComponent, DbxFirebaseModelTypesService, DbxFirebaseModelTypesServiceConfig, DbxFirebaseModelViewedEventDirective, DbxFirebaseModule, DbxFirebaseNotificationBoxCollectionStoreDirective, DbxFirebaseNotificationBoxDocumentStoreDirective, DbxFirebaseNotificationCollectionStoreDirective, DbxFirebaseNotificationDocumentStoreDirective, DbxFirebaseNotificationHealthCheckComponent, DbxFirebaseNotificationHealthCheckConfig, DbxFirebaseNotificationHealthCheckDialogButtonComponent, DbxFirebaseNotificationHealthCheckDialogComponent, DbxFirebaseNotificationHealthCheckIssueComponent, DbxFirebaseNotificationHealthCheckMethodComponent, DbxFirebaseNotificationHealthCheckPresentationService, DbxFirebaseNotificationHealthCheckPresentationServiceConfig, DbxFirebaseNotificationHealthCheckViewComponent, DbxFirebaseNotificationItemContentComponent, DbxFirebaseNotificationItemDefaultViewComponent, DbxFirebaseNotificationItemListComponent, DbxFirebaseNotificationItemListViewComponent, DbxFirebaseNotificationItemListViewItemComponent, DbxFirebaseNotificationItemStore, DbxFirebaseNotificationItemStorePopoverButtonComponent, DbxFirebaseNotificationItemStorePopoverComponent, DbxFirebaseNotificationItemViewComponent, DbxFirebaseNotificationItemWidgetService, DbxFirebaseNotificationSummaryCollectionStoreDirective, DbxFirebaseNotificationSummaryDocumentStoreDirective, DbxFirebaseNotificationTemplateService, DbxFirebaseNotificationUserCollectionStoreDirective, DbxFirebaseNotificationUserDocumentStoreDirective, DbxFirebaseNotificationUserHealthCheckStore, DbxFirebaseParsedEmulatorsConfig, DbxFirebasePasswordResetComponent, DbxFirebasePasswordResetFormComponent, DbxFirebaseRegisterComponent, DbxFirebaseRegisterEmailComponent, DbxFirebaseStorageFileCollectionStoreDirective, DbxFirebaseStorageFileDocumentStoreDirective, DbxFirebaseStorageFileDownloadButtonComponent, DbxFirebaseStorageFileDownloadService, DbxFirebaseStorageFileDownloadStorage, DbxFirebaseStorageFileGroupDocumentStoreDirective, DbxFirebaseStorageFileListComponent, DbxFirebaseStorageFileListViewComponent, DbxFirebaseStorageFileListViewItemComponent, DbxFirebaseStorageFileUploadActionHandlerDirective, DbxFirebaseStorageFileUploadInitializeDocumentDirective, DbxFirebaseStorageFileUploadModule, DbxFirebaseStorageFileUploadStore, DbxFirebaseStorageFileUploadStoreDirective, DbxFirebaseStorageFileUploadSyncDirective, DbxFirebaseStoragePdfMergeUploadSyncDirective, DbxFirebaseStorageService, DbxFirebaseSystemStateCollectionStoreDirective, DbxFirebaseSystemStateDocumentStoreDirective, DbxFirebaseUserExternalConnectionCollections, DbxFirebaseUserExternalConnectionDocumentStoreDirective, DbxFirebaseUserExternalConnectionsStore, DbxFirestoreContextService, DbxLimitedFirebaseDocumentLoaderInstance, FIREBASE_APP_CHECK_TOKEN, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_FUNCTIONS_TOKEN, FIREBASE_NOTIFICATION_ITEM_WIDGET_TYPE_PREFIX, FIREBASE_PROVIDER_ID_TO_LOGIN_METHOD_TYPE_MAP, FIREBASE_STORAGE_TOKEN, FlatFirestoreModelKeyPipe, FormSpaceCollectionStore, FormSpaceDocumentStore, IMPORTS_AND_EXPORTS$1 as IMPORTS_AND_EXPORTS, LOGIN_METHOD_TYPE_TO_FIREBASE_PROVIDER_ID_MAP, NOTIFICATION_DELIVERY_METHOD_ICONS, NOTIFICATION_DELIVERY_METHOD_LABELS, NOTIFICATION_DELIVERY_METHOD_SHORT_LABELS, NOTIFICATION_DELIVERY_METHOD_TEST_MESSAGE_LABELS, NOTIFICATION_DELIVERY_METHOD_TEST_MESSAGE_NOUNS, NOTIFICATION_HEALTH_CHECK_PROBE_ISSUE_OUTCOMES, NOTIFICATION_HEALTH_CHECK_STATUS_COLORS, NOTIFICATION_HEALTH_CHECK_STATUS_ICONS, NOTIFICATION_HEALTH_CHECK_STATUS_LABELS, NotificationBoxCollectionStore, NotificationBoxDocumentStore, NotificationCollectionStore, NotificationDocumentStore, NotificationSummaryCollectionStore, NotificationSummaryDocumentStore, NotificationUserCollectionStore, NotificationUserDocumentStore, OAUTH_FIREBASE_LOGIN_METHOD_CATEGORY, StorageFileCollectionStore, StorageFileDocumentStore, StorageFileGroupDocumentStore, StorageFileUploadFilesError, SystemStateCollectionStore, SystemStateDocumentStore, TwoWayFlatFirestoreModelKeyPipe, UserExternalConnectionDocumentStore, authRolesObsWithClaimsService, authUserInfoFromAuthUser, authUserStateFromFirebaseAuthServiceFunction, createDbxFirebaseAppCheck, createDbxFirebaseAuth, createDbxFirebaseFirestore, createDbxFirebaseFunctions, createDbxFirebaseStorage, dbxFirebaseAuthContextInfo, dbxFirebaseCollectionChangeTrigger, dbxFirebaseCollectionChangeTriggerForStore, dbxFirebaseCollectionChangeTriggerForWatcher, dbxFirebaseCollectionChangeWatcher, dbxFirebaseCollectionLoaderInstance, dbxFirebaseCollectionLoaderInstanceWithCollection, dbxFirebaseDocumentLoaderInstance, dbxFirebaseDocumentLoaderInstanceWithAccessor, dbxFirebaseDocumentStoreContextModelEntitiesSourceFactory, dbxFirebaseExternalConnectionProviderForEntry, dbxFirebaseExternalConnectionRowStatusForEntry, dbxFirebaseExternalConnectionRows, dbxFirebaseFormSpaceListItemStatus, dbxFirebaseFormSpaceSectionBlockerHint, dbxFirebaseFormSpaceSubmitIncompleteHint, dbxFirebaseIdRouteParamRedirect, dbxFirebaseInContextFirebaseModelServiceInstance, dbxFirebaseInContextFirebaseModelServiceInstanceFactory, dbxFirebaseKeyRouteParamRedirect, dbxFirebaseKnownExternalConnectionProvider, dbxFirebaseModelContextServiceInfoInstanceFactory, dbxFirebaseModelEntityWidgetInjectionConfigFactory, dbxFirebaseModelTypesServiceInstance, dbxFirebaseModelTypesServiceInstancePairForKeysFactory, dbxFirebaseSourceSelectLoadSource, dbxFirebaseStorageFileDownloadServiceCustomSourceFromObs, dbxFirebaseStorageFileImageCompressionFileModifier, dbxFirebaseStorageProvidersContextConfigFactory, dbxLimitedFirebaseDocumentLoaderInstance, dbxLimitedFirebaseDocumentLoaderInstanceWithAccessor, dbxWidgetTypeForNotificationTemplateType, defaultDbxFirebaseAuthServiceDelegateWithClaimsService, defaultDbxFirebaseStorageFileDownloadStorageAccessorFactory, developmentFirebaseServerSchedulerWidgetEntry, enableAppCheckDebugTokenGeneration, externalConnectionsLoadingStateFromDocumentLoadingState, firebaseAuthState, firebaseAuthTokenFromUser, firebaseCollectionStoreCreateFunction, firebaseCollectionStoreCrudFunction, firebaseContextServiceEntityMap, firebaseDocumentStoreCreateFunction, firebaseDocumentStoreCrudFunction, firebaseDocumentStoreDeleteFunction, firebaseDocumentStoreInvokeFunction, firebaseDocumentStoreReadFunction, firebaseDocumentStoreUpdateFunction, firebaseIdToken, firebaseProviderIdToLoginMethodType, isDbxFirebaseModelEntityWithStore, isStandaloneWebApp, keyForDbxFirebaseFormSpaceListValue, keyForDbxFirebaseStorageFileListEntry, limitRawFilesForState, linkDocumentStoreToParentContextStores, loginMethodTypeToFirebaseProviderId, maxUploadFilesForState, modelDoesNotExistError, navigateAndWaitForPageToLeave, notificationHealthCheckProbeIssueLabel, parseDbxFirebaseEmulatorsConfig, provideCalendarFirestoreCollections, provideDbxFirebase, provideDbxFirebaseAnalyticsUserEventsListenerService, provideDbxFirebaseApp, provideDbxFirebaseAuth, provideDbxFirebaseAuthImpersonation, provideDbxFirebaseCollectionStoreDirective, provideDbxFirebaseCollectionWithParentStoreDirective, provideDbxFirebaseDevelopment, provideDbxFirebaseDocumentStoreContextStore, provideDbxFirebaseDocumentStoreDirective, provideDbxFirebaseDocumentStoreTwoWayKeyProvider, provideDbxFirebaseExternalConnections, provideDbxFirebaseFormSpaceTypeConfigService, provideDbxFirebaseFunctions, provideDbxFirebaseLogin, provideDbxFirebaseModelContextService, provideDbxFirebaseModelEntitiesWidgetService, provideDbxFirebaseNotifications, provideDbxFirebaseStorageFileService, provideDbxFirestoreCollection, provideFormSpaceFirestoreCollections, provideNotificationFirestoreCollections, provideStorageFileFirestoreCollections, provideSystemStateFirestoreCollections, providedDbxFirebaseStorage, readDbxAnalyticsUserPropertiesFromAuthUserInfo, readValueFromIdToken, resolveDbxFirebaseAuthFlow, setParentStoreEffect, shouldCreateUserExternalConnectionForDocumentLoadingState, stateFromTokenForLoggedInUserFunction, storageFileUploadFiles, storageFileUploadHandler };
+export { AbstractConfiguredDbxFirebaseLoginButtonDirective, AbstractDbxFirebaseCollectionStore, AbstractDbxFirebaseCollectionWithParentStore, AbstractDbxFirebaseDocumentStore, AbstractDbxFirebaseDocumentWithParentStore, AbstractDbxFirebaseModelEntityWidgetDirective, AbstractDbxFirebaseNotificationItemWidgetComponent, AbstractRootSingleItemDbxFirebaseDocument, AbstractSingleItemDbxFirebaseDocument, AbstractSystemStateDocumentStoreAccessor, CalendarDocumentStore, CalendarDocumentStoreDirective, DBX_CONFIGURED_DBX_FIREBASE_LOGIN_BUTTON_COMPONENT_CONFIGURATION, DBX_FIREBASE_APP_OPTIONS_TOKEN, DBX_FIREBASE_AUTH_FLOW_TOKEN, DBX_FIREBASE_DOCUMENT_STORE_CONTEXT_STORE_TOKEN, DBX_FIREBASE_EXTERNAL_CONNECTION_CALCOM_PROVIDER, DBX_FIREBASE_EXTERNAL_CONNECTION_DISCORD_PROVIDER, DBX_FIREBASE_EXTERNAL_CONNECTION_LOGIN_CATEGORY, DBX_FIREBASE_EXTERNAL_CONNECTION_ZOHO_PROVIDER, DBX_FIREBASE_EXTERNAL_CONNECTION_ZOOM_PROVIDER, DBX_FIREBASE_KNOWN_EXTERNAL_CONNECTION_PROVIDERS, DBX_FIREBASE_LINKED_LOGIN_METHODS_SOURCES_TOKEN, DBX_FIREBASE_MODEL_DOES_NOT_EXIST_ERROR, DBX_FIREBASE_MODEL_ENTITY_WITH_STORE_TOKEN, DBX_FIREBASE_STORAGEFILE_DOWNLOAD_STORAGE_ACCESSOR_TOKEN, DBX_FIREBASE_STORAGE_CONTEXT_CONFIG_TOKEN, DBX_FIREBASE_STORAGE_CONTEXT_TOKEN, DBX_FIREBASE_STORAGE_PDF_MERGE_UPLOAD_FILE_NAME, DBX_FIRESTORE_CONTEXT_TOKEN, DEFAULT_CONFIGURED_DBX_FIREBASE_LOGIN_BUTTON_TEMPLATE, DEFAULT_DBX_FIREBASE_ANALYTICS_USER_PROPERTIES_FACTORY, DEFAULT_DBX_FIREBASE_AUTH_FLOW, DEFAULT_DBX_FIREBASE_AUTH_SERVICE_DELEGATE, DEFAULT_DBX_FIREBASE_FORM_SPACE_STEP_BLOCK_COLOR, DEFAULT_DBX_FIREBASE_FORM_SPACE_STEP_BLOCK_COMPLETE_COLOR, DEFAULT_DBX_FIREBASE_FORM_SPACE_STEP_BLOCK_COMPLETE_ICON, DEFAULT_DBX_FIREBASE_FORM_SPACE_SUBMIT_INCOMPLETE_HINT, DEFAULT_DBX_FIREBASE_ID_ROUTER_PARAM_ID_PARAM_KEY, DEFAULT_DBX_FIREBASE_ID_ROUTER_PARAM_KEY_PARAM_KEY, DEFAULT_DBX_FIREBASE_ID_ROUTER_PARAM_USE_PARAM_VALUE, DEFAULT_DBX_FIREBASE_MODEL_ENTITIES_COMPONENT_POPOVER_KEY, DEFAULT_DBX_FIREBASE_MODEL_HISTORY_COMPONENT_POPOVER_KEY, DEFAULT_DBX_FIREBASE_NOTIFICATION_ITEM_STORE_POPOVER_KEY, DEFAULT_DBX_FIREBASE_STORAGE_FILE_LIST_REMOVE_CONFIRM_CONFIG, DEFAULT_EXTERNAL_CONNECTION_AUTHORIZE_PATH_FACTORY, DEFAULT_EXTERNAL_CONNECTION_NAVIGATE_FUNCTION, DEFAULT_EXTERNAL_CONNECTION_NAVIGATE_TIMEOUT, DEFAULT_EXTERNAL_CONNECTION_SIGN_IN_PATH_FACTORY, DEFAULT_EXTERNAL_CONNECTION_TOKEN_PATH_FACTORY, DEFAULT_FIREBASE_AUTH_LOGIN_PASSWORD_CONFIG, DEFAULT_FIREBASE_AUTH_LOGIN_PASSWORD_CONFIG_TOKEN, DEFAULT_FIREBASE_AUTH_LOGIN_PROVIDERS_TOKEN, DEFAULT_FIREBASE_AUTH_LOGIN_TERMS_COMPONENT_CLASS_TOKEN, DEFAULT_FIREBASE_COLLECTION_CHANGE_TRIGGER_FUNCTION, DEFAULT_FIREBASE_DEVELOPMENT_ENABLED_TOKEN, DEFAULT_FIREBASE_DEVELOPMENT_POPUP_KEY, DEFAULT_FIREBASE_DEVELOPMENT_SCHEDULER_ENABLED_TOKEN, DEFAULT_FIREBASE_DEVELOPMENT_WIDGET_PROVIDERS_TOKEN, DEFAULT_FIREBASE_LOGIN_METHOD_CATEGORY, DEFAULT_FIREBASE_NOTIFICATION_ITEM_WIDGET_TYPE, DEFAULT_NOTIFICATION_HEALTH_CHECK_PRESENTATION_ENTRIES, DEFAULT_NOTIFICATION_HEALTH_CHECK_PROBE_WATCH_MINUTES, DEVELOPMENT_FIREBASE_SERVER_SCHEDULER_WIDGET_KEY, DbxFirebaseAnalyticsUserEventsListenerService, DbxFirebaseAnalyticsUserSource, DbxFirebaseAppCheckHttpInterceptor, DbxFirebaseAuthImpersonationDelegate, DbxFirebaseAuthLoginService, DbxFirebaseAuthService, DbxFirebaseAuthServiceDelegate, DbxFirebaseCalendarIcsRotateButtonComponent, DbxFirebaseCalendarIcsRotateComponent, DbxFirebaseCalendarSubscribeDialogComponent, DbxFirebaseCollectionChangeDirective, DbxFirebaseCollectionChangeTriggerInstance, DbxFirebaseCollectionHasChangeDirective, DbxFirebaseCollectionListDirective, DbxFirebaseCollectionLoaderInstance, DbxFirebaseCollectionStoreDirective, DbxFirebaseCollectionWithParentStoreDirective, DbxFirebaseDevelopmentDirective, DbxFirebaseDevelopmentModule, DbxFirebaseDevelopmentPopupComponent, DbxFirebaseDevelopmentPopupContentComponent, DbxFirebaseDevelopmentPopupContentForgeFormComponent, DbxFirebaseDevelopmentSchedulerListComponent, DbxFirebaseDevelopmentSchedulerListViewComponent, DbxFirebaseDevelopmentSchedulerListViewItemComponent, DbxFirebaseDevelopmentSchedulerService, DbxFirebaseDevelopmentSchedulerWidgetComponent, DbxFirebaseDevelopmentService, DbxFirebaseDevelopmentWidgetService, DbxFirebaseDocumentLoaderInstance, DbxFirebaseDocumentStoreContextModelEntitiesSourceDirective, DbxFirebaseDocumentStoreContextStore, DbxFirebaseDocumentStoreContextStoreDirective, DbxFirebaseDocumentStoreDirective, DbxFirebaseDocumentStoreIdFromTwoWayModelKeyDirective, DbxFirebaseDocumentStoreTwoWayKeyProvider, DbxFirebaseDocumentStoreTwoWayModelKeySourceDirective, DbxFirebaseEmailForgeFormComponent, DbxFirebaseEmailRecoveryForgeFormComponent, DbxFirebaseEmulatorService, DbxFirebaseExternalConnectionLinkedLoginMethodsSource, DbxFirebaseExternalConnectionListComponent, DbxFirebaseExternalConnectionListViewComponent, DbxFirebaseExternalConnectionListViewItemComponent, DbxFirebaseExternalConnectionService, DbxFirebaseExternalConnectionsComponent, DbxFirebaseExternalConnectionsConfig, DbxFirebaseFormSpaceCollectionStoreDirective, DbxFirebaseFormSpaceDocumentStoreDirective, DbxFirebaseFormSpaceListComponent, DbxFirebaseFormSpaceListViewComponent, DbxFirebaseFormSpaceListViewItemComponent, DbxFirebaseFormSpaceModule, DbxFirebaseFormSpaceSectionComponent, DbxFirebaseFormSpaceSlotUploadComponent, DbxFirebaseFormSpaceSlotUploadDirective, DbxFirebaseFormSpaceStepBlockComponent, DbxFirebaseFormSpaceSubmitButtonComponent, DbxFirebaseFormSpaceUploadInitializeDocumentsDirective, DbxFirebaseLinkedLoginMethodsService, DbxFirebaseLinkedLoginMethodsSource, DbxFirebaseLoginAnonymousComponent, DbxFirebaseLoginAppleComponent, DbxFirebaseLoginButtonComponent, DbxFirebaseLoginButtonContainerComponent, DbxFirebaseLoginComponent, DbxFirebaseLoginContext, DbxFirebaseLoginContextBackButtonComponent, DbxFirebaseLoginContextDirective, DbxFirebaseLoginEmailComponent, DbxFirebaseLoginEmailContentComponent, DbxFirebaseLoginExternalConnectionComponent, DbxFirebaseLoginFacebookComponent, DbxFirebaseLoginGitHubComponent, DbxFirebaseLoginGoogleComponent, DbxFirebaseLoginListComponent, DbxFirebaseLoginMicrosoftComponent, DbxFirebaseLoginTermsComponent, DbxFirebaseLoginTermsSimpleComponent, DbxFirebaseLoginTwitterComponent, DbxFirebaseManageAuthProvidersComponent, DbxFirebaseModelContextService, DbxFirebaseModelEntitiesComponent, DbxFirebaseModelEntitiesDebugWidgetComponent, DbxFirebaseModelEntitiesPopoverButtonComponent, DbxFirebaseModelEntitiesPopoverComponent, DbxFirebaseModelEntitiesSource, DbxFirebaseModelEntitiesWidgetService, DbxFirebaseModelEntitiesWidgetServiceConfig, DbxFirebaseModelHistoryComponent, DbxFirebaseModelHistoryPopoverButtonComponent, DbxFirebaseModelHistoryPopoverComponent, DbxFirebaseModelKeyComponent, DbxFirebaseModelModule, DbxFirebaseModelStoreModule, DbxFirebaseModelTrackerService, DbxFirebaseModelTypeInstanceListComponent, DbxFirebaseModelTypeInstanceListViewComponent, DbxFirebaseModelTypeInstanceListViewItemComponent, DbxFirebaseModelTypesService, DbxFirebaseModelTypesServiceConfig, DbxFirebaseModelViewedEventDirective, DbxFirebaseModule, DbxFirebaseNotificationBoxCollectionStoreDirective, DbxFirebaseNotificationBoxDocumentStoreDirective, DbxFirebaseNotificationCollectionStoreDirective, DbxFirebaseNotificationDocumentStoreDirective, DbxFirebaseNotificationHealthCheckComponent, DbxFirebaseNotificationHealthCheckConfig, DbxFirebaseNotificationHealthCheckDialogButtonComponent, DbxFirebaseNotificationHealthCheckDialogComponent, DbxFirebaseNotificationHealthCheckIssueComponent, DbxFirebaseNotificationHealthCheckMethodComponent, DbxFirebaseNotificationHealthCheckPresentationService, DbxFirebaseNotificationHealthCheckPresentationServiceConfig, DbxFirebaseNotificationHealthCheckViewComponent, DbxFirebaseNotificationItemContentComponent, DbxFirebaseNotificationItemDefaultViewComponent, DbxFirebaseNotificationItemListComponent, DbxFirebaseNotificationItemListViewComponent, DbxFirebaseNotificationItemListViewItemComponent, DbxFirebaseNotificationItemStore, DbxFirebaseNotificationItemStorePopoverButtonComponent, DbxFirebaseNotificationItemStorePopoverComponent, DbxFirebaseNotificationItemViewComponent, DbxFirebaseNotificationItemWidgetService, DbxFirebaseNotificationSummaryCollectionStoreDirective, DbxFirebaseNotificationSummaryDocumentStoreDirective, DbxFirebaseNotificationTemplateService, DbxFirebaseNotificationUserCollectionStoreDirective, DbxFirebaseNotificationUserDocumentStoreDirective, DbxFirebaseNotificationUserHealthCheckStore, DbxFirebaseParsedEmulatorsConfig, DbxFirebasePasswordResetComponent, DbxFirebasePasswordResetFormComponent, DbxFirebaseRegisterComponent, DbxFirebaseRegisterEmailComponent, DbxFirebaseStorageFileCollectionStoreDirective, DbxFirebaseStorageFileDocumentStoreDirective, DbxFirebaseStorageFileDownloadButtonComponent, DbxFirebaseStorageFileDownloadService, DbxFirebaseStorageFileDownloadStorage, DbxFirebaseStorageFileGroupDocumentStoreDirective, DbxFirebaseStorageFileListComponent, DbxFirebaseStorageFileListViewComponent, DbxFirebaseStorageFileListViewItemComponent, DbxFirebaseStorageFileUploadActionHandlerDirective, DbxFirebaseStorageFileUploadInitializeDocumentDirective, DbxFirebaseStorageFileUploadModule, DbxFirebaseStorageFileUploadStore, DbxFirebaseStorageFileUploadStoreDirective, DbxFirebaseStorageFileUploadSyncDirective, DbxFirebaseStoragePdfMergeUploadSyncDirective, DbxFirebaseStorageService, DbxFirebaseSystemStateCollectionStoreDirective, DbxFirebaseSystemStateDocumentStoreDirective, DbxFirebaseUserExternalConnectionCollections, DbxFirebaseUserExternalConnectionDocumentStoreDirective, DbxFirebaseUserExternalConnectionsStore, DbxFirestoreContextService, DbxLimitedFirebaseDocumentLoaderInstance, EXTERNAL_CONNECTION_SIGN_IN_ERROR_PARAM, EXTERNAL_CONNECTION_SIGN_IN_TICKET_PARAM, EXTERNAL_CONNECTION_SIGN_IN_VERIFIER_STORAGE_KEY, FIREBASE_APP_CHECK_TOKEN, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_FUNCTIONS_TOKEN, FIREBASE_NOTIFICATION_ITEM_WIDGET_TYPE_PREFIX, FIREBASE_PROVIDER_ID_TO_LOGIN_METHOD_TYPE_MAP, FIREBASE_STORAGE_TOKEN, FlatFirestoreModelKeyPipe, FormSpaceCollectionStore, FormSpaceDocumentStore, IMPORTS_AND_EXPORTS$1 as IMPORTS_AND_EXPORTS, LOGIN_METHOD_TYPE_TO_FIREBASE_PROVIDER_ID_MAP, NOTIFICATION_DELIVERY_METHOD_ICONS, NOTIFICATION_DELIVERY_METHOD_LABELS, NOTIFICATION_DELIVERY_METHOD_SHORT_LABELS, NOTIFICATION_DELIVERY_METHOD_TEST_MESSAGE_LABELS, NOTIFICATION_DELIVERY_METHOD_TEST_MESSAGE_NOUNS, NOTIFICATION_HEALTH_CHECK_PROBE_ISSUE_OUTCOMES, NOTIFICATION_HEALTH_CHECK_STATUS_COLORS, NOTIFICATION_HEALTH_CHECK_STATUS_ICONS, NOTIFICATION_HEALTH_CHECK_STATUS_LABELS, NotificationBoxCollectionStore, NotificationBoxDocumentStore, NotificationCollectionStore, NotificationDocumentStore, NotificationSummaryCollectionStore, NotificationSummaryDocumentStore, NotificationUserCollectionStore, NotificationUserDocumentStore, OAUTH_FIREBASE_LOGIN_METHOD_CATEGORY, StorageFileCollectionStore, StorageFileDocumentStore, StorageFileGroupDocumentStore, StorageFileUploadFilesError, SystemStateCollectionStore, SystemStateDocumentStore, TwoWayFlatFirestoreModelKeyPipe, UserExternalConnectionDocumentStore, authRolesObsWithClaimsService, authUserInfoFromAuthUser, authUserStateFromFirebaseAuthServiceFunction, createDbxFirebaseAppCheck, createDbxFirebaseAuth, createDbxFirebaseFirestore, createDbxFirebaseFunctions, createDbxFirebaseStorage, dbxFirebaseAuthContextInfo, dbxFirebaseCollectionChangeTrigger, dbxFirebaseCollectionChangeTriggerForStore, dbxFirebaseCollectionChangeTriggerForWatcher, dbxFirebaseCollectionChangeWatcher, dbxFirebaseCollectionLoaderInstance, dbxFirebaseCollectionLoaderInstanceWithCollection, dbxFirebaseDocumentLoaderInstance, dbxFirebaseDocumentLoaderInstanceWithAccessor, dbxFirebaseDocumentStoreContextModelEntitiesSourceFactory, dbxFirebaseExternalConnectionLinkedLoginMethodTypes, dbxFirebaseExternalConnectionLoginProvider, dbxFirebaseExternalConnectionLoginProviders, dbxFirebaseExternalConnectionProviderForEntry, dbxFirebaseExternalConnectionRowStatusForEntry, dbxFirebaseExternalConnectionRows, dbxFirebaseFormSpaceListItemStatus, dbxFirebaseFormSpaceSectionBlockerHint, dbxFirebaseFormSpaceSubmitIncompleteHint, dbxFirebaseIdRouteParamRedirect, dbxFirebaseInContextFirebaseModelServiceInstance, dbxFirebaseInContextFirebaseModelServiceInstanceFactory, dbxFirebaseKeyRouteParamRedirect, dbxFirebaseKnownExternalConnectionProvider, dbxFirebaseModelContextServiceInfoInstanceFactory, dbxFirebaseModelEntityWidgetInjectionConfigFactory, dbxFirebaseModelTypesServiceInstance, dbxFirebaseModelTypesServiceInstancePairForKeysFactory, dbxFirebaseSourceSelectLoadSource, dbxFirebaseStorageFileDownloadServiceCustomSourceFromObs, dbxFirebaseStorageFileImageCompressionFileModifier, dbxFirebaseStorageProvidersContextConfigFactory, dbxLimitedFirebaseDocumentLoaderInstance, dbxLimitedFirebaseDocumentLoaderInstanceWithAccessor, dbxWidgetTypeForNotificationTemplateType, defaultDbxFirebaseAuthServiceDelegateWithClaimsService, defaultDbxFirebaseStorageFileDownloadStorageAccessorFactory, developmentFirebaseServerSchedulerWidgetEntry, enableAppCheckDebugTokenGeneration, externalConnectionLoginsLoadingStateFromDocumentLoadingState, externalConnectionMapLoadingStateFromDocumentLoadingState, externalConnectionsLoadingStateFromDocumentLoadingState, firebaseAuthState, firebaseAuthTokenFromUser, firebaseCollectionStoreCreateFunction, firebaseCollectionStoreCrudFunction, firebaseContextServiceEntityMap, firebaseDocumentStoreCreateFunction, firebaseDocumentStoreCrudFunction, firebaseDocumentStoreDeleteFunction, firebaseDocumentStoreInvokeFunction, firebaseDocumentStoreReadFunction, firebaseDocumentStoreUpdateFunction, firebaseIdToken, firebaseProviderIdToLoginMethodType, isDbxFirebaseModelEntityWithStore, isStandaloneWebApp, keyForDbxFirebaseFormSpaceListValue, keyForDbxFirebaseStorageFileListEntry, limitRawFilesForState, linkDocumentStoreToParentContextStores, loginMethodTypeToFirebaseProviderId, maxUploadFilesForState, mergeDbxFirebaseLinkedLoginMethodTypes, modelDoesNotExistError, navigateAndWaitForPageToLeave, notificationHealthCheckProbeIssueLabel, parseDbxFirebaseEmulatorsConfig, provideCalendarFirestoreCollections, provideDbxFirebase, provideDbxFirebaseAnalyticsUserEventsListenerService, provideDbxFirebaseApp, provideDbxFirebaseAuth, provideDbxFirebaseAuthImpersonation, provideDbxFirebaseCollectionStoreDirective, provideDbxFirebaseCollectionWithParentStoreDirective, provideDbxFirebaseDevelopment, provideDbxFirebaseDocumentStoreContextStore, provideDbxFirebaseDocumentStoreDirective, provideDbxFirebaseDocumentStoreTwoWayKeyProvider, provideDbxFirebaseExternalConnections, provideDbxFirebaseFormSpaceTypeConfigService, provideDbxFirebaseFunctions, provideDbxFirebaseLogin, provideDbxFirebaseModelContextService, provideDbxFirebaseModelEntitiesWidgetService, provideDbxFirebaseNotifications, provideDbxFirebaseStorageFileService, provideDbxFirestoreCollection, provideFormSpaceFirestoreCollections, provideNotificationFirestoreCollections, provideStorageFileFirestoreCollections, provideSystemStateFirestoreCollections, providedDbxFirebaseStorage, readDbxAnalyticsUserPropertiesFromAuthUserInfo, readExternalConnectionSignInFailureFromUrl, readExternalConnectionSignInTicketFromUrl, readValueFromIdToken, resolveDbxFirebaseAuthFlow, setParentStoreEffect, shouldCreateUserExternalConnectionForDocumentLoadingState, stateFromTokenForLoggedInUserFunction, storageFileUploadFiles, storageFileUploadHandler };
 //# sourceMappingURL=dereekb-dbx-firebase.mjs.map