@dereekb/oauth-resource 14.4.0

package/firebase/index.esm.js

@@ -0,0 +1,1924 @@
+import { createRequire } from 'node:module';
+import { dirname } from 'node:path';
+import { Firestore, getFirestore, connectFirestoreEmulator } from 'firebase/firestore';
+import { initializeApp, deleteApp, getApps } from 'firebase/app';
+import { initializeAppCheck, CustomProvider } from 'firebase/app-check';
+import { signInWithCustomToken, getAuth, connectAuthEmulator } from 'firebase/auth';
+import { clientFirebaseFirestoreContextFactory } from '@dereekb/firebase';
+import { BaseError } from 'make-error';
+import { expirationDetails } from '@dereekb/util';
+
+function _define_property$3(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _instanceof$2(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _object_spread$2(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$3(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$2(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$2(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$2(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+/**
+ * The `drivers.firestoreDriverIdentifier` a client-SDK `FirestoreContext` reports.
+ *
+ * `clientFirebaseFirestoreContextFactory` stamps this; the server's
+ * `googleCloudFirestoreContextFactory` stamps `@google-cloud/firestore` instead. Comparing against
+ * it is how {@link inspectFirebaseClientFirestoreIdentity} tells an admin-SDK context that reached
+ * the client-SDK read path apart from a genuinely broken client one.
+ */ var CLIENT_FIRESTORE_DRIVER_IDENTIFIER = '@firebase/firestore';
+/**
+ * Default {@link InspectFirebaseClientFirestoreIdentityInput.consumerName}.
+ */ var DEFAULT_FIRESTORE_IDENTITY_CONSUMER_NAME = '@dereekb/oauth-resource/firebase';
+/**
+ * Checks that a session's Firestore handle is one THIS copy of the client SDK will accept, and
+ * reports where every consumer resolved the SDK from.
+ *
+ * Exists because `collection()` refuses any non-`Firestore` first argument with one message —
+ * `Expected first argument to collection() to be a CollectionReference, a DocumentReference or
+ * FirebaseFirestore` — that names neither the model, nor the collection, nor which of the four
+ * distinct causes ({@link FirebaseClientFirestoreIdentityProblem}) produced it.
+ *
+ * Lives in this package rather than in a consumer because the `instanceof Firestore` brand check
+ * must be performed by the module that CONSTRUCTS the handle, and that module is
+ * `openFirebaseUserSession`.
+ *
+ * The `instanceof` test is the load-bearing one and it is deliberately NOT structural: an identity
+ * check across the package boundary is the only thing that can detect a duplicated
+ * `@firebase/firestore`, which is exactly what a structural check would hide.
+ *
+ * @param input - The session's `firestoreContext`, when one was built, plus the consumer's
+ *   resolution root.
+ * @returns The provenance + brand-check report.
+ */ function inspectFirebaseClientFirestoreIdentity(input) {
+    var _input_firestoreContext, _input_firestoreContext_drivers, _input_firestoreContext1;
+    var firestore = (_input_firestoreContext = input.firestoreContext) === null || _input_firestoreContext === void 0 ? void 0 : _input_firestoreContext.firestore;
+    var driverIdentifier = (_input_firestoreContext1 = input.firestoreContext) === null || _input_firestoreContext1 === void 0 ? void 0 : (_input_firestoreContext_drivers = _input_firestoreContext1.drivers) === null || _input_firestoreContext_drivers === void 0 ? void 0 : _input_firestoreContext_drivers.firestoreDriverIdentifier;
+    var firestoreDriverIdentifier = typeof driverIdentifier === 'string' ? driverIdentifier : undefined;
+    var firestorePresent = firestore != null;
+    var firestoreIsSdkInstance = _instanceof$2(firestore, Firestore);
+    var firestoreConstructor = firestoreConstructorName(firestore);
+    var modules = resolveFirebaseClientFirestoreSdkModules(input.consumerRequire);
+    var sdkDuplicated = modules.sdkFromConsumer.packageDir != null && modules.sdkFromDbxFirebase.packageDir != null && modules.sdkFromConsumer.packageDir !== modules.sdkFromDbxFirebase.packageDir;
+    var problem;
+    if (!firestorePresent) {
+        problem = 'no-firestore-handle';
+    } else if (firestoreDriverIdentifier != null && firestoreDriverIdentifier !== CLIENT_FIRESTORE_DRIVER_IDENTIFIER) {
+        problem = 'unexpected-driver';
+    } else if (!firestoreIsSdkInstance) {
+        problem = sdkDuplicated ? 'duplicated-firestore-sdk' : 'foreign-firestore-instance';
+    }
+    return _object_spread_props$2(_object_spread$2(_object_spread_props$2(_object_spread$2({
+        ok: problem == null
+    }, problem == null ? {} : {
+        problem: problem
+    }), {
+        firestorePresent: firestorePresent,
+        firestoreIsSdkInstance: firestoreIsSdkInstance
+    }), firestoreConstructor == null ? {} : {
+        firestoreConstructor: firestoreConstructor
+    }, firestoreDriverIdentifier == null ? {} : {
+        firestoreDriverIdentifier: firestoreDriverIdentifier
+    }, modules), {
+        sdkDuplicated: sdkDuplicated
+    });
+}
+/**
+ * The actionable next step for a failed {@link inspectFirebaseClientFirestoreIdentity}, keyed on
+ * which problem was found.
+ *
+ * Each branch names the fix rather than the symptom — a raw SDK sentence sends an operator looking at
+ * security rules and App Check, neither of which is ever the cause here.
+ *
+ * @param report - The report to describe.
+ * @param overrides - Per-problem replacement text, for a consumer whose operator-facing wording
+ *   names its own remediation (`re-run with --verbose`, `rebuild the CLI`, …).
+ * @param consumerName - Names the consumer in the duplicated-SDK text. Defaults to
+ *   {@link DEFAULT_FIRESTORE_IDENTITY_CONSUMER_NAME}.
+ * @returns The suggestion, or `undefined` when the report passed.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function firebaseClientFirestoreIdentitySuggestion(report, overrides, consumerName) {
+    var consumer = consumerName || DEFAULT_FIRESTORE_IDENTITY_CONSUMER_NAME;
+    var override = report.problem == null ? undefined : overrides === null || overrides === void 0 ? void 0 : overrides[report.problem];
+    var result;
+    if (override == null) {
+        switch(report.problem){
+            case 'no-firestore-handle':
+                result = "The session produced no Firestore handle, so every collection reference built from it fails. This is a wiring fault, not a rules or App Check fault — verify the handshake completed and that ".concat(consumer, " resolves ONE `@dereekb/firebase`.");
+                break;
+            case 'unexpected-driver':
+                result = 'The `FirestoreContext` reports driver "'.concat(report.firestoreDriverIdentifier, '", not "').concat(CLIENT_FIRESTORE_DRIVER_IDENTIFIER, '". An admin-SDK context reached the client-SDK read path — build the context with `clientFirebaseFirestoreContextFactory`, not `googleCloudFirestoreContextFactory`.');
+                break;
+            case 'duplicated-firestore-sdk':
+                result = "Two copies of `@firebase/firestore` are loaded — ".concat(consumer, " resolves ").concat(report.sdkFromConsumer.packageDir, ", `@dereekb/firebase` resolves ").concat(report.sdkFromDbxFirebase.packageDir, " — so the handle one minted fails the other's brand check. Dedupe the install (`npm ls @firebase/firestore`) and rebuild.");
+                break;
+            case 'foreign-firestore-instance':
+                var _report_firestoreConstructor;
+                result = "The session's handle (`".concat((_report_firestoreConstructor = report.firestoreConstructor) !== null && _report_firestoreConstructor !== void 0 ? _report_firestoreConstructor : 'unknown', "`) is not an instance of the loaded SDK's `Firestore`, and only one copy of `@firebase/firestore` is installed. The likeliest cause is a STALE build artifact running against a newer `@dereekb/*` in `node_modules` — rebuild ").concat(consumer, "'s consumer and re-run.");
+                break;
+            default:
+                result = undefined;
+                break;
+        }
+    } else {
+        result = override;
+    }
+    return result;
+}
+// MARK: Internal
+/**
+ * The handle's constructor name, when it has one.
+ *
+ * @param firestore - The candidate handle.
+ * @returns The constructor name, or `undefined`.
+ */ function firestoreConstructorName(firestore) {
+    var _firestore_constructor;
+    var name = firestore == null ? undefined : (_firestore_constructor = firestore.constructor) === null || _firestore_constructor === void 0 ? void 0 : _firestore_constructor.name;
+    return typeof name === 'string' ? name : undefined;
+}
+/**
+ * Resolves `@firebase/firestore` from both the consumer and `@dereekb/firebase`, plus the `firebase`
+ * umbrella version.
+ *
+ * `createRequire` rather than `import.meta.resolve` because the resolution has to be performed
+ * relative to ANOTHER package's location (`@dereekb/firebase`'s entry file) to answer the question
+ * that matters — whether the two consumers see the same copy.
+ *
+ * @param consumerRequire - The consumer's own `require`. Defaults to this package's.
+ * @returns The two module identities and the umbrella version, each degrading to an `error` field
+ *   rather than throwing: this runs inside a diagnostic, and a failed resolution is itself a finding.
+ */ function resolveFirebaseClientFirestoreSdkModules(consumerRequire) {
+    var requireFromConsumer = consumerRequire !== null && consumerRequire !== void 0 ? consumerRequire : createRequire(import.meta.url);
+    var sdkFromConsumer = resolveFirestoreSdkIdentity(requireFromConsumer);
+    var sdkFromDbxFirebase;
+    try {
+        sdkFromDbxFirebase = resolveFirestoreSdkIdentity(createRequire(requireFromConsumer.resolve('@dereekb/firebase')));
+    } catch (e) {
+        sdkFromDbxFirebase = {
+            error: _instanceof$2(e, Error) ? e.message : String(e)
+        };
+    }
+    var firebaseVersion;
+    try {
+        firebaseVersion = readPackageVersion(requireFromConsumer, 'firebase/package.json');
+    } catch (unused) {
+        // the umbrella version is context for the report, not a finding on its own
+        firebaseVersion = undefined;
+    }
+    return _object_spread$2({
+        sdkFromConsumer: sdkFromConsumer,
+        sdkFromDbxFirebase: sdkFromDbxFirebase
+    }, firebaseVersion == null ? {} : {
+        firebaseVersion: firebaseVersion
+    });
+}
+/**
+ * Resolves `@firebase/firestore`'s package directory + version through one `require`.
+ *
+ * Resolves `package.json` rather than the package entry because the entry differs per export
+ * condition (`index.node.cjs.js` vs `index.node.mjs`), which would report two copies where there is
+ * one. The `package.json` path is condition-independent, so its directory is a stable identity.
+ *
+ * @param resolver - The `require` to resolve through.
+ * @returns The module identity, with `error` set when resolution failed.
+ */ function resolveFirestoreSdkIdentity(resolver) {
+    var result;
+    try {
+        var packageJsonPath = resolver.resolve('@firebase/firestore/package.json');
+        var version = readPackageVersion(resolver, '@firebase/firestore/package.json');
+        result = _object_spread$2({
+            packageDir: dirname(packageJsonPath)
+        }, version == null ? {} : {
+            version: version
+        });
+    } catch (e) {
+        result = {
+            error: _instanceof$2(e, Error) ? e.message : String(e)
+        };
+    }
+    return result;
+}
+/**
+ * Reads a resolvable `package.json`'s `version`.
+ *
+ * @param resolver - The `require` to load through.
+ * @param specifier - The `package.json` specifier.
+ * @returns The version string, or `undefined` when absent.
+ */ function readPackageVersion(resolver, specifier) {
+    var contents = resolver(specifier);
+    return typeof contents.version === 'string' ? contents.version : undefined;
+}
+
+/**
+ * Default host used for Firebase emulator connections when a {@link FirebaseClientEmulatorsConfig}
+ * omits one.
+ */ var DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST = 'localhost';
+/**
+ * Returns true when the config carries the minimum Firebase client values needed to open a
+ * user-scoped Firestore session.
+ *
+ * Deliberately a standalone predicate rather than a field of a wider "config is complete" check: a
+ * host's Firebase config is optional, and folding it into a general completeness check would break
+ * every consumer that only talks to the HTTP API.
+ *
+ * @param firebase - The Firebase client config, if any.
+ * @returns `true` when `apiKey`, `projectId`, and `appId` are all present and non-empty.
+ */ function isFirebaseClientConfigComplete(firebase) {
+    return Boolean((firebase === null || firebase === void 0 ? void 0 : firebase.apiKey) && (firebase === null || firebase === void 0 ? void 0 : firebase.projectId) && (firebase === null || firebase === void 0 ? void 0 : firebase.appId));
+}
+/**
+ * Returns true when the config's emulator targets are present and active.
+ *
+ * @param firebase - The Firebase client config, if any.
+ * @returns `true` when emulators are configured and not explicitly disabled.
+ */ function firebaseClientEmulatorsInUse(firebase) {
+    var emulators = firebase === null || firebase === void 0 ? void 0 : firebase.emulators;
+    return Boolean(emulators && emulators.useEmulators !== false && (emulators.authPort != null || emulators.firestorePort != null));
+}
+
+function _assert_this_initialized(self) {
+    if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    return self;
+}
+function asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$2(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _call_super(_this, derived, args) {
+    derived = _get_prototype_of(derived);
+    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, args || [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
+}
+function _define_property$2(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _get_prototype_of(o) {
+    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of(o);
+}
+function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of(subClass, superClass);
+}
+function _instanceof$1(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _is_native_reflect_construct() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct = function() {
+        return !!result;
+    })();
+}
+function _possible_constructor_return(self, call) {
+    if (call && (_type_of(call) === "object" || typeof call === "function")) return call;
+    return _assert_this_initialized(self);
+}
+function _set_prototype_of(o, p) {
+    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of(o, p);
+}
+function _ts_generator$2(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+/**
+ * Path (relative to the API base URL) of the user-scoped Firestore session endpoint served by
+ * `@dereekb/firebase-server`'s `SessionApiController`.
+ *
+ * Duplicated here rather than imported because importing it from `@dereekb/firebase-server` would be
+ * a dependency CYCLE: `firebase-server` already depends on `@dereekb/oauth-resource`
+ * (`packages/firebase-server/oidc/src/lib/service/oidc.service.ts`). The source of truth is
+ * `packages/firebase-server/src/lib/nest/controller/session/session.api.config.ts`.
+ */ var FIRESTORE_SESSION_API_PATH = "/session/firestore";
+/**
+ * Error raised when a user-scoped Firestore session cannot be obtained.
+ *
+ * Consumers that already have their own error type do not have to catch and re-wrap this one: pass a
+ * {@link FirestoreSessionErrorFactory} and the session functions throw that type instead — the same
+ * seam `OAuthResourceErrorFactory` provides for verification.
+ */ var FirestoreSessionError = /*#__PURE__*/ function(BaseError) {
+    _inherits(FirestoreSessionError, BaseError);
+    function FirestoreSessionError(input) {
+        _class_call_check(this, FirestoreSessionError);
+        var _this;
+        _this = _call_super(this, FirestoreSessionError, [
+            input.message
+        ]), _define_property$2(_this, "code", void 0), _define_property$2(_this, "status", void 0), _define_property$2(_this, "suggestion", void 0), _define_property$2(_this, "details", void 0);
+        _this.code = input.code;
+        if (input.status != null) {
+            _this.status = input.status;
+        }
+        if (input.suggestion != null) {
+            _this.suggestion = input.suggestion;
+        }
+        if (input.details != null) {
+            _this.details = input.details;
+        }
+        return _this;
+    }
+    return FirestoreSessionError;
+}(BaseError);
+/**
+ * Default {@link FirestoreSessionErrorFactory}, producing a {@link FirestoreSessionError}.
+ *
+ * @param input - The code, message, status, suggestion, and details of the failure.
+ * @returns The error to throw.
+ */ var defaultFirestoreSessionErrorFactory = function defaultFirestoreSessionErrorFactory(input) {
+    return new FirestoreSessionError(input);
+};
+/**
+ * Returns true when the input is a {@link FirestoreSessionError}.
+ *
+ * @param error - The value to test.
+ * @returns Whether the value is a {@link FirestoreSessionError}.
+ */ function isFirestoreSessionError(error) {
+    return _instanceof$1(error, FirestoreSessionError);
+}
+/**
+ * Maps an HTTP status from the mint endpoint onto a {@link FirestoreSessionErrorCode}.
+ *
+ * @param status - The response status.
+ * @returns The matching error code.
+ * @__NO_SIDE_EFFECTS__
+ */ function firestoreSessionErrorCodeForStatus(status) {
+    var result;
+    if (status === 401) {
+        result = 'unauthorized';
+    } else if (status === 403) {
+        result = 'forbidden';
+    } else if (status === 404) {
+        result = 'not_found';
+    } else if (status >= 500) {
+        result = 'unavailable';
+    } else {
+        result = 'invalid_response';
+    }
+    return result;
+}
+// MARK: Fetch
+/**
+ * Composes the session endpoint's absolute URL from an API base URL.
+ *
+ * @param apiBaseUrl - The API base URL, with or without a trailing slash.
+ * @returns The absolute `/session/firestore` URL.
+ * @__NO_SIDE_EFFECTS__
+ */ function firestoreSessionUrl(apiBaseUrl) {
+    return "".concat(trimSlash(apiBaseUrl)).concat(FIRESTORE_SESSION_API_PATH);
+}
+/**
+ * Fetches a user-scoped Firestore session from the API with a Bearer access token.
+ *
+ * The endpoint is admin-only and additionally gated on the `session.firestore` OIDC scope, so a 403
+ * here usually means the token's user is not an admin or the token was issued without that scope.
+ *
+ * @param input - The API target, access token, and optional fetch/error overrides.
+ * @returns The parsed {@link FirestoreSessionCredentials}.
+ * @throws {FirestoreSessionError} (or the `errorFactory`'s type) When the endpoint answers non-2xx or returns an unusable body.
+ */ function fetchFirestoreSession(input) {
+    return _async_to_generator$2(function() {
+        var _input_errorFactory, _input_fetcher, errorFactory, url, fetchImpl, res, text, body, credentials;
+        return _ts_generator$2(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    errorFactory = (_input_errorFactory = input.errorFactory) !== null && _input_errorFactory !== void 0 ? _input_errorFactory : defaultFirestoreSessionErrorFactory;
+                    url = firestoreSessionUrl(input.apiBaseUrl);
+                    fetchImpl = (_input_fetcher = input.fetcher) !== null && _input_fetcher !== void 0 ? _input_fetcher : fetch;
+                    return [
+                        4,
+                        fetchImpl(url, {
+                            method: 'GET',
+                            headers: {
+                                Accept: 'application/json',
+                                Authorization: "Bearer ".concat(input.accessToken)
+                            }
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    return [
+                        4,
+                        res.text()
+                    ];
+                case 2:
+                    text = _state.sent();
+                    if (text.length > 0) {
+                        try {
+                            body = JSON.parse(text);
+                        } catch (unused) {
+                            body = text;
+                        }
+                    }
+                    if (!res.ok) {
+                        throw errorFactory({
+                            message: "firestore session request failed: ".concat(extractMessage(body, text, res)),
+                            code: firestoreSessionErrorCodeForStatus(res.status),
+                            status: res.status,
+                            suggestion: res.status === 401 || res.status === 403 ? '`/session/firestore` is admin-only and additionally gated on the `session.firestore` OIDC scope. The presented access token must belong to an admin user and carry that scope.' : 'Verify the API exposes `/session/firestore` (the `@dereekb/firebase-server` session module must be registered and `/api/session` added to the OIDC `protectedPaths`).'
+                        });
+                    }
+                    credentials = body;
+                    if (!(credentials === null || credentials === void 0 ? void 0 : credentials.customToken)) {
+                        throw errorFactory({
+                            message: 'firestore session response did not include a customToken.',
+                            code: 'invalid_response',
+                            status: res.status,
+                            suggestion: 'Verify the API is running a `@dereekb/firebase-server` version that serves `/session/firestore`.'
+                        });
+                    }
+                    return [
+                        2,
+                        credentials
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * The most descriptive message available for a failed response.
+ *
+ * @param body - The parsed body, when one parsed.
+ * @param fallback - The raw response text.
+ * @param res - The response, for its status line.
+ * @returns The message to report.
+ */ function extractMessage(body, fallback, res) {
+    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of(body)) === 'object' && body && 'message' in body ? body.message : undefined;
+    var messageString = typeof bodyMessage === 'string' ? bodyMessage : undefined;
+    return messageString !== null && messageString !== void 0 ? messageString : fallback || "".concat(res.status, " ").concat(res.statusText);
+}
+/**
+ * Removes a single trailing slash from a URL.
+ *
+ * @param url - The URL to trim.
+ * @returns The URL with no trailing slash.
+ */ function trimSlash(url) {
+    return url.endsWith('/') ? url.slice(0, -1) : url;
+}
+
+/**
+ * Hard ceiling on how long a minted user-scoped Firestore session may be reused, regardless of what
+ * the API reported in `expiresAt`.
+ *
+ * One hour, because that is the Firebase ceiling the credentials themselves sit under: a custom
+ * token is exchangeable for one hour, and the ID token it mints lives one hour. Holding a session
+ * past that buys nothing — the sign-in would fail — and re-minting is one HTTP round-trip.
+ */ var FIRESTORE_SESSION_MAX_CACHE_MS = 60 * 60 * 1000;
+/**
+ * Default skew/latency buffer applied when deciding whether a cached session is still usable.
+ */ var FIRESTORE_SESSION_EXPIRY_BUFFER_MS = 60000;
+/**
+ * Resolves the epoch-millis instant at which a cached session stops being usable.
+ *
+ * The effective expiry is the EARLIER of the API-reported `expiresAt` and
+ * {@link FIRESTORE_SESSION_MAX_CACHE_MS} past the write. Taking the earlier of the two means a
+ * server that reports an over-long (or unparsable) window still cannot push a session past the
+ * Firebase credential ceiling.
+ *
+ * @param entry - The cached entry.
+ * @returns The effective expiry in unix epoch milliseconds.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function firestoreSessionEntryExpiresAt(entry) {
+    var ceiling = entry.cachedAt + FIRESTORE_SESSION_MAX_CACHE_MS;
+    var reported = Date.parse(entry.session.expiresAt);
+    return Number.isFinite(reported) ? Math.min(reported, ceiling) : ceiling;
+}
+/**
+ * Returns true when the cached session is at or near its effective expiry.
+ *
+ * @param entry - The cached entry (`null`/`undefined` is treated as expired).
+ * @param nowMs - The current time in unix epoch milliseconds. Defaults to `Date.now()`.
+ * @param bufferMs - Skew/latency buffer; the entry is treated as expired this far ahead of its effective expiry.
+ * @returns `true` when the entry is unusable, otherwise `false`.
+ */ function isFirestoreSessionExpired(entry) {
+    var nowMs = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : Date.now(), bufferMs = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : FIRESTORE_SESSION_EXPIRY_BUFFER_MS;
+    return entry == null || expirationDetails({
+        expiresFromDate: firestoreSessionEntryExpiresAt(entry),
+        expiresIn: -bufferMs,
+        now: new Date(nowMs)
+    }).hasExpired();
+}
+
+function asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$1(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _define_property$1(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _object_spread$1(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$1(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$1(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$1(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$1(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator$1(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+// MARK: App Name
+/**
+ * Separator between the segments of a {@link firebaseUserSessionAppName}.
+ *
+ * `::` rather than `-` because a Firebase project id is `[a-z0-9-]+`, so a single `-` makes
+ * `(ns='srv', scope='a-b', uid='c')` and `(ns='srv', scope='a', uid='b-c')` collide on `srv-a-b-c`.
+ * `:` cannot appear in a project id, so `::` is collision-free for any namespace that does not itself
+ * contain `::`.
+ */ var FIREBASE_USER_SESSION_KEY_SEPARATOR = '::';
+/**
+ * The base Firebase app name a user-scoped session registers.
+ *
+ * A DERIVED name rather than a side registry is what lets {@link closeFirebaseUserSessionApps} find
+ * every app this owner opened from `getApps()` alone — no registry to keep in sync, and idempotent by
+ * construction.
+ *
+ * Note this is the BASE name: {@link openFirebaseUserSession} appends `#2`, `#3`, … when the base is
+ * already taken, because a session that mints its own credentials must never reuse an existing app
+ * registration (see the note on {@link openFirebaseUserSession}).
+ *
+ * @param input - The namespace, scope, and uid the session targets.
+ * @returns The base Firebase app name.
+ * @__NO_SIDE_EFFECTS__
+ */ function firebaseUserSessionAppName(input) {
+    return [
+        input.namespace,
+        input.scope,
+        input.uid
+    ].join(FIREBASE_USER_SESSION_KEY_SEPARATOR);
+}
+/**
+ * The `getApps()` name prefix every session opened under a namespace shares.
+ *
+ * @param namespace - The namespace to sweep.
+ * @returns The app-name prefix.
+ * @__NO_SIDE_EFFECTS__
+ */ function firebaseUserSessionNamespacePrefix(namespace) {
+    return "".concat(namespace).concat(FIREBASE_USER_SESSION_KEY_SEPARATOR);
+}
+/**
+ * Opens a direct Firestore connection as the user the presented access token belongs to.
+ *
+ * Steps, in a strict order:
+ *
+ * 0. When a `credentialsCache` is supplied, reuse the cached credential envelope if it is still live.
+ *    Sessions are cached for up to an hour (see {@link FIRESTORE_SESSION_MAX_CACHE_MS}), which is the
+ *    ceiling the Firebase credentials themselves sit under. A hit skips step 1 only — the Firebase
+ *    app is per-session, so the sign-in in step 5 always runs.
+ * 1. `GET <apiBaseUrl>/session/firestore` for a custom token + App Check attestation.
+ * 2. `initializeApp` under the first FREE name derived from {@link firebaseUserSessionAppName}.
+ *
+ *    **Never reuse an existing registration.** `initializeAppCheck` on an app whose App Check
+ *    provider is already initialized silently returns the EXISTING instance when
+ *    `CustomProvider.isEqual` matches — and `isEqual` compares `getToken.toString()`, the source text
+ *    of the arrow function, which is byte-identical across two closures built at this call site over
+ *    different tokens. Reusing an app therefore keeps the FIRST attestation and drops the freshly
+ *    minted one on the floor, so requests go out under a stale (eventually expired) App Check token.
+ *    App reuse is the POOL's responsibility, at the session-object level, never at the app-registry
+ *    level.
+ * 3. `initializeAppCheck` with a `CustomProvider` handing back the server-minted token. **This must
+ *    happen before any other Firebase call** — `dbx-firebase`'s provider documents the same
+ *    constraint: "App Check must be initialized before any Firebase request goes out, otherwise
+ *    requests are sent without an App Check token and are rejected in production." Skipped when the
+ *    config targets emulators (which do not verify attestations) or when the API minted no token.
+ * 4. `getAuth` / `getFirestore`, connecting each to its emulator when configured.
+ * 5. `signInWithCustomToken`. The user's stored custom claims land at the top level of the exchanged
+ *    ID token, so `request.auth.token.<claim>` reads in security rules behave exactly as in the app.
+ *
+ * There is deliberately NO fallback to an Admin-SDK context — the whole point is that rules stay in
+ * force, so a failure here throws.
+ *
+ * @param input - The namespace, Firebase client config, API target, and access token.
+ * @returns The live {@link FirebaseUserSession}.
+ * @throws {FirestoreSessionError} (or the `errorFactory`'s type) When the config is incomplete, or any step of the handshake fails.
+ */ function openFirebaseUserSession(input) {
+    return _async_to_generator$1(function() {
+        var _input_maxSessionAgeMs, _input_errorFactory, _input_now, _ref, _ref1, _firebase_emulators, _firebase_emulators1, _firebase_emulators2, namespace, firebase, apiBaseUrl, accessToken, fetcher, credentialsCache, cacheKey, _input_refreshCredentials, refreshCredentials, maxSessionAgeMs, errorFactory, now, scope, readKey, cached, _tmp, liveCached, fromCache, credentials, _tmp1, writeKey, appName, app, createdAt, useEmulators, appCheckToken, expireTimeMillis, emulatorHost, auth, firestore, e;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    namespace = input.namespace, firebase = input.firebase, apiBaseUrl = input.apiBaseUrl, accessToken = input.accessToken, fetcher = input.fetcher, credentialsCache = input.credentialsCache, cacheKey = input.cacheKey, _input_refreshCredentials = input.refreshCredentials, refreshCredentials = _input_refreshCredentials === void 0 ? false : _input_refreshCredentials;
+                    maxSessionAgeMs = (_input_maxSessionAgeMs = input.maxSessionAgeMs) !== null && _input_maxSessionAgeMs !== void 0 ? _input_maxSessionAgeMs : FIRESTORE_SESSION_MAX_CACHE_MS;
+                    errorFactory = (_input_errorFactory = input.errorFactory) !== null && _input_errorFactory !== void 0 ? _input_errorFactory : defaultFirestoreSessionErrorFactory;
+                    now = (_input_now = input.now) !== null && _input_now !== void 0 ? _input_now : function() {
+                        return Date.now();
+                    };
+                    if (!isFirebaseClientConfigComplete(firebase)) {
+                        throw errorFactory({
+                            code: 'invalid_config',
+                            message: 'No complete Firebase client config was supplied, so a user-scoped Firestore session cannot be opened.',
+                            suggestion: "Set `apiKey`, `projectId`, and `appId` on the Firebase client config. Copy them from the app's Firebase web app config."
+                        });
+                    }
+                    scope = input.scope || firebase.projectId;
+                    readKey = (_ref = cacheKey !== null && cacheKey !== void 0 ? cacheKey : input.uid) !== null && _ref !== void 0 ? _ref : undefined;
+                    if (!(credentialsCache && !refreshCredentials && readKey != null)) return [
+                        3,
+                        2
+                    ];
+                    return [
+                        4,
+                        credentialsCache.get(readKey)
+                    ];
+                case 1:
+                    _tmp = _state.sent();
+                    return [
+                        3,
+                        3
+                    ];
+                case 2:
+                    _tmp = undefined;
+                    _state.label = 3;
+                case 3:
+                    cached = _tmp;
+                    liveCached = isFirestoreSessionExpired(cached, now()) ? undefined : cached;
+                    fromCache = liveCached != null;
+                    if (!((_ref1 = liveCached === null || liveCached === void 0 ? void 0 : liveCached.session) !== null && _ref1 !== void 0)) return [
+                        3,
+                        4
+                    ];
+                    _tmp1 = _ref1;
+                    return [
+                        3,
+                        6
+                    ];
+                case 4:
+                    return [
+                        4,
+                        fetchFirestoreSession({
+                            apiBaseUrl: apiBaseUrl,
+                            accessToken: accessToken,
+                            fetcher: fetcher,
+                            errorFactory: errorFactory
+                        })
+                    ];
+                case 5:
+                    _tmp1 = _state.sent();
+                    _state.label = 6;
+                case 6:
+                    credentials = _tmp1;
+                    if (input.uid != null && credentials.uid !== input.uid) {
+                        throw errorFactory({
+                            code: 'invalid_response',
+                            message: 'The session endpoint minted credentials for uid "'.concat(credentials.uid, '" but "').concat(input.uid, '" was requested.'),
+                            suggestion: "The mint endpoint always mints for the presented token's own `auth.uid`. A mismatch means the access token does not belong to the requested user."
+                        });
+                    }
+                    writeKey = cacheKey !== null && cacheKey !== void 0 ? cacheKey : credentials.uid;
+                    if (!(!fromCache && credentialsCache)) return [
+                        3,
+                        8
+                    ];
+                    return [
+                        4,
+                        credentialsCache.set(writeKey, {
+                            session: credentials,
+                            cachedAt: now(),
+                            uid: credentials.uid
+                        })
+                    ];
+                case 7:
+                    _state.sent();
+                    _state.label = 8;
+                case 8:
+                    appName = nextFreeFirebaseAppName(firebaseUserSessionAppName({
+                        namespace: namespace,
+                        scope: scope,
+                        uid: credentials.uid
+                    }));
+                    app = initializeApp({
+                        apiKey: firebase.apiKey,
+                        authDomain: firebase.authDomain,
+                        projectId: firebase.projectId,
+                        appId: firebase.appId
+                    }, appName);
+                    createdAt = now();
+                    useEmulators = firebaseClientEmulatorsInUse(firebase);
+                    // App Check must be registered on the app before any Firebase request goes out. Mirrors
+                    // `createDbxFirebaseAppCheck`, which likewise disables App Check whenever emulators are in use.
+                    if (credentials.appCheckToken && !useEmulators) {
+                        appCheckToken = credentials.appCheckToken;
+                        expireTimeMillis = expireTimeMillisFromCredentials(credentials, now());
+                        initializeAppCheck(app, {
+                            provider: new CustomProvider({
+                                getToken: function getToken() {
+                                    return _async_to_generator$1(function() {
+                                        return _ts_generator$1(this, function(_state) {
+                                            return [
+                                                2,
+                                                {
+                                                    token: appCheckToken,
+                                                    expireTimeMillis: expireTimeMillis
+                                                }
+                                            ];
+                                        });
+                                    })();
+                                }
+                            }),
+                            // the token is minted per-session by the API; there is no local attestation to refresh against
+                            isTokenAutoRefreshEnabled: false
+                        });
+                    }
+                    emulatorHost = ((_firebase_emulators = firebase.emulators) === null || _firebase_emulators === void 0 ? void 0 : _firebase_emulators.host) || DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST;
+                    auth = getAuth(app);
+                    if (useEmulators && ((_firebase_emulators1 = firebase.emulators) === null || _firebase_emulators1 === void 0 ? void 0 : _firebase_emulators1.authPort) != null) {
+                        connectAuthEmulator(auth, "http://".concat(emulatorHost, ":").concat(firebase.emulators.authPort), {
+                            disableWarnings: true
+                        });
+                    }
+                    firestore = getFirestore(app);
+                    if (useEmulators && ((_firebase_emulators2 = firebase.emulators) === null || _firebase_emulators2 === void 0 ? void 0 : _firebase_emulators2.firestorePort) != null) {
+                        connectFirestoreEmulator(firestore, emulatorHost, firebase.emulators.firestorePort);
+                    }
+                    _state.label = 9;
+                case 9:
+                    _state.trys.push([
+                        9,
+                        11,
+                        ,
+                        15
+                    ]);
+                    return [
+                        4,
+                        signInWithCustomToken(auth, credentials.customToken)
+                    ];
+                case 10:
+                    _state.sent();
+                    return [
+                        3,
+                        15
+                    ];
+                case 11:
+                    e = _state.sent();
+                    // The app created on THIS attempt is torn down explicitly rather than left to the namespace
+                    // sweep: every open registers its OWN app (see step 2), so a caller that retries — or a pool
+                    // whose config is broken and fails once per request — would otherwise accumulate one dead app,
+                    // with its refresh timer and network stack, per failed attempt.
+                    return [
+                        4,
+                        closeFirebaseUserSessionApp(app)
+                    ];
+                case 12:
+                    _state.sent();
+                    if (!(fromCache && credentialsCache)) return [
+                        3,
+                        14
+                    ];
+                    return [
+                        4,
+                        credentialsCache.remove(writeKey)
+                    ];
+                case 13:
+                    _state.sent();
+                    return [
+                        2,
+                        openFirebaseUserSession(_object_spread_props$1(_object_spread$1({}, input), {
+                            refreshCredentials: true
+                        }))
+                    ];
+                case 14:
+                    throw errorFactory({
+                        code: 'unauthorized',
+                        message: "Failed to sign in with the minted custom token: ".concat(_instanceof(e, Error) ? e.message : String(e)),
+                        suggestion: 'Verify `firebase.projectId`/`firebase.apiKey` match the project the API mints tokens for.'
+                    });
+                case 15:
+                    return [
+                        2,
+                        {
+                            uid: credentials.uid,
+                            credentials: credentials,
+                            fromCache: fromCache,
+                            appName: appName,
+                            app: app,
+                            auth: auth,
+                            firestore: firestore,
+                            firestoreContext: clientFirebaseFirestoreContextFactory(firestore),
+                            createdAt: createdAt,
+                            expiresAt: firebaseUserSessionExpiresAt(credentials, createdAt, maxSessionAgeMs)
+                        }
+                    ];
+            }
+        });
+    })();
+}
+// MARK: Teardown
+/**
+ * Tears down a session opened by {@link openFirebaseUserSession}.
+ *
+ * Required, not optional hygiene. A signed-in `Auth` runs a token-refresh timer and a live
+ * `Firestore` holds open handles, so both leak per user without teardown — and in a CLI-shaped
+ * process they keep the Node event loop alive indefinitely, so the process never exits.
+ *
+ * `deleteApp` is the single call that covers it — it disposes every registered component, which for
+ * Firestore runs the same shutdown `terminate()` does, and for Auth stops the token-refresh timer.
+ *
+ * Deliberately tolerant: teardown normally runs after the caller's result is already produced, so a
+ * failure here must not change the outcome.
+ *
+ * @param session - The session to close.
+ */ function closeFirebaseUserSession(session) {
+    return _async_to_generator$1(function() {
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        closeFirebaseUserSessionApp(session.app)
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Deletes one Firebase app, swallowing any failure.
+ *
+ * @param app - The app to delete.
+ */ function closeFirebaseUserSessionApp(app) {
+    return _async_to_generator$1(function() {
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        2,
+                        ,
+                        3
+                    ]);
+                    return [
+                        4,
+                        deleteApp(app)
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        3,
+                        3
+                    ];
+                case 2:
+                    _state.sent();
+                    return [
+                        3,
+                        3
+                    ];
+                case 3:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Deletes every still-live Firebase app opened under a namespace, whether or not a session was
+ * handed back.
+ *
+ * The last line of defence against a leak. {@link closeFirebaseUserSession} covers the normal path,
+ * but it needs a session to be handed to it, and three cases never produce one:
+ *
+ * - a handshake that fails AFTER `initializeApp` — a rejected custom token, a failed App Check
+ *   registration — throws, so the caller that catches it has an initialized app and no session;
+ * - a caller that opens its own session outside a pool owns its own teardown, and forgetting it
+ *   leaks;
+ * - an owner orphaned mid-invocation carries the only reference to its session.
+ *
+ * `getApps()` already tracks every live app and `deleteApp` removes it from that list, so the app
+ * names {@link firebaseUserSessionAppName} derives are enough to find them again — no side registry
+ * to keep in sync, and idempotent by construction.
+ *
+ * @param input - The function inputs.
+ * @param input.namespace - The namespace whose apps should be closed. Apps belonging to other
+ *   Firebase consumers in the same process are left alone.
+ * @returns Resolves once every matching app has been deleted.
+ */ function closeFirebaseUserSessionApps(input) {
+    return _async_to_generator$1(function() {
+        var prefix, apps;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    prefix = firebaseUserSessionNamespacePrefix(input.namespace);
+                    apps = getApps().filter(function(x) {
+                        return x.name.startsWith(prefix);
+                    });
+                    return [
+                        4,
+                        Promise.all(apps.map(function(app) {
+                            return closeFirebaseUserSessionApp(app);
+                        }))
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+// MARK: Internal
+/**
+ * The first unregistered app name at or after `base`, trying `base`, `base#2`, `base#3`, ….
+ *
+ * @param base - The derived base app name.
+ * @returns A name no live app currently holds.
+ */ function nextFreeFirebaseAppName(base) {
+    var taken = new Set(getApps().map(function(x) {
+        return x.name;
+    }));
+    var result = base;
+    var attempt = 1;
+    while(taken.has(result)){
+        attempt += 1;
+        result = "".concat(base, "#").concat(attempt);
+    }
+    return result;
+}
+/**
+ * The session's effective expiry: the EARLIER of the API-reported `expiresAt` and the age ceiling.
+ *
+ * Mirrors `firestoreSessionEntryExpiresAt` — a server reporting an over-long (or unparsable) window
+ * still cannot push a session past the Firebase credential ceiling.
+ *
+ * @param credentials - The minted envelope.
+ * @param createdAt - When the session was opened, in unix epoch milliseconds.
+ * @param maxSessionAgeMs - The age ceiling.
+ * @returns The effective expiry in unix epoch milliseconds.
+ */ function firebaseUserSessionExpiresAt(credentials, createdAt, maxSessionAgeMs) {
+    var ceiling = createdAt + maxSessionAgeMs;
+    var reported = Date.parse(credentials.expiresAt);
+    return Number.isFinite(reported) ? Math.min(reported, ceiling) : ceiling;
+}
+/**
+ * Resolves the App Check token's expiry from the credential envelope, falling back to a short window
+ * when the API returned an unparsable `expiresAt`.
+ *
+ * @param credentials - The credential envelope returned by the API.
+ * @param nowMs - The current time in unix epoch milliseconds.
+ * @returns The epoch-millis expiry to advertise to the App Check `CustomProvider`.
+ */ function expireTimeMillisFromCredentials(credentials, nowMs) {
+    var parsed = Date.parse(credentials.expiresAt);
+    return Number.isFinite(parsed) ? parsed : nowMs + 30 * 60 * 1000;
+}
+
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Default {@link FirebaseUserSessionPoolConfig.maxSessions}.
+ *
+ * Bounds *concurrently distinct users*, not total users. Each entry is a full Firebase app: one
+ * `Firestore` with its network stack and one `Auth` with a refresh timer. 32 is deliberate — high
+ * enough that a normal request mix never evicts, low enough that an unbounded-uid caller cannot
+ * exhaust the process.
+ */ var DEFAULT_FIREBASE_USER_SESSION_POOL_SIZE = 32;
+/**
+ * Creates a per-`(scope, uid)` Firebase session pool with an explicit cap and TTL/LRU eviction.
+ *
+ * Exists because {@link openFirebaseUserSession} alone does not generalize past one user per process:
+ * a signed-in `Auth` runs a token-refresh timer and a live `Firestore` holds handles, so a server
+ * holding N concurrent user sessions leaks both per user without an owner. The pool is that owner.
+ *
+ * ### Why the TTL is driven by App Check, not Auth
+ *
+ * A signed-in `Auth` refreshes its ID token indefinitely — a Firebase refresh token does not expire
+ * on an hourly clock. The App Check token does not refresh: it is minted once by the API and
+ * `isTokenAutoRefreshEnabled` is `false`, because there is no local attestation to refresh against.
+ * So the session's real ceiling is the envelope's `expiresAt` (documented by the endpoint as "the
+ * earliest expiry among its credentials"), floored by {@link FirebaseUserSessionPoolConfig.maxSessionAgeMs}.
+ * Tearing the whole app down on expiry and re-minting costs one round trip; keeping it alive costs a
+ * silently unattested connection.
+ *
+ * ### Why a lease rather than a bare getter
+ *
+ * Reference counting is what makes eviction safe. Evicting an entry someone is mid-query on turns a
+ * capacity event into a user-visible failure, so the pool never tears down a leased session.
+ *
+ * @param config - The pool configuration.
+ * @returns The pool.
+ */ function firebaseUserSessionPool(config) {
+    var _config_errorFactory, _config_openSession, _config_now, _config_maxSessions, _config_maxSessionAgeMs, _config_refreshSkewMs;
+    var namespace = config.namespace, firebase = config.firebase, apiBaseUrl = config.apiBaseUrl, fetcher = config.fetcher, credentialsCache = config.credentialsCache;
+    var errorFactory = (_config_errorFactory = config.errorFactory) !== null && _config_errorFactory !== void 0 ? _config_errorFactory : defaultFirestoreSessionErrorFactory;
+    var openSessionImpl = (_config_openSession = config.openSession) !== null && _config_openSession !== void 0 ? _config_openSession : openFirebaseUserSession;
+    var now = (_config_now = config.now) !== null && _config_now !== void 0 ? _config_now : function() {
+        return Date.now();
+    };
+    var scope = config.scope || firebase.projectId || namespace;
+    var maxSessions = (_config_maxSessions = config.maxSessions) !== null && _config_maxSessions !== void 0 ? _config_maxSessions : DEFAULT_FIREBASE_USER_SESSION_POOL_SIZE;
+    var maxSessionAgeMs = (_config_maxSessionAgeMs = config.maxSessionAgeMs) !== null && _config_maxSessionAgeMs !== void 0 ? _config_maxSessionAgeMs : FIRESTORE_SESSION_MAX_CACHE_MS;
+    var refreshSkewMs = (_config_refreshSkewMs = config.refreshSkewMs) !== null && _config_refreshSkewMs !== void 0 ? _config_refreshSkewMs : FIRESTORE_SESSION_EXPIRY_BUFFER_MS;
+    var onEvent = config.onEvent;
+    var entries = new Map();
+    var closed = false;
+    function emit(type, entry, error) {
+        onEvent === null || onEvent === void 0 ? void 0 : onEvent(_object_spread({
+            type: type,
+            uid: entry.uid,
+            appName: entry.appName,
+            size: entries.size
+        }, error === undefined ? {} : {
+            error: error
+        }));
+    }
+    /**
+     * Removes the entry from the map when it is still the live one for its key.
+     *
+     * Guarded on identity because a replacement entry may already have been inserted for the same key
+     * (the expiry path detaches and immediately re-opens), and deleting blindly would drop the new one.
+     *
+     * @param entry - The entry to remove.
+     */ function detach(entry) {
+        if (entries.get(entry.key) === entry) {
+            entries.delete(entry.key);
+        }
+    }
+    function teardown(entry) {
+        return _async_to_generator(function() {
+            var session, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            2,
+                            ,
+                            3
+                        ]);
+                        return [
+                            4,
+                            entry.loading
+                        ];
+                    case 1:
+                        session = _state.sent();
+                        return [
+                            3,
+                            3
+                        ];
+                    case 2:
+                        _state.sent();
+                        // an open that never produced a session has nothing to tear down; the rejection was already
+                        // surfaced to the caller that awaited it
+                        session = undefined;
+                        return [
+                            3,
+                            3
+                        ];
+                    case 3:
+                        if (!(session != null)) return [
+                            3,
+                            7
+                        ];
+                        entry.appName = session.appName;
+                        _state.label = 4;
+                    case 4:
+                        _state.trys.push([
+                            4,
+                            6,
+                            ,
+                            7
+                        ]);
+                        // `deleteApp` directly rather than `closeFirebaseUserSession`, which deliberately swallows:
+                        // a long-lived pool wants a failed teardown OBSERVABLE — it means an app whose refresh timer
+                        // and network stack are still running — even though it must never be fatal.
+                        return [
+                            4,
+                            deleteApp(session.app)
+                        ];
+                    case 5:
+                        _state.sent();
+                        emit('closed', entry);
+                        return [
+                            3,
+                            7
+                        ];
+                    case 6:
+                        error = _state.sent();
+                        emit('teardown-failed', entry, error);
+                        return [
+                            3,
+                            7
+                        ];
+                    case 7:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    }
+    /**
+     * Tears the entry down now when it is idle, otherwise marks it for teardown on its last release.
+     *
+     * @param entry - The detached entry.
+     * @returns The teardown promise when one started, otherwise `undefined`.
+     */ function teardownWhenIdle(entry) {
+        var result;
+        if (entry.leases === 0) {
+            result = teardown(entry);
+        } else {
+            entry.pendingTeardown = true;
+        }
+        return result;
+    }
+    /**
+     * Brings the pool back to its cap after an insert.
+     *
+     * The cap is a TARGET, not a hard ceiling. When every entry is leased there is nothing safe to
+     * evict, so the pool admits anyway and marks the LRU entry for teardown-on-release: refusing a user
+     * because other users are busy is worse than a brief overshoot, and killing a live handle is worse
+     * than both. The overshoot is bounded by the host's own request concurrency.
+     *
+     * @param admitted - The entry just inserted, which is never the one given up.
+     */ function enforceCapacity(admitted) {
+        while(entries.size > maxSessions){
+            var idle = leastRecentlyUsed(function(x) {
+                return x.leases === 0 && !x.pendingTeardown && x !== admitted;
+            });
+            if (idle == null) {
+                var lru = leastRecentlyUsed(function(x) {
+                    return !x.pendingTeardown && x !== admitted;
+                });
+                if (lru == null) {
+                    // every entry is leased AND already marked; there is nothing further to give up
+                    emit('over-capacity', admitted);
+                    break;
+                } else {
+                    lru.pendingTeardown = true;
+                    detach(lru);
+                    emit('over-capacity', lru);
+                }
+            } else {
+                detach(idle);
+                emit('evicted', idle);
+                void teardown(idle);
+            }
+        }
+    }
+    function leastRecentlyUsed(predicate) {
+        var result;
+        entries.forEach(function(entry) {
+            if (predicate(entry) && (result == null || entry.lastUsedAt < result.lastUsedAt)) {
+                result = entry;
+            }
+        });
+        return result;
+    }
+    function openEntry(input, key, openedAt) {
+        var entry = {
+            key: key,
+            uid: input.uid,
+            appName: key,
+            leases: 0,
+            lastUsedAt: openedAt,
+            pendingTeardown: false,
+            loading: openSessionImpl(_object_spread_props(_object_spread({
+                namespace: namespace,
+                scope: scope,
+                firebase: firebase,
+                apiBaseUrl: apiBaseUrl,
+                accessToken: input.accessToken,
+                uid: input.uid,
+                fetcher: fetcher,
+                errorFactory: errorFactory,
+                credentialsCache: credentialsCache,
+                cacheKey: key
+            }, input.refreshCredentials == null ? {} : {
+                refreshCredentials: input.refreshCredentials
+            }), {
+                maxSessionAgeMs: maxSessionAgeMs,
+                now: now
+            }))
+        };
+        entry.loading.then(function(session) {
+            entry.appName = session.appName;
+            // the ceiling is re-derived from the POOL's clock so it holds whatever the opener reported —
+            // an envelope claiming a six-hour window is still capped at maxSessionAgeMs
+            entry.expiresAt = Math.min(session.expiresAt, openedAt + maxSessionAgeMs);
+        }, function() {
+            // Cache only on success: a rejected open is removed outright so the next acquisition retries
+            // rather than latching onto the failure.
+            detach(entry);
+        });
+        return entry;
+    }
+    function isExpired(entry, nowMs) {
+        return entry.expiresAt != null && entry.expiresAt - nowMs <= refreshSkewMs;
+    }
+    function leaseFor(entry, session) {
+        var released = false;
+        return {
+            session: session,
+            release: function release() {
+                if (!released) {
+                    released = true;
+                    entry.leases -= 1;
+                    entry.lastUsedAt = now();
+                    if (entry.pendingTeardown && entry.leases === 0) {
+                        void teardown(entry);
+                    }
+                }
+            }
+        };
+    }
+    function acquire(input) {
+        return _async_to_generator(function() {
+            var nowMs, key, existing, entry, acquired, session, e;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        if (closed) {
+                            throw errorFactory({
+                                code: 'unavailable',
+                                message: 'The Firebase user session pool is closed.',
+                                suggestion: 'Do not reuse a pool after `close()`; build a new one.'
+                            });
+                        }
+                        nowMs = now();
+                        key = firebaseUserSessionAppName({
+                            namespace: namespace,
+                            scope: scope,
+                            uid: input.uid
+                        });
+                        existing = entries.get(key);
+                        if (existing != null && !existing.pendingTeardown && !isExpired(existing, nowMs)) {
+                            entry = existing;
+                            // leases + lastUsedAt are bumped SYNCHRONOUSLY, before any await, so a concurrent eviction
+                            // cannot tear down a session that is about to be handed out
+                            entry.leases += 1;
+                            entry.lastUsedAt = nowMs;
+                            emit('reused', entry);
+                        } else {
+                            if (existing != null) {
+                                detach(existing);
+                                emit('expired', existing);
+                                void teardownWhenIdle(existing);
+                            }
+                            entry = openEntry(input, key, nowMs);
+                            entry.leases += 1;
+                            entries.set(key, entry);
+                            emit('opened', entry);
+                            enforceCapacity(entry);
+                        }
+                        acquired = entry;
+                        _state.label = 1;
+                    case 1:
+                        _state.trys.push([
+                            1,
+                            3,
+                            ,
+                            4
+                        ]);
+                        return [
+                            4,
+                            acquired.loading
+                        ];
+                    case 2:
+                        session = _state.sent();
+                        return [
+                            3,
+                            4
+                        ];
+                    case 3:
+                        e = _state.sent();
+                        acquired.leases -= 1;
+                        throw e;
+                    case 4:
+                        return [
+                            2,
+                            leaseFor(acquired, session)
+                        ];
+                }
+            });
+        })();
+    }
+    return {
+        openSession: acquire,
+        useSession: function useSession(input, fn) {
+            return _async_to_generator(function() {
+                var lease;
+                return _ts_generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            return [
+                                4,
+                                acquire(input)
+                            ];
+                        case 1:
+                            lease = _state.sent();
+                            _state.label = 2;
+                        case 2:
+                            _state.trys.push([
+                                2,
+                                ,
+                                4,
+                                5
+                            ]);
+                            return [
+                                4,
+                                fn(lease.session)
+                            ];
+                        case 3:
+                            return [
+                                2,
+                                _state.sent()
+                            ];
+                        case 4:
+                            lease.release();
+                            return [
+                                7
+                            ];
+                        case 5:
+                            return [
+                                2
+                            ];
+                    }
+                });
+            })();
+        },
+        closeSession: function closeSession(uid) {
+            return _async_to_generator(function() {
+                var entry;
+                return _ts_generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            entry = entries.get(firebaseUserSessionAppName({
+                                namespace: namespace,
+                                scope: scope,
+                                uid: uid
+                            }));
+                            if (!(entry != null)) return [
+                                3,
+                                2
+                            ];
+                            detach(entry);
+                            return [
+                                4,
+                                teardownWhenIdle(entry)
+                            ];
+                        case 1:
+                            _state.sent();
+                            _state.label = 2;
+                        case 2:
+                            return [
+                                2
+                            ];
+                    }
+                });
+            })();
+        },
+        close: function close() {
+            return _async_to_generator(function() {
+                var all;
+                return _ts_generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            closed = true;
+                            all = Array.from(entries.values());
+                            entries.clear();
+                            return [
+                                4,
+                                Promise.all(all.map(function(entry) {
+                                    return teardown(entry);
+                                }))
+                            ];
+                        case 1:
+                            _state.sent();
+                            return [
+                                2
+                            ];
+                    }
+                });
+            })();
+        },
+        stats: function stats() {
+            var leased = 0;
+            entries.forEach(function(entry) {
+                leased += entry.leases;
+            });
+            return {
+                size: entries.size,
+                leased: leased,
+                maxSessions: maxSessions
+            };
+        }
+    };
+}
+
+export { CLIENT_FIRESTORE_DRIVER_IDENTIFIER, DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST, DEFAULT_FIREBASE_USER_SESSION_POOL_SIZE, DEFAULT_FIRESTORE_IDENTITY_CONSUMER_NAME, FIREBASE_USER_SESSION_KEY_SEPARATOR, FIRESTORE_SESSION_API_PATH, FIRESTORE_SESSION_EXPIRY_BUFFER_MS, FIRESTORE_SESSION_MAX_CACHE_MS, FirestoreSessionError, closeFirebaseUserSession, closeFirebaseUserSessionApp, closeFirebaseUserSessionApps, defaultFirestoreSessionErrorFactory, fetchFirestoreSession, firebaseClientEmulatorsInUse, firebaseClientFirestoreIdentitySuggestion, firebaseUserSessionAppName, firebaseUserSessionNamespacePrefix, firebaseUserSessionPool, firestoreSessionEntryExpiresAt, firestoreSessionErrorCodeForStatus, firestoreSessionUrl, inspectFirebaseClientFirestoreIdentity, isFirebaseClientConfigComplete, isFirestoreSessionError, isFirestoreSessionExpired, openFirebaseUserSession };