@firebase/auth 1.3.2 → 1.4.0-canary.00235ba68

package/dist/esm5/index.js

@@ -1,4 +1,4 @@
-export { A as ActionCodeOperation, ah as ActionCodeURL, K as AuthCredential, H as AuthErrorCodes, L as EmailAuthCredential, U as EmailAuthProvider, V as FacebookAuthProvider, F as FactorId, X as GithubAuthProvider, W as GoogleAuthProvider, M as OAuthCredential, Y as OAuthProvider, O as OperationType, N as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, Z as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, _ as TwitterAuthProvider, a6 as applyActionCode, x as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a7 as checkActionCode, a5 as confirmPasswordReset, J as connectAuthEmulator, a9 as createUserWithEmailAndPassword, E as debugErrorMap, D as deleteUser, ae as fetchSignInMethodsForEmail, ap as getAdditionalUserInfo, o as getAuth, am as getIdToken, an as getIdTokenResult, ar as getMultiFactorResolver, j as getRedirectResult, Q as inMemoryPersistence, i as indexedDBLocalPersistence, I as initializeAuth, t as initializeRecaptchaConfig, ac as isSignInWithEmailLink, a1 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, as as multiFactor, y as onAuthStateChanged, w as onIdTokenChanged, ai as parseActionCodeURL, G as prodErrorMap, a2 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, aq as reload, af as sendEmailVerification, a4 as sendPasswordResetEmail, ab as sendSignInLinkToEmail, q as setPersistence, $ as signInAnonymously, a0 as signInWithCredential, a3 as signInWithCustomToken, aa as signInWithEmailAndPassword, ad as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, C as signOut, ao as unlink, B as updateCurrentUser, ak as updateEmail, al as updatePassword, u as updatePhoneNumber, aj as updateProfile, z as useDeviceLanguage, v as validatePassword, ag as verifyBeforeUpdateEmail, a8 as verifyPasswordResetCode } from './index-7b6c682b.js';
+export { A as ActionCodeOperation, ai as ActionCodeURL, L as AuthCredential, I as AuthErrorCodes, M as EmailAuthCredential, V as EmailAuthProvider, W as FacebookAuthProvider, F as FactorId, Y as GithubAuthProvider, X as GoogleAuthProvider, N as OAuthCredential, Z as OAuthProvider, O as OperationType, Q as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, _ as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, $ as TwitterAuthProvider, a7 as applyActionCode, x as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a8 as checkActionCode, a6 as confirmPasswordReset, K as connectAuthEmulator, aa as createUserWithEmailAndPassword, G as debugErrorMap, E as deleteUser, af as fetchSignInMethodsForEmail, aq as getAdditionalUserInfo, o as getAuth, an as getIdToken, ao as getIdTokenResult, as as getMultiFactorResolver, j as getRedirectResult, U as inMemoryPersistence, i as indexedDBLocalPersistence, J as initializeAuth, t as initializeRecaptchaConfig, ad as isSignInWithEmailLink, a2 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, at as multiFactor, y as onAuthStateChanged, w as onIdTokenChanged, aj as parseActionCodeURL, H as prodErrorMap, a3 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ar as reload, D as revokeAccessToken, ag as sendEmailVerification, a5 as sendPasswordResetEmail, ac as sendSignInLinkToEmail, q as setPersistence, a0 as signInAnonymously, a1 as signInWithCredential, a4 as signInWithCustomToken, ab as signInWithEmailAndPassword, ae as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, C as signOut, ap as unlink, B as updateCurrentUser, al as updateEmail, am as updatePassword, u as updatePhoneNumber, ak as updateProfile, z as useDeviceLanguage, v as validatePassword, ah as verifyBeforeUpdateEmail, a9 as verifyPasswordResetCode } from './index-ab0a3e4e.js';
 import 'tslib';
 import '@firebase/util';
 import '@firebase/app';

package/dist/esm5/internal.js

@@ -1,5 +1,5 @@
-import { at as _isIOS, au as _isAndroid, av as _fail, aw as _getRedirectUrl, ax as debugAssert, ay as _getProjectConfig, az as _isIOS7Or8, aA as _assert, aB as _createError, aC as AuthEventManager, aD as _getInstance, b as browserLocalPersistence, aE as _persistenceKeyName, aF as _clearRedirectOutcomes, a as browserSessionPersistence, aG as _getRedirectResult, aH as _overrideRedirectResult, aI as _castAuth } from './index-7b6c682b.js';
-export { A as ActionCodeOperation, ah as ActionCodeURL, K as AuthCredential, H as AuthErrorCodes, aK as AuthImpl, aN as AuthPopup, L as EmailAuthCredential, U as EmailAuthProvider, V as FacebookAuthProvider, F as FactorId, aO as FetchProvider, X as GithubAuthProvider, W as GoogleAuthProvider, M as OAuthCredential, Y as OAuthProvider, O as OperationType, N as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aP as SAMLAuthCredential, Z as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, _ as TwitterAuthProvider, aJ as UserImpl, aA as _assert, aI as _castAuth, av as _fail, aM as _generateEventId, aL as _getClientVersion, aD as _getInstance, aG as _getRedirectResult, aH as _overrideRedirectResult, aE as _persistenceKeyName, a6 as applyActionCode, x as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a7 as checkActionCode, a5 as confirmPasswordReset, J as connectAuthEmulator, a9 as createUserWithEmailAndPassword, E as debugErrorMap, D as deleteUser, ae as fetchSignInMethodsForEmail, ap as getAdditionalUserInfo, o as getAuth, am as getIdToken, an as getIdTokenResult, ar as getMultiFactorResolver, j as getRedirectResult, Q as inMemoryPersistence, i as indexedDBLocalPersistence, I as initializeAuth, t as initializeRecaptchaConfig, ac as isSignInWithEmailLink, a1 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, as as multiFactor, y as onAuthStateChanged, w as onIdTokenChanged, ai as parseActionCodeURL, G as prodErrorMap, a2 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, aq as reload, af as sendEmailVerification, a4 as sendPasswordResetEmail, ab as sendSignInLinkToEmail, q as setPersistence, $ as signInAnonymously, a0 as signInWithCredential, a3 as signInWithCustomToken, aa as signInWithEmailAndPassword, ad as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, C as signOut, ao as unlink, B as updateCurrentUser, ak as updateEmail, al as updatePassword, u as updatePhoneNumber, aj as updateProfile, z as useDeviceLanguage, v as validatePassword, ag as verifyBeforeUpdateEmail, a8 as verifyPasswordResetCode } from './index-7b6c682b.js';
+import { au as _isIOS, av as _isAndroid, aw as _fail, ax as _getRedirectUrl, ay as debugAssert, az as _getProjectConfig, aA as _isIOS7Or8, aB as _assert, aC as _createError, aD as AuthEventManager, aE as _getInstance, b as browserLocalPersistence, aF as _persistenceKeyName, aG as _clearRedirectOutcomes, a as browserSessionPersistence, aH as _getRedirectResult, aI as _overrideRedirectResult, aJ as _castAuth } from './index-ab0a3e4e.js';
+export { A as ActionCodeOperation, ai as ActionCodeURL, L as AuthCredential, I as AuthErrorCodes, aL as AuthImpl, aO as AuthPopup, M as EmailAuthCredential, V as EmailAuthProvider, W as FacebookAuthProvider, F as FactorId, aP as FetchProvider, Y as GithubAuthProvider, X as GoogleAuthProvider, N as OAuthCredential, Z as OAuthProvider, O as OperationType, Q as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aQ as SAMLAuthCredential, _ as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, $ as TwitterAuthProvider, aK as UserImpl, aB as _assert, aJ as _castAuth, aw as _fail, aN as _generateEventId, aM as _getClientVersion, aE as _getInstance, aH as _getRedirectResult, aI as _overrideRedirectResult, aF as _persistenceKeyName, a7 as applyActionCode, x as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a8 as checkActionCode, a6 as confirmPasswordReset, K as connectAuthEmulator, aa as createUserWithEmailAndPassword, G as debugErrorMap, E as deleteUser, af as fetchSignInMethodsForEmail, aq as getAdditionalUserInfo, o as getAuth, an as getIdToken, ao as getIdTokenResult, as as getMultiFactorResolver, j as getRedirectResult, U as inMemoryPersistence, i as indexedDBLocalPersistence, J as initializeAuth, t as initializeRecaptchaConfig, ad as isSignInWithEmailLink, a2 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, at as multiFactor, y as onAuthStateChanged, w as onIdTokenChanged, aj as parseActionCodeURL, H as prodErrorMap, a3 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ar as reload, D as revokeAccessToken, ag as sendEmailVerification, a5 as sendPasswordResetEmail, ac as sendSignInLinkToEmail, q as setPersistence, a0 as signInAnonymously, a1 as signInWithCredential, a4 as signInWithCustomToken, ab as signInWithEmailAndPassword, ae as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, C as signOut, ap as unlink, B as updateCurrentUser, al as updateEmail, am as updatePassword, u as updatePhoneNumber, ak as updateProfile, z as useDeviceLanguage, v as validatePassword, ah as verifyBeforeUpdateEmail, a9 as verifyPasswordResetCode } from './index-ab0a3e4e.js';
 import { __awaiter, __generator, __extends } from 'tslib';
 import { querystringDecode } from '@firebase/util';
 import '@firebase/app';

package/dist/esm5/src/api/account_management/email_and_password.d.ts

@@ -17,6 +17,7 @@
 import { ActionCodeOperation, Auth } from '../../model/public_types';
 import { IdTokenResponse } from '../../model/id_token';
 import { MfaEnrollment } from './mfa';
+import { SignUpRequest, SignUpResponse } from '../authentication/sign_up';
 export interface ResetPasswordRequest {
     oobCode: string;
     newPassword?: string;
@@ -38,6 +39,7 @@ export interface UpdateEmailPasswordRequest {
 export interface UpdateEmailPasswordResponse extends IdTokenResponse {
 }
 export declare function updateEmailPassword(auth: Auth, request: UpdateEmailPasswordRequest): Promise<UpdateEmailPasswordResponse>;
+export declare function linkEmailPassword(auth: Auth, request: SignUpRequest): Promise<SignUpResponse>;
 export interface ApplyActionCodeRequest {
     oobCode: string;
     tenantId?: string;

package/dist/esm5/src/api/authentication/sign_up.d.ts

@@ -18,6 +18,7 @@ import { RecaptchaClientType, RecaptchaVersion } from '../index';
 import { IdTokenResponse } from '../../model/id_token';
 import { Auth } from '../../model/public_types';
 export interface SignUpRequest {
+    idToken?: string;
     returnSecureToken?: boolean;
     email?: string;
     password?: string;

package/dist/esm5/src/api/authentication/token.d.ts

@@ -15,12 +15,23 @@
  * limitations under the License.
  */
 import { Auth } from '../../model/public_types';
-export declare const enum Endpoint {
-    TOKEN = "/v1/token"
+export declare const enum TokenType {
+    REFRESH_TOKEN = "REFRESH_TOKEN",
+    ACCESS_TOKEN = "ACCESS_TOKEN"
 }
 export interface RequestStsTokenResponse {
     accessToken: string;
     expiresIn: string;
     refreshToken: string;
 }
+export interface RevokeTokenRequest {
+    providerId: string;
+    tokenType: TokenType;
+    token: string;
+    idToken: string;
+    tenantId?: string;
+}
+export interface RevokeTokenResponse {
+}
 export declare function requestStsToken(auth: Auth, refreshToken: string): Promise<RequestStsTokenResponse>;
+export declare function revokeToken(auth: Auth, request: RevokeTokenRequest): Promise<RevokeTokenResponse>;

package/dist/esm5/src/api/errors.d.ts

@@ -42,6 +42,7 @@ export declare const enum ServerError {
     INVALID_ID_TOKEN = "INVALID_ID_TOKEN",
     INVALID_IDP_RESPONSE = "INVALID_IDP_RESPONSE",
     INVALID_IDENTIFIER = "INVALID_IDENTIFIER",
+    INVALID_LOGIN_CREDENTIALS = "INVALID_LOGIN_CREDENTIALS",
     INVALID_MESSAGE_PAYLOAD = "INVALID_MESSAGE_PAYLOAD",
     INVALID_MFA_PENDING_CREDENTIAL = "INVALID_MFA_PENDING_CREDENTIAL",
     INVALID_OAUTH_CLIENT_ID = "INVALID_OAUTH_CLIENT_ID",

package/dist/esm5/src/api/index.d.ts

@@ -54,7 +54,9 @@ export declare const enum Endpoint {
     WITHDRAW_MFA = "/v2/accounts/mfaEnrollment:withdraw",
     GET_PROJECT_CONFIG = "/v1/projects",
     GET_RECAPTCHA_CONFIG = "/v2/recaptchaConfig",
-    GET_PASSWORD_POLICY = "/v2/passwordPolicy"
+    GET_PASSWORD_POLICY = "/v2/passwordPolicy",
+    TOKEN = "/v1/token",
+    REVOKE_TOKEN = "/v2/accounts:revokeToken"
 }
 export declare const enum RecaptchaClientType {
     WEB = "CLIENT_TYPE_WEB",

package/dist/esm5/src/core/auth/auth_impl.d.ts

@@ -87,6 +87,10 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
     beforeAuthStateChanged(callback: (user: User | null) => void | Promise<void>, onAbort?: () => void): Unsubscribe;
     onIdTokenChanged(nextOrObserver: NextOrObserver<User>, error?: ErrorFn, completed?: CompleteFn): Unsubscribe;
     authStateReady(): Promise<void>;
+    /**
+     * Revokes the given access token. Currently only supports Apple OAuth access tokens.
+     */
+    revokeAccessToken(token: string): Promise<void>;
     toJSON(): object;
     _setRedirectUser(user: UserInternal | null, popupRedirectResolver?: PopupRedirectResolver): Promise<void>;
     private getOrInitRedirectPersistenceManager;

package/dist/esm5/src/core/errors.d.ts

@@ -57,7 +57,7 @@ export declare const enum AuthErrorCode {
     INVALID_DYNAMIC_LINK_DOMAIN = "invalid-dynamic-link-domain",
     INVALID_EMAIL = "invalid-email",
     INVALID_EMULATOR_SCHEME = "invalid-emulator-scheme",
-    INVALID_IDP_RESPONSE = "invalid-credential",
+    INVALID_CREDENTIAL = "invalid-credential",
     INVALID_MESSAGE_PAYLOAD = "invalid-message-payload",
     INVALID_MFA_SESSION = "invalid-multi-factor-session",
     INVALID_OAUTH_CLIENT_ID = "invalid-oauth-client-id",
@@ -250,6 +250,7 @@ export declare const AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY: {
     readonly INVALID_EMAIL: "auth/invalid-email";
     readonly INVALID_EMULATOR_SCHEME: "auth/invalid-emulator-scheme";
     readonly INVALID_IDP_RESPONSE: "auth/invalid-credential";
+    readonly INVALID_LOGIN_CREDENTIALS: "auth/invalid-credential";
     readonly INVALID_MESSAGE_PAYLOAD: "auth/invalid-message-payload";
     readonly INVALID_MFA_SESSION: "auth/invalid-multi-factor-session";
     readonly INVALID_OAUTH_CLIENT_ID: "auth/invalid-oauth-client-id";

package/dist/esm5/src/core/index.d.ts

@@ -171,6 +171,15 @@ export declare function updateCurrentUser(auth: Auth, user: User | null): Promis
  * @public
  */
 export declare function signOut(auth: Auth): Promise<void>;
+/**
+ * Revokes the given access token. Currently only supports Apple OAuth access tokens.
+ *
+ * @param auth - The {@link Auth} instance.
+ * @param token - The Apple OAuth access token.
+ *
+ * @public
+ */
+export declare function revokeAccessToken(auth: Auth, token: string): Promise<void>;
 export { initializeAuth } from './auth/initialize';
 export { connectAuthEmulator } from './auth/emulator';
 export { AuthCredential } from './credentials';

package/dist/esm5/src/core/strategies/email.d.ts

@@ -16,7 +16,9 @@
  */
 import { ActionCodeSettings, Auth, User } from '../../model/public_types';
 /**
- * Gets the list of possible sign in methods for the given email address.
+ * Gets the list of possible sign in methods for the given email address. This method returns an
+ * empty list when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled, irrespective of the number of
+ * authentication methods available for the given email.
  *
  * @remarks
  * This is useful to differentiate methods of sign-in for the same provider, eg.
@@ -27,6 +29,8 @@ import { ActionCodeSettings, Auth, User } from '../../model/public_types';
  * @param auth - The {@link Auth} instance.
  * @param email - The user's email address.
  *
+ * Deprecated. Migrating off of this method is recommended as a security best-practice.
+ * Learn more in the Identity Platform documentation for [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection).
  * @public
  */
 export declare function fetchSignInMethodsForEmail(auth: Auth, email: string): Promise<string[]>;

package/dist/esm5/src/core/strategies/email_and_password.d.ts

@@ -16,7 +16,9 @@
  */
 import { ActionCodeInfo, ActionCodeSettings, Auth, UserCredential } from '../../model/public_types';
 /**
- * Sends a password reset email to the given email address.
+ * Sends a password reset email to the given email address. This method does not throw an error when
+ * there's no user account with the given email address and
+ * [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
  *
  * @remarks
  * To complete the password reset, call {@link confirmPasswordReset} with the code supplied in
@@ -112,6 +114,8 @@ export declare function createUserWithEmailAndPassword(auth: Auth, email: string
  *
  * @remarks
  * Fails with an error if the email address and password do not match.
+ * When [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled,
+ * this method fails with "auth/invalid-credential" in case of an invalid email/password.
  *
  * Note: The user's password is NOT the password used to access the user's email account. The
  * email address serves as a unique identifier for the user, and the password is used to access

package/dist/esm5/src/core/user/account_info.d.ts

@@ -41,6 +41,9 @@ export declare function updateProfile(user: User, { displayName, photoURL: photo
  * @param user - The user.
  * @param newEmail - The new email address.
  *
+ * Throws "auth/operation-not-allowed" error when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
+ * Deprecated - Use {@link verifyBeforeUpdateEmail} instead.
+ *
  * @public
  */
 export declare function updateEmail(user: User, newEmail: string): Promise<void>;

package/dist/esm5/src/model/auth.d.ts

@@ -83,4 +83,5 @@ export interface AuthInternal extends Auth {
     useDeviceLanguage(): void;
     signOut(): Promise<void>;
     validatePassword(password: string): Promise<PasswordValidationStatus>;
+    revokeAccessToken(token: string): Promise<void>;
 }

package/dist/index.webworker.esm5.js

@@ -76,7 +76,7 @@ function _debugErrorMap() {
         _a["invalid-emulator-scheme" /* AuthErrorCode.INVALID_EMULATOR_SCHEME */] = 'Emulator URL must start with a valid scheme (http:// or https://).',
         _a["invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */] = 'Your API key is invalid, please check you have copied it correctly.',
         _a["invalid-cert-hash" /* AuthErrorCode.INVALID_CERT_HASH */] = 'The SHA-1 certificate hash provided is invalid.',
-        _a["invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */] = 'The supplied auth credential is malformed or has expired.',
+        _a["invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */] = 'The supplied auth credential is incorrect, malformed or has expired.',
         _a["invalid-message-payload" /* AuthErrorCode.INVALID_MESSAGE_PAYLOAD */] = 'The email template corresponding to this action contains invalid characters in its message. ' +
             'Please fix by going to the Auth email templates section in the Firebase Console.',
         _a["invalid-multi-factor-session" /* AuthErrorCode.INVALID_MFA_SESSION */] = 'The request does not contain a valid proof of first factor successful sign-in.',
@@ -253,6 +253,7 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
     INVALID_EMAIL: 'auth/invalid-email',
     INVALID_EMULATOR_SCHEME: 'auth/invalid-emulator-scheme',
     INVALID_IDP_RESPONSE: 'auth/invalid-credential',
+    INVALID_LOGIN_CREDENTIALS: 'auth/invalid-credential',
     INVALID_MESSAGE_PAYLOAD: 'auth/invalid-message-payload',
     INVALID_MFA_SESSION: 'auth/invalid-multi-factor-session',
     INVALID_OAUTH_CLIENT_ID: 'auth/invalid-oauth-client-id',
@@ -551,7 +552,7 @@ function _initializeAuthInstance(auth, deps) {
 }
 
 var name = "@firebase/auth";
-var version = "1.3.2";
+var version = "1.4.0-canary.00235ba68";
 
 /**
  * @license
@@ -952,12 +953,15 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["INVALID_PASSWORD" /* ServerError.INVALID_PASSWORD */] = "wrong-password" /* AuthErrorCode.INVALID_PASSWORD */,
     // This can only happen if the SDK sends a bad request.
     _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "missing-password" /* AuthErrorCode.MISSING_PASSWORD */,
+    // Thrown if Email Enumeration Protection is enabled in the project and the email or password is
+    // invalid.
+    _a$1["INVALID_LOGIN_CREDENTIALS" /* ServerError.INVALID_LOGIN_CREDENTIALS */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
     // Sign up with email and password errors.
     _a$1["EMAIL_EXISTS" /* ServerError.EMAIL_EXISTS */] = "email-already-in-use" /* AuthErrorCode.EMAIL_EXISTS */,
     _a$1["PASSWORD_LOGIN_DISABLED" /* ServerError.PASSWORD_LOGIN_DISABLED */] = "operation-not-allowed" /* AuthErrorCode.OPERATION_NOT_ALLOWED */,
     // Verify assertion for sign in with credential errors:
-    _a$1["INVALID_IDP_RESPONSE" /* ServerError.INVALID_IDP_RESPONSE */] = "invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */,
-    _a$1["INVALID_PENDING_TOKEN" /* ServerError.INVALID_PENDING_TOKEN */] = "invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */,
+    _a$1["INVALID_IDP_RESPONSE" /* ServerError.INVALID_IDP_RESPONSE */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
+    _a$1["INVALID_PENDING_TOKEN" /* ServerError.INVALID_PENDING_TOKEN */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
     _a$1["FEDERATED_USER_ID_ALREADY_LINKED" /* ServerError.FEDERATED_USER_ID_ALREADY_LINKED */] = "credential-already-in-use" /* AuthErrorCode.CREDENTIAL_ALREADY_IN_USE */,
     // This can only happen if the SDK sends a bad request.
     _a$1["MISSING_REQ_TYPE" /* ServerError.MISSING_REQ_TYPE */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
@@ -979,7 +983,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     // Phone Auth related errors.
     _a$1["INVALID_CODE" /* ServerError.INVALID_CODE */] = "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     _a$1["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */] = "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
-    _a$1["INVALID_TEMPORARY_PROOF" /* ServerError.INVALID_TEMPORARY_PROOF */] = "invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */,
+    _a$1["INVALID_TEMPORARY_PROOF" /* ServerError.INVALID_TEMPORARY_PROOF */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
     _a$1["MISSING_SESSION_INFO" /* ServerError.MISSING_SESSION_INFO */] = "missing-verification-id" /* AuthErrorCode.MISSING_SESSION_INFO */,
     _a$1["SESSION_EXPIRED" /* ServerError.SESSION_EXPIRED */] = "code-expired" /* AuthErrorCode.CODE_EXPIRED */,
     // Other action code errors when additional settings passed.
@@ -1754,6 +1758,13 @@ function requestStsToken(auth, refreshToken) {
             }
         });
     });
+}
+function revokeToken(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts:revokeToken" /* Endpoint.REVOKE_TOKEN */, _addTidIfNecessary(auth, request))];
+        });
+    });
 }
 
 /**
@@ -3145,6 +3156,37 @@ var AuthImpl = /** @class */ (function () {
             }
         });
     };
+    /**
+     * Revokes the given access token. Currently only supports Apple OAuth access tokens.
+     */
+    AuthImpl.prototype.revokeAccessToken = function (token) {
+        return __awaiter(this, void 0, void 0, function () {
+            var idToken, request;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!this.currentUser) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.currentUser.getIdToken()];
+                    case 1:
+                        idToken = _a.sent();
+                        request = {
+                            providerId: 'apple.com',
+                            tokenType: "ACCESS_TOKEN" /* TokenType.ACCESS_TOKEN */,
+                            token: token,
+                            idToken: idToken
+                        };
+                        if (this.tenantId != null) {
+                            request.tenantId = this.tenantId;
+                        }
+                        return [4 /*yield*/, revokeToken(this, request)];
+                    case 2:
+                        _a.sent();
+                        _a.label = 3;
+                    case 3: return [2 /*return*/];
+                }
+            });
+        });
+    };
     AuthImpl.prototype.toJSON = function () {
         var _a;
         return {
@@ -5178,6 +5220,15 @@ function updateEmailPassword(auth, request) {
         });
     });
 }
+// Used for linking an email/password account to an existing idToken. Uses the same request/response
+// format as updateEmailPassword.
+function linkEmailPassword(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v1/accounts:signUp" /* Endpoint.SIGN_UP */, request)];
+        });
+    });
+}
 function applyActionCode$1(auth, request) {
     return __awaiter(this, void 0, void 0, function () {
         return __generator(this, function (_a) {
@@ -5386,15 +5437,18 @@ var EmailAuthCredential = /** @class */ (function (_super) {
     /** @internal */
     EmailAuthCredential.prototype._linkToIdToken = function (auth, idToken) {
         return __awaiter(this, void 0, void 0, function () {
+            var request;
             return __generator(this, function (_a) {
                 switch (this.signInMethod) {
                     case "password" /* SignInMethod.EMAIL_PASSWORD */:
-                        return [2 /*return*/, updateEmailPassword(auth, {
-                                idToken: idToken,
-                                returnSecureToken: true,
-                                email: this._email,
-                                password: this._password
-                            })];
+                        request = {
+                            idToken: idToken,
+                            returnSecureToken: true,
+                            email: this._email,
+                            password: this._password,
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                        };
+                        return [2 /*return*/, handleRecaptchaFlow(auth, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */, linkEmailPassword)];
                     case "emailLink" /* SignInMethod.EMAIL_LINK */:
                         return [2 /*return*/, signInWithEmailLinkForLinking(auth, {
                                 idToken: idToken,
@@ -7557,7 +7611,9 @@ function recachePasswordPolicy(auth) {
     });
 }
 /**
- * Sends a password reset email to the given email address.
+ * Sends a password reset email to the given email address. This method does not throw an error when
+ * there's no user account with the given email address and
+ * [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
  *
  * @remarks
  * To complete the password reset, call {@link confirmPasswordReset} with the code supplied in
@@ -7798,6 +7854,8 @@ function createUserWithEmailAndPassword(auth, email, password) {
  *
  * @remarks
  * Fails with an error if the email address and password do not match.
+ * When [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled,
+ * this method fails with "auth/invalid-credential" in case of an invalid email/password.
  *
  * Note: The user's password is NOT the password used to access the user's email account. The
  * email address serves as a unique identifier for the user, and the password is used to access
@@ -8006,7 +8064,9 @@ function createAuthUri(auth, request) {
  * limitations under the License.
  */
 /**
- * Gets the list of possible sign in methods for the given email address.
+ * Gets the list of possible sign in methods for the given email address. This method returns an
+ * empty list when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled, irrespective of the number of
+ * authentication methods available for the given email.
  *
  * @remarks
  * This is useful to differentiate methods of sign-in for the same provider, eg.
@@ -8017,6 +8077,8 @@ function createAuthUri(auth, request) {
  * @param auth - The {@link Auth} instance.
  * @param email - The user's email address.
  *
+ * Deprecated. Migrating off of this method is recommended as a security best-practice.
+ * Learn more in the Identity Platform documentation for [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection).
  * @public
  */
 function fetchSignInMethodsForEmail(auth, email) {
@@ -8271,6 +8333,9 @@ function updateProfile(user, _a) {
  * @param user - The user.
  * @param newEmail - The new email address.
  *
+ * Throws "auth/operation-not-allowed" error when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
+ * Deprecated - Use {@link verifyBeforeUpdateEmail} instead.
+ *
  * @public
  */
 function updateEmail(user, newEmail) {
@@ -8648,6 +8713,18 @@ function updateCurrentUser(auth, user) {
 function signOut(auth) {
     return getModularInstance(auth).signOut();
 }
+/**
+ * Revokes the given access token. Currently only supports Apple OAuth access tokens.
+ *
+ * @param auth - The {@link Auth} instance.
+ * @param token - The Apple OAuth access token.
+ *
+ * @public
+ */
+function revokeAccessToken(auth, token) {
+    var authInternal = _castAuth(auth);
+    return authInternal.revokeAccessToken(token);
+}
 /**
  * Deletes and signs out the user.
  *
@@ -8998,5 +9075,5 @@ function getAuth(app) {
     return auth;
 }
 
-export { ActionCodeOperation, ActionCodeURL, AuthCredential, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as AuthErrorCodes, EmailAuthCredential, EmailAuthProvider, FacebookAuthProvider, FactorId, GithubAuthProvider, GoogleAuthProvider, OAuthCredential, OAuthProvider, OperationType, PhoneAuthCredential, ProviderId, SAMLAuthProvider, SignInMethod, TwitterAuthProvider, applyActionCode, beforeAuthStateChanged, checkActionCode, confirmPasswordReset, connectAuthEmulator, createUserWithEmailAndPassword, debugErrorMap, deleteUser, fetchSignInMethodsForEmail, getAdditionalUserInfo, getAuth, getIdToken, getIdTokenResult, getMultiFactorResolver, inMemoryPersistence, indexedDBLocalPersistence, initializeAuth, initializeRecaptchaConfig, isSignInWithEmailLink, linkWithCredential, multiFactor, onAuthStateChanged, onIdTokenChanged, parseActionCodeURL, prodErrorMap, reauthenticateWithCredential, reload, sendEmailVerification, sendPasswordResetEmail, sendSignInLinkToEmail, setPersistence, signInAnonymously, signInWithCredential, signInWithCustomToken, signInWithEmailAndPassword, signInWithEmailLink, signOut, unlink, updateCurrentUser, updateEmail, updatePassword, updateProfile, useDeviceLanguage, validatePassword, verifyBeforeUpdateEmail, verifyPasswordResetCode };
+export { ActionCodeOperation, ActionCodeURL, AuthCredential, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as AuthErrorCodes, EmailAuthCredential, EmailAuthProvider, FacebookAuthProvider, FactorId, GithubAuthProvider, GoogleAuthProvider, OAuthCredential, OAuthProvider, OperationType, PhoneAuthCredential, ProviderId, SAMLAuthProvider, SignInMethod, TwitterAuthProvider, applyActionCode, beforeAuthStateChanged, checkActionCode, confirmPasswordReset, connectAuthEmulator, createUserWithEmailAndPassword, debugErrorMap, deleteUser, fetchSignInMethodsForEmail, getAdditionalUserInfo, getAuth, getIdToken, getIdTokenResult, getMultiFactorResolver, inMemoryPersistence, indexedDBLocalPersistence, initializeAuth, initializeRecaptchaConfig, isSignInWithEmailLink, linkWithCredential, multiFactor, onAuthStateChanged, onIdTokenChanged, parseActionCodeURL, prodErrorMap, reauthenticateWithCredential, reload, revokeAccessToken, sendEmailVerification, sendPasswordResetEmail, sendSignInLinkToEmail, setPersistence, signInAnonymously, signInWithCredential, signInWithCustomToken, signInWithEmailAndPassword, signInWithEmailLink, signOut, unlink, updateCurrentUser, updateEmail, updatePassword, updateProfile, useDeviceLanguage, validatePassword, verifyBeforeUpdateEmail, verifyPasswordResetCode };
 //# sourceMappingURL=index.webworker.esm5.js.map