@firebase/auth 0.21.6 → 0.22.0-canary.1d6771eb3

package/dist/node/{totp-5e73d8e7.js → totp-13fce87f.js}

@@ -236,6 +236,7 @@ function _debugErrorMap() {
         _a["missing-or-invalid-nonce" /* AuthErrorCode.MISSING_OR_INVALID_NONCE */] = 'The request does not contain a valid nonce. This can occur if the ' +
             'SHA-256 hash of the provided raw nonce does not match the hashed nonce ' +
             'in the ID token payload.',
+        _a["missing-password" /* AuthErrorCode.MISSING_PASSWORD */] = 'A non-empty password must be provided',
         _a["missing-multi-factor-info" /* AuthErrorCode.MISSING_MFA_INFO */] = 'No second factor identifier is provided.',
         _a["missing-multi-factor-session" /* AuthErrorCode.MISSING_MFA_SESSION */] = 'The request is missing proof of first factor successful sign-in.',
         _a["missing-phone-number" /* AuthErrorCode.MISSING_PHONE_NUMBER */] = 'To send verification codes, provide a phone number for the recipient.',
@@ -289,6 +290,14 @@ function _debugErrorMap() {
             'different options. To avoid this error, call initializeAuth() with the ' +
             'same options as when it was originally called, or call getAuth() to return the' +
             ' already initialized instance.',
+        _a["missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */] = 'The reCAPTCHA token is missing when sending request to the backend.',
+        _a["invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */] = 'The reCAPTCHA token is invalid when sending request to the backend.',
+        _a["invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */] = 'The reCAPTCHA action is invalid when sending request to the backend.',
+        _a["recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */] = 'reCAPTCHA Enterprise integration is not enabled for this project.',
+        _a["missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */] = 'The reCAPTCHA client type is missing when sending request to the backend.',
+        _a["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is missing when sending request to the backend.',
+        _a["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */] = 'Invalid request parameters.',
+        _a["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is invalid when sending request to the backend.',
         _a;
 }
 function _prodErrorMap() {
@@ -425,7 +434,15 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
     USER_SIGNED_OUT: 'auth/user-signed-out',
     WEAK_PASSWORD: 'auth/weak-password',
     WEB_STORAGE_UNSUPPORTED: 'auth/web-storage-unsupported',
-    ALREADY_INITIALIZED: 'auth/already-initialized'
+    ALREADY_INITIALIZED: 'auth/already-initialized',
+    RECAPTCHA_NOT_ENABLED: 'auth/recaptcha-not-enabled',
+    MISSING_RECAPTCHA_TOKEN: 'auth/missing-recaptcha-token',
+    INVALID_RECAPTCHA_TOKEN: 'auth/invalid-recaptcha-token',
+    INVALID_RECAPTCHA_ACTION: 'auth/invalid-recaptcha-action',
+    MISSING_CLIENT_TYPE: 'auth/missing-client-type',
+    MISSING_RECAPTCHA_VERSION: 'auth/missing-recaptcha-version',
+    INVALID_RECAPTCHA_VERSION: 'auth/invalid-recaptcha-version',
+    INVALID_REQ_TYPE: 'auth/invalid-req-type'
 };
 
 /**
@@ -445,6 +462,15 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
  * limitations under the License.
  */
 var logClient = new logger.Logger('@firebase/auth');
+function _logWarn(msg) {
+    var args = [];
+    for (var _i = 1; _i < arguments.length; _i++) {
+        args[_i - 1] = arguments[_i];
+    }
+    if (logClient.logLevel <= logger.LogLevel.WARN) {
+        logClient.warn.apply(logClient, tslib.__spreadArray(["Auth (".concat(app.SDK_VERSION, "): ").concat(msg)], args, false));
+    }
+}
 function _logError(msg) {
     var args = [];
     for (var _i = 1; _i < arguments.length; _i++) {
@@ -547,103 +573,6 @@ function debugAssert(assertion, message) {
     }
 }
 
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var instanceCache = new Map();
-function _getInstance(cls) {
-    debugAssert(cls instanceof Function, 'Expected a class definition');
-    var instance = instanceCache.get(cls);
-    if (instance) {
-        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
-        return instance;
-    }
-    instance = new cls();
-    instanceCache.set(cls, instance);
-    return instance;
-}
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * Initializes an {@link Auth} instance with fine-grained control over
- * {@link Dependencies}.
- *
- * @remarks
- *
- * This function allows more control over the {@link Auth} instance than
- * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
- * the {@link Dependencies}. In general, `getAuth` is the easiest way to
- * initialize Auth and works for most use cases. Use `initializeAuth` if you
- * need control over which persistence layer is used, or to minimize bundle
- * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
- *
- * For example, if your app only uses anonymous accounts and you only want
- * accounts saved for the current session, initialize `Auth` with:
- *
- * ```js
- * const auth = initializeAuth(app, {
- *   persistence: browserSessionPersistence,
- *   popupRedirectResolver: undefined,
- * });
- * ```
- *
- * @public
- */
-function initializeAuth(app$1, deps) {
-    var provider = app._getProvider(app$1, 'auth');
-    if (provider.isInitialized()) {
-        var auth_1 = provider.getImmediate();
-        var initialOptions = provider.getOptions();
-        if (util.deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
-            return auth_1;
-        }
-        else {
-            _fail(auth_1, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
-        }
-    }
-    var auth = provider.initialize({ options: deps });
-    return auth;
-}
-function _initializeAuthInstance(auth, deps) {
-    var persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
-    var hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
-    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
-        auth._updateErrorMap(deps.errorMap);
-    }
-    // This promise is intended to float; auth initialization happens in the
-    // background, meanwhile the auth object may be used by the app.
-    // eslint-disable-next-line @typescript-eslint/no-floating-promises
-    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
-}
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -880,7 +809,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     // Sign in with email and password errors (some apply to sign up too).
     _a$1["INVALID_PASSWORD" /* ServerError.INVALID_PASSWORD */] = "wrong-password" /* AuthErrorCode.INVALID_PASSWORD */,
     // This can only happen if the SDK sends a bad request.
-    _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "missing-password" /* AuthErrorCode.MISSING_PASSWORD */,
     // Sign up with email and password errors.
     _a$1["EMAIL_EXISTS" /* ServerError.EMAIL_EXISTS */] = "email-already-in-use" /* AuthErrorCode.EMAIL_EXISTS */,
     _a$1["PASSWORD_LOGIN_DISABLED" /* ServerError.PASSWORD_LOGIN_DISABLED */] = "operation-not-allowed" /* AuthErrorCode.OPERATION_NOT_ALLOWED */,
@@ -928,6 +857,15 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["SECOND_FACTOR_LIMIT_EXCEEDED" /* ServerError.SECOND_FACTOR_LIMIT_EXCEEDED */] = "maximum-second-factor-count-exceeded" /* AuthErrorCode.SECOND_FACTOR_LIMIT_EXCEEDED */,
     // Blocking functions related errors.
     _a$1["BLOCKING_FUNCTION_ERROR_RESPONSE" /* ServerError.BLOCKING_FUNCTION_ERROR_RESPONSE */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    // Recaptcha related errors.
+    _a$1["RECAPTCHA_NOT_ENABLED" /* ServerError.RECAPTCHA_NOT_ENABLED */] = "recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */,
+    _a$1["MISSING_RECAPTCHA_TOKEN" /* ServerError.MISSING_RECAPTCHA_TOKEN */] = "missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */,
+    _a$1["INVALID_RECAPTCHA_TOKEN" /* ServerError.INVALID_RECAPTCHA_TOKEN */] = "invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */,
+    _a$1["INVALID_RECAPTCHA_ACTION" /* ServerError.INVALID_RECAPTCHA_ACTION */] = "invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */,
+    _a$1["MISSING_CLIENT_TYPE" /* ServerError.MISSING_CLIENT_TYPE */] = "missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */,
+    _a$1["MISSING_RECAPTCHA_VERSION" /* ServerError.MISSING_RECAPTCHA_VERSION */] = "missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */,
+    _a$1["INVALID_RECAPTCHA_VERSION" /* ServerError.INVALID_RECAPTCHA_VERSION */] = "invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */,
+    _a$1["INVALID_REQ_TYPE" /* ServerError.INVALID_REQ_TYPE */] = "invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */,
     _a$1);
 
 /**
@@ -2049,6 +1987,35 @@ var UserImpl = /** @class */ (function () {
     return UserImpl;
 }());
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var instanceCache = new Map();
+function _getInstance(cls) {
+    debugAssert(cls instanceof Function, 'Expected a class definition');
+    var instance = instanceCache.get(cls);
+    if (instance) {
+        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
+        return instance;
+    }
+    instance = new cls();
+    instanceCache.set(cls, instance);
+    return instance;
+}
+
 /**
  * @license
  * Copyright 2019 Google LLC
@@ -2482,6 +2449,271 @@ function _getClientVersion(clientPlatform, frameworks) {
     return "".concat(reportedPlatform, "/").concat("JsCore" /* ClientImplementation.CORE */, "/").concat(app.SDK_VERSION, "/").concat(reportedFrameworks);
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getRecaptchaConfig(auth, request) {
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        return tslib.__generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+        });
+    });
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+var RecaptchaConfig = /** @class */ (function () {
+    function RecaptchaConfig(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
+            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+                enforcementState.enforcementState !== 'OFF';
+        });
+    }
+    return RecaptchaConfig;
+}());
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise(function (resolve, reject) {
+        var el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = function (e) {
+            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    function RecaptchaEnterpriseVerifier(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
+        if (action === void 0) { action = 'verify'; }
+        if (forceRefresh === void 0) { forceRefresh = false; }
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            function retrieveSiteKey(auth) {
+                return tslib.__awaiter(this, void 0, void 0, function () {
+                    var _this = this;
+                    return tslib.__generator(this, function (_a) {
+                        if (!forceRefresh) {
+                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
+                            }
+                            if (auth.tenantId != null &&
+                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
+                            }
+                        }
+                        return [2 /*return*/, new Promise(function (resolve, reject) { return tslib.__awaiter(_this, void 0, void 0, function () {
+                                return tslib.__generator(this, function (_a) {
+                                    getRecaptchaConfig(auth, {
+                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                                    })
+                                        .then(function (response) {
+                                        if (response.recaptchaKey === undefined) {
+                                            reject(new Error('recaptcha Enterprise site key undefined'));
+                                        }
+                                        else {
+                                            var config = new RecaptchaConfig(response);
+                                            if (auth.tenantId == null) {
+                                                auth._agentRecaptchaConfig = config;
+                                            }
+                                            else {
+                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                                            }
+                                            return resolve(config.siteKey);
+                                        }
+                                    })
+                                        .catch(function (error) {
+                                        reject(error);
+                                    });
+                                    return [2 /*return*/];
+                                });
+                            }); })];
+                    });
+                });
+            }
+            function retrieveRecaptchaToken(siteKey, resolve, reject) {
+                var grecaptcha = window.grecaptcha;
+                if (isEnterprise(grecaptcha)) {
+                    grecaptcha.enterprise.ready(function () {
+                        try {
+                            grecaptcha.enterprise
+                                .execute(siteKey, { action: action })
+                                .then(function (token) {
+                                resolve(token);
+                            })
+                                .catch(function (error) {
+                                reject(error);
+                            });
+                        }
+                        catch (error) {
+                            reject(error);
+                        }
+                    });
+                }
+                else {
+                    reject(Error('No reCAPTCHA enterprise script loaded.'));
+                }
+            }
+            var _this = this;
+            return tslib.__generator(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        retrieveSiteKey(_this.auth)
+                            .then(function (siteKey) {
+                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                                retrieveRecaptchaToken(siteKey, resolve, reject);
+                            }
+                            else {
+                                if (typeof window === 'undefined') {
+                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
+                                    return;
+                                }
+                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                                    .then(function () {
+                                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                                })
+                                    .catch(function (error) {
+                                    reject(error);
+                                });
+                            }
+                        })
+                            .catch(function (error) {
+                            reject(error);
+                        });
+                    })];
+            });
+        });
+    };
+    return RecaptchaEnterpriseVerifier;
+}());
+function injectRecaptchaFields(auth, request, action, captchaResp) {
+    if (captchaResp === void 0) { captchaResp = false; }
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        var verifier, captchaResponse, newRequest;
+        return tslib.__generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    verifier = new RecaptchaEnterpriseVerifier(auth);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 5]);
+                    return [4 /*yield*/, verifier.verify(action)];
+                case 2:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, verifier.verify(action, true)];
+                case 4:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    newRequest = tslib.__assign({}, request);
+                    if (!captchaResp) {
+                        Object.assign(newRequest, { captchaResponse: captchaResponse });
+                    }
+                    else {
+                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+                    }
+                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+                    Object.assign(newRequest, {
+                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                    });
+                    return [2 /*return*/, newRequest];
+            }
+        });
+    });
+}
+
 /**
  * @license
  * Copyright 2022 Google LLC
@@ -2603,9 +2835,10 @@ var AuthMiddlewareQueue = /** @class */ (function () {
  * limitations under the License.
  */
 var AuthImpl = /** @class */ (function () {
-    function AuthImpl(app, heartbeatServiceProvider, config) {
+    function AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config) {
         this.app = app;
         this.heartbeatServiceProvider = heartbeatServiceProvider;
+        this.appCheckServiceProvider = appCheckServiceProvider;
         this.config = config;
         this.currentUser = null;
         this.emulatorConfig = null;
@@ -2623,6 +2856,8 @@ var AuthImpl = /** @class */ (function () {
         this._initializationPromise = null;
         this._popupRedirectResolver = null;
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
+        this._agentRecaptchaConfig = null;
+        this._tenantRecaptchaConfigs = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -2952,6 +3187,41 @@ var AuthImpl = /** @class */ (function () {
             });
         }); });
     };
+    AuthImpl.prototype.initializeRecaptchaConfig = function () {
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            var response, config, verifier;
+            return tslib.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, getRecaptchaConfig(this, {
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                        })];
+                    case 1:
+                        response = _a.sent();
+                        config = new RecaptchaConfig(response);
+                        if (this.tenantId == null) {
+                            this._agentRecaptchaConfig = config;
+                        }
+                        else {
+                            this._tenantRecaptchaConfigs[this.tenantId] = config;
+                        }
+                        if (config.emailPasswordEnabled) {
+                            verifier = new RecaptchaEnterpriseVerifier(this);
+                            void verifier.verify();
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    AuthImpl.prototype._getRecaptchaConfig = function () {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    };
     AuthImpl.prototype._getPersistence = function () {
         return this.assertedPersistence.persistence.type;
     };
@@ -3179,7 +3449,7 @@ var AuthImpl = /** @class */ (function () {
     AuthImpl.prototype._getAdditionalHeaders = function () {
         var _a;
         return tslib.__awaiter(this, void 0, void 0, function () {
-            var headers, heartbeatsHeader;
+            var headers, heartbeatsHeader, appCheckToken;
             var _b;
             return tslib.__generator(this, function (_c) {
                 switch (_c.label) {
@@ -3199,11 +3469,39 @@ var AuthImpl = /** @class */ (function () {
                         if (heartbeatsHeader) {
                             headers["X-Firebase-Client" /* HttpHeader.X_FIREBASE_CLIENT */] = heartbeatsHeader;
                         }
+                        return [4 /*yield*/, this._getAppCheckToken()];
+                    case 2:
+                        appCheckToken = _c.sent();
+                        if (appCheckToken) {
+                            headers["X-Firebase-AppCheck" /* HttpHeader.X_FIREBASE_APP_CHECK */] = appCheckToken;
+                        }
                         return [2 /*return*/, headers];
                 }
             });
         });
     };
+    AuthImpl.prototype._getAppCheckToken = function () {
+        var _a;
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            var appCheckTokenResult;
+            return tslib.__generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
+                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
+                    case 1:
+                        appCheckTokenResult = _b.sent();
+                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+                            // Context: appCheck.getToken() will never throw even if an error happened.
+                            // In the error case, a dummy token will be returned along with an error field describing
+                            // the error. In general, we shouldn't care about the error condition and just use
+                            // the token (actual or dummy) to send requests.
+                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+                        }
+                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                }
+            });
+        });
+    };
     return AuthImpl;
 }());
 /**
@@ -3234,6 +3532,74 @@ var Subscription = /** @class */ (function () {
     return Subscription;
 }());
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Initializes an {@link Auth} instance with fine-grained control over
+ * {@link Dependencies}.
+ *
+ * @remarks
+ *
+ * This function allows more control over the {@link Auth} instance than
+ * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
+ * the {@link Dependencies}. In general, `getAuth` is the easiest way to
+ * initialize Auth and works for most use cases. Use `initializeAuth` if you
+ * need control over which persistence layer is used, or to minimize bundle
+ * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
+ *
+ * For example, if your app only uses anonymous accounts and you only want
+ * accounts saved for the current session, initialize `Auth` with:
+ *
+ * ```js
+ * const auth = initializeAuth(app, {
+ *   persistence: browserSessionPersistence,
+ *   popupRedirectResolver: undefined,
+ * });
+ * ```
+ *
+ * @public
+ */
+function initializeAuth(app$1, deps) {
+    var provider = app._getProvider(app$1, 'auth');
+    if (provider.isInitialized()) {
+        var auth_1 = provider.getImmediate();
+        var initialOptions = provider.getOptions();
+        if (util.deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
+            return auth_1;
+        }
+        else {
+            _fail(auth_1, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
+        }
+    }
+    var auth = provider.initialize({ options: deps });
+    return auth;
+}
+function _initializeAuthInstance(auth, deps) {
+    var persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
+    var hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
+    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
+        auth._updateErrorMap(deps.errorMap);
+    }
+    // This promise is intended to float; auth initialization happens in the
+    // background, meanwhile the auth object may be used by the app.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
+}
+
 /**
  * Changes the {@link Auth} instance to communicate with the Firebase Auth Emulator, instead of production
  * Firebase Auth services.
@@ -3622,24 +3988,55 @@ var EmailAuthCredential = /** @class */ (function (_super) {
     };
     /** @internal */
     EmailAuthCredential.prototype._getIdTokenResponse = function (auth) {
+        var _a;
         return tslib.__awaiter(this, void 0, void 0, function () {
-            return tslib.__generator(this, function (_a) {
-                switch (this.signInMethod) {
-                    case "password" /* SignInMethod.EMAIL_PASSWORD */:
-                        return [2 /*return*/, signInWithPassword(auth, {
-                                returnSecureToken: true,
-                                email: this._email,
-                                password: this._password
-                            })];
-                    case "emailLink" /* SignInMethod.EMAIL_LINK */:
-                        return [2 /*return*/, signInWithEmailLink$1(auth, {
-                                email: this._email,
-                                oobCode: this._password
-                            })];
-                    default:
+            var _b, request_1, requestWithRecaptcha;
+            var _this = this;
+            return tslib.__generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        _b = this.signInMethod;
+                        switch (_b) {
+                            case "password" /* SignInMethod.EMAIL_PASSWORD */: return [3 /*break*/, 1];
+                            case "emailLink" /* SignInMethod.EMAIL_LINK */: return [3 /*break*/, 4];
+                        }
+                        return [3 /*break*/, 5];
+                    case 1:
+                        request_1 = {
+                            returnSecureToken: true,
+                            email: this._email,
+                            password: this._password,
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                        };
+                        if (!((_a = auth._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                        return [4 /*yield*/, injectRecaptchaFields(auth, request_1, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */)];
+                    case 2:
+                        requestWithRecaptcha = _c.sent();
+                        return [2 /*return*/, signInWithPassword(auth, requestWithRecaptcha)];
+                    case 3: return [2 /*return*/, signInWithPassword(auth, request_1).catch(function (error) { return tslib.__awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return tslib.__generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 2];
+                                        console.log('Sign-in with email address and password is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(auth, request_1, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        return [2 /*return*/, signInWithPassword(auth, requestWithRecaptcha)];
+                                    case 2: return [2 /*return*/, Promise.reject(error)];
+                                }
+                            });
+                        }); })];
+                    case 4: return [2 /*return*/, signInWithEmailLink$1(auth, {
+                            email: this._email,
+                            oobCode: this._password
+                        })];
+                    case 5:
                         _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+                        _c.label = 6;
+                    case 6: return [2 /*return*/];
                 }
-                return [2 /*return*/];
             });
         });
     };
@@ -5819,23 +6216,61 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * @public
  */
 function sendPasswordResetEmail(auth, email, actionCodeSettings) {
+    var _a;
     return tslib.__awaiter(this, void 0, void 0, function () {
-        var authModular, request;
-        return tslib.__generator(this, function (_a) {
-            switch (_a.label) {
+        var authInternal, request, requestWithRecaptcha;
+        var _this = this;
+        return tslib.__generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    authModular = util.getModularInstance(auth);
+                    authInternal = _castAuth(auth);
                     request = {
                         requestType: "PASSWORD_RESET" /* ActionCodeOperation.PASSWORD_RESET */,
-                        email: email
+                        email: email,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
                     };
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                case 1:
+                    requestWithRecaptcha = _b.sent();
                     if (actionCodeSettings) {
-                        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
+                        _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
                     }
-                    return [4 /*yield*/, sendPasswordResetEmail$1(authModular, request)];
-                case 1:
-                    _a.sent();
-                    return [2 /*return*/];
+                    return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, requestWithRecaptcha)];
+                case 2:
+                    _b.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    if (actionCodeSettings) {
+                        _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+                    }
+                    return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, request)
+                            .catch(function (error) { return tslib.__awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return tslib.__generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 3];
+                                        console.log('Password resets are protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the password reset flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        if (actionCodeSettings) {
+                                            _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
+                                        }
+                                        return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, requestWithRecaptcha)];
+                                    case 2:
+                                        _a.sent();
+                                        return [3 /*break*/, 4];
+                                    case 3: return [2 /*return*/, Promise.reject(error)];
+                                    case 4: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 4:
+                    _b.sent();
+                    _b.label = 5;
+                case 5: return [2 /*return*/];
             }
         });
     });
@@ -5980,25 +6415,54 @@ function verifyPasswordResetCode(auth, code) {
  * @public
  */
 function createUserWithEmailAndPassword(auth, email, password) {
+    var _a;
     return tslib.__awaiter(this, void 0, void 0, function () {
-        var authInternal, response, userCredential;
-        return tslib.__generator(this, function (_a) {
-            switch (_a.label) {
+        var authInternal, request, signUpResponse, requestWithRecaptcha, response, userCredential;
+        var _this = this;
+        return tslib.__generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
                     authInternal = _castAuth(auth);
-                    return [4 /*yield*/, signUp(authInternal, {
-                            returnSecureToken: true,
-                            email: email,
-                            password: password
-                        })];
+                    request = {
+                        returnSecureToken: true,
+                        email: email,
+                        password: password,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                    };
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 2];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */)];
                 case 1:
-                    response = _a.sent();
-                    return [4 /*yield*/, UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response)];
+                    requestWithRecaptcha = _b.sent();
+                    signUpResponse = signUp(authInternal, requestWithRecaptcha);
+                    return [3 /*break*/, 3];
                 case 2:
-                    userCredential = _a.sent();
+                    signUpResponse = signUp(authInternal, request).catch(function (error) { return tslib.__awaiter(_this, void 0, void 0, function () {
+                        var requestWithRecaptcha;
+                        return tslib.__generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 2];
+                                    console.log('Sign-up is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-up flow.');
+                                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */)];
+                                case 1:
+                                    requestWithRecaptcha = _a.sent();
+                                    return [2 /*return*/, signUp(authInternal, requestWithRecaptcha)];
+                                case 2: return [2 /*return*/, Promise.reject(error)];
+                            }
+                        });
+                    }); });
+                    _b.label = 3;
+                case 3: return [4 /*yield*/, signUpResponse.catch(function (error) {
+                        return Promise.reject(error);
+                    })];
+                case 4:
+                    response = _b.sent();
+                    return [4 /*yield*/, UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response)];
+                case 5:
+                    userCredential = _b.sent();
                     return [4 /*yield*/, authInternal._updateCurrentUser(userCredential.user)];
-                case 3:
-                    _a.sent();
+                case 6:
+                    _b.sent();
                     return [2 /*return*/, userCredential];
             }
         });
@@ -6079,24 +6543,61 @@ function signInWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function sendSignInLinkToEmail(auth, email, actionCodeSettings) {
+    var _a;
     return tslib.__awaiter(this, void 0, void 0, function () {
-        var authModular, request;
-        return tslib.__generator(this, function (_a) {
-            switch (_a.label) {
+        function setActionCodeSettings(request, actionCodeSettings) {
+            _assert(actionCodeSettings.handleCodeInApp, authInternal, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+            if (actionCodeSettings) {
+                _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+            }
+        }
+        var authInternal, request, requestWithRecaptcha;
+        var _this = this;
+        return tslib.__generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    authModular = util.getModularInstance(auth);
+                    authInternal = _castAuth(auth);
                     request = {
                         requestType: "EMAIL_SIGNIN" /* ActionCodeOperation.EMAIL_SIGNIN */,
-                        email: email
+                        email: email,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
                     };
-                    _assert(actionCodeSettings.handleCodeInApp, authModular, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
-                    if (actionCodeSettings) {
-                        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
-                    }
-                    return [4 /*yield*/, sendSignInLinkToEmail$1(authModular, request)];
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
                 case 1:
-                    _a.sent();
-                    return [2 /*return*/];
+                    requestWithRecaptcha = _b.sent();
+                    setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                    return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha)];
+                case 2:
+                    _b.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    setActionCodeSettings(request, actionCodeSettings);
+                    return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, request)
+                            .catch(function (error) { return tslib.__awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return tslib.__generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 3];
+                                        console.log('Email link sign-in is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                                        return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha)];
+                                    case 2:
+                                        _a.sent();
+                                        return [3 /*break*/, 4];
+                                    case 3: return [2 /*return*/, Promise.reject(error)];
+                                    case 4: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 4:
+                    _b.sent();
+                    _b.label = 5;
+                case 5: return [2 /*return*/];
             }
         });
     });
@@ -6692,11 +7193,41 @@ function getAdditionalUserInfo(userCredential) {
 function setPersistence(auth, persistence) {
     return util.getModularInstance(auth).setPersistence(persistence);
 }
+/**
+ * Loads the reCAPTCHA configuration into the `Auth` instance.
+ *
+ * @remarks
+ * This will load the reCAPTCHA config, which indicates whether the reCAPTCHA
+ * verification flow should be triggered for each auth provider, into the
+ * current Auth session.
+ *
+ * If initializeRecaptchaConfig() is not invoked, the auth flow will always start
+ * without reCAPTCHA verification. If the provider is configured to require reCAPTCHA
+ * verification, the SDK will transparently load the reCAPTCHA config and restart the
+ * auth flows.
+ *
+ * Thus, by calling this optional method, you will reduce the latency of future auth flows.
+ * Loading the reCAPTCHA config early will also enhance the signal collected by reCAPTCHA.
+ *
+ * @example
+ * ```javascript
+ * initializeRecaptchaConfig(auth);
+ * ```
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @public
+ */
+function initializeRecaptchaConfig(auth) {
+    var authInternal = _castAuth(auth);
+    return authInternal.initializeRecaptchaConfig();
+}
 /**
  * Adds an observer for changes to the signed-in user's ID token.
  *
  * @remarks
  * This includes sign-in, sign-out, and token refresh events.
+ * This will not be triggered automatically upon ID token expiration. Use {@link User.getIdToken} to refresh the ID token.
  *
  * @param auth - The {@link Auth} instance.
  * @param nextOrObserver - callback triggered on change.
@@ -7089,7 +7620,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "0.21.6";
+var version = "0.22.0-canary.1d6771eb3";
 
 /**
  * @license
@@ -7209,26 +7740,25 @@ function registerAuth(clientPlatform) {
         var deps = _a.options;
         var app = container.getProvider('app').getImmediate();
         var heartbeatServiceProvider = container.getProvider('heartbeat');
+        var appCheckServiceProvider = container.getProvider('app-check-internal');
         var _b = app.options, apiKey = _b.apiKey, authDomain = _b.authDomain;
-        return (function (app, heartbeatServiceProvider) {
-            _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
-            // Auth domain is optional if IdP sign in isn't being used
-            _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
-                appName: app.name
-            });
-            var config = {
-                apiKey: apiKey,
-                authDomain: authDomain,
-                clientPlatform: clientPlatform,
-                apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
-                tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
-                apiScheme: "https" /* DefaultConfig.API_SCHEME */,
-                sdkClientVersion: _getClientVersion(clientPlatform)
-            };
-            var authInstance = new AuthImpl(app, heartbeatServiceProvider, config);
-            _initializeAuthInstance(authInstance, deps);
-            return authInstance;
-        })(app, heartbeatServiceProvider);
+        _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
+        // Auth domain is optional if IdP sign in isn't being used
+        _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
+            appName: app.name
+        });
+        var config = {
+            apiKey: apiKey,
+            authDomain: authDomain,
+            clientPlatform: clientPlatform,
+            apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
+            tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
+            apiScheme: "https" /* DefaultConfig.API_SCHEME */,
+            sdkClientVersion: _getClientVersion(clientPlatform)
+        };
+        var authInstance = new AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config);
+        _initializeAuthInstance(authInstance, deps);
+        return authInstance;
     }, "PUBLIC" /* ComponentType.PUBLIC */)
         /**
          * Auth can only be initialized by explicitly calling getAuth() or initializeAuth()
@@ -7624,6 +8154,7 @@ exports.getRedirectResult = getRedirectResult;
 exports.inMemoryPersistence = inMemoryPersistence;
 exports.indexedDBLocalPersistence = indexedDBLocalPersistence;
 exports.initializeAuth = initializeAuth;
+exports.initializeRecaptchaConfig = initializeRecaptchaConfig;
 exports.isSignInWithEmailLink = isSignInWithEmailLink;
 exports.linkWithCredential = linkWithCredential;
 exports.linkWithPhoneNumber = linkWithPhoneNumber;
@@ -7662,4 +8193,4 @@ exports.updateProfile = updateProfile;
 exports.useDeviceLanguage = useDeviceLanguage;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=totp-5e73d8e7.js.map
+//# sourceMappingURL=totp-13fce87f.js.map