@ttt-productions/auth-core 1.6.15 → 1.6.16

package/dist/acceptance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acceptance.d.ts","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAUA,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,EAAG,qBAA8B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,CAAC;IACnD,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,yBAAyB,CAQlG;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/D"}
+{"version":3,"file":"acceptance.d.ts","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAUA,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,EAAG,qBAA8B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,CAAC;IACnD,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,yBAAyB,CAQtC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/D"}

package/dist/acceptance.js

@@ -5,9 +5,9 @@
 // monotonically increasing whole-number LEVEL: the app decides what raises the required level
 // and where the caller's accepted level is stored (a custom claim named by the app). The package
 // only compares the two numbers and reports a refusal in one recognisable shape.
-import { failedPreconditionDetails } from "./refusal.js";
+import { failedPreconditionDetails } from './refusal.js';
 /** The `details.reason` of the refusal a caller below the required level receives. */
-export const ACCEPTANCE_REQUIRED_REASON = "acceptance-required";
+export const ACCEPTANCE_REQUIRED_REASON = 'acceptance-required';
 /**
  * Normalize an acceptance level: a finite number ≥ 0, floored to a whole number. Anything
  * else — absent, a string, NaN, a negative — is 0. Applied to BOTH sides of the comparison:
@@ -15,18 +15,18 @@ export const ACCEPTANCE_REQUIRED_REASON = "acceptance-required";
  * required level requires nothing.
  */
 export function normalizeAcceptanceLevel(value) {
-    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0)
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)
         return 0;
     return Math.floor(value);
 }
 /** True when `details` is the acceptance refusal's structured details. */
 export function isAcceptanceRequiredDetails(details) {
-    if (!details || typeof details !== "object")
+    if (!details || typeof details !== 'object')
         return false;
     const d = details;
     return (d.reason === ACCEPTANCE_REQUIRED_REASON &&
-        typeof d.requiredLevel === "number" &&
-        typeof d.acceptedLevel === "number");
+        typeof d.requiredLevel === 'number' &&
+        typeof d.acceptedLevel === 'number');
 }
 /**
  * True when `err` is the acceptance refusal — a `failed-precondition` whose details carry

package/dist/acceptance.js.map

@@ -1 +1 @@
-{"version":3,"file":"acceptance.js","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,8FAA8F;AAC9F,EAAE;AACF,wFAAwF;AACxF,8FAA8F;AAC9F,iGAAiG;AACjG,iFAAiF;AAEjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAA8B,CAAC;AAezE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,0BAA0B;QACvC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC","sourcesContent":["// The acceptance-level contract shared by the server gate (`createAssertAuth`'s optional\n// `acceptance` config on ./server) and the client that answers it. Pure: no Firebase runtime.\n//\n// A consuming app publishes documents its users must accept, and tracks acceptance as a\n// monotonically increasing whole-number LEVEL: the app decides what raises the required level\n// and where the caller's accepted level is stored (a custom claim named by the app). The package\n// only compares the two numbers and reports a refusal in one recognisable shape.\n\nimport { failedPreconditionDetails } from \"./refusal.js\";\n\n/** The `details.reason` of the refusal a caller below the required level receives. */\nexport const ACCEPTANCE_REQUIRED_REASON = \"acceptance-required\" as const;\n\n/**\n * Structured details carried by the acceptance refusal. Server side it rides\n * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so\n * the client receives it on the callable error's `details`.\n */\nexport interface AcceptanceRequiredDetails {\n  readonly reason: typeof ACCEPTANCE_REQUIRED_REASON;\n  /** The level the backend currently requires. */\n  readonly requiredLevel: number;\n  /** The level read from the caller's token (0 when absent or unreadable). */\n  readonly acceptedLevel: number;\n}\n\n/**\n * Normalize an acceptance level: a finite number ≥ 0, floored to a whole number. Anything\n * else — absent, a string, NaN, a negative — is 0. Applied to BOTH sides of the comparison:\n * an unreadable accepted level can never satisfy a positive requirement, and an unreadable\n * required level requires nothing.\n */\nexport function normalizeAcceptanceLevel(value: unknown): number {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value <= 0) return 0;\n  return Math.floor(value);\n}\n\n/** True when `details` is the acceptance refusal's structured details. */\nexport function isAcceptanceRequiredDetails(details: unknown): details is AcceptanceRequiredDetails {\n  if (!details || typeof details !== \"object\") return false;\n  const d = details as Record<string, unknown>;\n  return (\n    d.reason === ACCEPTANCE_REQUIRED_REASON &&\n    typeof d.requiredLevel === \"number\" &&\n    typeof d.acceptedLevel === \"number\"\n  );\n}\n\n/**\n * True when `err` is the acceptance refusal — a `failed-precondition` whose details carry\n * `reason: 'acceptance-required'`. Works on the server-side error and on the client-side\n * callable error alike, so the app has one recognizer for \"show the acceptance prompt\".\n */\nexport function isAcceptanceRequiredError(err: unknown): boolean {\n  return isAcceptanceRequiredDetails(failedPreconditionDetails(err));\n}\n"]}
+{"version":3,"file":"acceptance.js","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,8FAA8F;AAC9F,EAAE;AACF,wFAAwF;AACxF,8FAA8F;AAC9F,iGAAiG;AACjG,iFAAiF;AAEjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAA8B,CAAC;AAezE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CACzC,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,0BAA0B;QACvC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC","sourcesContent":["// The acceptance-level contract shared by the server gate (`createAssertAuth`'s optional\n// `acceptance` config on ./server) and the client that answers it. Pure: no Firebase runtime.\n//\n// A consuming app publishes documents its users must accept, and tracks acceptance as a\n// monotonically increasing whole-number LEVEL: the app decides what raises the required level\n// and where the caller's accepted level is stored (a custom claim named by the app). The package\n// only compares the two numbers and reports a refusal in one recognisable shape.\n\nimport { failedPreconditionDetails } from './refusal.js';\n\n/** The `details.reason` of the refusal a caller below the required level receives. */\nexport const ACCEPTANCE_REQUIRED_REASON = 'acceptance-required' as const;\n\n/**\n * Structured details carried by the acceptance refusal. Server side it rides\n * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so\n * the client receives it on the callable error's `details`.\n */\nexport interface AcceptanceRequiredDetails {\n  readonly reason: typeof ACCEPTANCE_REQUIRED_REASON;\n  /** The level the backend currently requires. */\n  readonly requiredLevel: number;\n  /** The level read from the caller's token (0 when absent or unreadable). */\n  readonly acceptedLevel: number;\n}\n\n/**\n * Normalize an acceptance level: a finite number ≥ 0, floored to a whole number. Anything\n * else — absent, a string, NaN, a negative — is 0. Applied to BOTH sides of the comparison:\n * an unreadable accepted level can never satisfy a positive requirement, and an unreadable\n * required level requires nothing.\n */\nexport function normalizeAcceptanceLevel(value: unknown): number {\n  if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) return 0;\n  return Math.floor(value);\n}\n\n/** True when `details` is the acceptance refusal's structured details. */\nexport function isAcceptanceRequiredDetails(\n  details: unknown,\n): details is AcceptanceRequiredDetails {\n  if (!details || typeof details !== 'object') return false;\n  const d = details as Record<string, unknown>;\n  return (\n    d.reason === ACCEPTANCE_REQUIRED_REASON &&\n    typeof d.requiredLevel === 'number' &&\n    typeof d.acceptedLevel === 'number'\n  );\n}\n\n/**\n * True when `err` is the acceptance refusal — a `failed-precondition` whose details carry\n * `reason: 'acceptance-required'`. Works on the server-side error and on the client-side\n * callable error alike, so the app has one recognizer for \"show the acceptance prompt\".\n */\nexport function isAcceptanceRequiredError(err: unknown): boolean {\n  return isAcceptanceRequiredDetails(failedPreconditionDetails(err));\n}\n"]}

package/dist/{auth.d.ts → client/auth.d.ts}

@@ -1,4 +1,4 @@
-import type { Auth, User } from "firebase/auth";
+import type { Auth, User } from 'firebase/auth';
 export type Unsubscribe = () => void;
 export declare function getAuthUser(auth: Auth): User | null;
 /**

package/dist/client/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAErC,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,WAAW,CAEb"}

package/dist/{auth.js → client/auth.js}

@@ -1,4 +1,4 @@
-import { onAuthStateChanged as fbOnAuthStateChanged } from "firebase/auth";
+import { onAuthStateChanged as fbOnAuthStateChanged } from 'firebase/auth';
 export function getAuthUser(auth) {
     return auth.currentUser;
 }

package/dist/client/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,IAAI,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAI3E,MAAM,UAAU,WAAW,CAAC,IAAU;IACpC,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAU,EACV,EAA+B,EAC/B,OAAkC;IAElC,OAAO,oBAAoB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { Auth, User } from 'firebase/auth';\nimport { onAuthStateChanged as fbOnAuthStateChanged } from 'firebase/auth';\n\nexport type Unsubscribe = () => void;\n\nexport function getAuthUser(auth: Auth): User | null {\n  return auth.currentUser;\n}\n\n/**\n * Thin wrapper around Firebase onAuthStateChanged.\n * - always returns the unsubscribe function\n * - preserves Firebase callback signature\n */\nexport function onAuthStateChanged(\n  auth: Auth,\n  cb: (user: User | null) => void,\n  onError?: (error: unknown) => void,\n): Unsubscribe {\n  return fbOnAuthStateChanged(auth, cb, onError);\n}\n"]}

package/dist/{claims.d.ts → client/claims.d.ts}

@@ -1,5 +1,5 @@
-import type { Auth, User, IdTokenResult } from "firebase/auth";
-export type IdTokenClaims = IdTokenResult["claims"];
+import type { Auth, User, IdTokenResult } from 'firebase/auth';
+export type IdTokenClaims = IdTokenResult['claims'];
 export type ParsedClaims = {
     roles: string[];
     raw: IdTokenClaims;

package/dist/client/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/client/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IAEzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,GAAG,EAAE,aAAa,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQvF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAIpF;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAWlF"}

package/dist/{claims.js → client/claims.js}

@@ -47,9 +47,11 @@ export async function refreshClaimsFromAuth(auth) {
 export function parseClaims(claims) {
     const raw = (claims ?? {});
     const rolesValue = raw.roles;
-    const roles = Array.isArray(rolesValue) ? rolesValue.filter((x) => typeof x === "string") :
-        typeof rolesValue === "string" ? [rolesValue] :
-            [];
+    const roles = Array.isArray(rolesValue)
+        ? rolesValue.filter((x) => typeof x === 'string')
+        : typeof rolesValue === 'string'
+            ? [rolesValue]
+            : [];
     return { roles, raw };
 }
 //# sourceMappingURL=claims.js.map

package/dist/client/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/client/claims.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAiB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAU;IACpD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwC;IAClE,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAkB,CAAC;IAE5C,MAAM,UAAU,GAAI,GAAW,CAAC,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjD,CAAC,CAAC,OAAO,UAAU,KAAK,QAAQ;YAC9B,CAAC,CAAC,CAAC,UAAU,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import type { Auth, User, IdTokenResult } from 'firebase/auth';\n\nexport type IdTokenClaims = IdTokenResult['claims'];\n\nexport type ParsedClaims = {\n  // common defaults (kept generic)\n  roles: string[];\n  // raw claims for app-level decisions\n  raw: IdTokenClaims;\n};\n\n/**\n * Get the current user's ID token claims.\n * Returns null if no current user.\n *\n * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is\n * verified but the cached token claim still says it is not, force-mint a fresh\n * token and return ITS claims. Firebase ID tokens live for up to an hour and a\n * backend-side `emailVerified` flip (verification link applied elsewhere, or an\n * Admin SDK update) never invalidates them — without this, the UI (account\n * state) believes the user is verified while every backend call (token claim)\n * rejects with \"Email must be verified\" until the token happens to rotate.\n * One forced mint converges the two (the fresh token carries\n * `email_verified: true`); the check is directional, so an already-consistent\n * user never pays a forced refresh.\n */\nexport async function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(false);\n  if (user.emailVerified === true && res.claims.email_verified !== true) {\n    const fresh = await user.getIdTokenResult(true);\n    return fresh.claims;\n  }\n  return res.claims;\n}\n\n/**\n * Forces refresh of ID token + claims.\n * Returns null if no current user.\n */\nexport async function refreshClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(true);\n  return res.claims;\n}\n\n/**\n * Convenience helper when you only have Auth.\n */\nexport async function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null> {\n  return refreshClaims(auth.currentUser);\n}\n\n/**\n * Keep parsing intentionally minimal and generic:\n * - normalize \"roles\" into string[]\n * - keep raw claims attached\n */\nexport function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims {\n  const raw = (claims ?? {}) as IdTokenClaims;\n\n  const rolesValue = (raw as any).roles;\n  const roles = Array.isArray(rolesValue)\n    ? rolesValue.filter((x) => typeof x === 'string')\n    : typeof rolesValue === 'string'\n      ? [rolesValue]\n      : [];\n\n  return { roles, raw };\n}\n"]}

package/dist/client/index.d.ts

@@ -0,0 +1,3 @@
+export * from './auth.js';
+export * from './claims.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAGA,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC"}

package/dist/{client.js → client/index.js}

@@ -1,5 +1,6 @@
 // Firebase *client* auth runtime. Importing this subpath pulls firebase/auth
 // at runtime (e.g. onAuthStateChanged), so it is intentionally kept off the
 // pure root. The pure root exposes only contracts/config/errors.
-export * from "./auth.js";
-//# sourceMappingURL=client.js.map
+export * from './auth.js';
+export * from './claims.js';
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,iEAAiE;AACjE,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC","sourcesContent":["// Firebase *client* auth runtime. Importing this subpath pulls firebase/auth\n// at runtime (e.g. onAuthStateChanged), so it is intentionally kept off the\n// pure root. The pure root exposes only contracts/config/errors.\nexport * from './auth.js';\nexport * from './claims.js';\n"]}

package/dist/email-verification.js

@@ -6,12 +6,12 @@
 // email-verified. The package owns that refusal, so it owns its one recognisable shape: a
 // `failed-precondition` whose details name the reason. The client tells it apart from every
 // other failed-precondition by that reason — never by the message text.
-import { failedPreconditionDetails } from "./refusal.js";
+import { failedPreconditionDetails } from './refusal.js';
 /** The `details.reason` of the refusal a caller without a verified email receives. */
-export const EMAIL_VERIFICATION_REQUIRED_REASON = "email-verification-required";
+export const EMAIL_VERIFICATION_REQUIRED_REASON = 'email-verification-required';
 /** True when `details` is the email-verification refusal's structured details. */
 export function isEmailVerificationRequiredDetails(details) {
-    if (!details || typeof details !== "object")
+    if (!details || typeof details !== 'object')
         return false;
     return details.reason === EMAIL_VERIFICATION_REQUIRED_REASON;
 }

package/dist/email-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.js","sourceRoot":"","sources":["../src/email-verification.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,6FAA6F;AAC7F,WAAW;AACX,EAAE;AACF,mFAAmF;AACnF,0FAA0F;AAC1F,4FAA4F;AAC5F,wEAAwE;AAExE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,sFAAsF;AACtF,MAAM,CAAC,MAAM,kCAAkC,GAAG,6BAAsC,CAAC;AAWzF,kFAAkF;AAClF,MAAM,UAAU,kCAAkC,CAChD,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAQ,OAAmC,CAAC,MAAM,KAAK,kCAAkC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,OAAO,kCAAkC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["// The email-verification refusal contract shared by the server gate (`createAssertAuth`'s\n// `emailVerified` requirement on ./server) and the client that answers it. Pure: no Firebase\n// runtime.\n//\n// A callable that requires a verified email refuses a caller whose ID token is not\n// email-verified. The package owns that refusal, so it owns its one recognisable shape: a\n// `failed-precondition` whose details name the reason. The client tells it apart from every\n// other failed-precondition by that reason — never by the message text.\n\nimport { failedPreconditionDetails } from \"./refusal.js\";\n\n/** The `details.reason` of the refusal a caller without a verified email receives. */\nexport const EMAIL_VERIFICATION_REQUIRED_REASON = \"email-verification-required\" as const;\n\n/**\n * Structured details carried by the email-verification refusal. Server side it rides\n * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so\n * the client receives it on the callable error's `details`.\n */\nexport interface EmailVerificationRequiredDetails {\n  readonly reason: typeof EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\n/** True when `details` is the email-verification refusal's structured details. */\nexport function isEmailVerificationRequiredDetails(\n  details: unknown\n): details is EmailVerificationRequiredDetails {\n  if (!details || typeof details !== \"object\") return false;\n  return (details as Record<string, unknown>).reason === EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\n/**\n * True when `err` is the email-verification refusal — a `failed-precondition` whose details\n * carry `reason: 'email-verification-required'`. Works on the server-side error and on the\n * client-side callable error alike, so the app has one recognizer for \"show the verify-email\n * surface\".\n */\nexport function isEmailVerificationRequiredError(err: unknown): boolean {\n  return isEmailVerificationRequiredDetails(failedPreconditionDetails(err));\n}\n"]}
+{"version":3,"file":"email-verification.js","sourceRoot":"","sources":["../src/email-verification.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,6FAA6F;AAC7F,WAAW;AACX,EAAE;AACF,mFAAmF;AACnF,0FAA0F;AAC1F,4FAA4F;AAC5F,wEAAwE;AAExE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,sFAAsF;AACtF,MAAM,CAAC,MAAM,kCAAkC,GAAG,6BAAsC,CAAC;AAWzF,kFAAkF;AAClF,MAAM,UAAU,kCAAkC,CAChD,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAQ,OAAmC,CAAC,MAAM,KAAK,kCAAkC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,OAAO,kCAAkC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["// The email-verification refusal contract shared by the server gate (`createAssertAuth`'s\n// `emailVerified` requirement on ./server) and the client that answers it. Pure: no Firebase\n// runtime.\n//\n// A callable that requires a verified email refuses a caller whose ID token is not\n// email-verified. The package owns that refusal, so it owns its one recognisable shape: a\n// `failed-precondition` whose details name the reason. The client tells it apart from every\n// other failed-precondition by that reason — never by the message text.\n\nimport { failedPreconditionDetails } from './refusal.js';\n\n/** The `details.reason` of the refusal a caller without a verified email receives. */\nexport const EMAIL_VERIFICATION_REQUIRED_REASON = 'email-verification-required' as const;\n\n/**\n * Structured details carried by the email-verification refusal. Server side it rides\n * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so\n * the client receives it on the callable error's `details`.\n */\nexport interface EmailVerificationRequiredDetails {\n  readonly reason: typeof EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\n/** True when `details` is the email-verification refusal's structured details. */\nexport function isEmailVerificationRequiredDetails(\n  details: unknown,\n): details is EmailVerificationRequiredDetails {\n  if (!details || typeof details !== 'object') return false;\n  return (details as Record<string, unknown>).reason === EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\n/**\n * True when `err` is the email-verification refusal — a `failed-precondition` whose details\n * carry `reason: 'email-verification-required'`. Works on the server-side error and on the\n * client-side callable error alike, so the app has one recognizer for \"show the verify-email\n * surface\".\n */\nexport function isEmailVerificationRequiredError(err: unknown): boolean {\n  return isEmailVerificationRequiredDetails(failedPreconditionDetails(err));\n}\n"]}

package/dist/env.d.ts

@@ -1,4 +1,4 @@
-export type AppEnvironment = "development" | "production";
+export type AppEnvironment = 'development' | 'production';
 export declare function getAppEnvironment(): AppEnvironment;
 export declare function isDevelopment(): boolean;
 export declare function isProduction(): boolean;

package/dist/env.js

@@ -1,13 +1,13 @@
 export function getAppEnvironment() {
-    if (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_APP_ENV === "production") {
-        return "production";
+    if (typeof process !== 'undefined' && process.env?.NEXT_PUBLIC_APP_ENV === 'production') {
+        return 'production';
     }
-    return "development";
+    return 'development';
 }
 export function isDevelopment() {
-    return getAppEnvironment() === "development";
+    return getAppEnvironment() === 'development';
 }
 export function isProduction() {
-    return getAppEnvironment() === "production";
+    return getAppEnvironment() === 'production';
 }
 //# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,iBAAiB;IAC/B,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,mBAAmB,KAAK,YAAY,EAAE,CAAC;QACxF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,KAAK,aAAa,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,iBAAiB,EAAE,KAAK,YAAY,CAAC;AAC9C,CAAC","sourcesContent":["export type AppEnvironment = \"development\" | \"production\";\n\nexport function getAppEnvironment(): AppEnvironment {\n  if (typeof process !== \"undefined\" && process.env?.NEXT_PUBLIC_APP_ENV === \"production\") {\n    return \"production\";\n  }\n  return \"development\";\n}\n\nexport function isDevelopment(): boolean {\n  return getAppEnvironment() === \"development\";\n}\n\nexport function isProduction(): boolean {\n  return getAppEnvironment() === \"production\";\n}\n"]}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,iBAAiB;IAC/B,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,mBAAmB,KAAK,YAAY,EAAE,CAAC;QACxF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,KAAK,aAAa,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,iBAAiB,EAAE,KAAK,YAAY,CAAC;AAC9C,CAAC","sourcesContent":["export type AppEnvironment = 'development' | 'production';\n\nexport function getAppEnvironment(): AppEnvironment {\n  if (typeof process !== 'undefined' && process.env?.NEXT_PUBLIC_APP_ENV === 'production') {\n    return 'production';\n  }\n  return 'development';\n}\n\nexport function isDevelopment(): boolean {\n  return getAppEnvironment() === 'development';\n}\n\nexport function isProduction(): boolean {\n  return getAppEnvironment() === 'production';\n}\n"]}

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type AuthErrorCode = "AUTH_UNKNOWN" | "AUTH_NETWORK_ERROR" | "AUTH_TOO_MANY_REQUESTS" | "AUTH_POPUP_CLOSED" | "AUTH_POPUP_BLOCKED" | "AUTH_CANCELLED" | "AUTH_USER_DISABLED" | "AUTH_USER_NOT_FOUND" | "AUTH_WRONG_PASSWORD" | "AUTH_INVALID_EMAIL" | "AUTH_EMAIL_ALREADY_IN_USE" | "AUTH_WEAK_PASSWORD" | "AUTH_REQUIRES_RECENT_LOGIN" | "AUTH_INVALID_CREDENTIAL" | "AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL" | "AUTH_PROVIDER_ALREADY_LINKED" | "AUTH_CREDENTIAL_ALREADY_IN_USE" | "AUTH_EXPIRED_ACTION_CODE" | "AUTH_INVALID_ACTION_CODE";
+export type AuthErrorCode = 'AUTH_UNKNOWN' | 'AUTH_NETWORK_ERROR' | 'AUTH_TOO_MANY_REQUESTS' | 'AUTH_POPUP_CLOSED' | 'AUTH_POPUP_BLOCKED' | 'AUTH_CANCELLED' | 'AUTH_USER_DISABLED' | 'AUTH_USER_NOT_FOUND' | 'AUTH_WRONG_PASSWORD' | 'AUTH_INVALID_EMAIL' | 'AUTH_EMAIL_ALREADY_IN_USE' | 'AUTH_WEAK_PASSWORD' | 'AUTH_REQUIRES_RECENT_LOGIN' | 'AUTH_INVALID_CREDENTIAL' | 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL' | 'AUTH_PROVIDER_ALREADY_LINKED' | 'AUTH_CREDENTIAL_ALREADY_IN_USE' | 'AUTH_EXPIRED_ACTION_CODE' | 'AUTH_INVALID_ACTION_CODE';
 export type NormalizedAuthError = {
     code: AuthErrorCode;
     message: string;

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,oBAAoB,GACpB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,+CAA+C,GAC/C,8BAA8B,GAC9B,gCAAgC,GAChC,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAwFF,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,4CAA4C,CAAC;AAEpF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB,CAsBvG;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,oBAAoB,GACpB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,+CAA+C,GAC/C,8BAA8B,GAC9B,gCAAgC,GAChC,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAwFF,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,4CAA4C,CAAC;AAEpF,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,mBAAmB,CAsBrB;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/errors.js

@@ -1,89 +1,89 @@
 function pickFirebaseCode(err) {
-    if (!err || typeof err !== "object")
+    if (!err || typeof err !== 'object')
         return undefined;
     const anyErr = err;
     const c = anyErr.code;
-    return typeof c === "string" ? c : undefined;
+    return typeof c === 'string' ? c : undefined;
 }
 const MAP = {
-    "auth/network-request-failed": {
-        code: "AUTH_NETWORK_ERROR",
-        message: "Network error. Please check your connection and try again."
+    'auth/network-request-failed': {
+        code: 'AUTH_NETWORK_ERROR',
+        message: 'Network error. Please check your connection and try again.',
     },
-    "auth/too-many-requests": {
-        code: "AUTH_TOO_MANY_REQUESTS",
-        message: "Too many attempts. Please wait a moment and try again."
+    'auth/too-many-requests': {
+        code: 'AUTH_TOO_MANY_REQUESTS',
+        message: 'Too many attempts. Please wait a moment and try again.',
     },
-    "auth/popup-closed-by-user": {
-        code: "AUTH_POPUP_CLOSED",
-        message: "Sign-in popup was closed."
+    'auth/popup-closed-by-user': {
+        code: 'AUTH_POPUP_CLOSED',
+        message: 'Sign-in popup was closed.',
     },
-    "auth/popup-blocked": {
-        code: "AUTH_POPUP_BLOCKED",
-        message: "Sign-in popup was blocked by the browser."
+    'auth/popup-blocked': {
+        code: 'AUTH_POPUP_BLOCKED',
+        message: 'Sign-in popup was blocked by the browser.',
     },
-    "auth/cancelled-popup-request": {
-        code: "AUTH_CANCELLED",
-        message: "Sign-in was cancelled."
+    'auth/cancelled-popup-request': {
+        code: 'AUTH_CANCELLED',
+        message: 'Sign-in was cancelled.',
     },
-    "auth/user-disabled": {
-        code: "AUTH_USER_DISABLED",
-        message: "This account has been disabled."
+    'auth/user-disabled': {
+        code: 'AUTH_USER_DISABLED',
+        message: 'This account has been disabled.',
     },
-    "auth/user-not-found": {
-        code: "AUTH_USER_NOT_FOUND",
-        message: "No account found with that email."
+    'auth/user-not-found': {
+        code: 'AUTH_USER_NOT_FOUND',
+        message: 'No account found with that email.',
     },
-    "auth/wrong-password": {
-        code: "AUTH_WRONG_PASSWORD",
-        message: "Incorrect password."
+    'auth/wrong-password': {
+        code: 'AUTH_WRONG_PASSWORD',
+        message: 'Incorrect password.',
     },
-    "auth/invalid-email": {
-        code: "AUTH_INVALID_EMAIL",
-        message: "Invalid email address."
+    'auth/invalid-email': {
+        code: 'AUTH_INVALID_EMAIL',
+        message: 'Invalid email address.',
     },
-    "auth/email-already-in-use": {
-        code: "AUTH_EMAIL_ALREADY_IN_USE",
-        message: "That email is already in use."
+    'auth/email-already-in-use': {
+        code: 'AUTH_EMAIL_ALREADY_IN_USE',
+        message: 'That email is already in use.',
     },
-    "auth/weak-password": {
-        code: "AUTH_WEAK_PASSWORD",
-        message: "Password is too weak."
+    'auth/weak-password': {
+        code: 'AUTH_WEAK_PASSWORD',
+        message: 'Password is too weak.',
     },
-    "auth/requires-recent-login": {
-        code: "AUTH_REQUIRES_RECENT_LOGIN",
-        message: "Please re-authenticate and try again."
+    'auth/requires-recent-login': {
+        code: 'AUTH_REQUIRES_RECENT_LOGIN',
+        message: 'Please re-authenticate and try again.',
     },
-    "auth/invalid-credential": {
-        code: "AUTH_INVALID_CREDENTIAL",
-        message: "Invalid credentials. Please try again."
+    'auth/invalid-credential': {
+        code: 'AUTH_INVALID_CREDENTIAL',
+        message: 'Invalid credentials. Please try again.',
     },
-    "auth/account-exists-with-different-credential": {
-        code: "AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL",
-        message: "An account already exists with a different sign-in method."
+    'auth/account-exists-with-different-credential': {
+        code: 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL',
+        message: 'An account already exists with a different sign-in method.',
     },
-    "auth/provider-already-linked": {
-        code: "AUTH_PROVIDER_ALREADY_LINKED",
-        message: "That provider is already linked to this account."
+    'auth/provider-already-linked': {
+        code: 'AUTH_PROVIDER_ALREADY_LINKED',
+        message: 'That provider is already linked to this account.',
     },
-    "auth/credential-already-in-use": {
-        code: "AUTH_CREDENTIAL_ALREADY_IN_USE",
-        message: "Those credentials are already associated with another account."
+    'auth/credential-already-in-use': {
+        code: 'AUTH_CREDENTIAL_ALREADY_IN_USE',
+        message: 'Those credentials are already associated with another account.',
     },
     // Email-action (oobCode) links — password reset, email verification, email recovery.
     // The copy is deliberately generic: it never reveals whether an account exists, and it
     // always points at the one recovery affordance (request a fresh link).
-    "auth/expired-action-code": {
-        code: "AUTH_EXPIRED_ACTION_CODE",
-        message: "This email action link has expired. Request a new link and try again."
+    'auth/expired-action-code': {
+        code: 'AUTH_EXPIRED_ACTION_CODE',
+        message: 'This email action link has expired. Request a new link and try again.',
+    },
+    'auth/invalid-action-code': {
+        code: 'AUTH_INVALID_ACTION_CODE',
+        message: 'This email action link is invalid or has already been used. Request a new link and try again.',
     },
-    "auth/invalid-action-code": {
-        code: "AUTH_INVALID_ACTION_CODE",
-        message: "This email action link is invalid or has already been used. Request a new link and try again."
-    }
 };
 /** The copy for every auth failure no mapped code covers. */
-export const UNKNOWN_AUTH_ERROR_MESSAGE = "Authentication error. Please try again.";
+export const UNKNOWN_AUTH_ERROR_MESSAGE = 'Authentication error. Please try again.';
 export function normalizeAuthError(err, details) {
     const firebaseCode = pickFirebaseCode(err);
     const mapped = firebaseCode ? MAP[firebaseCode] : undefined;
@@ -92,17 +92,17 @@ export function normalizeAuthError(err, details) {
             code: mapped.code,
             message: mapped.message,
             firebaseCode,
-            details
+            details,
         };
     }
     // Never the error's own message: for an unclassified failure it is the SDK's internal diagnostic
     // ("Firebase: Cloud function deadline exceeded. (auth/internal-error)."), not an answer the person
     // can act on. The consumer reports the error itself to its monitoring.
     return {
-        code: "AUTH_UNKNOWN",
+        code: 'AUTH_UNKNOWN',
         message: UNKNOWN_AUTH_ERROR_MESSAGE,
         firebaseCode,
-        details
+        details,
     };
 }
 /** Convenience: returns just the user-facing message string */

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA4BA,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,GAAU,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAA6D;IACpE,6BAA6B,EAAE;QAC7B,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,wDAAwD;KAClE;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;KACrC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2CAA2C;KACrD;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wBAAwB;KAClC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iCAAiC;KAC3C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,mCAAmC;KAC7C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,qBAAqB;KAC/B;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,wBAAwB;KAClC;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+BAA+B;KACzC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uBAAuB;KACjC;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uCAAuC;KACjD;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,wCAAwC;KAClD;IACD,+CAA+C,EAAE;QAC/C,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,4DAA4D;KACtE;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,kDAAkD;KAC5D;IACD,gCAAgC,EAAE;QAChC,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,gEAAgE;KAC1E;IACD,qFAAqF;IACrF,uFAAuF;IACvF,uEAAuE;IACvE,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uEAAuE;KACjF;IACD,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EACL,+FAA+F;KAClG;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,yCAAyC,CAAC;AAEpF,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,OAAiC;IAChF,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY;YACZ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,mGAAmG;IACnG,uEAAuE;IACvE,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,0BAA0B;QACnC,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC","sourcesContent":["export type AuthErrorCode =\n  | \"AUTH_UNKNOWN\"\n  | \"AUTH_NETWORK_ERROR\"\n  | \"AUTH_TOO_MANY_REQUESTS\"\n  | \"AUTH_POPUP_CLOSED\"\n  | \"AUTH_POPUP_BLOCKED\"\n  | \"AUTH_CANCELLED\"\n  | \"AUTH_USER_DISABLED\"\n  | \"AUTH_USER_NOT_FOUND\"\n  | \"AUTH_WRONG_PASSWORD\"\n  | \"AUTH_INVALID_EMAIL\"\n  | \"AUTH_EMAIL_ALREADY_IN_USE\"\n  | \"AUTH_WEAK_PASSWORD\"\n  | \"AUTH_REQUIRES_RECENT_LOGIN\"\n  | \"AUTH_INVALID_CREDENTIAL\"\n  | \"AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL\"\n  | \"AUTH_PROVIDER_ALREADY_LINKED\"\n  | \"AUTH_CREDENTIAL_ALREADY_IN_USE\"\n  | \"AUTH_EXPIRED_ACTION_CODE\"\n  | \"AUTH_INVALID_ACTION_CODE\";\n\nexport type NormalizedAuthError = {\n  code: AuthErrorCode;\n  message: string;\n  firebaseCode?: string;\n  details?: Record<string, unknown>;\n};\n\nfunction pickFirebaseCode(err: unknown): string | undefined {\n  if (!err || typeof err !== \"object\") return undefined;\n  const anyErr = err as any;\n  const c = anyErr.code;\n  return typeof c === \"string\" ? c : undefined;\n}\n\nconst MAP: Record<string, { code: AuthErrorCode; message: string }> = {\n  \"auth/network-request-failed\": {\n    code: \"AUTH_NETWORK_ERROR\",\n    message: \"Network error. Please check your connection and try again.\"\n  },\n  \"auth/too-many-requests\": {\n    code: \"AUTH_TOO_MANY_REQUESTS\",\n    message: \"Too many attempts. Please wait a moment and try again.\"\n  },\n  \"auth/popup-closed-by-user\": {\n    code: \"AUTH_POPUP_CLOSED\",\n    message: \"Sign-in popup was closed.\"\n  },\n  \"auth/popup-blocked\": {\n    code: \"AUTH_POPUP_BLOCKED\",\n    message: \"Sign-in popup was blocked by the browser.\"\n  },\n  \"auth/cancelled-popup-request\": {\n    code: \"AUTH_CANCELLED\",\n    message: \"Sign-in was cancelled.\"\n  },\n  \"auth/user-disabled\": {\n    code: \"AUTH_USER_DISABLED\",\n    message: \"This account has been disabled.\"\n  },\n  \"auth/user-not-found\": {\n    code: \"AUTH_USER_NOT_FOUND\",\n    message: \"No account found with that email.\"\n  },\n  \"auth/wrong-password\": {\n    code: \"AUTH_WRONG_PASSWORD\",\n    message: \"Incorrect password.\"\n  },\n  \"auth/invalid-email\": {\n    code: \"AUTH_INVALID_EMAIL\",\n    message: \"Invalid email address.\"\n  },\n  \"auth/email-already-in-use\": {\n    code: \"AUTH_EMAIL_ALREADY_IN_USE\",\n    message: \"That email is already in use.\"\n  },\n  \"auth/weak-password\": {\n    code: \"AUTH_WEAK_PASSWORD\",\n    message: \"Password is too weak.\"\n  },\n  \"auth/requires-recent-login\": {\n    code: \"AUTH_REQUIRES_RECENT_LOGIN\",\n    message: \"Please re-authenticate and try again.\"\n  },\n  \"auth/invalid-credential\": {\n    code: \"AUTH_INVALID_CREDENTIAL\",\n    message: \"Invalid credentials. Please try again.\"\n  },\n  \"auth/account-exists-with-different-credential\": {\n    code: \"AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL\",\n    message: \"An account already exists with a different sign-in method.\"\n  },\n  \"auth/provider-already-linked\": {\n    code: \"AUTH_PROVIDER_ALREADY_LINKED\",\n    message: \"That provider is already linked to this account.\"\n  },\n  \"auth/credential-already-in-use\": {\n    code: \"AUTH_CREDENTIAL_ALREADY_IN_USE\",\n    message: \"Those credentials are already associated with another account.\"\n  },\n  // Email-action (oobCode) links — password reset, email verification, email recovery.\n  // The copy is deliberately generic: it never reveals whether an account exists, and it\n  // always points at the one recovery affordance (request a fresh link).\n  \"auth/expired-action-code\": {\n    code: \"AUTH_EXPIRED_ACTION_CODE\",\n    message: \"This email action link has expired. Request a new link and try again.\"\n  },\n  \"auth/invalid-action-code\": {\n    code: \"AUTH_INVALID_ACTION_CODE\",\n    message:\n      \"This email action link is invalid or has already been used. Request a new link and try again.\"\n  }\n};\n\n/** The copy for every auth failure no mapped code covers. */\nexport const UNKNOWN_AUTH_ERROR_MESSAGE = \"Authentication error. Please try again.\";\n\nexport function normalizeAuthError(err: unknown, details?: Record<string, unknown>): NormalizedAuthError {\n  const firebaseCode = pickFirebaseCode(err);\n\n  const mapped = firebaseCode ? MAP[firebaseCode] : undefined;\n  if (mapped) {\n    return {\n      code: mapped.code,\n      message: mapped.message,\n      firebaseCode,\n      details\n    };\n  }\n\n  // Never the error's own message: for an unclassified failure it is the SDK's internal diagnostic\n  // (\"Firebase: Cloud function deadline exceeded. (auth/internal-error).\"), not an answer the person\n  // can act on. The consumer reports the error itself to its monitoring.\n  return {\n    code: \"AUTH_UNKNOWN\",\n    message: UNKNOWN_AUTH_ERROR_MESSAGE,\n    firebaseCode,\n    details\n  };\n}\n\n/** Convenience: returns just the user-facing message string */\nexport function getErrorMessage(error: unknown): string {\n  return normalizeAuthError(error).message;\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA4BA,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,GAAU,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAA6D;IACpE,6BAA6B,EAAE;QAC7B,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,wDAAwD;KAClE;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;KACrC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2CAA2C;KACrD;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wBAAwB;KAClC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iCAAiC;KAC3C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,mCAAmC;KAC7C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,qBAAqB;KAC/B;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,wBAAwB;KAClC;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+BAA+B;KACzC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uBAAuB;KACjC;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uCAAuC;KACjD;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,wCAAwC;KAClD;IACD,+CAA+C,EAAE;QAC/C,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,4DAA4D;KACtE;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,kDAAkD;KAC5D;IACD,gCAAgC,EAAE;QAChC,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,gEAAgE;KAC1E;IACD,qFAAqF;IACrF,uFAAuF;IACvF,uEAAuE;IACvE,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uEAAuE;KACjF;IACD,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EACL,+FAA+F;KAClG;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,yCAAyC,CAAC;AAEpF,MAAM,UAAU,kBAAkB,CAChC,GAAY,EACZ,OAAiC;IAEjC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY;YACZ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,mGAAmG;IACnG,uEAAuE;IACvE,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,0BAA0B;QACnC,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC","sourcesContent":["export type AuthErrorCode =\n  | 'AUTH_UNKNOWN'\n  | 'AUTH_NETWORK_ERROR'\n  | 'AUTH_TOO_MANY_REQUESTS'\n  | 'AUTH_POPUP_CLOSED'\n  | 'AUTH_POPUP_BLOCKED'\n  | 'AUTH_CANCELLED'\n  | 'AUTH_USER_DISABLED'\n  | 'AUTH_USER_NOT_FOUND'\n  | 'AUTH_WRONG_PASSWORD'\n  | 'AUTH_INVALID_EMAIL'\n  | 'AUTH_EMAIL_ALREADY_IN_USE'\n  | 'AUTH_WEAK_PASSWORD'\n  | 'AUTH_REQUIRES_RECENT_LOGIN'\n  | 'AUTH_INVALID_CREDENTIAL'\n  | 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL'\n  | 'AUTH_PROVIDER_ALREADY_LINKED'\n  | 'AUTH_CREDENTIAL_ALREADY_IN_USE'\n  | 'AUTH_EXPIRED_ACTION_CODE'\n  | 'AUTH_INVALID_ACTION_CODE';\n\nexport type NormalizedAuthError = {\n  code: AuthErrorCode;\n  message: string;\n  firebaseCode?: string;\n  details?: Record<string, unknown>;\n};\n\nfunction pickFirebaseCode(err: unknown): string | undefined {\n  if (!err || typeof err !== 'object') return undefined;\n  const anyErr = err as any;\n  const c = anyErr.code;\n  return typeof c === 'string' ? c : undefined;\n}\n\nconst MAP: Record<string, { code: AuthErrorCode; message: string }> = {\n  'auth/network-request-failed': {\n    code: 'AUTH_NETWORK_ERROR',\n    message: 'Network error. Please check your connection and try again.',\n  },\n  'auth/too-many-requests': {\n    code: 'AUTH_TOO_MANY_REQUESTS',\n    message: 'Too many attempts. Please wait a moment and try again.',\n  },\n  'auth/popup-closed-by-user': {\n    code: 'AUTH_POPUP_CLOSED',\n    message: 'Sign-in popup was closed.',\n  },\n  'auth/popup-blocked': {\n    code: 'AUTH_POPUP_BLOCKED',\n    message: 'Sign-in popup was blocked by the browser.',\n  },\n  'auth/cancelled-popup-request': {\n    code: 'AUTH_CANCELLED',\n    message: 'Sign-in was cancelled.',\n  },\n  'auth/user-disabled': {\n    code: 'AUTH_USER_DISABLED',\n    message: 'This account has been disabled.',\n  },\n  'auth/user-not-found': {\n    code: 'AUTH_USER_NOT_FOUND',\n    message: 'No account found with that email.',\n  },\n  'auth/wrong-password': {\n    code: 'AUTH_WRONG_PASSWORD',\n    message: 'Incorrect password.',\n  },\n  'auth/invalid-email': {\n    code: 'AUTH_INVALID_EMAIL',\n    message: 'Invalid email address.',\n  },\n  'auth/email-already-in-use': {\n    code: 'AUTH_EMAIL_ALREADY_IN_USE',\n    message: 'That email is already in use.',\n  },\n  'auth/weak-password': {\n    code: 'AUTH_WEAK_PASSWORD',\n    message: 'Password is too weak.',\n  },\n  'auth/requires-recent-login': {\n    code: 'AUTH_REQUIRES_RECENT_LOGIN',\n    message: 'Please re-authenticate and try again.',\n  },\n  'auth/invalid-credential': {\n    code: 'AUTH_INVALID_CREDENTIAL',\n    message: 'Invalid credentials. Please try again.',\n  },\n  'auth/account-exists-with-different-credential': {\n    code: 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL',\n    message: 'An account already exists with a different sign-in method.',\n  },\n  'auth/provider-already-linked': {\n    code: 'AUTH_PROVIDER_ALREADY_LINKED',\n    message: 'That provider is already linked to this account.',\n  },\n  'auth/credential-already-in-use': {\n    code: 'AUTH_CREDENTIAL_ALREADY_IN_USE',\n    message: 'Those credentials are already associated with another account.',\n  },\n  // Email-action (oobCode) links — password reset, email verification, email recovery.\n  // The copy is deliberately generic: it never reveals whether an account exists, and it\n  // always points at the one recovery affordance (request a fresh link).\n  'auth/expired-action-code': {\n    code: 'AUTH_EXPIRED_ACTION_CODE',\n    message: 'This email action link has expired. Request a new link and try again.',\n  },\n  'auth/invalid-action-code': {\n    code: 'AUTH_INVALID_ACTION_CODE',\n    message:\n      'This email action link is invalid or has already been used. Request a new link and try again.',\n  },\n};\n\n/** The copy for every auth failure no mapped code covers. */\nexport const UNKNOWN_AUTH_ERROR_MESSAGE = 'Authentication error. Please try again.';\n\nexport function normalizeAuthError(\n  err: unknown,\n  details?: Record<string, unknown>,\n): NormalizedAuthError {\n  const firebaseCode = pickFirebaseCode(err);\n\n  const mapped = firebaseCode ? MAP[firebaseCode] : undefined;\n  if (mapped) {\n    return {\n      code: mapped.code,\n      message: mapped.message,\n      firebaseCode,\n      details,\n    };\n  }\n\n  // Never the error's own message: for an unclassified failure it is the SDK's internal diagnostic\n  // (\"Firebase: Cloud function deadline exceeded. (auth/internal-error).\"), not an answer the person\n  // can act on. The consumer reports the error itself to its monitoring.\n  return {\n    code: 'AUTH_UNKNOWN',\n    message: UNKNOWN_AUTH_ERROR_MESSAGE,\n    firebaseCode,\n    details,\n  };\n}\n\n/** Convenience: returns just the user-facing message string */\nexport function getErrorMessage(error: unknown): string {\n  return normalizeAuthError(error).message;\n}\n"]}

package/dist/index.d.ts

@@ -1,6 +1,5 @@
-export * from "./claims.js";
-export * from "./errors.js";
-export * from "./env.js";
-export * from "./acceptance.js";
-export * from "./email-verification.js";
+export * from './errors.js';
+export * from './env.js';
+export * from './acceptance.js';
+export * from './email-verification.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -1,13 +1,12 @@
-// Pure root: contracts, claims parsing, normalized errors, environment helpers.
+// Pure root: contracts, normalized errors, environment helpers.
 // Nothing here imports firebase/auth at runtime.
 //
-// Client auth runtime (onAuthStateChanged wrapper, getAuthUser) lives behind
+// Client auth runtime (onAuthStateChanged wrapper, getAuthUser, ID-token claims) lives behind
 // "@ttt-productions/auth-core/client". Admin/Functions helpers live behind
 // "@ttt-productions/auth-core/server". React hooks live behind
 // "@ttt-productions/auth-core/react".
-export * from "./claims.js";
-export * from "./errors.js";
-export * from "./env.js";
-export * from "./acceptance.js";
-export * from "./email-verification.js";
+export * from './errors.js';
+export * from './env.js';
+export * from './acceptance.js';
+export * from './email-verification.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,+DAA+D;AAC/D,sCAAsC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC","sourcesContent":["// Pure root: contracts, claims parsing, normalized errors, environment helpers.\n// Nothing here imports firebase/auth at runtime.\n//\n// Client auth runtime (onAuthStateChanged wrapper, getAuthUser) lives behind\n// \"@ttt-productions/auth-core/client\". Admin/Functions helpers live behind\n// \"@ttt-productions/auth-core/server\". React hooks live behind\n// \"@ttt-productions/auth-core/react\".\nexport * from \"./claims.js\";\nexport * from \"./errors.js\";\nexport * from \"./env.js\";\nexport * from \"./acceptance.js\";\nexport * from \"./email-verification.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,8FAA8F;AAC9F,2EAA2E;AAC3E,+DAA+D;AAC/D,sCAAsC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC","sourcesContent":["// Pure root: contracts, normalized errors, environment helpers.\n// Nothing here imports firebase/auth at runtime.\n//\n// Client auth runtime (onAuthStateChanged wrapper, getAuthUser, ID-token claims) lives behind\n// \"@ttt-productions/auth-core/client\". Admin/Functions helpers live behind\n// \"@ttt-productions/auth-core/server\". React hooks live behind\n// \"@ttt-productions/auth-core/react\".\nexport * from './errors.js';\nexport * from './env.js';\nexport * from './acceptance.js';\nexport * from './email-verification.js';\n"]}

package/dist/react/AuthProvider.d.ts

@@ -1,10 +1,10 @@
-import { type ReactNode } from "react";
-import type { AuthProviderConfig, AuthContextValue } from "./types.js";
+import { type ReactNode } from 'react';
+import type { AuthProviderConfig, AuthContextValue } from './types.js';
 export declare const AuthContext: import("react").Context<AuthContextValue<any> | null>;
 interface AuthProviderProps<TClaims> {
     config: AuthProviderConfig<TClaims>;
     children: ReactNode;
 }
-export declare function AuthProvider<TClaims = Record<string, unknown>>({ config, children }: AuthProviderProps<TClaims>): import("react").JSX.Element;
+export declare function AuthProvider<TClaims = Record<string, unknown>>({ config, children, }: AuthProviderProps<TClaims>): import("react").JSX.Element;
 export {};
 //# sourceMappingURL=AuthProvider.d.ts.map

package/dist/react/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAIf,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAavE,eAAO,MAAM,WAAW,uDAAoD,CAAC;AAE7E,UAAU,iBAAiB,CAAC,OAAO;IACjC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,+BA8HjD"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAIf,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAYvE,eAAO,MAAM,WAAW,uDAAoD,CAAC;AAE7E,UAAU,iBAAiB,CAAC,OAAO;IACjC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC9D,MAAM,EACN,QAAQ,GACT,EAAE,iBAAiB,CAAC,OAAO,CAAC,+BAgI5B"}

package/dist/react/AuthProvider.js

@@ -1,10 +1,10 @@
-"use client";
+'use client';
 import { jsx as _jsx } from "react/jsx-runtime";
-import { createContext, useEffect, useRef, useState, useCallback, useMemo, } from "react";
-import { useAuthState } from "./useAuthState.js";
-import { getIdTokenClaims } from "../claims.js";
+import { createContext, useEffect, useRef, useState, useCallback, useMemo, } from 'react';
+import { useAuthState } from './useAuthState.js';
+import { getIdTokenClaims } from '../client/claims.js';
 export const AuthContext = createContext(null);
-export function AuthProvider({ config, children }) {
+export function AuthProvider({ config, children, }) {
     const { user, loading: authLoading } = useAuthState(config.auth);
     // Claims are held with the session they were read for and derived at render (below), so a
     // render can never pair one account's `user` with another account's claims, and a read that
@@ -29,7 +29,11 @@ export function AuthProvider({ config, children }) {
             if (currentUserRef.current !== forUser || generation <= appliedGenerationRef.current)
                 return;
             appliedGenerationRef.current = generation;
-            setResolved({ user: forUser, generation, claims: configRef.current.parseClaims(raw ?? {}) });
+            setResolved({
+                user: forUser,
+                generation,
+                claims: configRef.current.parseClaims(raw ?? {}),
+            });
         }
         catch (err) {
             if (currentUserRef.current !== forUser)
@@ -51,12 +55,14 @@ export function AuthProvider({ config, children }) {
         let cancelled = false;
         Promise.resolve()
             .then(() => gate())
-            .catch((err) => configRef.current.onError?.(err, "readyGate"))
+            .catch((err) => configRef.current.onError?.(err, 'readyGate'))
             .finally(() => {
             if (!cancelled)
                 setGateOpen(true);
         });
-        return () => { cancelled = true; };
+        return () => {
+            cancelled = true;
+        };
         // Mount-only by design (reads only the stable configRef): the gate is a
         // one-time client readiness signal.
     }, []);
@@ -70,7 +76,7 @@ export function AuthProvider({ config, children }) {
             return;
         }
         configRef.current.onAuthStateChange?.(user);
-        void readClaims(user, async () => ((await getIdTokenClaims(user)) ?? {}), "getIdTokenClaims");
+        void readClaims(user, async () => ((await getIdTokenClaims(user)) ?? {}), 'getIdTokenClaims');
     }, [user, authLoading, readClaims]);
     // --- refreshClaims ---
     const refreshClaims = useCallback(async () => {
@@ -81,7 +87,7 @@ export function AuthProvider({ config, children }) {
         const liveUser = configRef.current.auth.currentUser;
         if (!liveUser)
             return;
-        await readClaims(liveUser, async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}), "refreshClaims");
+        await readClaims(liveUser, async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}), 'refreshClaims');
     }, [readClaims]);
     // --- Derived at render: only the current session's claims are ever exposed ---
     const sessionClaims = user && resolved?.user === user ? resolved : null;
@@ -102,6 +108,6 @@ export function AuthProvider({ config, children }) {
         isAuthenticated: !!exposedUser,
         refreshClaims,
     }), [exposedUser, claims, loading, authLoading, claimsLoading, refreshClaims]);
-    return (_jsx(AuthContext.Provider, { value: value, children: children }));
+    return _jsx(AuthContext.Provider, { value: value, children: children });
 }
 //# sourceMappingURL=AuthProvider.js.map