@ttt-productions/auth-core 1.6.16 → 1.6.17

package/dist/acceptance.d.ts

@@ -1,30 +1,10 @@
-/** The `details.reason` of the refusal a caller below the required level receives. */
 export declare const ACCEPTANCE_REQUIRED_REASON: "acceptance-required";
-/**
- * Structured details carried by the acceptance refusal. Server side it rides
- * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so
- * the client receives it on the callable error's `details`.
- */
 export interface AcceptanceRequiredDetails {
     readonly reason: typeof ACCEPTANCE_REQUIRED_REASON;
-    /** The level the backend currently requires. */
     readonly requiredLevel: number;
-    /** The level read from the caller's token (0 when absent or unreadable). */
     readonly acceptedLevel: number;
 }
-/**
- * Normalize an acceptance level: a finite number ≥ 0, floored to a whole number. Anything
- * else — absent, a string, NaN, a negative — is 0. Applied to BOTH sides of the comparison:
- * an unreadable accepted level can never satisfy a positive requirement, and an unreadable
- * required level requires nothing.
- */
 export declare function normalizeAcceptanceLevel(value: unknown): number;
-/** True when `details` is the acceptance refusal's structured details. */
 export declare function isAcceptanceRequiredDetails(details: unknown): details is AcceptanceRequiredDetails;
-/**
- * True when `err` is the acceptance refusal — a `failed-precondition` whose details carry
- * `reason: 'acceptance-required'`. Works on the server-side error and on the client-side
- * callable error alike, so the app has one recognizer for "show the acceptance prompt".
- */
 export declare function isAcceptanceRequiredError(err: unknown): boolean;
 //# sourceMappingURL=acceptance.d.ts.map

package/dist/acceptance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acceptance.d.ts","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAUA,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,EAAG,qBAA8B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,CAAC;IACnD,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,yBAAyB,CAQtC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/D"}
+{"version":3,"file":"acceptance.d.ts","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B,EAAG,qBAA8B,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,yBAAyB,CAQtC;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/D"}

package/dist/acceptance.js

@@ -1,25 +1,10 @@
-// The acceptance-level contract shared by the server gate (`createAssertAuth`'s optional
-// `acceptance` config on ./server) and the client that answers it. Pure: no Firebase runtime.
-//
-// A consuming app publishes documents its users must accept, and tracks acceptance as a
-// monotonically increasing whole-number LEVEL: the app decides what raises the required level
-// and where the caller's accepted level is stored (a custom claim named by the app). The package
-// only compares the two numbers and reports a refusal in one recognisable shape.
 import { failedPreconditionDetails } from './refusal.js';
-/** The `details.reason` of the refusal a caller below the required level receives. */
 export const ACCEPTANCE_REQUIRED_REASON = 'acceptance-required';
-/**
- * Normalize an acceptance level: a finite number ≥ 0, floored to a whole number. Anything
- * else — absent, a string, NaN, a negative — is 0. Applied to BOTH sides of the comparison:
- * an unreadable accepted level can never satisfy a positive requirement, and an unreadable
- * required level requires nothing.
- */
 export function normalizeAcceptanceLevel(value) {
     if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)
         return 0;
     return Math.floor(value);
 }
-/** True when `details` is the acceptance refusal's structured details. */
 export function isAcceptanceRequiredDetails(details) {
     if (!details || typeof details !== 'object')
         return false;
@@ -28,11 +13,6 @@ export function isAcceptanceRequiredDetails(details) {
         typeof d.requiredLevel === 'number' &&
         typeof d.acceptedLevel === 'number');
 }
-/**
- * True when `err` is the acceptance refusal — a `failed-precondition` whose details carry
- * `reason: 'acceptance-required'`. Works on the server-side error and on the client-side
- * callable error alike, so the app has one recognizer for "show the acceptance prompt".
- */
 export function isAcceptanceRequiredError(err) {
     return isAcceptanceRequiredDetails(failedPreconditionDetails(err));
 }

package/dist/acceptance.js.map

@@ -1 +1 @@
-{"version":3,"file":"acceptance.js","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,8FAA8F;AAC9F,EAAE;AACF,wFAAwF;AACxF,8FAA8F;AAC9F,iGAAiG;AACjG,iFAAiF;AAEjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAA8B,CAAC;AAezE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CACzC,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,0BAA0B;QACvC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC","sourcesContent":["// The acceptance-level contract shared by the server gate (`createAssertAuth`'s optional\n// `acceptance` config on ./server) and the client that answers it. Pure: no Firebase runtime.\n//\n// A consuming app publishes documents its users must accept, and tracks acceptance as a\n// monotonically increasing whole-number LEVEL: the app decides what raises the required level\n// and where the caller's accepted level is stored (a custom claim named by the app). The package\n// only compares the two numbers and reports a refusal in one recognisable shape.\n\nimport { failedPreconditionDetails } from './refusal.js';\n\n/** The `details.reason` of the refusal a caller below the required level receives. */\nexport const ACCEPTANCE_REQUIRED_REASON = 'acceptance-required' as const;\n\n/**\n * Structured details carried by the acceptance refusal. Server side it rides\n * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so\n * the client receives it on the callable error's `details`.\n */\nexport interface AcceptanceRequiredDetails {\n  readonly reason: typeof ACCEPTANCE_REQUIRED_REASON;\n  /** The level the backend currently requires. */\n  readonly requiredLevel: number;\n  /** The level read from the caller's token (0 when absent or unreadable). */\n  readonly acceptedLevel: number;\n}\n\n/**\n * Normalize an acceptance level: a finite number ≥ 0, floored to a whole number. Anything\n * else — absent, a string, NaN, a negative — is 0. Applied to BOTH sides of the comparison:\n * an unreadable accepted level can never satisfy a positive requirement, and an unreadable\n * required level requires nothing.\n */\nexport function normalizeAcceptanceLevel(value: unknown): number {\n  if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) return 0;\n  return Math.floor(value);\n}\n\n/** True when `details` is the acceptance refusal's structured details. */\nexport function isAcceptanceRequiredDetails(\n  details: unknown,\n): details is AcceptanceRequiredDetails {\n  if (!details || typeof details !== 'object') return false;\n  const d = details as Record<string, unknown>;\n  return (\n    d.reason === ACCEPTANCE_REQUIRED_REASON &&\n    typeof d.requiredLevel === 'number' &&\n    typeof d.acceptedLevel === 'number'\n  );\n}\n\n/**\n * True when `err` is the acceptance refusal — a `failed-precondition` whose details carry\n * `reason: 'acceptance-required'`. Works on the server-side error and on the client-side\n * callable error alike, so the app has one recognizer for \"show the acceptance prompt\".\n */\nexport function isAcceptanceRequiredError(err: unknown): boolean {\n  return isAcceptanceRequiredDetails(failedPreconditionDetails(err));\n}\n"]}
+{"version":3,"file":"acceptance.js","sourceRoot":"","sources":["../src/acceptance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAA8B,CAAC;AAQzE,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,0BAA0B;QACvC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC","sourcesContent":["import { failedPreconditionDetails } from './refusal.js';\n\nexport const ACCEPTANCE_REQUIRED_REASON = 'acceptance-required' as const;\n\nexport interface AcceptanceRequiredDetails {\n  readonly reason: typeof ACCEPTANCE_REQUIRED_REASON;\n  readonly requiredLevel: number;\n  readonly acceptedLevel: number;\n}\n\nexport function normalizeAcceptanceLevel(value: unknown): number {\n  if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) return 0;\n  return Math.floor(value);\n}\n\nexport function isAcceptanceRequiredDetails(\n  details: unknown,\n): details is AcceptanceRequiredDetails {\n  if (!details || typeof details !== 'object') return false;\n  const d = details as Record<string, unknown>;\n  return (\n    d.reason === ACCEPTANCE_REQUIRED_REASON &&\n    typeof d.requiredLevel === 'number' &&\n    typeof d.acceptedLevel === 'number'\n  );\n}\n\nexport function isAcceptanceRequiredError(err: unknown): boolean {\n  return isAcceptanceRequiredDetails(failedPreconditionDetails(err));\n}\n"]}

package/dist/client/auth.d.ts

@@ -1,10 +1,5 @@
 import type { Auth, User } from 'firebase/auth';
 export type Unsubscribe = () => void;
 export declare function getAuthUser(auth: Auth): User | null;
-/**
- * Thin wrapper around Firebase onAuthStateChanged.
- * - always returns the unsubscribe function
- * - preserves Firebase callback signature
- */
 export declare function onAuthStateChanged(auth: Auth, cb: (user: User | null) => void, onError?: (error: unknown) => void): Unsubscribe;
 //# sourceMappingURL=auth.d.ts.map

package/dist/client/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAErC,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,WAAW,CAEb"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAErC,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAEnD;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,WAAW,CAEb"}

package/dist/client/auth.js

@@ -2,11 +2,6 @@ import { onAuthStateChanged as fbOnAuthStateChanged } from 'firebase/auth';
 export function getAuthUser(auth) {
     return auth.currentUser;
 }
-/**
- * Thin wrapper around Firebase onAuthStateChanged.
- * - always returns the unsubscribe function
- * - preserves Firebase callback signature
- */
 export function onAuthStateChanged(auth, cb, onError) {
     return fbOnAuthStateChanged(auth, cb, onError);
 }

package/dist/client/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,IAAI,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAI3E,MAAM,UAAU,WAAW,CAAC,IAAU;IACpC,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAU,EACV,EAA+B,EAC/B,OAAkC;IAElC,OAAO,oBAAoB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { Auth, User } from 'firebase/auth';\nimport { onAuthStateChanged as fbOnAuthStateChanged } from 'firebase/auth';\n\nexport type Unsubscribe = () => void;\n\nexport function getAuthUser(auth: Auth): User | null {\n  return auth.currentUser;\n}\n\n/**\n * Thin wrapper around Firebase onAuthStateChanged.\n * - always returns the unsubscribe function\n * - preserves Firebase callback signature\n */\nexport function onAuthStateChanged(\n  auth: Auth,\n  cb: (user: User | null) => void,\n  onError?: (error: unknown) => void,\n): Unsubscribe {\n  return fbOnAuthStateChanged(auth, cb, onError);\n}\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,IAAI,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAI3E,MAAM,UAAU,WAAW,CAAC,IAAU;IACpC,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAU,EACV,EAA+B,EAC/B,OAAkC;IAElC,OAAO,oBAAoB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { Auth, User } from 'firebase/auth';\nimport { onAuthStateChanged as fbOnAuthStateChanged } from 'firebase/auth';\n\nexport type Unsubscribe = () => void;\n\nexport function getAuthUser(auth: Auth): User | null {\n  return auth.currentUser;\n}\n\nexport function onAuthStateChanged(\n  auth: Auth,\n  cb: (user: User | null) => void,\n  onError?: (error: unknown) => void,\n): Unsubscribe {\n  return fbOnAuthStateChanged(auth, cb, onError);\n}\n"]}

package/dist/client/claims.d.ts

@@ -4,35 +4,8 @@ export type ParsedClaims = {
     roles: string[];
     raw: IdTokenClaims;
 };
-/**
- * Get the current user's ID token claims.
- * Returns null if no current user.
- *
- * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is
- * verified but the cached token claim still says it is not, force-mint a fresh
- * token and return ITS claims. Firebase ID tokens live for up to an hour and a
- * backend-side `emailVerified` flip (verification link applied elsewhere, or an
- * Admin SDK update) never invalidates them — without this, the UI (account
- * state) believes the user is verified while every backend call (token claim)
- * rejects with "Email must be verified" until the token happens to rotate.
- * One forced mint converges the two (the fresh token carries
- * `email_verified: true`); the check is directional, so an already-consistent
- * user never pays a forced refresh.
- */
 export declare function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null>;
-/**
- * Forces refresh of ID token + claims.
- * Returns null if no current user.
- */
 export declare function refreshClaims(user: User | null): Promise<IdTokenClaims | null>;
-/**
- * Convenience helper when you only have Auth.
- */
 export declare function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null>;
-/**
- * Keep parsing intentionally minimal and generic:
- * - normalize "roles" into string[]
- * - keep raw claims attached
- */
 export declare function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims;
 //# sourceMappingURL=claims.d.ts.map

package/dist/client/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/client/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IAEzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,GAAG,EAAE,aAAa,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQvF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAIpF;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAWlF"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/client/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,aAAa,CAAC;CACpB,CAAC;AAEF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQvF;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAIpF;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAWlF"}

package/dist/client/claims.js

@@ -1,18 +1,3 @@
-/**
- * Get the current user's ID token claims.
- * Returns null if no current user.
- *
- * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is
- * verified but the cached token claim still says it is not, force-mint a fresh
- * token and return ITS claims. Firebase ID tokens live for up to an hour and a
- * backend-side `emailVerified` flip (verification link applied elsewhere, or an
- * Admin SDK update) never invalidates them — without this, the UI (account
- * state) believes the user is verified while every backend call (token claim)
- * rejects with "Email must be verified" until the token happens to rotate.
- * One forced mint converges the two (the fresh token carries
- * `email_verified: true`); the check is directional, so an already-consistent
- * user never pays a forced refresh.
- */
 export async function getIdTokenClaims(user) {
     if (!user)
         return null;
@@ -23,27 +8,15 @@ export async function getIdTokenClaims(user) {
     }
     return res.claims;
 }
-/**
- * Forces refresh of ID token + claims.
- * Returns null if no current user.
- */
 export async function refreshClaims(user) {
     if (!user)
         return null;
     const res = await user.getIdTokenResult(true);
     return res.claims;
 }
-/**
- * Convenience helper when you only have Auth.
- */
 export async function refreshClaimsFromAuth(auth) {
     return refreshClaims(auth.currentUser);
 }
-/**
- * Keep parsing intentionally minimal and generic:
- * - normalize "roles" into string[]
- * - keep raw claims attached
- */
 export function parseClaims(claims) {
     const raw = (claims ?? {});
     const rolesValue = raw.roles;

package/dist/client/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/client/claims.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAiB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAU;IACpD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwC;IAClE,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAkB,CAAC;IAE5C,MAAM,UAAU,GAAI,GAAW,CAAC,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjD,CAAC,CAAC,OAAO,UAAU,KAAK,QAAQ;YAC9B,CAAC,CAAC,CAAC,UAAU,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import type { Auth, User, IdTokenResult } from 'firebase/auth';\n\nexport type IdTokenClaims = IdTokenResult['claims'];\n\nexport type ParsedClaims = {\n  // common defaults (kept generic)\n  roles: string[];\n  // raw claims for app-level decisions\n  raw: IdTokenClaims;\n};\n\n/**\n * Get the current user's ID token claims.\n * Returns null if no current user.\n *\n * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is\n * verified but the cached token claim still says it is not, force-mint a fresh\n * token and return ITS claims. Firebase ID tokens live for up to an hour and a\n * backend-side `emailVerified` flip (verification link applied elsewhere, or an\n * Admin SDK update) never invalidates them — without this, the UI (account\n * state) believes the user is verified while every backend call (token claim)\n * rejects with \"Email must be verified\" until the token happens to rotate.\n * One forced mint converges the two (the fresh token carries\n * `email_verified: true`); the check is directional, so an already-consistent\n * user never pays a forced refresh.\n */\nexport async function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(false);\n  if (user.emailVerified === true && res.claims.email_verified !== true) {\n    const fresh = await user.getIdTokenResult(true);\n    return fresh.claims;\n  }\n  return res.claims;\n}\n\n/**\n * Forces refresh of ID token + claims.\n * Returns null if no current user.\n */\nexport async function refreshClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(true);\n  return res.claims;\n}\n\n/**\n * Convenience helper when you only have Auth.\n */\nexport async function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null> {\n  return refreshClaims(auth.currentUser);\n}\n\n/**\n * Keep parsing intentionally minimal and generic:\n * - normalize \"roles\" into string[]\n * - keep raw claims attached\n */\nexport function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims {\n  const raw = (claims ?? {}) as IdTokenClaims;\n\n  const rolesValue = (raw as any).roles;\n  const roles = Array.isArray(rolesValue)\n    ? rolesValue.filter((x) => typeof x === 'string')\n    : typeof rolesValue === 'string'\n      ? [rolesValue]\n      : [];\n\n  return { roles, raw };\n}\n"]}
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/client/claims.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAiB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAU;IACpD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAwC;IAClE,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAkB,CAAC;IAE5C,MAAM,UAAU,GAAI,GAAW,CAAC,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjD,CAAC,CAAC,OAAO,UAAU,KAAK,QAAQ;YAC9B,CAAC,CAAC,CAAC,UAAU,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import type { Auth, User, IdTokenResult } from 'firebase/auth';\n\nexport type IdTokenClaims = IdTokenResult['claims'];\n\nexport type ParsedClaims = {\n  roles: string[];\n  raw: IdTokenClaims;\n};\n\nexport async function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(false);\n  if (user.emailVerified === true && res.claims.email_verified !== true) {\n    const fresh = await user.getIdTokenResult(true);\n    return fresh.claims;\n  }\n  return res.claims;\n}\n\nexport async function refreshClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(true);\n  return res.claims;\n}\n\nexport async function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null> {\n  return refreshClaims(auth.currentUser);\n}\n\nexport function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims {\n  const raw = (claims ?? {}) as IdTokenClaims;\n\n  const rolesValue = (raw as any).roles;\n  const roles = Array.isArray(rolesValue)\n    ? rolesValue.filter((x) => typeof x === 'string')\n    : typeof rolesValue === 'string'\n      ? [rolesValue]\n      : [];\n\n  return { roles, raw };\n}\n"]}

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAGA,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC"}

package/dist/client/index.js

@@ -1,6 +1,3 @@
-// Firebase *client* auth runtime. Importing this subpath pulls firebase/auth
-// at runtime (e.g. onAuthStateChanged), so it is intentionally kept off the
-// pure root. The pure root exposes only contracts/config/errors.
 export * from './auth.js';
 export * from './claims.js';
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,iEAAiE;AACjE,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC","sourcesContent":["// Firebase *client* auth runtime. Importing this subpath pulls firebase/auth\n// at runtime (e.g. onAuthStateChanged), so it is intentionally kept off the\n// pure root. The pure root exposes only contracts/config/errors.\nexport * from './auth.js';\nexport * from './claims.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC","sourcesContent":["export * from './auth.js';\nexport * from './claims.js';\n"]}

package/dist/email-verification.d.ts

@@ -1,20 +1,7 @@
-/** The `details.reason` of the refusal a caller without a verified email receives. */
 export declare const EMAIL_VERIFICATION_REQUIRED_REASON: "email-verification-required";
-/**
- * Structured details carried by the email-verification refusal. Server side it rides
- * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so
- * the client receives it on the callable error's `details`.
- */
 export interface EmailVerificationRequiredDetails {
     readonly reason: typeof EMAIL_VERIFICATION_REQUIRED_REASON;
 }
-/** True when `details` is the email-verification refusal's structured details. */
 export declare function isEmailVerificationRequiredDetails(details: unknown): details is EmailVerificationRequiredDetails;
-/**
- * True when `err` is the email-verification refusal — a `failed-precondition` whose details
- * carry `reason: 'email-verification-required'`. Works on the server-side error and on the
- * client-side callable error alike, so the app has one recognizer for "show the verify-email
- * surface".
- */
 export declare function isEmailVerificationRequiredError(err: unknown): boolean;
 //# sourceMappingURL=email-verification.d.ts.map

package/dist/email-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.d.ts","sourceRoot":"","sources":["../src/email-verification.ts"],"names":[],"mappings":"AAWA,sFAAsF;AACtF,eAAO,MAAM,kCAAkC,EAAG,6BAAsC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,OAAO,kCAAkC,CAAC;CAC5D;AAED,kFAAkF;AAClF,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,gCAAgC,CAG7C;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtE"}
+{"version":3,"file":"email-verification.d.ts","sourceRoot":"","sources":["../src/email-verification.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,kCAAkC,EAAG,6BAAsC,CAAC;AAEzF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,OAAO,kCAAkC,CAAC;CAC5D;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,gCAAgC,CAG7C;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtE"}

package/dist/email-verification.js

@@ -1,26 +1,10 @@
-// The email-verification refusal contract shared by the server gate (`createAssertAuth`'s
-// `emailVerified` requirement on ./server) and the client that answers it. Pure: no Firebase
-// runtime.
-//
-// A callable that requires a verified email refuses a caller whose ID token is not
-// email-verified. The package owns that refusal, so it owns its one recognisable shape: a
-// `failed-precondition` whose details name the reason. The client tells it apart from every
-// other failed-precondition by that reason — never by the message text.
 import { failedPreconditionDetails } from './refusal.js';
-/** The `details.reason` of the refusal a caller without a verified email receives. */
 export const EMAIL_VERIFICATION_REQUIRED_REASON = 'email-verification-required';
-/** True when `details` is the email-verification refusal's structured details. */
 export function isEmailVerificationRequiredDetails(details) {
     if (!details || typeof details !== 'object')
         return false;
     return details.reason === EMAIL_VERIFICATION_REQUIRED_REASON;
 }
-/**
- * True when `err` is the email-verification refusal — a `failed-precondition` whose details
- * carry `reason: 'email-verification-required'`. Works on the server-side error and on the
- * client-side callable error alike, so the app has one recognizer for "show the verify-email
- * surface".
- */
 export function isEmailVerificationRequiredError(err) {
     return isEmailVerificationRequiredDetails(failedPreconditionDetails(err));
 }

package/dist/email-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.js","sourceRoot":"","sources":["../src/email-verification.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,6FAA6F;AAC7F,WAAW;AACX,EAAE;AACF,mFAAmF;AACnF,0FAA0F;AAC1F,4FAA4F;AAC5F,wEAAwE;AAExE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,sFAAsF;AACtF,MAAM,CAAC,MAAM,kCAAkC,GAAG,6BAAsC,CAAC;AAWzF,kFAAkF;AAClF,MAAM,UAAU,kCAAkC,CAChD,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAQ,OAAmC,CAAC,MAAM,KAAK,kCAAkC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,OAAO,kCAAkC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["// The email-verification refusal contract shared by the server gate (`createAssertAuth`'s\n// `emailVerified` requirement on ./server) and the client that answers it. Pure: no Firebase\n// runtime.\n//\n// A callable that requires a verified email refuses a caller whose ID token is not\n// email-verified. The package owns that refusal, so it owns its one recognisable shape: a\n// `failed-precondition` whose details name the reason. The client tells it apart from every\n// other failed-precondition by that reason — never by the message text.\n\nimport { failedPreconditionDetails } from './refusal.js';\n\n/** The `details.reason` of the refusal a caller without a verified email receives. */\nexport const EMAIL_VERIFICATION_REQUIRED_REASON = 'email-verification-required' as const;\n\n/**\n * Structured details carried by the email-verification refusal. Server side it rides\n * `AuthAssertionError.details`; the consuming app forwards it as the `HttpsError` details, so\n * the client receives it on the callable error's `details`.\n */\nexport interface EmailVerificationRequiredDetails {\n  readonly reason: typeof EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\n/** True when `details` is the email-verification refusal's structured details. */\nexport function isEmailVerificationRequiredDetails(\n  details: unknown,\n): details is EmailVerificationRequiredDetails {\n  if (!details || typeof details !== 'object') return false;\n  return (details as Record<string, unknown>).reason === EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\n/**\n * True when `err` is the email-verification refusal — a `failed-precondition` whose details\n * carry `reason: 'email-verification-required'`. Works on the server-side error and on the\n * client-side callable error alike, so the app has one recognizer for \"show the verify-email\n * surface\".\n */\nexport function isEmailVerificationRequiredError(err: unknown): boolean {\n  return isEmailVerificationRequiredDetails(failedPreconditionDetails(err));\n}\n"]}
+{"version":3,"file":"email-verification.js","sourceRoot":"","sources":["../src/email-verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,CAAC,MAAM,kCAAkC,GAAG,6BAAsC,CAAC;AAMzF,MAAM,UAAU,kCAAkC,CAChD,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAQ,OAAmC,CAAC,MAAM,KAAK,kCAAkC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,OAAO,kCAAkC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import { failedPreconditionDetails } from './refusal.js';\n\nexport const EMAIL_VERIFICATION_REQUIRED_REASON = 'email-verification-required' as const;\n\nexport interface EmailVerificationRequiredDetails {\n  readonly reason: typeof EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\nexport function isEmailVerificationRequiredDetails(\n  details: unknown,\n): details is EmailVerificationRequiredDetails {\n  if (!details || typeof details !== 'object') return false;\n  return (details as Record<string, unknown>).reason === EMAIL_VERIFICATION_REQUIRED_REASON;\n}\n\nexport function isEmailVerificationRequiredError(err: unknown): boolean {\n  return isEmailVerificationRequiredDetails(failedPreconditionDetails(err));\n}\n"]}

package/dist/errors.d.ts

@@ -5,9 +5,7 @@ export type NormalizedAuthError = {
     firebaseCode?: string;
     details?: Record<string, unknown>;
 };
-/** The copy for every auth failure no mapped code covers. */
 export declare const UNKNOWN_AUTH_ERROR_MESSAGE = "Authentication error. Please try again.";
 export declare function normalizeAuthError(err: unknown, details?: Record<string, unknown>): NormalizedAuthError;
-/** Convenience: returns just the user-facing message string */
 export declare function getErrorMessage(error: unknown): string;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,oBAAoB,GACpB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,+CAA+C,GAC/C,8BAA8B,GAC9B,gCAAgC,GAChC,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAwFF,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,4CAA4C,CAAC;AAEpF,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,mBAAmB,CAsBrB;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,oBAAoB,GACpB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,+CAA+C,GAC/C,8BAA8B,GAC9B,gCAAgC,GAChC,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAqFF,eAAO,MAAM,0BAA0B,4CAA4C,CAAC;AAEpF,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,mBAAmB,CAoBrB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/errors.js

@@ -70,9 +70,6 @@ const MAP = {
         code: 'AUTH_CREDENTIAL_ALREADY_IN_USE',
         message: 'Those credentials are already associated with another account.',
     },
-    // Email-action (oobCode) links — password reset, email verification, email recovery.
-    // The copy is deliberately generic: it never reveals whether an account exists, and it
-    // always points at the one recovery affordance (request a fresh link).
     'auth/expired-action-code': {
         code: 'AUTH_EXPIRED_ACTION_CODE',
         message: 'This email action link has expired. Request a new link and try again.',
@@ -82,7 +79,6 @@ const MAP = {
         message: 'This email action link is invalid or has already been used. Request a new link and try again.',
     },
 };
-/** The copy for every auth failure no mapped code covers. */
 export const UNKNOWN_AUTH_ERROR_MESSAGE = 'Authentication error. Please try again.';
 export function normalizeAuthError(err, details) {
     const firebaseCode = pickFirebaseCode(err);
@@ -95,9 +91,7 @@ export function normalizeAuthError(err, details) {
             details,
         };
     }
-    // Never the error's own message: for an unclassified failure it is the SDK's internal diagnostic
-    // ("Firebase: Cloud function deadline exceeded. (auth/internal-error)."), not an answer the person
-    // can act on. The consumer reports the error itself to its monitoring.
+    // Never the error's own message: for an unclassified failure it is the SDK's internal diagnostic.
     return {
         code: 'AUTH_UNKNOWN',
         message: UNKNOWN_AUTH_ERROR_MESSAGE,
@@ -105,7 +99,6 @@ export function normalizeAuthError(err, details) {
         details,
     };
 }
-/** Convenience: returns just the user-facing message string */
 export function getErrorMessage(error) {
     return normalizeAuthError(error).message;
 }

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA4BA,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,GAAU,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAA6D;IACpE,6BAA6B,EAAE;QAC7B,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,wDAAwD;KAClE;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;KACrC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2CAA2C;KACrD;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wBAAwB;KAClC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iCAAiC;KAC3C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,mCAAmC;KAC7C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,qBAAqB;KAC/B;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,wBAAwB;KAClC;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+BAA+B;KACzC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uBAAuB;KACjC;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uCAAuC;KACjD;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,wCAAwC;KAClD;IACD,+CAA+C,EAAE;QAC/C,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,4DAA4D;KACtE;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,kDAAkD;KAC5D;IACD,gCAAgC,EAAE;QAChC,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,gEAAgE;KAC1E;IACD,qFAAqF;IACrF,uFAAuF;IACvF,uEAAuE;IACvE,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uEAAuE;KACjF;IACD,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EACL,+FAA+F;KAClG;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,yCAAyC,CAAC;AAEpF,MAAM,UAAU,kBAAkB,CAChC,GAAY,EACZ,OAAiC;IAEjC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY;YACZ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,mGAAmG;IACnG,uEAAuE;IACvE,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,0BAA0B;QACnC,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC","sourcesContent":["export type AuthErrorCode =\n  | 'AUTH_UNKNOWN'\n  | 'AUTH_NETWORK_ERROR'\n  | 'AUTH_TOO_MANY_REQUESTS'\n  | 'AUTH_POPUP_CLOSED'\n  | 'AUTH_POPUP_BLOCKED'\n  | 'AUTH_CANCELLED'\n  | 'AUTH_USER_DISABLED'\n  | 'AUTH_USER_NOT_FOUND'\n  | 'AUTH_WRONG_PASSWORD'\n  | 'AUTH_INVALID_EMAIL'\n  | 'AUTH_EMAIL_ALREADY_IN_USE'\n  | 'AUTH_WEAK_PASSWORD'\n  | 'AUTH_REQUIRES_RECENT_LOGIN'\n  | 'AUTH_INVALID_CREDENTIAL'\n  | 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL'\n  | 'AUTH_PROVIDER_ALREADY_LINKED'\n  | 'AUTH_CREDENTIAL_ALREADY_IN_USE'\n  | 'AUTH_EXPIRED_ACTION_CODE'\n  | 'AUTH_INVALID_ACTION_CODE';\n\nexport type NormalizedAuthError = {\n  code: AuthErrorCode;\n  message: string;\n  firebaseCode?: string;\n  details?: Record<string, unknown>;\n};\n\nfunction pickFirebaseCode(err: unknown): string | undefined {\n  if (!err || typeof err !== 'object') return undefined;\n  const anyErr = err as any;\n  const c = anyErr.code;\n  return typeof c === 'string' ? c : undefined;\n}\n\nconst MAP: Record<string, { code: AuthErrorCode; message: string }> = {\n  'auth/network-request-failed': {\n    code: 'AUTH_NETWORK_ERROR',\n    message: 'Network error. Please check your connection and try again.',\n  },\n  'auth/too-many-requests': {\n    code: 'AUTH_TOO_MANY_REQUESTS',\n    message: 'Too many attempts. Please wait a moment and try again.',\n  },\n  'auth/popup-closed-by-user': {\n    code: 'AUTH_POPUP_CLOSED',\n    message: 'Sign-in popup was closed.',\n  },\n  'auth/popup-blocked': {\n    code: 'AUTH_POPUP_BLOCKED',\n    message: 'Sign-in popup was blocked by the browser.',\n  },\n  'auth/cancelled-popup-request': {\n    code: 'AUTH_CANCELLED',\n    message: 'Sign-in was cancelled.',\n  },\n  'auth/user-disabled': {\n    code: 'AUTH_USER_DISABLED',\n    message: 'This account has been disabled.',\n  },\n  'auth/user-not-found': {\n    code: 'AUTH_USER_NOT_FOUND',\n    message: 'No account found with that email.',\n  },\n  'auth/wrong-password': {\n    code: 'AUTH_WRONG_PASSWORD',\n    message: 'Incorrect password.',\n  },\n  'auth/invalid-email': {\n    code: 'AUTH_INVALID_EMAIL',\n    message: 'Invalid email address.',\n  },\n  'auth/email-already-in-use': {\n    code: 'AUTH_EMAIL_ALREADY_IN_USE',\n    message: 'That email is already in use.',\n  },\n  'auth/weak-password': {\n    code: 'AUTH_WEAK_PASSWORD',\n    message: 'Password is too weak.',\n  },\n  'auth/requires-recent-login': {\n    code: 'AUTH_REQUIRES_RECENT_LOGIN',\n    message: 'Please re-authenticate and try again.',\n  },\n  'auth/invalid-credential': {\n    code: 'AUTH_INVALID_CREDENTIAL',\n    message: 'Invalid credentials. Please try again.',\n  },\n  'auth/account-exists-with-different-credential': {\n    code: 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL',\n    message: 'An account already exists with a different sign-in method.',\n  },\n  'auth/provider-already-linked': {\n    code: 'AUTH_PROVIDER_ALREADY_LINKED',\n    message: 'That provider is already linked to this account.',\n  },\n  'auth/credential-already-in-use': {\n    code: 'AUTH_CREDENTIAL_ALREADY_IN_USE',\n    message: 'Those credentials are already associated with another account.',\n  },\n  // Email-action (oobCode) links — password reset, email verification, email recovery.\n  // The copy is deliberately generic: it never reveals whether an account exists, and it\n  // always points at the one recovery affordance (request a fresh link).\n  'auth/expired-action-code': {\n    code: 'AUTH_EXPIRED_ACTION_CODE',\n    message: 'This email action link has expired. Request a new link and try again.',\n  },\n  'auth/invalid-action-code': {\n    code: 'AUTH_INVALID_ACTION_CODE',\n    message:\n      'This email action link is invalid or has already been used. Request a new link and try again.',\n  },\n};\n\n/** The copy for every auth failure no mapped code covers. */\nexport const UNKNOWN_AUTH_ERROR_MESSAGE = 'Authentication error. Please try again.';\n\nexport function normalizeAuthError(\n  err: unknown,\n  details?: Record<string, unknown>,\n): NormalizedAuthError {\n  const firebaseCode = pickFirebaseCode(err);\n\n  const mapped = firebaseCode ? MAP[firebaseCode] : undefined;\n  if (mapped) {\n    return {\n      code: mapped.code,\n      message: mapped.message,\n      firebaseCode,\n      details,\n    };\n  }\n\n  // Never the error's own message: for an unclassified failure it is the SDK's internal diagnostic\n  // (\"Firebase: Cloud function deadline exceeded. (auth/internal-error).\"), not an answer the person\n  // can act on. The consumer reports the error itself to its monitoring.\n  return {\n    code: 'AUTH_UNKNOWN',\n    message: UNKNOWN_AUTH_ERROR_MESSAGE,\n    firebaseCode,\n    details,\n  };\n}\n\n/** Convenience: returns just the user-facing message string */\nexport function getErrorMessage(error: unknown): string {\n  return normalizeAuthError(error).message;\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA4BA,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,GAAU,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAA6D;IACpE,6BAA6B,EAAE;QAC7B,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,wDAAwD;KAClE;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;KACrC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2CAA2C;KACrD;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wBAAwB;KAClC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iCAAiC;KAC3C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,mCAAmC;KAC7C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,qBAAqB;KAC/B;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,wBAAwB;KAClC;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+BAA+B;KACzC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uBAAuB;KACjC;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uCAAuC;KACjD;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,wCAAwC;KAClD;IACD,+CAA+C,EAAE;QAC/C,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,4DAA4D;KACtE;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,kDAAkD;KAC5D;IACD,gCAAgC,EAAE;QAChC,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,gEAAgE;KAC1E;IACD,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uEAAuE;KACjF;IACD,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EACL,+FAA+F;KAClG;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,yCAAyC,CAAC;AAEpF,MAAM,UAAU,kBAAkB,CAChC,GAAY,EACZ,OAAiC;IAEjC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY;YACZ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,kGAAkG;IAClG,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,0BAA0B;QACnC,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC","sourcesContent":["export type AuthErrorCode =\n  | 'AUTH_UNKNOWN'\n  | 'AUTH_NETWORK_ERROR'\n  | 'AUTH_TOO_MANY_REQUESTS'\n  | 'AUTH_POPUP_CLOSED'\n  | 'AUTH_POPUP_BLOCKED'\n  | 'AUTH_CANCELLED'\n  | 'AUTH_USER_DISABLED'\n  | 'AUTH_USER_NOT_FOUND'\n  | 'AUTH_WRONG_PASSWORD'\n  | 'AUTH_INVALID_EMAIL'\n  | 'AUTH_EMAIL_ALREADY_IN_USE'\n  | 'AUTH_WEAK_PASSWORD'\n  | 'AUTH_REQUIRES_RECENT_LOGIN'\n  | 'AUTH_INVALID_CREDENTIAL'\n  | 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL'\n  | 'AUTH_PROVIDER_ALREADY_LINKED'\n  | 'AUTH_CREDENTIAL_ALREADY_IN_USE'\n  | 'AUTH_EXPIRED_ACTION_CODE'\n  | 'AUTH_INVALID_ACTION_CODE';\n\nexport type NormalizedAuthError = {\n  code: AuthErrorCode;\n  message: string;\n  firebaseCode?: string;\n  details?: Record<string, unknown>;\n};\n\nfunction pickFirebaseCode(err: unknown): string | undefined {\n  if (!err || typeof err !== 'object') return undefined;\n  const anyErr = err as any;\n  const c = anyErr.code;\n  return typeof c === 'string' ? c : undefined;\n}\n\nconst MAP: Record<string, { code: AuthErrorCode; message: string }> = {\n  'auth/network-request-failed': {\n    code: 'AUTH_NETWORK_ERROR',\n    message: 'Network error. Please check your connection and try again.',\n  },\n  'auth/too-many-requests': {\n    code: 'AUTH_TOO_MANY_REQUESTS',\n    message: 'Too many attempts. Please wait a moment and try again.',\n  },\n  'auth/popup-closed-by-user': {\n    code: 'AUTH_POPUP_CLOSED',\n    message: 'Sign-in popup was closed.',\n  },\n  'auth/popup-blocked': {\n    code: 'AUTH_POPUP_BLOCKED',\n    message: 'Sign-in popup was blocked by the browser.',\n  },\n  'auth/cancelled-popup-request': {\n    code: 'AUTH_CANCELLED',\n    message: 'Sign-in was cancelled.',\n  },\n  'auth/user-disabled': {\n    code: 'AUTH_USER_DISABLED',\n    message: 'This account has been disabled.',\n  },\n  'auth/user-not-found': {\n    code: 'AUTH_USER_NOT_FOUND',\n    message: 'No account found with that email.',\n  },\n  'auth/wrong-password': {\n    code: 'AUTH_WRONG_PASSWORD',\n    message: 'Incorrect password.',\n  },\n  'auth/invalid-email': {\n    code: 'AUTH_INVALID_EMAIL',\n    message: 'Invalid email address.',\n  },\n  'auth/email-already-in-use': {\n    code: 'AUTH_EMAIL_ALREADY_IN_USE',\n    message: 'That email is already in use.',\n  },\n  'auth/weak-password': {\n    code: 'AUTH_WEAK_PASSWORD',\n    message: 'Password is too weak.',\n  },\n  'auth/requires-recent-login': {\n    code: 'AUTH_REQUIRES_RECENT_LOGIN',\n    message: 'Please re-authenticate and try again.',\n  },\n  'auth/invalid-credential': {\n    code: 'AUTH_INVALID_CREDENTIAL',\n    message: 'Invalid credentials. Please try again.',\n  },\n  'auth/account-exists-with-different-credential': {\n    code: 'AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL',\n    message: 'An account already exists with a different sign-in method.',\n  },\n  'auth/provider-already-linked': {\n    code: 'AUTH_PROVIDER_ALREADY_LINKED',\n    message: 'That provider is already linked to this account.',\n  },\n  'auth/credential-already-in-use': {\n    code: 'AUTH_CREDENTIAL_ALREADY_IN_USE',\n    message: 'Those credentials are already associated with another account.',\n  },\n  'auth/expired-action-code': {\n    code: 'AUTH_EXPIRED_ACTION_CODE',\n    message: 'This email action link has expired. Request a new link and try again.',\n  },\n  'auth/invalid-action-code': {\n    code: 'AUTH_INVALID_ACTION_CODE',\n    message:\n      'This email action link is invalid or has already been used. Request a new link and try again.',\n  },\n};\n\nexport const UNKNOWN_AUTH_ERROR_MESSAGE = 'Authentication error. Please try again.';\n\nexport function normalizeAuthError(\n  err: unknown,\n  details?: Record<string, unknown>,\n): NormalizedAuthError {\n  const firebaseCode = pickFirebaseCode(err);\n\n  const mapped = firebaseCode ? MAP[firebaseCode] : undefined;\n  if (mapped) {\n    return {\n      code: mapped.code,\n      message: mapped.message,\n      firebaseCode,\n      details,\n    };\n  }\n\n  // Never the error's own message: for an unclassified failure it is the SDK's internal diagnostic.\n  return {\n    code: 'AUTH_UNKNOWN',\n    message: UNKNOWN_AUTH_ERROR_MESSAGE,\n    firebaseCode,\n    details,\n  };\n}\n\nexport function getErrorMessage(error: unknown): string {\n  return normalizeAuthError(error).message;\n}\n"]}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -1,10 +1,3 @@
-// Pure root: contracts, normalized errors, environment helpers.
-// Nothing here imports firebase/auth at runtime.
-//
-// Client auth runtime (onAuthStateChanged wrapper, getAuthUser, ID-token claims) lives behind
-// "@ttt-productions/auth-core/client". Admin/Functions helpers live behind
-// "@ttt-productions/auth-core/server". React hooks live behind
-// "@ttt-productions/auth-core/react".
 export * from './errors.js';
 export * from './env.js';
 export * from './acceptance.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,8FAA8F;AAC9F,2EAA2E;AAC3E,+DAA+D;AAC/D,sCAAsC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC","sourcesContent":["// Pure root: contracts, normalized errors, environment helpers.\n// Nothing here imports firebase/auth at runtime.\n//\n// Client auth runtime (onAuthStateChanged wrapper, getAuthUser, ID-token claims) lives behind\n// \"@ttt-productions/auth-core/client\". Admin/Functions helpers live behind\n// \"@ttt-productions/auth-core/server\". React hooks live behind\n// \"@ttt-productions/auth-core/react\".\nexport * from './errors.js';\nexport * from './env.js';\nexport * from './acceptance.js';\nexport * from './email-verification.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC","sourcesContent":["export * from './errors.js';\nexport * from './env.js';\nexport * from './acceptance.js';\nexport * from './email-verification.js';\n"]}

package/dist/react/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAIf,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAYvE,eAAO,MAAM,WAAW,uDAAoD,CAAC;AAE7E,UAAU,iBAAiB,CAAC,OAAO;IACjC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC9D,MAAM,EACN,QAAQ,GACT,EAAE,iBAAiB,CAAC,OAAO,CAAC,+BAgI5B"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAIf,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAQvE,eAAO,MAAM,WAAW,uDAAoD,CAAC;AAE7E,UAAU,iBAAiB,CAAC,OAAO;IACjC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC9D,MAAM,EACN,QAAQ,GACT,EAAE,iBAAiB,CAAC,OAAO,CAAC,+BAwG5B"}

package/dist/react/AuthProvider.js

@@ -6,22 +6,13 @@ import { getIdTokenClaims } from '../client/claims.js';
 export const AuthContext = createContext(null);
 export function AuthProvider({ config, children, }) {
     const { user, loading: authLoading } = useAuthState(config.auth);
-    // Claims are held with the session they were read for and derived at render (below), so a
-    // render can never pair one account's `user` with another account's claims, and a read that
-    // settles after the session changed (a late refresh, a slow initial read) is dropped.
     const [resolved, setResolved] = useState(null);
     const generationRef = useRef(0);
     const appliedGenerationRef = useRef(0);
     const currentUserRef = useRef(user);
     currentUserRef.current = user;
-    // Stable config ref so effects don't re-fire on config object identity changes
     const configRef = useRef(config);
     configRef.current = config;
-    /**
-     * Read `forUser`'s claims under a new generation and apply them only if `forUser` is still
-     * the signed-in session and no newer read has applied. A failed read leaves the session's
-     * claims as they are, or settles an unread session on the default claims.
-     */
     const readClaims = useCallback(async (forUser, read, context) => {
         const generation = ++generationRef.current;
         try {
@@ -44,9 +35,6 @@ export function AuthProvider({ config, children, }) {
                 : { user: forUser, generation, claims: configRef.current.defaultClaims });
         }
     }, []);
-    // --- Optional readiness gate (see AuthProviderConfig.readyGate) ---
-    // Open immediately when no gate is configured; otherwise held closed until the
-    // gate settles. Fail-open: a rejected gate is reported and then treated as open.
     const [gateOpen, setGateOpen] = useState(() => !config.readyGate);
     useEffect(() => {
         const gate = configRef.current.readyGate;
@@ -63,10 +51,7 @@ export function AuthProvider({ config, children, }) {
         return () => {
             cancelled = true;
         };
-        // Mount-only by design (reads only the stable configRef): the gate is a
-        // one-time client readiness signal.
     }, []);
-    // --- Claims fetching ---
     useEffect(() => {
         if (authLoading)
             return;
@@ -78,26 +63,17 @@ export function AuthProvider({ config, children, }) {
         configRef.current.onAuthStateChange?.(user);
         void readClaims(user, async () => ((await getIdTokenClaims(user)) ?? {}), 'getIdTokenClaims');
     }, [user, authLoading, readClaims]);
-    // --- refreshClaims ---
     const refreshClaims = useCallback(async () => {
-        // The LIVE signed-in user, never the one this render saw: a caller can hold this callback from
-        // before its own sign-in (a registration's submit handler creates the account and then asks for
-        // the claims the server just set), and a refresh of that render's `null` user would do nothing —
-        // leaving the new account on its pre-claim token until the hourly refresh.
+        // `auth.currentUser`, not this render's user: a caller can hold this callback from before its own sign-in.
         const liveUser = configRef.current.auth.currentUser;
         if (!liveUser)
             return;
         await readClaims(liveUser, async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}), 'refreshClaims');
     }, [readClaims]);
-    // --- Derived at render: only the current session's claims are ever exposed ---
     const sessionClaims = user && resolved?.user === user ? resolved : null;
     const claimsLoading = authLoading || (user !== null && sessionClaims === null);
-    // While the gate is closed a restored session is held back from consumers: a uid-keyed
-    // subscription opened before the gate's readiness signal is rejected once and dies, so no
-    // consumer may see a uid (or that session's claims) until the gate opens or fails open.
     const exposedUser = gateOpen ? user : null;
     const claims = exposedUser && sessionClaims ? sessionClaims.claims : config.defaultClaims;
-    // --- Context value ---
     const loading = authLoading || claimsLoading || !gateOpen;
     const value = useMemo(() => ({
         user: exposedUser,

package/dist/react/AuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EACL,aAAa,EACb,SAAS,EACT,MAAM,EACN,QAAQ,EACR,WAAW,EACX,OAAO,GAER,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAavD,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAA+B,IAAI,CAAC,CAAC;AAO7E,MAAM,UAAU,YAAY,CAAoC,EAC9D,MAAM,EACN,QAAQ,GACmB;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEjE,0FAA0F;IAC1F,4FAA4F;IAC5F,sFAAsF;IACtF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAiC,IAAI,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAc,IAAI,CAAC,CAAC;IACjD,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;IAE9B,+EAA+E;IAC/E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC;IAE3B;;;;OAIG;IACH,MAAM,UAAU,GAAG,WAAW,CAC5B,KAAK,EAAE,OAAa,EAAE,IAAmD,EAAE,OAAe,EAAE,EAAE;QAC5F,MAAM,UAAU,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO,IAAI,UAAU,IAAI,oBAAoB,CAAC,OAAO;gBAClF,OAAO;YACT,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;YAC1C,WAAW,CAAC;gBACV,IAAI,EAAE,OAAO;gBACb,UAAU;gBACV,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO;YAC/C,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,qEAAqE;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aAClB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;aAC7D,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;QACF,wEAAwE;QACxE,oCAAoC;IACtC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,0BAA0B;IAC1B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW;YAAE,OAAO;QAExB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,UAAU,CACb,IAAI,EACJ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAA4B,EAC7E,kBAAkB,CACnB,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAEpC,wBAAwB;IACxB,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,+FAA+F;QAC/F,gGAAgG;QAChG,iGAAiG;QACjG,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,UAAU,CACd,QAAQ,EACR,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,EAC7F,eAAe,CAChB,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,gFAAgF;IAChF,MAAM,aAAa,GAAG,IAAI,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,aAAa,GAAG,WAAW,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,CAAC,CAAC;IAE/E,uFAAuF;IACvF,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,IAAI,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;IAE1F,wBAAwB;IACxB,MAAM,OAAO,GAAG,WAAW,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC;IAE1D,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI,EAAE,WAAW;QACjB,MAAM;QACN,OAAO;QACP,WAAW;QACX,aAAa;QACb,eAAe,EAAE,CAAC,CAAC,WAAW;QAC9B,aAAa;KACd,CAAC,EACF,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAC1E,CAAC;IAEF,OAAO,KAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAwB,CAAC;AAC/E,CAAC","sourcesContent":["'use client';\n\nimport {\n  createContext,\n  useEffect,\n  useRef,\n  useState,\n  useCallback,\n  useMemo,\n  type ReactNode,\n} from 'react';\nimport type { User } from 'firebase/auth';\nimport { useAuthState } from './useAuthState.js';\nimport { getIdTokenClaims } from '../client/claims.js';\nimport type { AuthProviderConfig, AuthContextValue } from './types.js';\n\n/**\n * Claims resolved for one signed-in session. `user` is the Firebase `User` instance (it carries\n * the uid and is replaced on every sign-in), and `generation` orders the reads that produced it.\n */\ninterface ResolvedClaims<TClaims> {\n  user: User;\n  generation: number;\n  claims: TClaims;\n}\n\nexport const AuthContext = createContext<AuthContextValue<any> | null>(null);\n\ninterface AuthProviderProps<TClaims> {\n  config: AuthProviderConfig<TClaims>;\n  children: ReactNode;\n}\n\nexport function AuthProvider<TClaims = Record<string, unknown>>({\n  config,\n  children,\n}: AuthProviderProps<TClaims>) {\n  const { user, loading: authLoading } = useAuthState(config.auth);\n\n  // Claims are held with the session they were read for and derived at render (below), so a\n  // render can never pair one account's `user` with another account's claims, and a read that\n  // settles after the session changed (a late refresh, a slow initial read) is dropped.\n  const [resolved, setResolved] = useState<ResolvedClaims<TClaims> | null>(null);\n  const generationRef = useRef(0);\n  const appliedGenerationRef = useRef(0);\n  const currentUserRef = useRef<User | null>(user);\n  currentUserRef.current = user;\n\n  // Stable config ref so effects don't re-fire on config object identity changes\n  const configRef = useRef(config);\n  configRef.current = config;\n\n  /**\n   * Read `forUser`'s claims under a new generation and apply them only if `forUser` is still\n   * the signed-in session and no newer read has applied. A failed read leaves the session's\n   * claims as they are, or settles an unread session on the default claims.\n   */\n  const readClaims = useCallback(\n    async (forUser: User, read: () => Promise<Record<string, unknown> | null>, context: string) => {\n      const generation = ++generationRef.current;\n      try {\n        const raw = await read();\n        if (currentUserRef.current !== forUser || generation <= appliedGenerationRef.current)\n          return;\n        appliedGenerationRef.current = generation;\n        setResolved({\n          user: forUser,\n          generation,\n          claims: configRef.current.parseClaims(raw ?? {}),\n        });\n      } catch (err) {\n        if (currentUserRef.current !== forUser) return;\n        configRef.current.onError?.(err, context);\n        setResolved((prev) =>\n          prev && prev.user === forUser\n            ? prev\n            : { user: forUser, generation, claims: configRef.current.defaultClaims },\n        );\n      }\n    },\n    [],\n  );\n\n  // --- Optional readiness gate (see AuthProviderConfig.readyGate) ---\n  // Open immediately when no gate is configured; otherwise held closed until the\n  // gate settles. Fail-open: a rejected gate is reported and then treated as open.\n  const [gateOpen, setGateOpen] = useState(() => !config.readyGate);\n  useEffect(() => {\n    const gate = configRef.current.readyGate;\n    if (!gate) return;\n    let cancelled = false;\n    Promise.resolve()\n      .then(() => gate())\n      .catch((err) => configRef.current.onError?.(err, 'readyGate'))\n      .finally(() => {\n        if (!cancelled) setGateOpen(true);\n      });\n    return () => {\n      cancelled = true;\n    };\n    // Mount-only by design (reads only the stable configRef): the gate is a\n    // one-time client readiness signal.\n  }, []);\n\n  // --- Claims fetching ---\n  useEffect(() => {\n    if (authLoading) return;\n\n    if (!user) {\n      setResolved(null);\n      configRef.current.onAuthStateChange?.(null);\n      return;\n    }\n\n    configRef.current.onAuthStateChange?.(user);\n    void readClaims(\n      user,\n      async () => ((await getIdTokenClaims(user)) ?? {}) as Record<string, unknown>,\n      'getIdTokenClaims',\n    );\n  }, [user, authLoading, readClaims]);\n\n  // --- refreshClaims ---\n  const refreshClaims = useCallback(async () => {\n    // The LIVE signed-in user, never the one this render saw: a caller can hold this callback from\n    // before its own sign-in (a registration's submit handler creates the account and then asks for\n    // the claims the server just set), and a refresh of that render's `null` user would do nothing —\n    // leaving the new account on its pre-claim token until the hourly refresh.\n    const liveUser = configRef.current.auth.currentUser;\n    if (!liveUser) return;\n    await readClaims(\n      liveUser,\n      async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}) as Record<string, unknown>,\n      'refreshClaims',\n    );\n  }, [readClaims]);\n\n  // --- Derived at render: only the current session's claims are ever exposed ---\n  const sessionClaims = user && resolved?.user === user ? resolved : null;\n  const claimsLoading = authLoading || (user !== null && sessionClaims === null);\n\n  // While the gate is closed a restored session is held back from consumers: a uid-keyed\n  // subscription opened before the gate's readiness signal is rejected once and dies, so no\n  // consumer may see a uid (or that session's claims) until the gate opens or fails open.\n  const exposedUser = gateOpen ? user : null;\n  const claims = exposedUser && sessionClaims ? sessionClaims.claims : config.defaultClaims;\n\n  // --- Context value ---\n  const loading = authLoading || claimsLoading || !gateOpen;\n\n  const value = useMemo<AuthContextValue<TClaims>>(\n    () => ({\n      user: exposedUser,\n      claims,\n      loading,\n      authLoading,\n      claimsLoading,\n      isAuthenticated: !!exposedUser,\n      refreshClaims,\n    }),\n    [exposedUser, claims, loading, authLoading, claimsLoading, refreshClaims],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n"]}
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EACL,aAAa,EACb,SAAS,EACT,MAAM,EACN,QAAQ,EACR,WAAW,EACX,OAAO,GAER,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAA+B,IAAI,CAAC,CAAC;AAO7E,MAAM,UAAU,YAAY,CAAoC,EAC9D,MAAM,EACN,QAAQ,GACmB;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAiC,IAAI,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAc,IAAI,CAAC,CAAC;IACjD,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;IAE9B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC;IAE3B,MAAM,UAAU,GAAG,WAAW,CAC5B,KAAK,EAAE,OAAa,EAAE,IAAmD,EAAE,OAAe,EAAE,EAAE;QAC5F,MAAM,UAAU,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO,IAAI,UAAU,IAAI,oBAAoB,CAAC,OAAO;gBAClF,OAAO;YACT,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;YAC1C,WAAW,CAAC;gBACV,IAAI,EAAE,OAAO;gBACb,UAAU;gBACV,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO;YAC/C,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aAClB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;aAC7D,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW;YAAE,OAAO;QAExB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,UAAU,CACb,IAAI,EACJ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAA4B,EAC7E,kBAAkB,CACnB,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAEpC,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,2GAA2G;QAC3G,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,UAAU,CACd,QAAQ,EACR,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,EAC7F,eAAe,CAChB,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,aAAa,GAAG,IAAI,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,aAAa,GAAG,WAAW,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,CAAC,CAAC;IAE/E,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,IAAI,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;IAE1F,MAAM,OAAO,GAAG,WAAW,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC;IAE1D,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI,EAAE,WAAW;QACjB,MAAM;QACN,OAAO;QACP,WAAW;QACX,aAAa;QACb,eAAe,EAAE,CAAC,CAAC,WAAW;QAC9B,aAAa;KACd,CAAC,EACF,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAC1E,CAAC;IAEF,OAAO,KAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAwB,CAAC;AAC/E,CAAC","sourcesContent":["'use client';\n\nimport {\n  createContext,\n  useEffect,\n  useRef,\n  useState,\n  useCallback,\n  useMemo,\n  type ReactNode,\n} from 'react';\nimport type { User } from 'firebase/auth';\nimport { useAuthState } from './useAuthState.js';\nimport { getIdTokenClaims } from '../client/claims.js';\nimport type { AuthProviderConfig, AuthContextValue } from './types.js';\n\ninterface ResolvedClaims<TClaims> {\n  user: User;\n  generation: number;\n  claims: TClaims;\n}\n\nexport const AuthContext = createContext<AuthContextValue<any> | null>(null);\n\ninterface AuthProviderProps<TClaims> {\n  config: AuthProviderConfig<TClaims>;\n  children: ReactNode;\n}\n\nexport function AuthProvider<TClaims = Record<string, unknown>>({\n  config,\n  children,\n}: AuthProviderProps<TClaims>) {\n  const { user, loading: authLoading } = useAuthState(config.auth);\n\n  const [resolved, setResolved] = useState<ResolvedClaims<TClaims> | null>(null);\n  const generationRef = useRef(0);\n  const appliedGenerationRef = useRef(0);\n  const currentUserRef = useRef<User | null>(user);\n  currentUserRef.current = user;\n\n  const configRef = useRef(config);\n  configRef.current = config;\n\n  const readClaims = useCallback(\n    async (forUser: User, read: () => Promise<Record<string, unknown> | null>, context: string) => {\n      const generation = ++generationRef.current;\n      try {\n        const raw = await read();\n        if (currentUserRef.current !== forUser || generation <= appliedGenerationRef.current)\n          return;\n        appliedGenerationRef.current = generation;\n        setResolved({\n          user: forUser,\n          generation,\n          claims: configRef.current.parseClaims(raw ?? {}),\n        });\n      } catch (err) {\n        if (currentUserRef.current !== forUser) return;\n        configRef.current.onError?.(err, context);\n        setResolved((prev) =>\n          prev && prev.user === forUser\n            ? prev\n            : { user: forUser, generation, claims: configRef.current.defaultClaims },\n        );\n      }\n    },\n    [],\n  );\n\n  const [gateOpen, setGateOpen] = useState(() => !config.readyGate);\n  useEffect(() => {\n    const gate = configRef.current.readyGate;\n    if (!gate) return;\n    let cancelled = false;\n    Promise.resolve()\n      .then(() => gate())\n      .catch((err) => configRef.current.onError?.(err, 'readyGate'))\n      .finally(() => {\n        if (!cancelled) setGateOpen(true);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, []);\n\n  useEffect(() => {\n    if (authLoading) return;\n\n    if (!user) {\n      setResolved(null);\n      configRef.current.onAuthStateChange?.(null);\n      return;\n    }\n\n    configRef.current.onAuthStateChange?.(user);\n    void readClaims(\n      user,\n      async () => ((await getIdTokenClaims(user)) ?? {}) as Record<string, unknown>,\n      'getIdTokenClaims',\n    );\n  }, [user, authLoading, readClaims]);\n\n  const refreshClaims = useCallback(async () => {\n    // `auth.currentUser`, not this render's user: a caller can hold this callback from before its own sign-in.\n    const liveUser = configRef.current.auth.currentUser;\n    if (!liveUser) return;\n    await readClaims(\n      liveUser,\n      async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}) as Record<string, unknown>,\n      'refreshClaims',\n    );\n  }, [readClaims]);\n\n  const sessionClaims = user && resolved?.user === user ? resolved : null;\n  const claimsLoading = authLoading || (user !== null && sessionClaims === null);\n\n  const exposedUser = gateOpen ? user : null;\n  const claims = exposedUser && sessionClaims ? sessionClaims.claims : config.defaultClaims;\n\n  const loading = authLoading || claimsLoading || !gateOpen;\n\n  const value = useMemo<AuthContextValue<TClaims>>(\n    () => ({\n      user: exposedUser,\n      claims,\n      loading,\n      authLoading,\n      claimsLoading,\n      isAuthenticated: !!exposedUser,\n      refreshClaims,\n    }),\n    [exposedUser, claims, loading, authLoading, claimsLoading, refreshClaims],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n"]}

package/dist/react/redirect-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-storage.d.ts","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAmBA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAahE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQnD"}
+{"version":3,"file":"redirect-storage.d.ts","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAgBA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO3D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAWhE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMnD"}