@firebase/firestore 3.3.1 → 3.4.0-canary.774b2fc19

package/dist/index.node.cjs.js

@@ -8,18 +8,13 @@ var logger = require('@firebase/logger');
 var util = require('util');
 var util$1 = require('@firebase/util');
 var crypto = require('crypto');
-var module$1 = require('module');
 var grpcJs = require('@grpc/grpc-js');
 var path = require('path');
 var url = require('url');
 var protoLoader = require('@grpc/proto-loader');
 
-function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
-
-var module__default = /*#__PURE__*/_interopDefaultLegacy(module$1);
-
 const name = "@firebase/firestore";
-const version$1 = "3.3.1";
+const version$1 = "3.4.0-canary.774b2fc19";
 
 /**
  * @license
@@ -72,7 +67,7 @@ User.GOOGLE_CREDENTIALS = new User('google-credentials-uid');
 User.FIRST_PARTY = new User('first-party-uid');
 User.MOCK_USER = new User('mock-user');
 
-const version = "9.5.0";
+const version = "9.6.0-canary.774b2fc19";
 
 /**
  * @license
@@ -460,16 +455,15 @@ class OAuthToken {
     constructor(value, user) {
         this.user = user;
         this.type = 'OAuth';
-        this.authHeaders = {};
-        // Set the headers using Object Literal notation to avoid minification
-        this.authHeaders['Authorization'] = `Bearer ${value}`;
+        this.headers = new Map();
+        this.headers.set('Authorization', `Bearer ${value}`);
     }
 }
 /**
  * A CredentialsProvider that always yields an empty token.
  * @internal
  */
-class EmptyCredentialsProvider {
+class EmptyAuthCredentialsProvider {
     getToken() {
         return Promise.resolve(null);
     }
@@ -484,7 +478,7 @@ class EmptyCredentialsProvider {
  * A CredentialsProvider that always returns a constant token. Used for
  * emulator token mocking.
  */
-class EmulatorCredentialsProvider {
+class EmulatorAuthCredentialsProvider {
     constructor(token) {
         this.token = token;
         /**
@@ -507,7 +501,7 @@ class EmulatorCredentialsProvider {
         this.changeListener = null;
     }
 }
-class FirebaseCredentialsProvider {
+class FirebaseAuthCredentialsProvider {
     constructor(authProvider) {
         this.authProvider = authProvider;
         /** Tracks the current User. */
@@ -550,7 +544,7 @@ class FirebaseCredentialsProvider {
             });
         };
         const registerAuth = (auth) => {
-            logDebug('FirebaseCredentialsProvider', 'Auth detected');
+            logDebug('FirebaseAuthCredentialsProvider', 'Auth detected');
             this.auth = auth;
             this.auth.addAuthTokenListener(this.tokenListener);
             awaitNextToken();
@@ -567,7 +561,7 @@ class FirebaseCredentialsProvider {
                 }
                 else {
                     // If auth is still not available, proceed with `null` user
-                    logDebug('FirebaseCredentialsProvider', 'Auth not yet detected');
+                    logDebug('FirebaseAuthCredentialsProvider', 'Auth not yet detected');
                     nextToken.resolve();
                     nextToken = new Deferred();
                 }
@@ -590,7 +584,7 @@ class FirebaseCredentialsProvider {
             // outstanding so the response is potentially for a previous user (which
             // user, we can't be sure).
             if (this.tokenCounter !== initialTokenCounter) {
-                logDebug('FirebaseCredentialsProvider', 'getToken aborted due to token change.');
+                logDebug('FirebaseAuthCredentialsProvider', 'getToken aborted due to token change.');
                 return this.getToken();
             }
             else {
@@ -631,25 +625,17 @@ class FirebaseCredentialsProvider {
  */
 class FirstPartyToken {
     constructor(gapi, sessionIndex, iamToken) {
-        this.gapi = gapi;
-        this.sessionIndex = sessionIndex;
-        this.iamToken = iamToken;
         this.type = 'FirstParty';
         this.user = User.FIRST_PARTY;
-    }
-    get authHeaders() {
-        const headers = {
-            'X-Goog-AuthUser': this.sessionIndex
-        };
-        // Use array notation to prevent minification
-        const authHeader = this.gapi['auth']['getAuthHeaderValueForFirstParty']([]);
+        this.headers = new Map();
+        this.headers.set('X-Goog-AuthUser', sessionIndex);
+        const authHeader = gapi['auth']['getAuthHeaderValueForFirstParty']([]);
         if (authHeader) {
-            headers['Authorization'] = authHeader;
+            this.headers.set('Authorization', authHeader);
         }
-        if (this.iamToken) {
-            headers['X-Goog-Iam-Authorization-Token'] = this.iamToken;
+        if (iamToken) {
+            this.headers.set('X-Goog-Iam-Authorization-Token', iamToken);
         }
-        return headers;
     }
 }
 /*
@@ -657,7 +643,7 @@ class FirstPartyToken {
  * to authenticate the user, using technique that is only available
  * to applications hosted by Google.
  */
-class FirstPartyCredentialsProvider {
+class FirstPartyAuthCredentialsProvider {
     constructor(gapi, sessionIndex, iamToken) {
         this.gapi = gapi;
         this.sessionIndex = sessionIndex;
@@ -673,13 +659,97 @@ class FirstPartyCredentialsProvider {
     shutdown() { }
     invalidateToken() { }
 }
+class AppCheckToken {
+    constructor(value) {
+        this.value = value;
+        this.type = 'AppCheck';
+        this.headers = new Map();
+        if (value && value.length > 0) {
+            this.headers.set('x-firebase-appcheck', this.value);
+        }
+    }
+}
+class FirebaseAppCheckTokenProvider {
+    constructor(appCheckProvider) {
+        this.appCheckProvider = appCheckProvider;
+        this.forceRefresh = false;
+        this.appCheck = null;
+    }
+    start(asyncQueue, changeListener) {
+        const onTokenChanged = tokenResult => {
+            if (tokenResult.error != null) {
+                logDebug('FirebaseAppCheckTokenProvider', `Error getting App Check token; using placeholder token instead. Error: ${tokenResult.error.message}`);
+            }
+            return changeListener(tokenResult.token);
+        };
+        this.tokenListener = (tokenResult) => {
+            asyncQueue.enqueueRetryable(() => onTokenChanged(tokenResult));
+        };
+        const registerAppCheck = (appCheck) => {
+            logDebug('FirebaseAppCheckTokenProvider', 'AppCheck detected');
+            this.appCheck = appCheck;
+            this.appCheck.addTokenListener(this.tokenListener);
+        };
+        this.appCheckProvider.onInit(appCheck => registerAppCheck(appCheck));
+        // Our users can initialize AppCheck after Firestore, so we give it
+        // a chance to register itself with the component framework.
+        setTimeout(() => {
+            if (!this.appCheck) {
+                const appCheck = this.appCheckProvider.getImmediate({ optional: true });
+                if (appCheck) {
+                    registerAppCheck(appCheck);
+                }
+                else {
+                    // If AppCheck is still not available, proceed without it.
+                    logDebug('FirebaseAppCheckTokenProvider', 'AppCheck not yet detected');
+                }
+            }
+        }, 0);
+    }
+    getToken() {
+        const forceRefresh = this.forceRefresh;
+        this.forceRefresh = false;
+        if (!this.appCheck) {
+            return Promise.resolve(null);
+        }
+        return this.appCheck.getToken(forceRefresh).then(tokenResult => {
+            if (tokenResult) {
+                hardAssert(typeof tokenResult.token === 'string');
+                return new AppCheckToken(tokenResult.token);
+            }
+            else {
+                return null;
+            }
+        });
+    }
+    invalidateToken() {
+        this.forceRefresh = true;
+    }
+    shutdown() {
+        if (this.appCheck) {
+            this.appCheck.removeTokenListener(this.tokenListener);
+        }
+    }
+}
+/**
+ * An AppCheck token provider that always yields an empty token.
+ * @internal
+ */
+class EmptyAppCheckTokenProvider {
+    getToken() {
+        return Promise.resolve(new AppCheckToken(''));
+    }
+    invalidateToken() { }
+    start(asyncQueue, changeListener) { }
+    shutdown() { }
+}
 /**
  * Builds a CredentialsProvider depending on the type of
  * the credentials passed in.
  */
-function makeCredentialsProvider(credentials) {
+function makeAuthCredentialsProvider(credentials) {
     if (!credentials) {
-        return new EmptyCredentialsProvider();
+        return new EmptyAuthCredentialsProvider();
     }
     switch (credentials['type']) {
         case 'gapi':
@@ -689,11 +759,11 @@ function makeCredentialsProvider(credentials) {
                 client !== null &&
                 client['auth'] &&
                 client['auth']['getAuthHeaderValueForFirstParty']));
-            return new FirstPartyCredentialsProvider(client, credentials['sessionIndex'] || '0', credentials['iamToken'] || null);
+            return new FirstPartyAuthCredentialsProvider(client, credentials['sessionIndex'] || '0', credentials['iamToken'] || null);
         case 'provider':
             return credentials['client'];
         default:
-            throw new FirestoreError(Code.INVALID_ARGUMENT, 'makeCredentialsProvider failed due to invalid credential type');
+            throw new FirestoreError(Code.INVALID_ARGUMENT, 'makeAuthCredentialsProvider failed due to invalid credential type');
     }
 }
 
@@ -14245,22 +14315,19 @@ function nodePromise(action) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-// This is a hack fix for Node ES modules to use `require`.
-// @ts-ignore To avoid using `--module es2020` flag.
-const require$1 = module__default["default"].createRequire(new (require('url').URL)('file:' + __filename).href);
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { version: grpcVersion } = require$1('@grpc/grpc-js/package.json');
+// TODO: Fetch runtime version from grpc-js/package.json instead
+// when there's a cleaner way to dynamic require JSON in both Node ESM and CJS
+const grpcVersion = '1.3.7';
 const LOG_TAG$9 = 'Connection';
 const X_GOOG_API_CLIENT_VALUE = `gl-node/${process.versions.node} fire/${SDK_VERSION} grpc/${grpcVersion}`;
-function createMetadata(databasePath, token, appId) {
-    hardAssert(token === null || token.type === 'OAuth');
+function createMetadata(databasePath, authToken, appCheckToken, appId) {
+    hardAssert(authToken === null || authToken.type === 'OAuth');
     const metadata = new grpcJs.Metadata();
-    if (token) {
-        for (const header in token.authHeaders) {
-            if (token.authHeaders.hasOwnProperty(header)) {
-                metadata.set(header, token.authHeaders[header]);
-            }
-        }
+    if (authToken) {
+        authToken.headers.forEach((value, key) => metadata.set(key, value));
+    }
+    if (appCheckToken) {
+        appCheckToken.headers.forEach((value, key) => metadata.set(key, value));
     }
     if (appId) {
         metadata.set('X-Firebase-GMPID', appId);
@@ -14293,9 +14360,9 @@ class GrpcConnection {
         }
         return this.cachedStub;
     }
-    invokeRPC(rpcName, path, request, token) {
+    invokeRPC(rpcName, path, request, authToken, appCheckToken) {
         const stub = this.ensureActiveStub();
-        const metadata = createMetadata(this.databasePath, token, this.databaseInfo.appId);
+        const metadata = createMetadata(this.databasePath, authToken, appCheckToken, this.databaseInfo.appId);
         const jsonRequest = Object.assign({ database: this.databasePath }, request);
         return nodePromise((callback) => {
             logDebug(LOG_TAG$9, `RPC '${rpcName}' invoked with request:`, request);
@@ -14311,12 +14378,12 @@ class GrpcConnection {
             });
         });
     }
-    invokeStreamingRPC(rpcName, path, request, token) {
+    invokeStreamingRPC(rpcName, path, request, authToken, appCheckToken) {
         const results = [];
         const responseDeferred = new Deferred();
         logDebug(LOG_TAG$9, `RPC '${rpcName}' invoked (streaming) with request:`, request);
         const stub = this.ensureActiveStub();
-        const metadata = createMetadata(this.databasePath, token, this.databaseInfo.appId);
+        const metadata = createMetadata(this.databasePath, authToken, appCheckToken, this.databaseInfo.appId);
         const jsonRequest = Object.assign(Object.assign({}, request), { database: this.databasePath });
         const stream = stub[rpcName](jsonRequest, metadata);
         stream.on('data', (response) => {
@@ -14335,9 +14402,9 @@ class GrpcConnection {
         return responseDeferred.promise;
     }
     // TODO(mikelehen): This "method" is a monster. Should be refactored.
-    openStream(rpcName, token) {
+    openStream(rpcName, authToken, appCheckToken) {
         const stub = this.ensureActiveStub();
-        const metadata = createMetadata(this.databasePath, token, this.databaseInfo.appId);
+        const metadata = createMetadata(this.databasePath, authToken, appCheckToken, this.databaseInfo.appId);
         const grpcStream = stub[rpcName](metadata);
         let closed = false;
         const close = (err) => {
@@ -14417,8 +14484,8 @@ class GrpcConnection {
  */
 // __filename and __dirname globals are unavailable in ES modules
 // @ts-ignore To avoid using `--module es2020` flag.
-const __filename$1 = url.fileURLToPath(new (require('url').URL)('file:' + __filename).href);
-const __dirname$1 = path.dirname(__filename$1);
+const __filenameInESM = url.fileURLToPath(new (require('url').URL)('file:' + __filename).href);
+const __dirnameInESM = path.dirname(__filenameInESM);
 /** Used by tests so we can match @grpc/proto-loader behavior. */
 const protoLoaderOptions = {
     longs: String,
@@ -14432,7 +14499,7 @@ const protoLoaderOptions = {
  * @returns The GrpcObject representing our protos.
  */
 function loadProtos() {
-    const root = path.resolve(__dirname$1, "src/protos" );
+    const root = path.resolve(__dirnameInESM, "src/protos" );
     const firestoreProtoFile = path.join(root, 'google/firestore/v1/firestore.proto');
     const packageDefinition = protoLoader.loadSync(firestoreProtoFile, Object.assign(Object.assign({}, protoLoaderOptions), { includeDirs: [root] }));
     return grpcJs.loadPackageDefinition(packageDefinition);
@@ -14721,12 +14788,13 @@ const HEALTHY_TIMEOUT_MS = 10 * 1000;
  *  ListenerType: The type of the listener that will be used for callbacks
  */
 class PersistentStream {
-    constructor(queue, connectionTimerId, idleTimerId, healthTimerId, connection, credentialsProvider, listener) {
+    constructor(queue, connectionTimerId, idleTimerId, healthTimerId, connection, authCredentialsProvider, appCheckCredentialsProvider, listener) {
         this.queue = queue;
         this.idleTimerId = idleTimerId;
         this.healthTimerId = healthTimerId;
         this.connection = connection;
-        this.credentialsProvider = credentialsProvider;
+        this.authCredentialsProvider = authCredentialsProvider;
+        this.appCheckCredentialsProvider = appCheckCredentialsProvider;
         this.listener = listener;
         this.state = 0 /* Initial */;
         /**
@@ -14881,7 +14949,8 @@ class PersistentStream {
             // fail, however. In this case, we should get a Code.UNAUTHENTICATED error
             // before we received the first message and we need to invalidate the token
             // to ensure that we fetch a new token.
-            this.credentialsProvider.invalidateToken();
+            this.authCredentialsProvider.invalidateToken();
+            this.appCheckCredentialsProvider.invalidateToken();
         }
         // Clean up the underlying stream because we are no longer interested in events.
         if (this.stream !== null) {
@@ -14905,7 +14974,10 @@ class PersistentStream {
         const dispatchIfNotClosed = this.getCloseGuardedDispatcher(this.closeCount);
         // TODO(mikelehen): Just use dispatchIfNotClosed, but see TODO below.
         const closeCount = this.closeCount;
-        this.credentialsProvider.getToken().then(token => {
+        Promise.all([
+            this.authCredentialsProvider.getToken(),
+            this.appCheckCredentialsProvider.getToken()
+        ]).then(([authToken, appCheckToken]) => {
             // Stream can be stopped while waiting for authentication.
             // TODO(mikelehen): We really should just use dispatchIfNotClosed
             // and let this dispatch onto the queue, but that opened a spec test can
@@ -14914,7 +14986,7 @@ class PersistentStream {
                 // Normally we'd have to schedule the callback on the AsyncQueue.
                 // However, the following calls are safe to be called outside the
                 // AsyncQueue since they don't chain asynchronous calls
-                this.startStream(token);
+                this.startStream(authToken, appCheckToken);
             }
         }, (error) => {
             dispatchIfNotClosed(() => {
@@ -14923,9 +14995,9 @@ class PersistentStream {
             });
         });
     }
-    startStream(token) {
+    startStream(authToken, appCheckToken) {
         const dispatchIfNotClosed = this.getCloseGuardedDispatcher(this.closeCount);
-        this.stream = this.startRpc(token);
+        this.stream = this.startRpc(authToken, appCheckToken);
         this.stream.onOpen(() => {
             dispatchIfNotClosed(() => {
                 this.state = 2 /* Open */;
@@ -14994,12 +15066,12 @@ class PersistentStream {
  * sent from the server for ListenResponses.
  */
 class PersistentListenStream extends PersistentStream {
-    constructor(queue, connection, credentials, serializer, listener) {
-        super(queue, "listen_stream_connection_backoff" /* ListenStreamConnectionBackoff */, "listen_stream_idle" /* ListenStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, credentials, listener);
+    constructor(queue, connection, authCredentials, appCheckCredentials, serializer, listener) {
+        super(queue, "listen_stream_connection_backoff" /* ListenStreamConnectionBackoff */, "listen_stream_idle" /* ListenStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, authCredentials, appCheckCredentials, listener);
         this.serializer = serializer;
     }
-    startRpc(token) {
-        return this.connection.openStream('Listen', token);
+    startRpc(authToken, appCheckToken) {
+        return this.connection.openStream('Listen', authToken, appCheckToken);
     }
     onMessage(watchChangeProto) {
         // A successful response means the stream is healthy
@@ -15053,8 +15125,8 @@ class PersistentListenStream extends PersistentStream {
  * TODO(b/33271235): Use proto types
  */
 class PersistentWriteStream extends PersistentStream {
-    constructor(queue, connection, credentials, serializer, listener) {
-        super(queue, "write_stream_connection_backoff" /* WriteStreamConnectionBackoff */, "write_stream_idle" /* WriteStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, credentials, listener);
+    constructor(queue, connection, authCredentials, appCheckCredentials, serializer, listener) {
+        super(queue, "write_stream_connection_backoff" /* WriteStreamConnectionBackoff */, "write_stream_idle" /* WriteStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, authCredentials, appCheckCredentials, listener);
         this.serializer = serializer;
         this.handshakeComplete_ = false;
     }
@@ -15076,8 +15148,8 @@ class PersistentWriteStream extends PersistentStream {
             this.writeMutations([]);
         }
     }
-    startRpc(token) {
-        return this.connection.openStream('Write', token);
+    startRpc(authToken, appCheckToken) {
+        return this.connection.openStream('Write', authToken, appCheckToken);
     }
     onMessage(responseProto) {
         // Always capture the last stream token.
@@ -15149,9 +15221,10 @@ class Datastore {
  * consumption.
  */
 class DatastoreImpl extends Datastore {
-    constructor(credentials, connection, serializer) {
+    constructor(authCredentials, appCheckCredentials, connection, serializer) {
         super();
-        this.credentials = credentials;
+        this.authCredentials = authCredentials;
+        this.appCheckCredentials = appCheckCredentials;
         this.connection = connection;
         this.serializer = serializer;
         this.terminated = false;
@@ -15161,18 +15234,21 @@ class DatastoreImpl extends Datastore {
             throw new FirestoreError(Code.FAILED_PRECONDITION, 'The client has already been terminated.');
         }
     }
-    /** Gets an auth token and invokes the provided RPC. */
+    /** Invokes the provided RPC with auth and AppCheck tokens. */
     invokeRPC(rpcName, path, request) {
         this.verifyInitialized();
-        return this.credentials
-            .getToken()
-            .then(token => {
-            return this.connection.invokeRPC(rpcName, path, request, token);
+        return Promise.all([
+            this.authCredentials.getToken(),
+            this.appCheckCredentials.getToken()
+        ])
+            .then(([authToken, appCheckToken]) => {
+            return this.connection.invokeRPC(rpcName, path, request, authToken, appCheckToken);
         })
             .catch((error) => {
             if (error.name === 'FirebaseError') {
                 if (error.code === Code.UNAUTHENTICATED) {
-                    this.credentials.invalidateToken();
+                    this.authCredentials.invalidateToken();
+                    this.appCheckCredentials.invalidateToken();
                 }
                 throw error;
             }
@@ -15181,18 +15257,21 @@ class DatastoreImpl extends Datastore {
             }
         });
     }
-    /** Gets an auth token and invokes the provided RPC with streamed results. */
+    /** Invokes the provided RPC with streamed results with auth and AppCheck tokens. */
     invokeStreamingRPC(rpcName, path, request) {
         this.verifyInitialized();
-        return this.credentials
-            .getToken()
-            .then(token => {
-            return this.connection.invokeStreamingRPC(rpcName, path, request, token);
+        return Promise.all([
+            this.authCredentials.getToken(),
+            this.appCheckCredentials.getToken()
+        ])
+            .then(([authToken, appCheckToken]) => {
+            return this.connection.invokeStreamingRPC(rpcName, path, request, authToken, appCheckToken);
         })
             .catch((error) => {
             if (error.name === 'FirebaseError') {
                 if (error.code === Code.UNAUTHENTICATED) {
-                    this.credentials.invalidateToken();
+                    this.authCredentials.invalidateToken();
+                    this.appCheckCredentials.invalidateToken();
                 }
                 throw error;
             }
@@ -15207,8 +15286,8 @@ class DatastoreImpl extends Datastore {
 }
 // TODO(firestorexp): Make sure there is only one Datastore instance per
 // firestore-exp client.
-function newDatastore(credentials, connection, serializer) {
-    return new DatastoreImpl(credentials, connection, serializer);
+function newDatastore(authCredentials, appCheckCredentials, connection, serializer) {
+    return new DatastoreImpl(authCredentials, appCheckCredentials, connection, serializer);
 }
 async function invokeCommitRpc(datastore, mutations) {
     const datastoreImpl = debugCast(datastore);
@@ -15241,12 +15320,12 @@ async function invokeBatchGetDocumentsRpc(datastore, keys) {
 function newPersistentWriteStream(datastore, queue, listener) {
     const datastoreImpl = debugCast(datastore);
     datastoreImpl.verifyInitialized();
-    return new PersistentWriteStream(queue, datastoreImpl.connection, datastoreImpl.credentials, datastoreImpl.serializer, listener);
+    return new PersistentWriteStream(queue, datastoreImpl.connection, datastoreImpl.authCredentials, datastoreImpl.appCheckCredentials, datastoreImpl.serializer, listener);
 }
 function newPersistentWatchStream(datastore, queue, listener) {
     const datastoreImpl = debugCast(datastore);
     datastoreImpl.verifyInitialized();
-    return new PersistentListenStream(queue, datastoreImpl.connection, datastoreImpl.credentials, datastoreImpl.serializer, listener);
+    return new PersistentListenStream(queue, datastoreImpl.connection, datastoreImpl.authCredentials, datastoreImpl.appCheckCredentials, datastoreImpl.serializer, listener);
 }
 
 /**
@@ -18359,7 +18438,7 @@ class OnlineComponentProvider {
     createDatastore(cfg) {
         const serializer = newSerializer(cfg.databaseInfo.databaseId);
         const connection = newConnection(cfg.databaseInfo);
-        return newDatastore(cfg.credentials, connection, serializer);
+        return newDatastore(cfg.authCredentials, cfg.appCheckCredentials, connection, serializer);
     }
     createRemoteStore(cfg) {
         return newRemoteStore(this.localStore, this.datastore, cfg.asyncQueue, onlineState => syncEngineApplyOnlineStateChange(this.syncEngine, onlineState, 0 /* RemoteStore */), newConnectivityMonitor());
@@ -19117,7 +19196,7 @@ const MAX_CONCURRENT_LIMBO_RESOLUTIONS = 100;
  * async queue that is shared by all of the other components in the system.
  */
 class FirestoreClient {
-    constructor(credentials, 
+    constructor(authCredentials, appCheckCredentials, 
     /**
      * Asynchronous queue responsible for all of our internal processing. When
      * we get incoming work from the user (via public API) or the network
@@ -19127,30 +19206,34 @@ class FirestoreClient {
      * an async I/O to complete).
      */
     asyncQueue, databaseInfo) {
-        this.credentials = credentials;
+        this.authCredentials = authCredentials;
+        this.appCheckCredentials = appCheckCredentials;
         this.asyncQueue = asyncQueue;
         this.databaseInfo = databaseInfo;
         this.user = User.UNAUTHENTICATED;
         this.clientId = AutoId.newId();
-        this.credentialListener = () => Promise.resolve();
-        this.credentials.start(asyncQueue, async (user) => {
+        this.authCredentialListener = () => Promise.resolve();
+        this.authCredentials.start(asyncQueue, async (user) => {
             logDebug(LOG_TAG$2, 'Received user=', user.uid);
-            await this.credentialListener(user);
+            await this.authCredentialListener(user);
             this.user = user;
         });
+        // Register an empty credentials change listener to activate token refresh.
+        this.appCheckCredentials.start(asyncQueue, () => Promise.resolve());
     }
     async getConfiguration() {
         return {
             asyncQueue: this.asyncQueue,
             databaseInfo: this.databaseInfo,
             clientId: this.clientId,
-            credentials: this.credentials,
+            authCredentials: this.authCredentials,
+            appCheckCredentials: this.appCheckCredentials,
             initialUser: this.user,
             maxConcurrentLimboResolutions: MAX_CONCURRENT_LIMBO_RESOLUTIONS
         };
     }
     setCredentialChangeListener(listener) {
-        this.credentialListener = listener;
+        this.authCredentialListener = listener;
     }
     /**
      * Checks that the client has not been terminated. Ensures that other methods on
@@ -19175,7 +19258,8 @@ class FirestoreClient {
                 // The credentials provider must be terminated after shutting down the
                 // RemoteStore as it will prevent the RemoteStore from retrieving auth
                 // tokens.
-                this.credentials.shutdown();
+                this.authCredentials.shutdown();
+                this.appCheckCredentials.shutdown();
                 deferred.resolve();
             }
             catch (e) {
@@ -19698,8 +19782,9 @@ class FirestoreSettingsImpl {
  */
 class Firestore$1 {
     /** @hideconstructor */
-    constructor(databaseIdOrApp, _credentials) {
-        this._credentials = _credentials;
+    constructor(databaseIdOrApp, _authCredentials, _appCheckCredentials) {
+        this._authCredentials = _authCredentials;
+        this._appCheckCredentials = _appCheckCredentials;
         /**
          * Whether it's a Firestore or Firestore Lite instance.
          */
@@ -19740,7 +19825,7 @@ class Firestore$1 {
         }
         this._settings = new FirestoreSettingsImpl(settings);
         if (settings.credentials !== undefined) {
-            this._credentials = makeCredentialsProvider(settings.credentials);
+            this._authCredentials = makeAuthCredentialsProvider(settings.credentials);
         }
     }
     _getSettings() {
@@ -19821,7 +19906,7 @@ function connectFirestoreEmulator(firestore, host, port, options = {}) {
             }
             user = new User(uid);
         }
-        firestore._credentials = new EmulatorCredentialsProvider(new OAuthToken(token, user));
+        firestore._authCredentials = new EmulatorAuthCredentialsProvider(new OAuthToken(token, user));
     }
 }
 
@@ -20450,8 +20535,8 @@ const CACHE_SIZE_UNLIMITED = LRU_COLLECTION_DISABLED;
  */
 class Firestore extends Firestore$1 {
     /** @hideconstructor */
-    constructor(databaseIdOrApp, credentialsProvider) {
-        super(databaseIdOrApp, credentialsProvider);
+    constructor(databaseIdOrApp, authCredentialsProvider, appCheckCredentialsProvider) {
+        super(databaseIdOrApp, authCredentialsProvider, appCheckCredentialsProvider);
         /**
          * Whether it's a {@link Firestore} or Firestore Lite instance.
          */
@@ -20528,7 +20613,7 @@ function configureFirestore(firestore) {
     var _a;
     const settings = firestore._freezeSettings();
     const databaseInfo = makeDatabaseInfo(firestore._databaseId, ((_a = firestore._app) === null || _a === void 0 ? void 0 : _a.options.appId) || '', firestore._persistenceKey, settings);
-    firestore._firestoreClient = new FirestoreClient(firestore._credentials, firestore._queue, databaseInfo);
+    firestore._firestoreClient = new FirestoreClient(firestore._authCredentials, firestore._appCheckCredentials, firestore._queue, databaseInfo);
 }
 /**
  * Attempts to enable persistent storage, if possible.
@@ -20823,11 +20908,11 @@ function registerFirestore(variant, useFetchStreams = true) {
     setSDKVersion(app.SDK_VERSION);
     app._registerComponent(new component.Component('firestore', (container, { options: settings }) => {
         const app = container.getProvider('app').getImmediate();
-        const firestoreInstance = new Firestore(app, new FirebaseCredentialsProvider(container.getProvider('auth-internal')));
+        const firestoreInstance = new Firestore(app, new FirebaseAuthCredentialsProvider(container.getProvider('auth-internal')), new FirebaseAppCheckTokenProvider(container.getProvider('app-check-internal')));
         settings = Object.assign({ useFetchStreams }, settings);
         firestoreInstance._setSettings(settings);
         return firestoreInstance;
-    }, "PUBLIC" /* PUBLIC */));
+    }, 'PUBLIC'));
     app.registerVersion(name, version$1, variant);
     // BUILD_TARGET will be replaced by values like esm5, esm2017, cjs5, etc during the compilation
     app.registerVersion(name, version$1, 'cjs2017');
@@ -23514,7 +23599,8 @@ exports.Transaction = Transaction;
 exports.WriteBatch = WriteBatch;
 exports._DatabaseId = DatabaseId;
 exports._DocumentKey = DocumentKey;
-exports._EmptyCredentialsProvider = EmptyCredentialsProvider;
+exports._EmptyAppCheckTokenProvider = EmptyAppCheckTokenProvider;
+exports._EmptyAuthCredentialsProvider = EmptyAuthCredentialsProvider;
 exports._FieldPath = FieldPath$1;
 exports._cast = cast;
 exports._debugAssert = debugAssert;