@firebase/firestore 3.3.1 → 3.4.0-canary.774b2fc19

package/dist/index.node.mjs

@@ -4,14 +4,13 @@ import { Logger, LogLevel } from '@firebase/logger';
 import { inspect, TextEncoder, TextDecoder } from 'util';
 import { createMockUserToken, getModularInstance, deepEqual, getUA, isIndexedDBAvailable, isSafari } from '@firebase/util';
 import { randomBytes as randomBytes$1 } from 'crypto';
-import module from 'module';
 import { credentials, loadPackageDefinition, Metadata } from '@grpc/grpc-js';
 import { dirname, resolve, join } from 'path';
 import { fileURLToPath } from 'url';
 import { loadSync } from '@grpc/proto-loader';
 
 const name = "@firebase/firestore";
-const version$1 = "3.3.1";
+const version$1 = "3.4.0-canary.774b2fc19";
 
 /**
  * @license
@@ -64,7 +63,7 @@ User.GOOGLE_CREDENTIALS = new User('google-credentials-uid');
 User.FIRST_PARTY = new User('first-party-uid');
 User.MOCK_USER = new User('mock-user');
 
-const version = "9.5.0";
+const version = "9.6.0-canary.774b2fc19";
 
 /**
  * @license
@@ -452,16 +451,15 @@ class OAuthToken {
     constructor(value, user) {
         this.user = user;
         this.type = 'OAuth';
-        this.authHeaders = {};
-        // Set the headers using Object Literal notation to avoid minification
-        this.authHeaders['Authorization'] = `Bearer ${value}`;
+        this.headers = new Map();
+        this.headers.set('Authorization', `Bearer ${value}`);
     }
 }
 /**
  * A CredentialsProvider that always yields an empty token.
  * @internal
  */
-class EmptyCredentialsProvider {
+class EmptyAuthCredentialsProvider {
     getToken() {
         return Promise.resolve(null);
     }
@@ -476,7 +474,7 @@ class EmptyCredentialsProvider {
  * A CredentialsProvider that always returns a constant token. Used for
  * emulator token mocking.
  */
-class EmulatorCredentialsProvider {
+class EmulatorAuthCredentialsProvider {
     constructor(token) {
         this.token = token;
         /**
@@ -499,7 +497,7 @@ class EmulatorCredentialsProvider {
         this.changeListener = null;
     }
 }
-class FirebaseCredentialsProvider {
+class FirebaseAuthCredentialsProvider {
     constructor(authProvider) {
         this.authProvider = authProvider;
         /** Tracks the current User. */
@@ -542,7 +540,7 @@ class FirebaseCredentialsProvider {
             });
         };
         const registerAuth = (auth) => {
-            logDebug('FirebaseCredentialsProvider', 'Auth detected');
+            logDebug('FirebaseAuthCredentialsProvider', 'Auth detected');
             this.auth = auth;
             this.auth.addAuthTokenListener(this.tokenListener);
             awaitNextToken();
@@ -559,7 +557,7 @@ class FirebaseCredentialsProvider {
                 }
                 else {
                     // If auth is still not available, proceed with `null` user
-                    logDebug('FirebaseCredentialsProvider', 'Auth not yet detected');
+                    logDebug('FirebaseAuthCredentialsProvider', 'Auth not yet detected');
                     nextToken.resolve();
                     nextToken = new Deferred();
                 }
@@ -582,7 +580,7 @@ class FirebaseCredentialsProvider {
             // outstanding so the response is potentially for a previous user (which
             // user, we can't be sure).
             if (this.tokenCounter !== initialTokenCounter) {
-                logDebug('FirebaseCredentialsProvider', 'getToken aborted due to token change.');
+                logDebug('FirebaseAuthCredentialsProvider', 'getToken aborted due to token change.');
                 return this.getToken();
             }
             else {
@@ -623,25 +621,17 @@ class FirebaseCredentialsProvider {
  */
 class FirstPartyToken {
     constructor(gapi, sessionIndex, iamToken) {
-        this.gapi = gapi;
-        this.sessionIndex = sessionIndex;
-        this.iamToken = iamToken;
         this.type = 'FirstParty';
         this.user = User.FIRST_PARTY;
-    }
-    get authHeaders() {
-        const headers = {
-            'X-Goog-AuthUser': this.sessionIndex
-        };
-        // Use array notation to prevent minification
-        const authHeader = this.gapi['auth']['getAuthHeaderValueForFirstParty']([]);
+        this.headers = new Map();
+        this.headers.set('X-Goog-AuthUser', sessionIndex);
+        const authHeader = gapi['auth']['getAuthHeaderValueForFirstParty']([]);
         if (authHeader) {
-            headers['Authorization'] = authHeader;
+            this.headers.set('Authorization', authHeader);
         }
-        if (this.iamToken) {
-            headers['X-Goog-Iam-Authorization-Token'] = this.iamToken;
+        if (iamToken) {
+            this.headers.set('X-Goog-Iam-Authorization-Token', iamToken);
         }
-        return headers;
     }
 }
 /*
@@ -649,7 +639,7 @@ class FirstPartyToken {
  * to authenticate the user, using technique that is only available
  * to applications hosted by Google.
  */
-class FirstPartyCredentialsProvider {
+class FirstPartyAuthCredentialsProvider {
     constructor(gapi, sessionIndex, iamToken) {
         this.gapi = gapi;
         this.sessionIndex = sessionIndex;
@@ -665,13 +655,97 @@ class FirstPartyCredentialsProvider {
     shutdown() { }
     invalidateToken() { }
 }
+class AppCheckToken {
+    constructor(value) {
+        this.value = value;
+        this.type = 'AppCheck';
+        this.headers = new Map();
+        if (value && value.length > 0) {
+            this.headers.set('x-firebase-appcheck', this.value);
+        }
+    }
+}
+class FirebaseAppCheckTokenProvider {
+    constructor(appCheckProvider) {
+        this.appCheckProvider = appCheckProvider;
+        this.forceRefresh = false;
+        this.appCheck = null;
+    }
+    start(asyncQueue, changeListener) {
+        const onTokenChanged = tokenResult => {
+            if (tokenResult.error != null) {
+                logDebug('FirebaseAppCheckTokenProvider', `Error getting App Check token; using placeholder token instead. Error: ${tokenResult.error.message}`);
+            }
+            return changeListener(tokenResult.token);
+        };
+        this.tokenListener = (tokenResult) => {
+            asyncQueue.enqueueRetryable(() => onTokenChanged(tokenResult));
+        };
+        const registerAppCheck = (appCheck) => {
+            logDebug('FirebaseAppCheckTokenProvider', 'AppCheck detected');
+            this.appCheck = appCheck;
+            this.appCheck.addTokenListener(this.tokenListener);
+        };
+        this.appCheckProvider.onInit(appCheck => registerAppCheck(appCheck));
+        // Our users can initialize AppCheck after Firestore, so we give it
+        // a chance to register itself with the component framework.
+        setTimeout(() => {
+            if (!this.appCheck) {
+                const appCheck = this.appCheckProvider.getImmediate({ optional: true });
+                if (appCheck) {
+                    registerAppCheck(appCheck);
+                }
+                else {
+                    // If AppCheck is still not available, proceed without it.
+                    logDebug('FirebaseAppCheckTokenProvider', 'AppCheck not yet detected');
+                }
+            }
+        }, 0);
+    }
+    getToken() {
+        const forceRefresh = this.forceRefresh;
+        this.forceRefresh = false;
+        if (!this.appCheck) {
+            return Promise.resolve(null);
+        }
+        return this.appCheck.getToken(forceRefresh).then(tokenResult => {
+            if (tokenResult) {
+                hardAssert(typeof tokenResult.token === 'string');
+                return new AppCheckToken(tokenResult.token);
+            }
+            else {
+                return null;
+            }
+        });
+    }
+    invalidateToken() {
+        this.forceRefresh = true;
+    }
+    shutdown() {
+        if (this.appCheck) {
+            this.appCheck.removeTokenListener(this.tokenListener);
+        }
+    }
+}
+/**
+ * An AppCheck token provider that always yields an empty token.
+ * @internal
+ */
+class EmptyAppCheckTokenProvider {
+    getToken() {
+        return Promise.resolve(new AppCheckToken(''));
+    }
+    invalidateToken() { }
+    start(asyncQueue, changeListener) { }
+    shutdown() { }
+}
 /**
  * Builds a CredentialsProvider depending on the type of
  * the credentials passed in.
  */
-function makeCredentialsProvider(credentials) {
+function makeAuthCredentialsProvider(credentials) {
     if (!credentials) {
-        return new EmptyCredentialsProvider();
+        return new EmptyAuthCredentialsProvider();
     }
     switch (credentials['type']) {
         case 'gapi':
@@ -681,11 +755,11 @@ function makeCredentialsProvider(credentials) {
                 client !== null &&
                 client['auth'] &&
                 client['auth']['getAuthHeaderValueForFirstParty']));
-            return new FirstPartyCredentialsProvider(client, credentials['sessionIndex'] || '0', credentials['iamToken'] || null);
+            return new FirstPartyAuthCredentialsProvider(client, credentials['sessionIndex'] || '0', credentials['iamToken'] || null);
         case 'provider':
             return credentials['client'];
         default:
-            throw new FirestoreError(Code.INVALID_ARGUMENT, 'makeCredentialsProvider failed due to invalid credential type');
+            throw new FirestoreError(Code.INVALID_ARGUMENT, 'makeAuthCredentialsProvider failed due to invalid credential type');
     }
 }
 
@@ -14237,22 +14311,19 @@ function nodePromise(action) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-// This is a hack fix for Node ES modules to use `require`.
-// @ts-ignore To avoid using `--module es2020` flag.
-const require = module.createRequire(import.meta.url);
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { version: grpcVersion } = require('@grpc/grpc-js/package.json');
+// TODO: Fetch runtime version from grpc-js/package.json instead
+// when there's a cleaner way to dynamic require JSON in both Node ESM and CJS
+const grpcVersion = '1.3.7';
 const LOG_TAG$9 = 'Connection';
 const X_GOOG_API_CLIENT_VALUE = `gl-node/${process.versions.node} fire/${SDK_VERSION} grpc/${grpcVersion}`;
-function createMetadata(databasePath, token, appId) {
-    hardAssert(token === null || token.type === 'OAuth');
+function createMetadata(databasePath, authToken, appCheckToken, appId) {
+    hardAssert(authToken === null || authToken.type === 'OAuth');
     const metadata = new Metadata();
-    if (token) {
-        for (const header in token.authHeaders) {
-            if (token.authHeaders.hasOwnProperty(header)) {
-                metadata.set(header, token.authHeaders[header]);
-            }
-        }
+    if (authToken) {
+        authToken.headers.forEach((value, key) => metadata.set(key, value));
+    }
+    if (appCheckToken) {
+        appCheckToken.headers.forEach((value, key) => metadata.set(key, value));
     }
     if (appId) {
         metadata.set('X-Firebase-GMPID', appId);
@@ -14285,9 +14356,9 @@ class GrpcConnection {
         }
         return this.cachedStub;
     }
-    invokeRPC(rpcName, path, request, token) {
+    invokeRPC(rpcName, path, request, authToken, appCheckToken) {
         const stub = this.ensureActiveStub();
-        const metadata = createMetadata(this.databasePath, token, this.databaseInfo.appId);
+        const metadata = createMetadata(this.databasePath, authToken, appCheckToken, this.databaseInfo.appId);
         const jsonRequest = Object.assign({ database: this.databasePath }, request);
         return nodePromise((callback) => {
             logDebug(LOG_TAG$9, `RPC '${rpcName}' invoked with request:`, request);
@@ -14303,12 +14374,12 @@ class GrpcConnection {
             });
         });
     }
-    invokeStreamingRPC(rpcName, path, request, token) {
+    invokeStreamingRPC(rpcName, path, request, authToken, appCheckToken) {
         const results = [];
         const responseDeferred = new Deferred();
         logDebug(LOG_TAG$9, `RPC '${rpcName}' invoked (streaming) with request:`, request);
         const stub = this.ensureActiveStub();
-        const metadata = createMetadata(this.databasePath, token, this.databaseInfo.appId);
+        const metadata = createMetadata(this.databasePath, authToken, appCheckToken, this.databaseInfo.appId);
         const jsonRequest = Object.assign(Object.assign({}, request), { database: this.databasePath });
         const stream = stub[rpcName](jsonRequest, metadata);
         stream.on('data', (response) => {
@@ -14327,9 +14398,9 @@ class GrpcConnection {
         return responseDeferred.promise;
     }
     // TODO(mikelehen): This "method" is a monster. Should be refactored.
-    openStream(rpcName, token) {
+    openStream(rpcName, authToken, appCheckToken) {
         const stub = this.ensureActiveStub();
-        const metadata = createMetadata(this.databasePath, token, this.databaseInfo.appId);
+        const metadata = createMetadata(this.databasePath, authToken, appCheckToken, this.databaseInfo.appId);
         const grpcStream = stub[rpcName](metadata);
         let closed = false;
         const close = (err) => {
@@ -14409,8 +14480,8 @@ class GrpcConnection {
  */
 // __filename and __dirname globals are unavailable in ES modules
 // @ts-ignore To avoid using `--module es2020` flag.
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
+const __filenameInESM = fileURLToPath(import.meta.url);
+const __dirnameInESM = dirname(__filenameInESM);
 /** Used by tests so we can match @grpc/proto-loader behavior. */
 const protoLoaderOptions = {
     longs: String,
@@ -14424,7 +14495,7 @@ const protoLoaderOptions = {
  * @returns The GrpcObject representing our protos.
  */
 function loadProtos() {
-    const root = resolve(__dirname, "src/protos" );
+    const root = resolve(__dirnameInESM, "src/protos" );
     const firestoreProtoFile = join(root, 'google/firestore/v1/firestore.proto');
     const packageDefinition = loadSync(firestoreProtoFile, Object.assign(Object.assign({}, protoLoaderOptions), { includeDirs: [root] }));
     return loadPackageDefinition(packageDefinition);
@@ -14713,12 +14784,13 @@ const HEALTHY_TIMEOUT_MS = 10 * 1000;
  *  ListenerType: The type of the listener that will be used for callbacks
  */
 class PersistentStream {
-    constructor(queue, connectionTimerId, idleTimerId, healthTimerId, connection, credentialsProvider, listener) {
+    constructor(queue, connectionTimerId, idleTimerId, healthTimerId, connection, authCredentialsProvider, appCheckCredentialsProvider, listener) {
         this.queue = queue;
         this.idleTimerId = idleTimerId;
         this.healthTimerId = healthTimerId;
         this.connection = connection;
-        this.credentialsProvider = credentialsProvider;
+        this.authCredentialsProvider = authCredentialsProvider;
+        this.appCheckCredentialsProvider = appCheckCredentialsProvider;
         this.listener = listener;
         this.state = 0 /* Initial */;
         /**
@@ -14873,7 +14945,8 @@ class PersistentStream {
             // fail, however. In this case, we should get a Code.UNAUTHENTICATED error
             // before we received the first message and we need to invalidate the token
             // to ensure that we fetch a new token.
-            this.credentialsProvider.invalidateToken();
+            this.authCredentialsProvider.invalidateToken();
+            this.appCheckCredentialsProvider.invalidateToken();
         }
         // Clean up the underlying stream because we are no longer interested in events.
         if (this.stream !== null) {
@@ -14897,7 +14970,10 @@ class PersistentStream {
         const dispatchIfNotClosed = this.getCloseGuardedDispatcher(this.closeCount);
         // TODO(mikelehen): Just use dispatchIfNotClosed, but see TODO below.
         const closeCount = this.closeCount;
-        this.credentialsProvider.getToken().then(token => {
+        Promise.all([
+            this.authCredentialsProvider.getToken(),
+            this.appCheckCredentialsProvider.getToken()
+        ]).then(([authToken, appCheckToken]) => {
             // Stream can be stopped while waiting for authentication.
             // TODO(mikelehen): We really should just use dispatchIfNotClosed
             // and let this dispatch onto the queue, but that opened a spec test can
@@ -14906,7 +14982,7 @@ class PersistentStream {
                 // Normally we'd have to schedule the callback on the AsyncQueue.
                 // However, the following calls are safe to be called outside the
                 // AsyncQueue since they don't chain asynchronous calls
-                this.startStream(token);
+                this.startStream(authToken, appCheckToken);
             }
         }, (error) => {
             dispatchIfNotClosed(() => {
@@ -14915,9 +14991,9 @@ class PersistentStream {
             });
         });
     }
-    startStream(token) {
+    startStream(authToken, appCheckToken) {
         const dispatchIfNotClosed = this.getCloseGuardedDispatcher(this.closeCount);
-        this.stream = this.startRpc(token);
+        this.stream = this.startRpc(authToken, appCheckToken);
         this.stream.onOpen(() => {
             dispatchIfNotClosed(() => {
                 this.state = 2 /* Open */;
@@ -14986,12 +15062,12 @@ class PersistentStream {
  * sent from the server for ListenResponses.
  */
 class PersistentListenStream extends PersistentStream {
-    constructor(queue, connection, credentials, serializer, listener) {
-        super(queue, "listen_stream_connection_backoff" /* ListenStreamConnectionBackoff */, "listen_stream_idle" /* ListenStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, credentials, listener);
+    constructor(queue, connection, authCredentials, appCheckCredentials, serializer, listener) {
+        super(queue, "listen_stream_connection_backoff" /* ListenStreamConnectionBackoff */, "listen_stream_idle" /* ListenStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, authCredentials, appCheckCredentials, listener);
         this.serializer = serializer;
     }
-    startRpc(token) {
-        return this.connection.openStream('Listen', token);
+    startRpc(authToken, appCheckToken) {
+        return this.connection.openStream('Listen', authToken, appCheckToken);
     }
     onMessage(watchChangeProto) {
         // A successful response means the stream is healthy
@@ -15045,8 +15121,8 @@ class PersistentListenStream extends PersistentStream {
  * TODO(b/33271235): Use proto types
  */
 class PersistentWriteStream extends PersistentStream {
-    constructor(queue, connection, credentials, serializer, listener) {
-        super(queue, "write_stream_connection_backoff" /* WriteStreamConnectionBackoff */, "write_stream_idle" /* WriteStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, credentials, listener);
+    constructor(queue, connection, authCredentials, appCheckCredentials, serializer, listener) {
+        super(queue, "write_stream_connection_backoff" /* WriteStreamConnectionBackoff */, "write_stream_idle" /* WriteStreamIdle */, "health_check_timeout" /* HealthCheckTimeout */, connection, authCredentials, appCheckCredentials, listener);
         this.serializer = serializer;
         this.handshakeComplete_ = false;
     }
@@ -15068,8 +15144,8 @@ class PersistentWriteStream extends PersistentStream {
             this.writeMutations([]);
         }
     }
-    startRpc(token) {
-        return this.connection.openStream('Write', token);
+    startRpc(authToken, appCheckToken) {
+        return this.connection.openStream('Write', authToken, appCheckToken);
     }
     onMessage(responseProto) {
         // Always capture the last stream token.
@@ -15141,9 +15217,10 @@ class Datastore {
  * consumption.
  */
 class DatastoreImpl extends Datastore {
-    constructor(credentials, connection, serializer) {
+    constructor(authCredentials, appCheckCredentials, connection, serializer) {
         super();
-        this.credentials = credentials;
+        this.authCredentials = authCredentials;
+        this.appCheckCredentials = appCheckCredentials;
         this.connection = connection;
         this.serializer = serializer;
         this.terminated = false;
@@ -15153,18 +15230,21 @@ class DatastoreImpl extends Datastore {
             throw new FirestoreError(Code.FAILED_PRECONDITION, 'The client has already been terminated.');
         }
     }
-    /** Gets an auth token and invokes the provided RPC. */
+    /** Invokes the provided RPC with auth and AppCheck tokens. */
     invokeRPC(rpcName, path, request) {
         this.verifyInitialized();
-        return this.credentials
-            .getToken()
-            .then(token => {
-            return this.connection.invokeRPC(rpcName, path, request, token);
+        return Promise.all([
+            this.authCredentials.getToken(),
+            this.appCheckCredentials.getToken()
+        ])
+            .then(([authToken, appCheckToken]) => {
+            return this.connection.invokeRPC(rpcName, path, request, authToken, appCheckToken);
         })
             .catch((error) => {
             if (error.name === 'FirebaseError') {
                 if (error.code === Code.UNAUTHENTICATED) {
-                    this.credentials.invalidateToken();
+                    this.authCredentials.invalidateToken();
+                    this.appCheckCredentials.invalidateToken();
                 }
                 throw error;
             }
@@ -15173,18 +15253,21 @@ class DatastoreImpl extends Datastore {
             }
         });
     }
-    /** Gets an auth token and invokes the provided RPC with streamed results. */
+    /** Invokes the provided RPC with streamed results with auth and AppCheck tokens. */
     invokeStreamingRPC(rpcName, path, request) {
         this.verifyInitialized();
-        return this.credentials
-            .getToken()
-            .then(token => {
-            return this.connection.invokeStreamingRPC(rpcName, path, request, token);
+        return Promise.all([
+            this.authCredentials.getToken(),
+            this.appCheckCredentials.getToken()
+        ])
+            .then(([authToken, appCheckToken]) => {
+            return this.connection.invokeStreamingRPC(rpcName, path, request, authToken, appCheckToken);
         })
             .catch((error) => {
             if (error.name === 'FirebaseError') {
                 if (error.code === Code.UNAUTHENTICATED) {
-                    this.credentials.invalidateToken();
+                    this.authCredentials.invalidateToken();
+                    this.appCheckCredentials.invalidateToken();
                 }
                 throw error;
             }
@@ -15199,8 +15282,8 @@ class DatastoreImpl extends Datastore {
 }
 // TODO(firestorexp): Make sure there is only one Datastore instance per
 // firestore-exp client.
-function newDatastore(credentials, connection, serializer) {
-    return new DatastoreImpl(credentials, connection, serializer);
+function newDatastore(authCredentials, appCheckCredentials, connection, serializer) {
+    return new DatastoreImpl(authCredentials, appCheckCredentials, connection, serializer);
 }
 async function invokeCommitRpc(datastore, mutations) {
     const datastoreImpl = debugCast(datastore);
@@ -15233,12 +15316,12 @@ async function invokeBatchGetDocumentsRpc(datastore, keys) {
 function newPersistentWriteStream(datastore, queue, listener) {
     const datastoreImpl = debugCast(datastore);
     datastoreImpl.verifyInitialized();
-    return new PersistentWriteStream(queue, datastoreImpl.connection, datastoreImpl.credentials, datastoreImpl.serializer, listener);
+    return new PersistentWriteStream(queue, datastoreImpl.connection, datastoreImpl.authCredentials, datastoreImpl.appCheckCredentials, datastoreImpl.serializer, listener);
 }
 function newPersistentWatchStream(datastore, queue, listener) {
     const datastoreImpl = debugCast(datastore);
     datastoreImpl.verifyInitialized();
-    return new PersistentListenStream(queue, datastoreImpl.connection, datastoreImpl.credentials, datastoreImpl.serializer, listener);
+    return new PersistentListenStream(queue, datastoreImpl.connection, datastoreImpl.authCredentials, datastoreImpl.appCheckCredentials, datastoreImpl.serializer, listener);
 }
 
 /**
@@ -18351,7 +18434,7 @@ class OnlineComponentProvider {
     createDatastore(cfg) {
         const serializer = newSerializer(cfg.databaseInfo.databaseId);
         const connection = newConnection(cfg.databaseInfo);
-        return newDatastore(cfg.credentials, connection, serializer);
+        return newDatastore(cfg.authCredentials, cfg.appCheckCredentials, connection, serializer);
     }
     createRemoteStore(cfg) {
         return newRemoteStore(this.localStore, this.datastore, cfg.asyncQueue, onlineState => syncEngineApplyOnlineStateChange(this.syncEngine, onlineState, 0 /* RemoteStore */), newConnectivityMonitor());
@@ -19109,7 +19192,7 @@ const MAX_CONCURRENT_LIMBO_RESOLUTIONS = 100;
  * async queue that is shared by all of the other components in the system.
  */
 class FirestoreClient {
-    constructor(credentials, 
+    constructor(authCredentials, appCheckCredentials, 
     /**
      * Asynchronous queue responsible for all of our internal processing. When
      * we get incoming work from the user (via public API) or the network
@@ -19119,30 +19202,34 @@ class FirestoreClient {
      * an async I/O to complete).
      */
     asyncQueue, databaseInfo) {
-        this.credentials = credentials;
+        this.authCredentials = authCredentials;
+        this.appCheckCredentials = appCheckCredentials;
         this.asyncQueue = asyncQueue;
         this.databaseInfo = databaseInfo;
         this.user = User.UNAUTHENTICATED;
         this.clientId = AutoId.newId();
-        this.credentialListener = () => Promise.resolve();
-        this.credentials.start(asyncQueue, async (user) => {
+        this.authCredentialListener = () => Promise.resolve();
+        this.authCredentials.start(asyncQueue, async (user) => {
             logDebug(LOG_TAG$2, 'Received user=', user.uid);
-            await this.credentialListener(user);
+            await this.authCredentialListener(user);
             this.user = user;
         });
+        // Register an empty credentials change listener to activate token refresh.
+        this.appCheckCredentials.start(asyncQueue, () => Promise.resolve());
     }
     async getConfiguration() {
         return {
             asyncQueue: this.asyncQueue,
             databaseInfo: this.databaseInfo,
             clientId: this.clientId,
-            credentials: this.credentials,
+            authCredentials: this.authCredentials,
+            appCheckCredentials: this.appCheckCredentials,
             initialUser: this.user,
             maxConcurrentLimboResolutions: MAX_CONCURRENT_LIMBO_RESOLUTIONS
         };
     }
     setCredentialChangeListener(listener) {
-        this.credentialListener = listener;
+        this.authCredentialListener = listener;
     }
     /**
      * Checks that the client has not been terminated. Ensures that other methods on
@@ -19167,7 +19254,8 @@ class FirestoreClient {
                 // The credentials provider must be terminated after shutting down the
                 // RemoteStore as it will prevent the RemoteStore from retrieving auth
                 // tokens.
-                this.credentials.shutdown();
+                this.authCredentials.shutdown();
+                this.appCheckCredentials.shutdown();
                 deferred.resolve();
             }
             catch (e) {
@@ -19690,8 +19778,9 @@ class FirestoreSettingsImpl {
  */
 class Firestore$1 {
     /** @hideconstructor */
-    constructor(databaseIdOrApp, _credentials) {
-        this._credentials = _credentials;
+    constructor(databaseIdOrApp, _authCredentials, _appCheckCredentials) {
+        this._authCredentials = _authCredentials;
+        this._appCheckCredentials = _appCheckCredentials;
         /**
          * Whether it's a Firestore or Firestore Lite instance.
          */
@@ -19732,7 +19821,7 @@ class Firestore$1 {
         }
         this._settings = new FirestoreSettingsImpl(settings);
         if (settings.credentials !== undefined) {
-            this._credentials = makeCredentialsProvider(settings.credentials);
+            this._authCredentials = makeAuthCredentialsProvider(settings.credentials);
         }
     }
     _getSettings() {
@@ -19813,7 +19902,7 @@ function connectFirestoreEmulator(firestore, host, port, options = {}) {
             }
             user = new User(uid);
         }
-        firestore._credentials = new EmulatorCredentialsProvider(new OAuthToken(token, user));
+        firestore._authCredentials = new EmulatorAuthCredentialsProvider(new OAuthToken(token, user));
     }
 }
 
@@ -20442,8 +20531,8 @@ const CACHE_SIZE_UNLIMITED = LRU_COLLECTION_DISABLED;
  */
 class Firestore extends Firestore$1 {
     /** @hideconstructor */
-    constructor(databaseIdOrApp, credentialsProvider) {
-        super(databaseIdOrApp, credentialsProvider);
+    constructor(databaseIdOrApp, authCredentialsProvider, appCheckCredentialsProvider) {
+        super(databaseIdOrApp, authCredentialsProvider, appCheckCredentialsProvider);
         /**
          * Whether it's a {@link Firestore} or Firestore Lite instance.
          */
@@ -20520,7 +20609,7 @@ function configureFirestore(firestore) {
     var _a;
     const settings = firestore._freezeSettings();
     const databaseInfo = makeDatabaseInfo(firestore._databaseId, ((_a = firestore._app) === null || _a === void 0 ? void 0 : _a.options.appId) || '', firestore._persistenceKey, settings);
-    firestore._firestoreClient = new FirestoreClient(firestore._credentials, firestore._queue, databaseInfo);
+    firestore._firestoreClient = new FirestoreClient(firestore._authCredentials, firestore._appCheckCredentials, firestore._queue, databaseInfo);
 }
 /**
  * Attempts to enable persistent storage, if possible.
@@ -20815,11 +20904,11 @@ function registerFirestore(variant, useFetchStreams = true) {
     setSDKVersion(SDK_VERSION$1);
     _registerComponent(new Component('firestore', (container, { options: settings }) => {
         const app = container.getProvider('app').getImmediate();
-        const firestoreInstance = new Firestore(app, new FirebaseCredentialsProvider(container.getProvider('auth-internal')));
+        const firestoreInstance = new Firestore(app, new FirebaseAuthCredentialsProvider(container.getProvider('auth-internal')), new FirebaseAppCheckTokenProvider(container.getProvider('app-check-internal')));
         settings = Object.assign({ useFetchStreams }, settings);
         firestoreInstance._setSettings(settings);
         return firestoreInstance;
-    }, "PUBLIC" /* PUBLIC */));
+    }, 'PUBLIC'));
     registerVersion(name, version$1, variant);
     // BUILD_TARGET will be replaced by values like esm5, esm2017, cjs5, etc during the compilation
     registerVersion(name, version$1, 'esm2017');
@@ -23484,5 +23573,5 @@ function writeBatch(firestore) {
  */
 registerFirestore('node');
 
-export { AbstractUserDataWriter, Bytes, CACHE_SIZE_UNLIMITED, CollectionReference, DocumentReference, DocumentSnapshot, FieldPath, FieldValue, Firestore, FirestoreError, GeoPoint, LoadBundleTask, Query, QueryConstraint, QueryDocumentSnapshot, QuerySnapshot, SnapshotMetadata, Timestamp, Transaction, WriteBatch, DatabaseId as _DatabaseId, DocumentKey as _DocumentKey, EmptyCredentialsProvider as _EmptyCredentialsProvider, FieldPath$1 as _FieldPath, cast as _cast, debugAssert as _debugAssert, isBase64Available as _isBase64Available, logWarn as _logWarn, validateIsNotUsedTogether as _validateIsNotUsedTogether, addDoc, arrayRemove, arrayUnion, clearIndexedDbPersistence, collection, collectionGroup, connectFirestoreEmulator, deleteDoc, deleteField, disableNetwork, doc, documentId, enableIndexedDbPersistence, enableMultiTabIndexedDbPersistence, enableNetwork, endAt, endBefore, ensureFirestoreConfigured, executeWrite, getDoc, getDocFromCache, getDocFromServer, getDocs, getDocsFromCache, getDocsFromServer, getFirestore, increment, initializeFirestore, limit, limitToLast, loadBundle, namedQuery, onSnapshot, onSnapshotsInSync, orderBy, query, queryEqual, refEqual, runTransaction, serverTimestamp, setDoc, setLogLevel, snapshotEqual, startAfter, startAt, terminate, updateDoc, waitForPendingWrites, where, writeBatch };
+export { AbstractUserDataWriter, Bytes, CACHE_SIZE_UNLIMITED, CollectionReference, DocumentReference, DocumentSnapshot, FieldPath, FieldValue, Firestore, FirestoreError, GeoPoint, LoadBundleTask, Query, QueryConstraint, QueryDocumentSnapshot, QuerySnapshot, SnapshotMetadata, Timestamp, Transaction, WriteBatch, DatabaseId as _DatabaseId, DocumentKey as _DocumentKey, EmptyAppCheckTokenProvider as _EmptyAppCheckTokenProvider, EmptyAuthCredentialsProvider as _EmptyAuthCredentialsProvider, FieldPath$1 as _FieldPath, cast as _cast, debugAssert as _debugAssert, isBase64Available as _isBase64Available, logWarn as _logWarn, validateIsNotUsedTogether as _validateIsNotUsedTogether, addDoc, arrayRemove, arrayUnion, clearIndexedDbPersistence, collection, collectionGroup, connectFirestoreEmulator, deleteDoc, deleteField, disableNetwork, doc, documentId, enableIndexedDbPersistence, enableMultiTabIndexedDbPersistence, enableNetwork, endAt, endBefore, ensureFirestoreConfigured, executeWrite, getDoc, getDocFromCache, getDocFromServer, getDocs, getDocsFromCache, getDocsFromServer, getFirestore, increment, initializeFirestore, limit, limitToLast, loadBundle, namedQuery, onSnapshot, onSnapshotsInSync, orderBy, query, queryEqual, refEqual, runTransaction, serverTimestamp, setDoc, setLogLevel, snapshotEqual, startAfter, startAt, terminate, updateDoc, waitForPendingWrites, where, writeBatch };
 //# sourceMappingURL=index.node.mjs.map