@ttt-productions/auth-core 1.6.15 → 1.6.17

package/dist/react/useAuthState.js

@@ -1,14 +1,10 @@
-import { useEffect, useState } from "react";
-import { onAuthStateChanged } from "../auth.js";
+import { useEffect, useState } from 'react';
+import { onAuthStateChanged } from '../client/auth.js';
 export function useAuthState(auth) {
-    // Initialize state based on current auth status to avoid initial flash
     const [user, setUser] = useState(() => auth.currentUser);
     const [loading, setLoading] = useState(() => auth.currentUser === null);
     const [error, setError] = useState(null);
     useEffect(() => {
-        // Only set loading if we don't have a user and haven't loaded yet
-        // This prevents the "flash" when a user is already signed in (e.g. hydration)
-        // or when simply refreshing the token.
         if (auth.currentUser === null) {
             setLoading(true);
         }

package/dist/react/useAuthState.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthState.js","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQhD,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,uEAAuE;IACvE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAc,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAU,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,kEAAkE;QAClE,8EAA8E;QAC9E,uCAAuC;QACvC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAC9B,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE;YACJ,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;YACJ,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import { useEffect, useState } from \"react\";\nimport type { Auth, User } from \"firebase/auth\";\nimport { onAuthStateChanged } from \"../auth.js\";\n\nexport type AuthState = {\n  user: User | null;\n  loading: boolean;\n  error: unknown | null;\n};\n\nexport function useAuthState(auth: Auth): AuthState {\n  // Initialize state based on current auth status to avoid initial flash\n  const [user, setUser] = useState<User | null>(() => auth.currentUser);\n  const [loading, setLoading] = useState<boolean>(() => auth.currentUser === null);\n  const [error, setError] = useState<unknown | null>(null);\n\n  useEffect(() => {\n    // Only set loading if we don't have a user and haven't loaded yet\n    // This prevents the \"flash\" when a user is already signed in (e.g. hydration)\n    // or when simply refreshing the token.\n    if (auth.currentUser === null) {\n      setLoading(true);\n    }\n\n    const unsub = onAuthStateChanged(\n      auth,\n      (u) => {\n        setUser(u);\n        setError(null);\n        setLoading(false);\n      },\n      (e) => {\n        setError(e);\n        setLoading(false);\n      }\n    );\n    return unsub;\n  }, [auth]);\n\n  return { user, loading, error };\n}"]}
+{"version":3,"file":"useAuthState.js","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAQvD,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAc,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAU,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAC9B,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE;YACJ,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;YACJ,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import { useEffect, useState } from 'react';\nimport type { Auth, User } from 'firebase/auth';\nimport { onAuthStateChanged } from '../client/auth.js';\n\nexport type AuthState = {\n  user: User | null;\n  loading: boolean;\n  error: unknown | null;\n};\n\nexport function useAuthState(auth: Auth): AuthState {\n  const [user, setUser] = useState<User | null>(() => auth.currentUser);\n  const [loading, setLoading] = useState<boolean>(() => auth.currentUser === null);\n  const [error, setError] = useState<unknown | null>(null);\n\n  useEffect(() => {\n    if (auth.currentUser === null) {\n      setLoading(true);\n    }\n\n    const unsub = onAuthStateChanged(\n      auth,\n      (u) => {\n        setUser(u);\n        setError(null);\n        setLoading(false);\n      },\n      (e) => {\n        setError(e);\n        setLoading(false);\n      },\n    );\n    return unsub;\n  }, [auth]);\n\n  return { user, loading, error };\n}\n"]}

package/dist/refusal.d.ts

@@ -1,8 +1,2 @@
-/**
- * The `details` of `err` when it is a `failed-precondition` error in either spelling —
- * server-side or client-side callable error alike — otherwise `undefined`. Each recognizer then
- * asks whether those details are its own refusal's, so refusals are told apart by
- * `details.reason`, never by message text.
- */
 export declare function failedPreconditionDetails(err: unknown): unknown;
 //# sourceMappingURL=refusal.d.ts.map

package/dist/refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI/D"}
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAKA,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM/D"}

package/dist/refusal.js

@@ -1,23 +1,13 @@
-// The code both structured `assertAuth` refusals carry — the acceptance refusal
-// (./acceptance.ts) and the email-verification refusal (./email-verification.ts) — and the one
-// place their recognizers read it. Internal: the root exports the recognizers, not this.
-// Pure: no Firebase runtime.
-// The HttpsError code, as the server (`failed-precondition`) and the Firebase client SDK
-// (`functions/failed-precondition`) spell it.
 const FAILED_PRECONDITION_CODES = new Set([
-    "failed-precondition",
-    "functions/failed-precondition",
+    'failed-precondition',
+    'functions/failed-precondition',
 ]);
-/**
- * The `details` of `err` when it is a `failed-precondition` error in either spelling —
- * server-side or client-side callable error alike — otherwise `undefined`. Each recognizer then
- * asks whether those details are its own refusal's, so refusals are told apart by
- * `details.reason`, never by message text.
- */
 export function failedPreconditionDetails(err) {
-    if (!err || typeof err !== "object")
+    if (!err || typeof err !== 'object')
         return undefined;
     const e = err;
-    return typeof e.code === "string" && FAILED_PRECONDITION_CODES.has(e.code) ? e.details : undefined;
+    return typeof e.code === 'string' && FAILED_PRECONDITION_CODES.has(e.code)
+        ? e.details
+        : undefined;
 }
 //# sourceMappingURL=refusal.js.map

package/dist/refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+FAA+F;AAC/F,yFAAyF;AACzF,6BAA6B;AAE7B,yFAAyF;AACzF,8CAA8C;AAC9C,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,qBAAqB;IACrB,+BAA+B;CAChC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,GAAG,GAA4C,CAAC;IACvD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC","sourcesContent":["// The code both structured `assertAuth` refusals carry — the acceptance refusal\n// (./acceptance.ts) and the email-verification refusal (./email-verification.ts) — and the one\n// place their recognizers read it. Internal: the root exports the recognizers, not this.\n// Pure: no Firebase runtime.\n\n// The HttpsError code, as the server (`failed-precondition`) and the Firebase client SDK\n// (`functions/failed-precondition`) spell it.\nconst FAILED_PRECONDITION_CODES: ReadonlySet<string> = new Set([\n  \"failed-precondition\",\n  \"functions/failed-precondition\",\n]);\n\n/**\n * The `details` of `err` when it is a `failed-precondition` error in either spelling —\n * server-side or client-side callable error alike — otherwise `undefined`. Each recognizer then\n * asks whether those details are its own refusal's, so refusals are told apart by\n * `details.reason`, never by message text.\n */\nexport function failedPreconditionDetails(err: unknown): unknown {\n  if (!err || typeof err !== \"object\") return undefined;\n  const e = err as { code?: unknown; details?: unknown };\n  return typeof e.code === \"string\" && FAILED_PRECONDITION_CODES.has(e.code) ? e.details : undefined;\n}\n"]}
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,qBAAqB;IACrB,+BAA+B;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,GAAG,GAA4C,CAAC;IACvD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,CAAC,CAAC,CAAC,CAAC,OAAO;QACX,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC","sourcesContent":["const FAILED_PRECONDITION_CODES: ReadonlySet<string> = new Set([\n  'failed-precondition',\n  'functions/failed-precondition',\n]);\n\nexport function failedPreconditionDetails(err: unknown): unknown {\n  if (!err || typeof err !== 'object') return undefined;\n  const e = err as { code?: unknown; details?: unknown };\n  return typeof e.code === 'string' && FAILED_PRECONDITION_CODES.has(e.code)\n    ? e.details\n    : undefined;\n}\n"]}

package/dist/server/assertAuth.d.ts

@@ -1,3 +1,3 @@
-import type { AssertAuthConfig, AssertAuthFn } from "./types.js";
-export declare function createAssertAuth<TUser, TAdmin = void>(config: AssertAuthConfig<TUser, TAdmin>): AssertAuthFn<TUser, TAdmin>;
+import type { AssertAuthConfig, AssertAuthFn } from './types.js';
+export declare function createAssertAuth<TUser, TAdmin = void, TAdminOptions = never>(config: AssertAuthConfig<TUser, TAdmin, TAdminOptions>): AssertAuthFn<TUser, TAdmin, TAdminOptions>;
 //# sourceMappingURL=assertAuth.d.ts.map

package/dist/server/assertAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assertAuth.d.ts","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EAGb,MAAM,YAAY,CAAC;AAEpB,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EACnD,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,GACtC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CA6F7B"}
+{"version":3,"file":"assertAuth.d.ts","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAiC,MAAM,YAAY,CAAC;AAEhG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,aAAa,GAAG,KAAK,EAC1E,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,GACrD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAuE5C"}

package/dist/server/assertAuth.js

@@ -1,75 +1,50 @@
-// Factory that produces an assertAuth function bound to a consuming app's
-// Firestore paths, user shape, and admin check.
-//
-// Every Cloud Functions callable in the consuming app should invoke the
-// returned assertAuth as its first executable line. The check order is:
-//   1. Authentication
-//   2. Email verification
-//   3. User doc Firestore read (when status check is needed)
-//   4. Status check (suspended / banned)
-//   5. Acceptance-level gate (only when config.acceptance is set)
-//   6. Admin check (delegated to config.requireAdmin)
-import { ACCEPTANCE_REQUIRED_REASON, normalizeAcceptanceLevel } from "../acceptance.js";
-import { EMAIL_VERIFICATION_REQUIRED_REASON } from "../email-verification.js";
-import { AuthAssertionError } from "./authError.js";
+import { ACCEPTANCE_REQUIRED_REASON, normalizeAcceptanceLevel } from '../acceptance.js';
+import { EMAIL_VERIFICATION_REQUIRED_REASON } from '../email-verification.js';
+import { AuthAssertionError } from './authError.js';
 export function createAssertAuth(config) {
     return async function assertAuth(request, requirements = {}) {
-        // 1. Authentication check (always first)
         if (!request.auth) {
-            throw new AuthAssertionError("unauthenticated", "You must be authenticated");
+            throw new AuthAssertionError('unauthenticated', 'You must be authenticated');
         }
         const uid = request.auth.uid;
         const token = request.auth.token;
-        // 2. Email verification check. The refusal carries its reason in `details`, so the client
-        // recognizes it structurally (`isEmailVerificationRequiredError`), never by the message.
-        if (requirements.emailVerified === true &&
-            requirements.allowUnverified !== true) {
+        if (requirements.emailVerified === true && requirements.allowUnverified !== true) {
             if (token.email_verified !== true) {
-                throw new AuthAssertionError("failed-precondition", "Email must be verified", {
+                throw new AuthAssertionError('failed-precondition', 'Email must be verified', {
                     reason: EMAIL_VERIFICATION_REQUIRED_REASON,
                 });
             }
         }
-        // 3. User doc Firestore read (skipped when allowAnyStatus is set)
         const db = config.firestore();
-        const userSnap = requirements.allowAnyStatus !== true
-            ? await db.doc(config.userProfilePath(uid)).get()
-            : null;
+        const userSnap = requirements.allowAnyStatus !== true ? await db.doc(config.userProfilePath(uid)).get() : null;
         let userDoc;
-        // 4. Status check (default: block suspended + banned; skipped if allowAnyStatus)
         if (requirements.allowAnyStatus !== true) {
             if (!userSnap || !userSnap.exists) {
-                throw new AuthAssertionError("not-found", "User profile not found");
+                throw new AuthAssertionError('not-found', 'User profile not found');
             }
             const userData = userSnap.data();
             const status = config.getUserStatus(userData);
-            if (status === "banned") {
-                throw new AuthAssertionError("permission-denied", "Account is not in good standing");
+            if (status === 'banned') {
+                throw new AuthAssertionError('permission-denied', 'Account is not in good standing');
             }
-            if (status === "suspended" && requirements.allowSuspended !== true) {
-                throw new AuthAssertionError("permission-denied", "Account is not in good standing");
+            if (status === 'suspended' && requirements.allowSuspended !== true) {
+                throw new AuthAssertionError('permission-denied', 'Account is not in good standing');
             }
             userDoc = userData;
         }
-        // 5. Acceptance-level gate. Runs only when the app configured one and the callable did
-        // not opt out. The required level comes from the app's cheap (cached) reader and the
-        // accepted level from the verified token, so the gate adds no per-call Firestore read.
-        // It sits after the status check so a banned caller still gets the standing refusal.
         if (config.acceptance !== undefined && requirements.allowUnaccepted !== true) {
             const requiredLevel = normalizeAcceptanceLevel(await config.acceptance.requiredLevel());
             if (requiredLevel > 0) {
                 const acceptedLevel = normalizeAcceptanceLevel(token[config.acceptance.claimKey]);
                 if (acceptedLevel < requiredLevel) {
-                    throw new AuthAssertionError("failed-precondition", "The current documents must be accepted before continuing", { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel, acceptedLevel });
+                    throw new AuthAssertionError('failed-precondition', 'The current documents must be accepted before continuing', { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel, acceptedLevel });
                 }
             }
         }
-        // 6. Admin check (delegates to config.requireAdmin)
         let adminResult;
         if (requirements.admin !== undefined) {
             adminResult = await config.requireAdmin(uid, token, requirements.admin);
         }
-        // 7. Return context with whatever docs were fetched
         const ctx = { uid, token };
         if (userDoc !== undefined) {
             ctx.userDoc = userDoc;

package/dist/server/assertAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertAuth.js","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,sBAAsB;AACtB,0BAA0B;AAC1B,6DAA6D;AAC7D,yCAAyC;AACzC,kEAAkE;AAClE,sDAAsD;AAGtD,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAQpD,MAAM,UAAU,gBAAgB,CAC9B,MAAuC;IAEvC,OAAO,KAAK,UAAU,UAAU,CAC9B,OAAwB,EACxB,eAAiC,EAAE;QAEnC,yCAAyC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAEjC,0FAA0F;QAC1F,yFAAyF;QACzF,IACE,YAAY,CAAC,aAAa,KAAK,IAAI;YACnC,YAAY,CAAC,eAAe,KAAK,IAAI,EACrC,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wBAAwB,EAAE;oBAC5E,MAAM,EAAE,kCAAkC;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GACZ,YAAY,CAAC,cAAc,KAAK,IAAI;YAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC;QAEX,IAAI,OAA0B,CAAC;QAE/B,iFAAiF;QACjF,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAW,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,WAAW,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnE,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;QAED,uFAAuF;QACvF,qFAAqF;QACrF,uFAAuF;QACvF,qFAAqF;QACrF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7E,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;YACxF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,wBAAwB,CAC3C,KAAiC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC/D,CAAC;gBACF,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;oBAClC,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,0DAA0D,EAC1D,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,aAAa,EAAE,CACrE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,WAA+B,CAAC;QACpC,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,WAAW,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,oDAAoD;QACpD,MAAM,GAAG,GAA+B,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,GAAG,WAAqB,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Factory that produces an assertAuth function bound to a consuming app's\n// Firestore paths, user shape, and admin check.\n//\n// Every Cloud Functions callable in the consuming app should invoke the\n// returned assertAuth as its first executable line. The check order is:\n//   1. Authentication\n//   2. Email verification\n//   3. User doc Firestore read (when status check is needed)\n//   4. Status check (suspended / banned)\n//   5. Acceptance-level gate (only when config.acceptance is set)\n//   6. Admin check (delegated to config.requireAdmin)\n\nimport type { CallableRequest } from \"firebase-functions/v2/https\";\nimport { ACCEPTANCE_REQUIRED_REASON, normalizeAcceptanceLevel } from \"../acceptance.js\";\nimport { EMAIL_VERIFICATION_REQUIRED_REASON } from \"../email-verification.js\";\nimport { AuthAssertionError } from \"./authError.js\";\nimport type {\n  AssertAuthConfig,\n  AssertAuthFn,\n  AuthContext,\n  AuthRequirements,\n} from \"./types.js\";\n\nexport function createAssertAuth<TUser, TAdmin = void>(\n  config: AssertAuthConfig<TUser, TAdmin>\n): AssertAuthFn<TUser, TAdmin> {\n  return async function assertAuth(\n    request: CallableRequest,\n    requirements: AuthRequirements = {}\n  ): Promise<AuthContext<TUser, TAdmin>> {\n    // 1. Authentication check (always first)\n    if (!request.auth) {\n      throw new AuthAssertionError(\"unauthenticated\", \"You must be authenticated\");\n    }\n\n    const uid = request.auth.uid;\n    const token = request.auth.token;\n\n    // 2. Email verification check. The refusal carries its reason in `details`, so the client\n    // recognizes it structurally (`isEmailVerificationRequiredError`), never by the message.\n    if (\n      requirements.emailVerified === true &&\n      requirements.allowUnverified !== true\n    ) {\n      if (token.email_verified !== true) {\n        throw new AuthAssertionError(\"failed-precondition\", \"Email must be verified\", {\n          reason: EMAIL_VERIFICATION_REQUIRED_REASON,\n        });\n      }\n    }\n\n    // 3. User doc Firestore read (skipped when allowAnyStatus is set)\n    const db = config.firestore();\n    const userSnap =\n      requirements.allowAnyStatus !== true\n        ? await db.doc(config.userProfilePath(uid)).get()\n        : null;\n\n    let userDoc: TUser | undefined;\n\n    // 4. Status check (default: block suspended + banned; skipped if allowAnyStatus)\n    if (requirements.allowAnyStatus !== true) {\n      if (!userSnap || !userSnap.exists) {\n        throw new AuthAssertionError(\"not-found\", \"User profile not found\");\n      }\n      const userData = userSnap.data() as TUser;\n      const status = config.getUserStatus(userData);\n      if (status === \"banned\") {\n        throw new AuthAssertionError(\n          \"permission-denied\",\n          \"Account is not in good standing\"\n        );\n      }\n      if (status === \"suspended\" && requirements.allowSuspended !== true) {\n        throw new AuthAssertionError(\n          \"permission-denied\",\n          \"Account is not in good standing\"\n        );\n      }\n      userDoc = userData;\n    }\n\n    // 5. Acceptance-level gate. Runs only when the app configured one and the callable did\n    // not opt out. The required level comes from the app's cheap (cached) reader and the\n    // accepted level from the verified token, so the gate adds no per-call Firestore read.\n    // It sits after the status check so a banned caller still gets the standing refusal.\n    if (config.acceptance !== undefined && requirements.allowUnaccepted !== true) {\n      const requiredLevel = normalizeAcceptanceLevel(await config.acceptance.requiredLevel());\n      if (requiredLevel > 0) {\n        const acceptedLevel = normalizeAcceptanceLevel(\n          (token as Record<string, unknown>)[config.acceptance.claimKey]\n        );\n        if (acceptedLevel < requiredLevel) {\n          throw new AuthAssertionError(\n            \"failed-precondition\",\n            \"The current documents must be accepted before continuing\",\n            { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel, acceptedLevel }\n          );\n        }\n      }\n    }\n\n    // 6. Admin check (delegates to config.requireAdmin)\n    let adminResult: TAdmin | undefined;\n    if (requirements.admin !== undefined) {\n      adminResult = await config.requireAdmin(uid, token, requirements.admin);\n    }\n\n    // 7. Return context with whatever docs were fetched\n    const ctx: AuthContext<TUser, TAdmin> = { uid, token };\n    if (userDoc !== undefined) {\n      ctx.userDoc = userDoc;\n    }\n    if (requirements.admin !== undefined) {\n      ctx.admin = adminResult as TAdmin;\n    }\n    return ctx;\n  };\n}\n"]}
+{"version":3,"file":"assertAuth.js","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,UAAU,gBAAgB,CAC9B,MAAsD;IAEtD,OAAO,KAAK,UAAU,UAAU,CAC9B,OAAwB,EACxB,eAAgD,EAAE;QAElD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAEjC,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjF,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wBAAwB,EAAE;oBAC5E,MAAM,EAAE,kCAAkC;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GACZ,YAAY,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhG,IAAI,OAA0B,CAAC;QAE/B,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAW,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,MAAM,KAAK,WAAW,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7E,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;YACxF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,wBAAwB,CAC3C,KAAiC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC/D,CAAC;gBACF,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;oBAClC,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,0DAA0D,EAC1D,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,aAAa,EAAE,CACrE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,WAAW,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAA+B,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,GAAG,WAAqB,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { CallableRequest } from 'firebase-functions/v2/https';\nimport { ACCEPTANCE_REQUIRED_REASON, normalizeAcceptanceLevel } from '../acceptance.js';\nimport { EMAIL_VERIFICATION_REQUIRED_REASON } from '../email-verification.js';\nimport { AuthAssertionError } from './authError.js';\nimport type { AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements } from './types.js';\n\nexport function createAssertAuth<TUser, TAdmin = void, TAdminOptions = never>(\n  config: AssertAuthConfig<TUser, TAdmin, TAdminOptions>,\n): AssertAuthFn<TUser, TAdmin, TAdminOptions> {\n  return async function assertAuth(\n    request: CallableRequest,\n    requirements: AuthRequirements<TAdminOptions> = {},\n  ): Promise<AuthContext<TUser, TAdmin>> {\n    if (!request.auth) {\n      throw new AuthAssertionError('unauthenticated', 'You must be authenticated');\n    }\n\n    const uid = request.auth.uid;\n    const token = request.auth.token;\n\n    if (requirements.emailVerified === true && requirements.allowUnverified !== true) {\n      if (token.email_verified !== true) {\n        throw new AuthAssertionError('failed-precondition', 'Email must be verified', {\n          reason: EMAIL_VERIFICATION_REQUIRED_REASON,\n        });\n      }\n    }\n\n    const db = config.firestore();\n    const userSnap =\n      requirements.allowAnyStatus !== true ? await db.doc(config.userProfilePath(uid)).get() : null;\n\n    let userDoc: TUser | undefined;\n\n    if (requirements.allowAnyStatus !== true) {\n      if (!userSnap || !userSnap.exists) {\n        throw new AuthAssertionError('not-found', 'User profile not found');\n      }\n      const userData = userSnap.data() as TUser;\n      const status = config.getUserStatus(userData);\n      if (status === 'banned') {\n        throw new AuthAssertionError('permission-denied', 'Account is not in good standing');\n      }\n      if (status === 'suspended' && requirements.allowSuspended !== true) {\n        throw new AuthAssertionError('permission-denied', 'Account is not in good standing');\n      }\n      userDoc = userData;\n    }\n\n    if (config.acceptance !== undefined && requirements.allowUnaccepted !== true) {\n      const requiredLevel = normalizeAcceptanceLevel(await config.acceptance.requiredLevel());\n      if (requiredLevel > 0) {\n        const acceptedLevel = normalizeAcceptanceLevel(\n          (token as Record<string, unknown>)[config.acceptance.claimKey],\n        );\n        if (acceptedLevel < requiredLevel) {\n          throw new AuthAssertionError(\n            'failed-precondition',\n            'The current documents must be accepted before continuing',\n            { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel, acceptedLevel },\n          );\n        }\n      }\n    }\n\n    let adminResult: TAdmin | undefined;\n    if (requirements.admin !== undefined) {\n      adminResult = await config.requireAdmin(uid, token, requirements.admin);\n    }\n\n    const ctx: AuthContext<TUser, TAdmin> = { uid, token };\n    if (userDoc !== undefined) {\n      ctx.userDoc = userDoc;\n    }\n    if (requirements.admin !== undefined) {\n      ctx.admin = adminResult as TAdmin;\n    }\n    return ctx;\n  };\n}\n"]}

package/dist/server/authError.d.ts

@@ -1,54 +1,6 @@
-import type { AcceptanceRequiredDetails } from "../acceptance.js";
-import type { EmailVerificationRequiredDetails } from "../email-verification.js";
-/**
- * Typed failure channel for `createAssertAuth`.
- *
- * Every EXPECTED auth outcome (not signed in, email unverified, missing profile,
- * account not in good standing) throws an `AuthAssertionError` whose `code` is
- * deliberately the matching `HttpsError` code string, so a consuming Cloud
- * Function maps it 1:1 at the app boundary:
- *
- *   catch (err) {
- *     if (err instanceof AuthAssertionError) throw new HttpsError(err.code, err.message);
- *     throw err;
- *   }
- *
- * WHY THE PACKAGE MUST NOT BUILD THE HttpsError ITSELF: firebase-functions 7.2.5
- * ships TWO distinct `HttpsError` classes — the one
- * exported from the ESM entry `firebase-functions/v2/https`, and the one the CJS
- * callable runtime closes over and `instanceof`-checks at
- * `lib/common/providers/https.js`. An `HttpsError` constructed by this package's
- * ESM `dist` fails that identity check, so `onCall` logged "Unhandled error" and
- * replaced a correct 400 with `500 INTERNAL`. Measured:
- *
- *   ESM class === CJS class ?              false
- *   esm-built error instanceof CJS class ? false
- *   httpErrorCode.status:                  400   (the error itself was correct)
- *
- * Because `assertAuth` is the first line of every callable, that turned EVERY auth
- * rejection — unauthenticated, unverified email, suspended, banned — into a generic
- * 500: users saw a generic error instead of the verify-email dialog, and monitoring
- * filled with 500s that were really expected answers. Constructing the HttpsError in
- * APP module space fixes the identity permanently and cannot regress when
- * firebase-functions repackages.
- *
- * This also brings auth-core in line with engineering-rules QUALITY-102 (generic
- * packages stay framework-agnostic; the consuming app's adapter binds the framework) and
- * mirrors `report-core`'s `ReportCoreTaskError`, which already works this way.
- */
-export type AuthAssertionErrorCode = "unauthenticated" | "failed-precondition" | "not-found" | "permission-denied";
-/**
- * Structured details an `AuthAssertionError` may carry — one per refusal the client answers
- * with a surface of its own, each told apart by `reason`: the email-verification refusal
- * (`reason: 'email-verification-required'`, recognized by `isEmailVerificationRequiredError`)
- * and the acceptance refusal (`reason: 'acceptance-required'`, recognized by
- * `isAcceptanceRequiredError`). The app forwards `details` as the `HttpsError` details so the
- * client can recognize them:
- *
- *   throw new HttpsError(err.code, err.message, err.details);
- *
- * Every other rejection leaves `details` undefined.
- */
+import type { AcceptanceRequiredDetails } from '../acceptance.js';
+import type { EmailVerificationRequiredDetails } from '../email-verification.js';
+export type AuthAssertionErrorCode = 'unauthenticated' | 'failed-precondition' | 'not-found' | 'permission-denied';
 export type AuthAssertionErrorDetails = AcceptanceRequiredDetails | EmailVerificationRequiredDetails;
 export declare class AuthAssertionError extends Error {
     readonly code: AuthAssertionErrorCode;

package/dist/server/authError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authError.d.ts","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,qBAAqB,GACrB,WAAW,GACX,mBAAmB,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,yBAAyB,GAAG,yBAAyB,GAAG,gCAAgC,CAAC;AAErG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;gBAEjC,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB;CAM/F"}
+{"version":3,"file":"authError.d.ts","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAIjF,MAAM,MAAM,sBAAsB,GAChC,iBAAiB,GAAG,qBAAqB,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAEhF,MAAM,MAAM,yBAAyB,GACnC,yBAAyB,GAAG,gCAAgC,CAAC;AAE/D,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;gBAEjC,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB;CAM/F"}

package/dist/server/authError.js

@@ -3,7 +3,7 @@ export class AuthAssertionError extends Error {
     details;
     constructor(code, message, details) {
         super(message);
-        this.name = "AuthAssertionError";
+        this.name = 'AuthAssertionError';
         this.code = code;
         if (details !== undefined)
             this.details = details;

package/dist/server/authError.js.map

@@ -1 +1 @@
-{"version":3,"file":"authError.js","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AA2DA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,OAAO,CAA6B;IAE7C,YAAY,IAA4B,EAAE,OAAe,EAAE,OAAmC;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACpD,CAAC;CACF","sourcesContent":["import type { AcceptanceRequiredDetails } from \"../acceptance.js\";\nimport type { EmailVerificationRequiredDetails } from \"../email-verification.js\";\n\n/**\n * Typed failure channel for `createAssertAuth`.\n *\n * Every EXPECTED auth outcome (not signed in, email unverified, missing profile,\n * account not in good standing) throws an `AuthAssertionError` whose `code` is\n * deliberately the matching `HttpsError` code string, so a consuming Cloud\n * Function maps it 1:1 at the app boundary:\n *\n *   catch (err) {\n *     if (err instanceof AuthAssertionError) throw new HttpsError(err.code, err.message);\n *     throw err;\n *   }\n *\n * WHY THE PACKAGE MUST NOT BUILD THE HttpsError ITSELF: firebase-functions 7.2.5\n * ships TWO distinct `HttpsError` classes — the one\n * exported from the ESM entry `firebase-functions/v2/https`, and the one the CJS\n * callable runtime closes over and `instanceof`-checks at\n * `lib/common/providers/https.js`. An `HttpsError` constructed by this package's\n * ESM `dist` fails that identity check, so `onCall` logged \"Unhandled error\" and\n * replaced a correct 400 with `500 INTERNAL`. Measured:\n *\n *   ESM class === CJS class ?              false\n *   esm-built error instanceof CJS class ? false\n *   httpErrorCode.status:                  400   (the error itself was correct)\n *\n * Because `assertAuth` is the first line of every callable, that turned EVERY auth\n * rejection — unauthenticated, unverified email, suspended, banned — into a generic\n * 500: users saw a generic error instead of the verify-email dialog, and monitoring\n * filled with 500s that were really expected answers. Constructing the HttpsError in\n * APP module space fixes the identity permanently and cannot regress when\n * firebase-functions repackages.\n *\n * This also brings auth-core in line with engineering-rules QUALITY-102 (generic\n * packages stay framework-agnostic; the consuming app's adapter binds the framework) and\n * mirrors `report-core`'s `ReportCoreTaskError`, which already works this way.\n */\nexport type AuthAssertionErrorCode =\n  | \"unauthenticated\"\n  | \"failed-precondition\"\n  | \"not-found\"\n  | \"permission-denied\";\n\n/**\n * Structured details an `AuthAssertionError` may carry — one per refusal the client answers\n * with a surface of its own, each told apart by `reason`: the email-verification refusal\n * (`reason: 'email-verification-required'`, recognized by `isEmailVerificationRequiredError`)\n * and the acceptance refusal (`reason: 'acceptance-required'`, recognized by\n * `isAcceptanceRequiredError`). The app forwards `details` as the `HttpsError` details so the\n * client can recognize them:\n *\n *   throw new HttpsError(err.code, err.message, err.details);\n *\n * Every other rejection leaves `details` undefined.\n */\nexport type AuthAssertionErrorDetails = AcceptanceRequiredDetails | EmailVerificationRequiredDetails;\n\nexport class AuthAssertionError extends Error {\n  readonly code: AuthAssertionErrorCode;\n  readonly details?: AuthAssertionErrorDetails;\n\n  constructor(code: AuthAssertionErrorCode, message: string, details?: AuthAssertionErrorDetails) {\n    super(message);\n    this.name = \"AuthAssertionError\";\n    this.code = code;\n    if (details !== undefined) this.details = details;\n  }\n}\n"]}
+{"version":3,"file":"authError.js","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,OAAO,CAA6B;IAE7C,YAAY,IAA4B,EAAE,OAAe,EAAE,OAAmC;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACpD,CAAC;CACF","sourcesContent":["import type { AcceptanceRequiredDetails } from '../acceptance.js';\nimport type { EmailVerificationRequiredDetails } from '../email-verification.js';\n\n// firebase-functions' callable runtime instanceof-checks its own HttpsError class, which one built\n// in this package's ESM dist fails (a 500 INTERNAL), so the consuming app builds the HttpsError.\nexport type AuthAssertionErrorCode =\n  'unauthenticated' | 'failed-precondition' | 'not-found' | 'permission-denied';\n\nexport type AuthAssertionErrorDetails =\n  AcceptanceRequiredDetails | EmailVerificationRequiredDetails;\n\nexport class AuthAssertionError extends Error {\n  readonly code: AuthAssertionErrorCode;\n  readonly details?: AuthAssertionErrorDetails;\n\n  constructor(code: AuthAssertionErrorCode, message: string, details?: AuthAssertionErrorDetails) {\n    super(message);\n    this.name = 'AuthAssertionError';\n    this.code = code;\n    if (details !== undefined) this.details = details;\n  }\n}\n"]}

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-export { createAssertAuth } from "./assertAuth.js";
-export { AuthAssertionError } from "./authError.js";
-export type { AuthAssertionErrorCode, AuthAssertionErrorDetails } from "./authError.js";
-export type { AcceptanceGateConfig, AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements, AdminCheckOptions, UserStatus, } from "./types.js";
+export { createAssertAuth } from './assertAuth.js';
+export { AuthAssertionError } from './authError.js';
+export type { AuthAssertionErrorCode, AuthAssertionErrorDetails } from './authError.js';
+export type { AcceptanceGateConfig, AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements, UserStatus, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,GACX,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/server/index.js

@@ -1,4 +1,3 @@
-// Public surface of @ttt-productions/auth-core/server.
-export { createAssertAuth } from "./assertAuth.js";
-export { AuthAssertionError } from "./authError.js";
+export { createAssertAuth } from './assertAuth.js';
+export { AuthAssertionError } from './authError.js';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["// Public surface of @ttt-productions/auth-core/server.\n\nexport { createAssertAuth } from \"./assertAuth.js\";\nexport { AuthAssertionError } from \"./authError.js\";\nexport type { AuthAssertionErrorCode, AuthAssertionErrorDetails } from \"./authError.js\";\nexport type {\n  AcceptanceGateConfig,\n  AssertAuthConfig,\n  AssertAuthFn,\n  AuthContext,\n  AuthRequirements,\n  AdminCheckOptions,\n  UserStatus,\n} from \"./types.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["export { createAssertAuth } from './assertAuth.js';\nexport { AuthAssertionError } from './authError.js';\nexport type { AuthAssertionErrorCode, AuthAssertionErrorDetails } from './authError.js';\nexport type {\n  AcceptanceGateConfig,\n  AssertAuthConfig,\n  AssertAuthFn,\n  AuthContext,\n  AuthRequirements,\n  UserStatus,\n} from './types.js';\n"]}

package/dist/server/types.d.ts

@@ -1,131 +1,31 @@
-import type { CallableRequest } from "firebase-functions/v2/https";
-import type { DecodedIdToken } from "firebase-admin/auth";
-import type { Firestore } from "firebase-admin/firestore";
-/**
- * Per-callable requirements passed at every assertAuth call site.
- * These are application-agnostic.
- */
-export interface AuthRequirements {
-    /**
-     * Allow unverified email. Default: false.
-     * If true, the emailVerified check is skipped entirely.
-     * Special-case for system flows (e.g. user registration).
-     */
+import type { CallableRequest } from 'firebase-functions/v2/https';
+import type { DecodedIdToken } from 'firebase-admin/auth';
+import type { Firestore } from 'firebase-admin/firestore';
+export interface AuthRequirements<TAdminOptions = never> {
     allowUnverified?: boolean;
-    /**
-     * Require email_verified=true on the auth token.
-     * Default: false. Skipped when allowUnverified=true.
-     */
     emailVerified?: boolean;
-    /**
-     * Skip the status check entirely. Special-case for flows where the
-     * user doc may not exist yet (e.g. user registration).
-     * Default: false.
-     */
     allowAnyStatus?: boolean;
-    /**
-     * Allow suspended users to pass the status check. Banned users still fail.
-     * Use ONLY for callables that are a suspended user's last recourse
-     * (e.g. admin-support chat / ban appeal).
-     * Default: false. Does NOT skip the existence check.
-     */
     allowSuspended?: boolean;
-    /**
-     * Let a caller below the currently required acceptance level through. Meaningful only
-     * when the factory was configured with `acceptance`; ignored otherwise.
-     * Use ONLY for callables that must work before the caller accepts: the accept callable
-     * itself, registration (a new account holds no accepted level yet), and last-recourse
-     * paths such as sign-out, support, refunds, account deletion, and legally required
-     * reporting. Default: false.
-     */
     allowUnaccepted?: boolean;
-    /**
-     * Require admin status. Delegates to config.requireAdmin().
-     * The shape of this object is forwarded verbatim to the consumer's
-     * requireAdmin callback — the package does not interpret it.
-     */
-    admin?: AdminCheckOptions;
+    admin?: TAdminOptions;
 }
-/**
- * Options forwarded to the consumer's requireAdmin callback. Generic shape.
- * Consuming apps may add their own fields; the package does not validate.
- */
-export interface AdminCheckOptions {
-    allowJrAdmin?: boolean;
-    useFastCheck?: boolean;
-    errorMessage?: string;
-    [key: string]: unknown;
-}
-/**
- * Return value from assertAuth. Generic over the consuming app's user
- * document type.
- */
 export interface AuthContext<TUser = unknown, TAdmin = void> {
     uid: string;
     token: DecodedIdToken;
-    /** Populated when the user doc was read (default not-banned check). */
     userDoc?: TUser;
-    /** Result returned by config.requireAdmin. Populated only when an admin check ran (AuthRequirements.admin was set). Undefined otherwise. */
     admin?: TAdmin;
 }
-/**
- * Status the consuming app reports for a user doc. The package only
- * interprets these three values.
- */
-export type UserStatus = "active" | "suspended" | "banned";
-/**
- * Configuration for createAssertAuth. The consuming app supplies every
- * app-specific operation as a callback.
- */
-export interface AssertAuthConfig<TUser, TAdmin = void> {
-    /**
-     * Returns the admin Firestore instance. Called every assertAuth invocation
-     * that needs a Firestore read. Implementations typically return
-     * `admin.firestore()` from a memoized handle.
-     */
+export type UserStatus = 'active' | 'suspended' | 'banned';
+export interface AssertAuthConfig<TUser, TAdmin = void, TAdminOptions = never> {
     firestore: () => Firestore;
-    /**
-     * Returns the Firestore document path for a user profile, given a uid.
-     * Example: `userProfiles/${uid}`
-     */
     userProfilePath: (uid: string) => string;
-    /**
-     * Returns the user's status given the user doc data. The package only
-     * acts on 'active' | 'suspended' | 'banned'. Apps may store status in any
-     * field; this callback interprets it.
-     */
     getUserStatus: (user: TUser) => UserStatus;
-    /**
-     * Admin check. Called only when AuthRequirements.admin is set. The
-     * package forwards uid, token, and the admin options verbatim. The
-     * callback throws (typically HttpsError) on failure.
-     */
-    requireAdmin: (uid: string, token: DecodedIdToken, options: AdminCheckOptions) => Promise<TAdmin>;
-    /**
-     * Optional acceptance-level gate. When set, every assertAuth call that does not pass
-     * `allowUnaccepted` refuses a caller whose accepted level (read from the token claim
-     * `claimKey`) is below the level `requiredLevel()` returns. Absent = no gate, exactly the
-     * behavior before the gate existed.
-     */
+    requireAdmin: (uid: string, token: DecodedIdToken, options: TAdminOptions) => Promise<TAdmin>;
     acceptance?: AcceptanceGateConfig;
 }
-/**
- * The consuming app's acceptance-level wiring. The package holds no claim name and no
- * document knowledge: the app names the claim and supplies the current requirement.
- */
 export interface AcceptanceGateConfig {
-    /** The custom claim on the verified ID token that holds the caller's accepted level. */
     claimKey: string;
-    /**
-     * The level currently required. Runs on every gated assertAuth, so it must be cheap —
-     * read it from a cached snapshot, never a fresh Firestore read per call. A non-finite or
-     * non-positive result requires nothing (see `normalizeAcceptanceLevel`); a throw rejects
-     * the call.
-     */
     requiredLevel: () => number | Promise<number>;
 }
-/**
- * The function returned by createAssertAuth.
- */
-export type AssertAuthFn<TUser, TAdmin = void> = (request: CallableRequest, requirements?: AuthRequirements) => Promise<AuthContext<TUser, TAdmin>>;
+export type AssertAuthFn<TUser, TAdmin = void, TAdminOptions = never> = (request: CallableRequest, requirements?: AuthRequirements<TAdminOptions>) => Promise<AuthContext<TUser, TAdmin>>;
 //# sourceMappingURL=types.d.ts.map

package/dist/server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;OAIG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,IAAI;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,cAAc,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,4IAA4I;IAC5I,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IACpD;;;;OAIG;IACH,SAAS,EAAE,MAAM,SAAS,CAAC;IAE3B;;;OAGG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAEzC;;;;OAIG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,UAAU,CAAC;IAE3C;;;;OAIG;IACH,YAAY,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,MAAM,CAAC,CAAC;IAErB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAC/C,OAAO,EAAE,eAAe,EACxB,YAAY,CAAC,EAAE,gBAAgB,KAC5B,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,WAAW,gBAAgB,CAAC,aAAa,GAAG,KAAK;IACrD,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,WAAW,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,IAAI;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,aAAa,GAAG,KAAK;IAC3E,SAAS,EAAE,MAAM,SAAS,CAAC;IAE3B,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAEzC,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,UAAU,CAAC;IAE3C,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9F,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IAEjB,aAAa,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,aAAa,GAAG,KAAK,IAAI,CACtE,OAAO,EAAE,eAAe,EACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,KAC3C,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC"}

package/dist/server/types.js

@@ -1,4 +1,2 @@
-// Types for the createAssertAuth factory. Fully generic over the consuming
-// app's user document shape. The package contains no app-specific knowledge.
 export {};
 //# sourceMappingURL=types.js.map

package/dist/server/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,6EAA6E","sourcesContent":["// Types for the createAssertAuth factory. Fully generic over the consuming\n// app's user document shape. The package contains no app-specific knowledge.\n\nimport type { CallableRequest } from \"firebase-functions/v2/https\";\nimport type { DecodedIdToken } from \"firebase-admin/auth\";\nimport type { Firestore } from \"firebase-admin/firestore\";\n\n/**\n * Per-callable requirements passed at every assertAuth call site.\n * These are application-agnostic.\n */\nexport interface AuthRequirements {\n  /**\n   * Allow unverified email. Default: false.\n   * If true, the emailVerified check is skipped entirely.\n   * Special-case for system flows (e.g. user registration).\n   */\n  allowUnverified?: boolean;\n\n  /**\n   * Require email_verified=true on the auth token.\n   * Default: false. Skipped when allowUnverified=true.\n   */\n  emailVerified?: boolean;\n\n  /**\n   * Skip the status check entirely. Special-case for flows where the\n   * user doc may not exist yet (e.g. user registration).\n   * Default: false.\n   */\n  allowAnyStatus?: boolean;\n\n  /**\n   * Allow suspended users to pass the status check. Banned users still fail.\n   * Use ONLY for callables that are a suspended user's last recourse\n   * (e.g. admin-support chat / ban appeal).\n   * Default: false. Does NOT skip the existence check.\n   */\n  allowSuspended?: boolean;\n\n  /**\n   * Let a caller below the currently required acceptance level through. Meaningful only\n   * when the factory was configured with `acceptance`; ignored otherwise.\n   * Use ONLY for callables that must work before the caller accepts: the accept callable\n   * itself, registration (a new account holds no accepted level yet), and last-recourse\n   * paths such as sign-out, support, refunds, account deletion, and legally required\n   * reporting. Default: false.\n   */\n  allowUnaccepted?: boolean;\n\n  /**\n   * Require admin status. Delegates to config.requireAdmin().\n   * The shape of this object is forwarded verbatim to the consumer's\n   * requireAdmin callback — the package does not interpret it.\n   */\n  admin?: AdminCheckOptions;\n}\n\n/**\n * Options forwarded to the consumer's requireAdmin callback. Generic shape.\n * Consuming apps may add their own fields; the package does not validate.\n */\nexport interface AdminCheckOptions {\n  allowJrAdmin?: boolean;\n  useFastCheck?: boolean;\n  errorMessage?: string;\n  [key: string]: unknown;\n}\n\n/**\n * Return value from assertAuth. Generic over the consuming app's user\n * document type.\n */\nexport interface AuthContext<TUser = unknown, TAdmin = void> {\n  uid: string;\n  token: DecodedIdToken;\n  /** Populated when the user doc was read (default not-banned check). */\n  userDoc?: TUser;\n  /** Result returned by config.requireAdmin. Populated only when an admin check ran (AuthRequirements.admin was set). Undefined otherwise. */\n  admin?: TAdmin;\n}\n\n/**\n * Status the consuming app reports for a user doc. The package only\n * interprets these three values.\n */\nexport type UserStatus = \"active\" | \"suspended\" | \"banned\";\n\n/**\n * Configuration for createAssertAuth. The consuming app supplies every\n * app-specific operation as a callback.\n */\nexport interface AssertAuthConfig<TUser, TAdmin = void> {\n  /**\n   * Returns the admin Firestore instance. Called every assertAuth invocation\n   * that needs a Firestore read. Implementations typically return\n   * `admin.firestore()` from a memoized handle.\n   */\n  firestore: () => Firestore;\n\n  /**\n   * Returns the Firestore document path for a user profile, given a uid.\n   * Example: `userProfiles/${uid}`\n   */\n  userProfilePath: (uid: string) => string;\n\n  /**\n   * Returns the user's status given the user doc data. The package only\n   * acts on 'active' | 'suspended' | 'banned'. Apps may store status in any\n   * field; this callback interprets it.\n   */\n  getUserStatus: (user: TUser) => UserStatus;\n\n  /**\n   * Admin check. Called only when AuthRequirements.admin is set. The\n   * package forwards uid, token, and the admin options verbatim. The\n   * callback throws (typically HttpsError) on failure.\n   */\n  requireAdmin: (\n    uid: string,\n    token: DecodedIdToken,\n    options: AdminCheckOptions\n  ) => Promise<TAdmin>;\n\n  /**\n   * Optional acceptance-level gate. When set, every assertAuth call that does not pass\n   * `allowUnaccepted` refuses a caller whose accepted level (read from the token claim\n   * `claimKey`) is below the level `requiredLevel()` returns. Absent = no gate, exactly the\n   * behavior before the gate existed.\n   */\n  acceptance?: AcceptanceGateConfig;\n}\n\n/**\n * The consuming app's acceptance-level wiring. The package holds no claim name and no\n * document knowledge: the app names the claim and supplies the current requirement.\n */\nexport interface AcceptanceGateConfig {\n  /** The custom claim on the verified ID token that holds the caller's accepted level. */\n  claimKey: string;\n\n  /**\n   * The level currently required. Runs on every gated assertAuth, so it must be cheap —\n   * read it from a cached snapshot, never a fresh Firestore read per call. A non-finite or\n   * non-positive result requires nothing (see `normalizeAcceptanceLevel`); a throw rejects\n   * the call.\n   */\n  requiredLevel: () => number | Promise<number>;\n}\n\n/**\n * The function returned by createAssertAuth.\n */\nexport type AssertAuthFn<TUser, TAdmin = void> = (\n  request: CallableRequest,\n  requirements?: AuthRequirements\n) => Promise<AuthContext<TUser, TAdmin>>;\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { CallableRequest } from 'firebase-functions/v2/https';\nimport type { DecodedIdToken } from 'firebase-admin/auth';\nimport type { Firestore } from 'firebase-admin/firestore';\n\nexport interface AuthRequirements<TAdminOptions = never> {\n  allowUnverified?: boolean;\n\n  emailVerified?: boolean;\n\n  allowAnyStatus?: boolean;\n\n  allowSuspended?: boolean;\n\n  allowUnaccepted?: boolean;\n\n  admin?: TAdminOptions;\n}\n\nexport interface AuthContext<TUser = unknown, TAdmin = void> {\n  uid: string;\n  token: DecodedIdToken;\n  userDoc?: TUser;\n  admin?: TAdmin;\n}\n\nexport type UserStatus = 'active' | 'suspended' | 'banned';\n\nexport interface AssertAuthConfig<TUser, TAdmin = void, TAdminOptions = never> {\n  firestore: () => Firestore;\n\n  userProfilePath: (uid: string) => string;\n\n  getUserStatus: (user: TUser) => UserStatus;\n\n  requireAdmin: (uid: string, token: DecodedIdToken, options: TAdminOptions) => Promise<TAdmin>;\n\n  acceptance?: AcceptanceGateConfig;\n}\n\nexport interface AcceptanceGateConfig {\n  claimKey: string;\n\n  requiredLevel: () => number | Promise<number>;\n}\n\nexport type AssertAuthFn<TUser, TAdmin = void, TAdminOptions = never> = (\n  request: CallableRequest,\n  requirements?: AuthRequirements<TAdminOptions>,\n) => Promise<AuthContext<TUser, TAdmin>>;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@ttt-productions/auth-core",
-    "version": "1.6.15",
+    "version": "1.6.17",
     "description": "Shared Firebase authentication utilities and React hooks for TTT Productions apps",
     "repository": {
         "type": "git",
@@ -21,8 +21,8 @@
             "default": "./dist/index.js"
         },
         "./client": {
-            "types": "./dist/client.d.ts",
-            "default": "./dist/client.js"
+            "types": "./dist/client/index.d.ts",
+            "default": "./dist/client/index.js"
         },
         "./react": {
             "types": "./dist/react/index.d.ts",

package/dist/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAErC,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,WAAW,CAEb"}

package/dist/auth.js

@@ -1,13 +0,0 @@
-import { onAuthStateChanged as fbOnAuthStateChanged } from "firebase/auth";
-export function getAuthUser(auth) {
-    return auth.currentUser;
-}
-/**
- * Thin wrapper around Firebase onAuthStateChanged.
- * - always returns the unsubscribe function
- * - preserves Firebase callback signature
- */
-export function onAuthStateChanged(auth, cb, onError) {
-    return fbOnAuthStateChanged(auth, cb, onError);
-}
-//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,IAAI,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAI3E,MAAM,UAAU,WAAW,CAAC,IAAU;IACpC,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAU,EACV,EAA+B,EAC/B,OAAkC;IAElC,OAAO,oBAAoB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { Auth, User } from \"firebase/auth\";\nimport { onAuthStateChanged as fbOnAuthStateChanged } from \"firebase/auth\";\n\nexport type Unsubscribe = () => void;\n\nexport function getAuthUser(auth: Auth): User | null {\n  return auth.currentUser;\n}\n\n/**\n * Thin wrapper around Firebase onAuthStateChanged.\n * - always returns the unsubscribe function\n * - preserves Firebase callback signature\n */\nexport function onAuthStateChanged(\n  auth: Auth,\n  cb: (user: User | null) => void,\n  onError?: (error: unknown) => void\n): Unsubscribe {\n  return fbOnAuthStateChanged(auth, cb, onError);\n}\n"]}