@firebase/firestore 3.3.0 → 3.3.1-canary.086df7c7e

package/dist/packages/firestore/src/api/credentials.d.ts

@@ -14,6 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { AppCheckInternalComponentName } from '@firebase/app-check-interop-types';
 import { FirebaseAuthInternalName } from '@firebase/auth-interop-types';
 import { Provider } from '@firebase/component';
 import { User } from '../auth/user';
@@ -26,30 +27,27 @@ export interface FirstPartyCredentialsSettings {
 }
 export interface ProviderCredentialsSettings {
     ['type']: 'provider';
-    ['client']: CredentialsProvider;
+    ['client']: CredentialsProvider<User>;
 }
 /** Settings for private credentials */
 export declare type CredentialsSettings = FirstPartyCredentialsSettings | ProviderCredentialsSettings;
-export declare type TokenType = 'OAuth' | 'FirstParty';
+export declare type TokenType = 'OAuth' | 'FirstParty' | 'AppCheck';
 export interface Token {
     /** Type of token. */
     type: TokenType;
     /**
      * The user with which the token is associated (used for persisting user
      * state on disk, etc.).
+     * This will be null for Tokens of the type 'AppCheck'.
      */
-    user: User;
-    /** Extra header values to be passed along with a request */
-    authHeaders: {
-        [header: string]: string;
-    };
+    user?: User;
+    /** Header values to set for this token */
+    headers: Map<string, string>;
 }
 export declare class OAuthToken implements Token {
     user: User;
     type: TokenType;
-    authHeaders: {
-        [header: string]: string;
-    };
+    headers: Map<any, any>;
     constructor(value: string, user: User);
 }
 /**
@@ -57,12 +55,12 @@ export declare class OAuthToken implements Token {
  * token and may need to invalidate other state if the current user has also
  * changed.
  */
-export declare type CredentialChangeListener = (user: User) => Promise<void>;
+export declare type CredentialChangeListener<T> = (credential: T) => Promise<void>;
 /**
  * Provides methods for getting the uid and token for the current user and
  * listening for changes.
  */
-export interface CredentialsProvider {
+export interface CredentialsProvider<T> {
     /**
      * Starts the credentials provider and specifies a listener to be notified of
      * credential changes (sign-in / sign-out, token changes). It is immediately
@@ -70,7 +68,7 @@ export interface CredentialsProvider {
      *
      * The change listener is invoked on the provided AsyncQueue.
      */
-    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<T>): void;
     /** Requests a token for the current user. */
     getToken(): Promise<Token | null>;
     /**
@@ -84,17 +82,17 @@ export interface CredentialsProvider {
  * A CredentialsProvider that always yields an empty token.
  * @internal
  */
-export declare class EmptyCredentialsProvider implements CredentialsProvider {
+export declare class EmptyAuthCredentialsProvider implements CredentialsProvider<User> {
     getToken(): Promise<Token | null>;
     invalidateToken(): void;
-    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<User>): void;
     shutdown(): void;
 }
 /**
  * A CredentialsProvider that always returns a constant token. Used for
  * emulator token mocking.
  */
-export declare class EmulatorCredentialsProvider implements CredentialsProvider {
+export declare class EmulatorAuthCredentialsProvider implements CredentialsProvider<User> {
     private token;
     constructor(token: Token);
     /**
@@ -105,19 +103,19 @@ export declare class EmulatorCredentialsProvider implements CredentialsProvider
     private changeListener;
     getToken(): Promise<Token | null>;
     invalidateToken(): void;
-    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<User>): void;
     shutdown(): void;
 }
 /** Credential provider for the Lite SDK. */
-export declare class LiteCredentialsProvider implements CredentialsProvider {
+export declare class LiteAuthCredentialsProvider implements CredentialsProvider<User> {
     private auth;
     constructor(authProvider: Provider<FirebaseAuthInternalName>);
     getToken(): Promise<Token | null>;
     invalidateToken(): void;
-    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<User>): void;
     shutdown(): void;
 }
-export declare class FirebaseCredentialsProvider implements CredentialsProvider {
+export declare class FirebaseAuthCredentialsProvider implements CredentialsProvider<User> {
     private authProvider;
     /**
      * The auth token listener registered with FirebaseApp, retained here so we
@@ -134,7 +132,7 @@ export declare class FirebaseCredentialsProvider implements CredentialsProvider
     private forceRefresh;
     private auth;
     constructor(authProvider: Provider<FirebaseAuthInternalName>);
-    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<User>): void;
     getToken(): Promise<Token | null>;
     invalidateToken(): void;
     shutdown(): void;
@@ -148,29 +146,65 @@ interface Gapi {
     };
 }
 export declare class FirstPartyToken implements Token {
-    private gapi;
-    private sessionIndex;
-    private iamToken;
     type: TokenType;
     user: User;
+    headers: Map<any, any>;
     constructor(gapi: Gapi, sessionIndex: string, iamToken: string | null);
-    get authHeaders(): {
-        [header: string]: string;
-    };
 }
-export declare class FirstPartyCredentialsProvider implements CredentialsProvider {
+export declare class FirstPartyAuthCredentialsProvider implements CredentialsProvider<User> {
     private gapi;
     private sessionIndex;
     private iamToken;
     constructor(gapi: Gapi, sessionIndex: string, iamToken: string | null);
     getToken(): Promise<Token | null>;
-    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<User>): void;
+    shutdown(): void;
+    invalidateToken(): void;
+}
+export declare class AppCheckToken implements Token {
+    private value;
+    type: TokenType;
+    headers: Map<any, any>;
+    constructor(value: string);
+}
+export declare class FirebaseAppCheckTokenProvider implements CredentialsProvider<string> {
+    private appCheckProvider;
+    /**
+     * The AppCheck token listener registered with FirebaseApp, retained here so
+     * we can unregister it.
+     */
+    private tokenListener;
+    private forceRefresh;
+    private appCheck;
+    constructor(appCheckProvider: Provider<AppCheckInternalComponentName>);
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<string>): void;
+    getToken(): Promise<Token | null>;
+    invalidateToken(): void;
+    shutdown(): void;
+}
+/**
+ * An AppCheck token provider that always yields an empty token.
+ * @internal
+ */
+export declare class EmptyAppCheckTokenProvider implements CredentialsProvider<string> {
+    getToken(): Promise<Token | null>;
+    invalidateToken(): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<string>): void;
     shutdown(): void;
+}
+/** AppCheck token provider for the Lite SDK. */
+export declare class LiteAppCheckTokenProvider implements CredentialsProvider<string> {
+    private appCheckProvider;
+    private appCheck;
+    constructor(appCheckProvider: Provider<AppCheckInternalComponentName>);
+    getToken(): Promise<Token | null>;
     invalidateToken(): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<string>): void;
+    shutdown(): void;
 }
 /**
  * Builds a CredentialsProvider depending on the type of
  * the credentials passed in.
  */
-export declare function makeCredentialsProvider(credentials?: CredentialsSettings): CredentialsProvider;
+export declare function makeAuthCredentialsProvider(credentials?: CredentialsSettings): CredentialsProvider<User>;
 export {};

package/dist/packages/firestore/src/api/database.d.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { FirebaseApp } from '@firebase/app';
+import { User } from '../auth/user';
 import { DatabaseId } from '../core/database_info';
 import { FirestoreClient } from '../core/firestore_client';
 import { Firestore as LiteFirestore } from '../lite-api/database';
@@ -49,7 +50,7 @@ export declare class Firestore extends LiteFirestore {
     readonly _persistenceKey: string;
     _firestoreClient: FirestoreClient | undefined;
     /** @hideconstructor */
-    constructor(databaseIdOrApp: DatabaseId | FirebaseApp, credentialsProvider: CredentialsProvider);
+    constructor(databaseIdOrApp: DatabaseId | FirebaseApp, authCredentialsProvider: CredentialsProvider<User>, appCheckCredentialsProvider: CredentialsProvider<string>);
     _terminate(): Promise<void>;
 }
 /**

package/dist/packages/firestore/src/api.d.ts

@@ -47,4 +47,5 @@ export { FieldPath as _FieldPath } from './model/path';
 export type { ResourcePath as _ResourcePath } from './model/path';
 export type { ByteString as _ByteString } from './util/byte_string';
 export { logWarn as _logWarn } from './util/log';
-export { EmptyCredentialsProvider as _EmptyCredentialsProvider } from './api/credentials';
+export { EmptyAuthCredentialsProvider as _EmptyAuthCredentialsProvider } from './api/credentials';
+export { EmptyAppCheckTokenProvider as _EmptyAppCheckTokenProvider } from './api/credentials';

package/dist/packages/firestore/src/core/component_provider.d.ts

@@ -30,7 +30,8 @@ import { SyncEngine } from './sync_engine';
 export interface ComponentConfiguration {
     asyncQueue: AsyncQueue;
     databaseInfo: DatabaseInfo;
-    credentials: CredentialsProvider;
+    authCredentials: CredentialsProvider<User>;
+    appCheckCredentials: CredentialsProvider<string>;
     clientId: ClientId;
     initialUser: User;
     maxConcurrentLimboResolutions: number;

package/dist/packages/firestore/src/core/firestore_client.d.ts

@@ -38,7 +38,8 @@ export declare const MAX_CONCURRENT_LIMBO_RESOLUTIONS = 100;
  * async queue that is shared by all of the other components in the system.
  */
 export declare class FirestoreClient {
-    private credentials;
+    private authCredentials;
+    private appCheckCredentials;
     /**
      * Asynchronous queue responsible for all of our internal processing. When
      * we get incoming work from the user (via public API) or the network
@@ -51,10 +52,10 @@ export declare class FirestoreClient {
     private databaseInfo;
     private user;
     private readonly clientId;
-    private credentialListener;
+    private authCredentialListener;
     offlineComponents?: OfflineComponentProvider;
     onlineComponents?: OnlineComponentProvider;
-    constructor(credentials: CredentialsProvider, 
+    constructor(authCredentials: CredentialsProvider<User>, appCheckCredentials: CredentialsProvider<string>, 
     /**
      * Asynchronous queue responsible for all of our internal processing. When
      * we get incoming work from the user (via public API) or the network

package/dist/packages/firestore/src/lite-api/components.d.ts

@@ -16,6 +16,7 @@
  */
 import { _FirebaseService } from '@firebase/app';
 import { CredentialsProvider } from '../api/credentials';
+import { User } from '../auth/user';
 import { DatabaseId, DatabaseInfo } from '../core/database_info';
 import { Datastore } from '../remote/datastore';
 import { FirestoreSettingsImpl } from './settings';
@@ -27,7 +28,8 @@ export declare const LOG_TAG = "ComponentProvider";
  * This interface mainly exists to remove a cyclic dependency.
  */
 export interface FirestoreService extends _FirebaseService {
-    _credentials: CredentialsProvider;
+    _authCredentials: CredentialsProvider<User>;
+    _appCheckCredentials: CredentialsProvider<string>;
     _persistenceKey: string;
     _databaseId: DatabaseId;
     _terminated: boolean;

package/dist/packages/firestore/src/lite-api/database.d.ts

@@ -17,6 +17,7 @@
 import { FirebaseApp } from '@firebase/app';
 import { EmulatorMockTokenOptions } from '@firebase/util';
 import { CredentialsProvider } from '../api/credentials';
+import { User } from '../auth/user';
 import { DatabaseId } from '../core/database_info';
 import { FirestoreService } from './components';
 import { FirestoreSettingsImpl, PrivateSettings, FirestoreSettings } from './settings';
@@ -31,7 +32,8 @@ declare module '@firebase/component' {
  * Do not call this constructor directly. Instead, use {@link getFirestore}.
  */
 export declare class Firestore implements FirestoreService {
-    _credentials: CredentialsProvider;
+    _authCredentials: CredentialsProvider<User>;
+    _appCheckCredentials: CredentialsProvider<string>;
     /**
      * Whether it's a Firestore or Firestore Lite instance.
      */
@@ -43,7 +45,7 @@ export declare class Firestore implements FirestoreService {
     private _terminateTask?;
     _app?: FirebaseApp;
     /** @hideconstructor */
-    constructor(databaseIdOrApp: DatabaseId | FirebaseApp, _credentials: CredentialsProvider);
+    constructor(databaseIdOrApp: DatabaseId | FirebaseApp, _authCredentials: CredentialsProvider<User>, _appCheckCredentials: CredentialsProvider<string>);
     /**
      * The {@link @firebase/app#FirebaseApp} associated with this `Firestore` service
      * instance.

package/dist/packages/firestore/src/platform/browser/webchannel_connection.d.ts

@@ -25,5 +25,5 @@ export declare class WebChannelConnection extends RestConnection {
     private readonly useFetchStreams;
     constructor(info: DatabaseInfo);
     protected performRPCRequest<Req, Resp>(rpcName: string, url: string, headers: StringMap, body: Req): Promise<Resp>;
-    openStream<Req, Resp>(rpcName: string, token: Token | null): Stream<Req, Resp>;
+    openStream<Req, Resp>(rpcName: string, authToken: Token | null, appCheckToken: Token | null): Stream<Req, Resp>;
 }

package/dist/packages/firestore/src/platform/node/grpc_connection.d.ts

@@ -28,7 +28,7 @@ export declare class GrpcConnection implements Connection {
     private cachedStub;
     constructor(protos: GrpcObject, databaseInfo: DatabaseInfo);
     private ensureActiveStub;
-    invokeRPC<Req, Resp>(rpcName: string, path: string, request: Req, token: Token | null): Promise<Resp>;
-    invokeStreamingRPC<Req, Resp>(rpcName: string, path: string, request: Req, token: Token | null): Promise<Resp[]>;
-    openStream<Req, Resp>(rpcName: string, token: Token | null): Stream<Req, Resp>;
+    invokeRPC<Req, Resp>(rpcName: string, path: string, request: Req, authToken: Token | null, appCheckToken: Token | null): Promise<Resp>;
+    invokeStreamingRPC<Req, Resp>(rpcName: string, path: string, request: Req, authToken: Token | null, appCheckToken: Token | null): Promise<Resp[]>;
+    openStream<Req, Resp>(rpcName: string, authToken: Token | null, appCheckToken: Token | null): Stream<Req, Resp>;
 }

package/dist/packages/firestore/src/remote/connection.d.ts

@@ -41,7 +41,7 @@ export interface Connection {
      * @param token - the Token to use for the RPC.
      * @returns a Promise containing the JSON object encoding of the response
      */
-    invokeRPC<Req, Resp>(rpcName: string, path: string, request: Req, token: Token | null): Promise<Resp>;
+    invokeRPC<Req, Resp>(rpcName: string, path: string, request: Req, authToken: Token | null, appCheckToken: Token | null): Promise<Resp>;
     /**
      * Invokes a streaming RPC by name, given a request message as a JavaScript
      * object representing the JSON to send. The responses will be consumed to
@@ -54,14 +54,14 @@ export interface Connection {
      * @returns a Promise containing an array with the JSON object encodings of the
      * responses
      */
-    invokeStreamingRPC<Req, Resp>(rpcName: string, path: string, request: Req, token: Token | null): Promise<Resp[]>;
+    invokeStreamingRPC<Req, Resp>(rpcName: string, path: string, request: Req, authToken: Token | null, appCheckToken: Token | null): Promise<Resp[]>;
     /**
      * Opens a stream to the given stream RPC endpoint. Returns a stream which
      * will try to open itself.
      * @param rpcName - the name of the RPC to open the stream on
      * @param token - the Token to use for the RPC.
      */
-    openStream<Req, Resp>(rpcName: string, token: Token | null): Stream<Req, Resp>;
+    openStream<Req, Resp>(rpcName: string, authToken: Token | null, appCheckToken: Token | null): Stream<Req, Resp>;
 }
 /**
  * A bidirectional stream that can be used to send an receive messages.

package/dist/packages/firestore/src/remote/datastore.d.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { CredentialsProvider } from '../api/credentials';
+import { User } from '../auth/user';
 import { Query } from '../core/query';
 import { Document } from '../model/document';
 import { DocumentKey } from '../model/document_key';
@@ -31,7 +32,7 @@ import { JsonProtoSerializer } from './serializer';
 export declare abstract class Datastore {
     abstract terminate(): void;
 }
-export declare function newDatastore(credentials: CredentialsProvider, connection: Connection, serializer: JsonProtoSerializer): Datastore;
+export declare function newDatastore(authCredentials: CredentialsProvider<User>, appCheckCredentials: CredentialsProvider<string>, connection: Connection, serializer: JsonProtoSerializer): Datastore;
 export declare function invokeCommitRpc(datastore: Datastore, mutations: Mutation[]): Promise<void>;
 export declare function invokeBatchGetDocumentsRpc(datastore: Datastore, keys: DocumentKey[]): Promise<Document[]>;
 export declare function invokeRunQueryRpc(datastore: Datastore, query: Query): Promise<Document[]>;

package/dist/packages/firestore/src/remote/persistent_stream.d.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { CredentialsProvider, Token } from '../api/credentials';
+import { User } from '../auth/user';
 import { SnapshotVersion } from '../core/snapshot_version';
 import { TargetId } from '../core/types';
 import { TargetData } from '../local/target_data';
@@ -82,7 +83,8 @@ export declare abstract class PersistentStream<SendType, ReceiveType, ListenerTy
     private idleTimerId;
     private healthTimerId;
     protected connection: Connection;
-    private credentialsProvider;
+    private authCredentialsProvider;
+    private appCheckCredentialsProvider;
     protected listener: ListenerType;
     private state;
     /**
@@ -95,7 +97,7 @@ export declare abstract class PersistentStream<SendType, ReceiveType, ListenerTy
     private healthCheck;
     private stream;
     protected backoff: ExponentialBackoff;
-    constructor(queue: AsyncQueue, connectionTimerId: TimerId, idleTimerId: TimerId, healthTimerId: TimerId, connection: Connection, credentialsProvider: CredentialsProvider, listener: ListenerType);
+    constructor(queue: AsyncQueue, connectionTimerId: TimerId, idleTimerId: TimerId, healthTimerId: TimerId, connection: Connection, authCredentialsProvider: CredentialsProvider<User>, appCheckCredentialsProvider: CredentialsProvider<string>, listener: ListenerType);
     /**
      * Returns true if start() has been called and no error has occurred. True
      * indicates the stream is open or in the process of opening (which
@@ -175,7 +177,7 @@ export declare abstract class PersistentStream<SendType, ReceiveType, ListenerTy
      * Used by subclasses to start the concrete RPC and return the underlying
      * connection stream.
      */
-    protected abstract startRpc(token: Token | null): Stream<SendType, ReceiveType>;
+    protected abstract startRpc(authToken: Token | null, appCheckToken: Token | null): Stream<SendType, ReceiveType>;
     /**
      * Called after the stream has received a message. The function will be
      * called on the right queue and must return a Promise.
@@ -211,8 +213,8 @@ export interface WatchStreamListener extends PersistentStreamListener {
  */
 export declare class PersistentListenStream extends PersistentStream<ProtoListenRequest, ProtoListenResponse, WatchStreamListener> {
     private serializer;
-    constructor(queue: AsyncQueue, connection: Connection, credentials: CredentialsProvider, serializer: JsonProtoSerializer, listener: WatchStreamListener);
-    protected startRpc(token: Token | null): Stream<ProtoListenRequest, ProtoListenResponse>;
+    constructor(queue: AsyncQueue, connection: Connection, authCredentials: CredentialsProvider<User>, appCheckCredentials: CredentialsProvider<string>, serializer: JsonProtoSerializer, listener: WatchStreamListener);
+    protected startRpc(authToken: Token | null, appCheckToken: Token | null): Stream<ProtoListenRequest, ProtoListenResponse>;
     protected onMessage(watchChangeProto: ProtoListenResponse): Promise<void>;
     /**
      * Registers interest in the results of the given target. If the target
@@ -260,7 +262,7 @@ export interface WriteStreamListener extends PersistentStreamListener {
 export declare class PersistentWriteStream extends PersistentStream<ProtoWriteRequest, ProtoWriteResponse, WriteStreamListener> {
     private serializer;
     private handshakeComplete_;
-    constructor(queue: AsyncQueue, connection: Connection, credentials: CredentialsProvider, serializer: JsonProtoSerializer, listener: WriteStreamListener);
+    constructor(queue: AsyncQueue, connection: Connection, authCredentials: CredentialsProvider<User>, appCheckCredentials: CredentialsProvider<string>, serializer: JsonProtoSerializer, listener: WriteStreamListener);
     /**
      * The last received stream token from the server, used to acknowledge which
      * responses the client has processed. Stream tokens are opaque checkpoint
@@ -277,7 +279,7 @@ export declare class PersistentWriteStream extends PersistentStream<ProtoWriteRe
     get handshakeComplete(): boolean;
     start(): void;
     protected tearDown(): void;
-    protected startRpc(token: Token | null): Stream<ProtoWriteRequest, ProtoWriteResponse>;
+    protected startRpc(authToken: Token | null, appCheckToken: Token | null): Stream<ProtoWriteRequest, ProtoWriteResponse>;
     protected onMessage(responseProto: ProtoWriteResponse): Promise<void>;
     /**
      * Sends an initial streamToken to the server, performing the handshake

package/dist/packages/firestore/src/remote/rest_connection.d.ts

@@ -28,14 +28,14 @@ export declare abstract class RestConnection implements Connection {
     protected readonly baseUrl: string;
     private readonly databaseRoot;
     constructor(databaseInfo: DatabaseInfo);
-    invokeRPC<Req, Resp>(rpcName: string, path: string, req: Req, token: Token | null): Promise<Resp>;
-    invokeStreamingRPC<Req, Resp>(rpcName: string, path: string, request: Req, token: Token | null): Promise<Resp[]>;
-    abstract openStream<Req, Resp>(rpcName: string, token: Token | null): Stream<Req, Resp>;
+    invokeRPC<Req, Resp>(rpcName: string, path: string, req: Req, authToken: Token | null, appCheckToken: Token | null): Promise<Resp>;
+    invokeStreamingRPC<Req, Resp>(rpcName: string, path: string, request: Req, authToken: Token | null, appCheckToken: Token | null): Promise<Resp[]>;
+    abstract openStream<Req, Resp>(rpcName: string, authToken: Token | null, appCheckToken: Token | null): Stream<Req, Resp>;
     /**
      * Modifies the headers for a request, adding any authorization token if
      * present and any additional headers for the request.
      */
-    protected modifyHeadersForRequest(headers: StringMap, token: Token | null): void;
+    protected modifyHeadersForRequest(headers: StringMap, authToken: Token | null, appCheckToken: Token | null): void;
     /**
      * Performs an RPC request using an implementation specific networking layer.
      */

package/dist/packages/firestore/test/integration/remote/stream.test.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { EmptyCredentialsProvider } from '../../../src/api/credentials';
+import { EmptyAuthCredentialsProvider } from '../../../src/api/credentials';
 import { SnapshotVersion } from '../../../src/core/snapshot_version';
 import { MutationResult } from '../../../src/model/mutation';
 import { PersistentListenStream, PersistentWriteStream, WatchStreamListener, WriteStreamListener } from '../../../src/remote/persistent_stream';
@@ -48,6 +48,6 @@ declare class StreamStatusListener implements WatchStreamListener, WriteStreamLi
     onClose(err?: FirestoreError): Promise<void>;
     private resolvePending;
 }
-export declare function withTestWriteStream(fn: (writeStream: PersistentWriteStream, streamListener: StreamStatusListener, queue: AsyncQueueImpl) => Promise<void>, credentialsProvider?: EmptyCredentialsProvider): Promise<void>;
+export declare function withTestWriteStream(fn: (writeStream: PersistentWriteStream, streamListener: StreamStatusListener, queue: AsyncQueueImpl) => Promise<void>, credentialsProvider?: EmptyAuthCredentialsProvider): Promise<void>;
 export declare function withTestWatchStream(fn: (watchStream: PersistentListenStream, streamListener: StreamStatusListener) => Promise<void>): Promise<void>;
 export {};

package/dist/packages/firestore/test/integration/util/internal_helpers.d.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 import * as firestore from '@firebase/firestore-types';
-import { CredentialChangeListener, CredentialsProvider, EmptyCredentialsProvider } from '../../../src/api/credentials';
+import { CredentialChangeListener, CredentialsProvider, EmptyAuthCredentialsProvider } from '../../../src/api/credentials';
 import { User } from '../../../src/auth/user';
 import { DatabaseInfo } from '../../../src/core/database_info';
 import { Datastore } from '../../../src/remote/datastore';
@@ -23,11 +23,11 @@ import { AsyncQueue } from '../../../src/util/async_queue';
 import { AsyncQueueImpl } from '../../../src/util/async_queue_impl';
 export declare function asyncQueue(db: firestore.FirebaseFirestore): AsyncQueueImpl;
 export declare function getDefaultDatabaseInfo(): DatabaseInfo;
-export declare function withTestDatastore(fn: (datastore: Datastore) => Promise<void>, credentialsProvider?: CredentialsProvider): Promise<void>;
-export declare class MockCredentialsProvider extends EmptyCredentialsProvider {
+export declare function withTestDatastore(fn: (datastore: Datastore) => Promise<void>, authCredentialsProvider?: CredentialsProvider<User>, appCheckTokenProvider?: CredentialsProvider<string>): Promise<void>;
+export declare class MockAuthCredentialsProvider extends EmptyAuthCredentialsProvider {
     private listener;
     private asyncQueue;
     triggerUserChange(newUser: User): void;
-    start(asyncQueue: AsyncQueue, listener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, listener: CredentialChangeListener<User>): void;
 }
-export declare function withMockCredentialProviderTestDb(persistence: boolean, fn: (db: firestore.FirebaseFirestore, mockCredential: MockCredentialsProvider) => Promise<void>): Promise<void>;
+export declare function withMockCredentialProviderTestDb(persistence: boolean, fn: (db: firestore.FirebaseFirestore, mockCredential: MockAuthCredentialsProvider) => Promise<void>): Promise<void>;

package/dist/packages/firestore/test/unit/remote/rest_connection.test.d.ts

@@ -23,6 +23,6 @@ export declare class TestRestConnection extends RestConnection {
     lastHeaders: StringMap;
     lastRequestBody: unknown;
     nextResponse: Promise<unknown>;
-    openStream<Req, Resp>(rpcName: string, token: Token | null): Stream<Req, Resp>;
+    openStream<Req, Resp>(rpcName: string, authToken: Token | null, appCheckToken: Token | null): Stream<Req, Resp>;
     protected performRPCRequest<Req, Resp>(rpcName: string, url: string, headers: StringMap, body: Req): Promise<Resp>;
 }

package/dist/private.d.ts

@@ -491,7 +491,8 @@ declare type Comparator<K> = (key1: K, key2: K) => number;
 declare interface ComponentConfiguration {
     asyncQueue: AsyncQueue;
     databaseInfo: DatabaseInfo;
-    credentials: CredentialsProvider;
+    authCredentials: CredentialsProvider<User>;
+    appCheckCredentials: CredentialsProvider<string>;
     clientId: ClientId;
     initialUser: User;
     maxConcurrentLimboResolutions: number;
@@ -521,13 +522,13 @@ export declare function connectFirestoreEmulator(firestore: Firestore_2, host: s
  * token and may need to invalidate other state if the current user has also
  * changed.
  */
-declare type CredentialChangeListener = (user: User) => Promise<void>;
+declare type CredentialChangeListener<T> = (credential: T) => Promise<void>;
 
 /**
  * Provides methods for getting the uid and token for the current user and
  * listening for changes.
  */
-declare interface CredentialsProvider {
+declare interface CredentialsProvider<T> {
     /**
      * Starts the credentials provider and specifies a listener to be notified of
      * credential changes (sign-in / sign-out, token changes). It is immediately
@@ -535,7 +536,7 @@ declare interface CredentialsProvider {
      *
      * The change listener is invoked on the provided AsyncQueue.
      */
-    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener): void;
+    start(asyncQueue: AsyncQueue, changeListener: CredentialChangeListener<T>): void;
     /** Requests a token for the current user. */
     getToken(): Promise<Token | null>;
     /**
@@ -1052,7 +1053,9 @@ declare interface DocumentViewChange {
     doc: Document_2;
 }
 
-/* Excluded from this release type: _EmptyCredentialsProvider */
+/* Excluded from this release type: _EmptyAppCheckTokenProvider */
+
+/* Excluded from this release type: _EmptyAuthCredentialsProvider */
 export { EmulatorMockTokenOptions }
 
 /**
@@ -1278,7 +1281,7 @@ export declare class Firestore extends Firestore_2 {
     readonly _persistenceKey: string;
     _firestoreClient: FirestoreClient | undefined;
     /** @hideconstructor */
-    constructor(databaseIdOrApp: _DatabaseId | FirebaseApp, credentialsProvider: CredentialsProvider);
+    constructor(databaseIdOrApp: _DatabaseId | FirebaseApp, authCredentialsProvider: CredentialsProvider<User>, appCheckCredentialsProvider: CredentialsProvider<string>);
     _terminate(): Promise<void>;
 }
 
@@ -1288,7 +1291,8 @@ export declare class Firestore extends Firestore_2 {
  * Do not call this constructor directly. Instead, use {@link getFirestore}.
  */
 declare class Firestore_2 implements FirestoreService {
-    _credentials: CredentialsProvider;
+    _authCredentials: CredentialsProvider<User>;
+    _appCheckCredentials: CredentialsProvider<string>;
     /**
      * Whether it's a Firestore or Firestore Lite instance.
      */
@@ -1300,7 +1304,7 @@ declare class Firestore_2 implements FirestoreService {
     private _terminateTask?;
     _app?: FirebaseApp;
     /** @hideconstructor */
-    constructor(databaseIdOrApp: _DatabaseId | FirebaseApp, _credentials: CredentialsProvider);
+    constructor(databaseIdOrApp: _DatabaseId | FirebaseApp, _authCredentials: CredentialsProvider<User>, _appCheckCredentials: CredentialsProvider<string>);
     /**
      * The {@link @firebase/app#FirebaseApp} associated with this `Firestore` service
      * instance.
@@ -1330,7 +1334,8 @@ declare class Firestore_2 implements FirestoreService {
  * async queue that is shared by all of the other components in the system.
  */
 declare class FirestoreClient {
-    private credentials;
+    private authCredentials;
+    private appCheckCredentials;
     /**
      * Asynchronous queue responsible for all of our internal processing. When
      * we get incoming work from the user (via public API) or the network
@@ -1343,10 +1348,10 @@ declare class FirestoreClient {
     private databaseInfo;
     private user;
     private readonly clientId;
-    private credentialListener;
+    private authCredentialListener;
     offlineComponents?: OfflineComponentProvider;
     onlineComponents?: OnlineComponentProvider;
-    constructor(credentials: CredentialsProvider, 
+    constructor(authCredentials: CredentialsProvider<User>, appCheckCredentials: CredentialsProvider<string>, 
     /**
      * Asynchronous queue responsible for all of our internal processing. When
      * we get incoming work from the user (via public API) or the network
@@ -1603,7 +1608,8 @@ export declare type FirestoreErrorCode = 'cancelled' | 'unknown' | 'invalid-argu
  * This interface mainly exists to remove a cyclic dependency.
  */
 declare interface FirestoreService extends _FirebaseService {
-    _credentials: CredentialsProvider;
+    _authCredentials: CredentialsProvider<User>;
+    _appCheckCredentials: CredentialsProvider<string>;
     _persistenceKey: string;
     _databaseId: _DatabaseId;
     _terminated: boolean;
@@ -3463,7 +3469,7 @@ declare interface PrivateSettings extends FirestoreSettings_2 {
 
 declare interface ProviderCredentialsSettings {
     ['type']: 'provider';
-    ['client']: CredentialsProvider;
+    ['client']: CredentialsProvider<User>;
 }
 
 /**
@@ -4924,15 +4930,14 @@ declare interface Token {
     /**
      * The user with which the token is associated (used for persisting user
      * state on disk, etc.).
+     * This will be null for Tokens of the type 'AppCheck'.
      */
-    user: User;
-    /** Extra header values to be passed along with a request */
-    authHeaders: {
-        [header: string]: string;
-    };
+    user?: User;
+    /** Header values to set for this token */
+    headers: Map<string, string>;
 }
 
-declare type TokenType = 'OAuth' | 'FirstParty';
+declare type TokenType = 'OAuth' | 'FirstParty' | 'AppCheck';
 
 /**
  * A reference to a transaction.