cloudflare-next-intl 0.2.2 → 0.3.1

package/dist/src/firebase_auth/middleware/update_session.js

@@ -0,0 +1,213 @@
+import { NextResponse } from 'next/server';
+import config from '@intl-config';
+export const sessionCookieName = '__fa_session__';
+export const refreshTokenCookieName = '__fa_refresh_token__';
+const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
+const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
+// Refresh slightly before the real expiry — treating a token as expired
+// right up to its last second means normal clock skew or in-flight request
+// time can hand a client a token that dies moments after this check, forcing
+// an extra round-trip on the very next request.
+const CLOCK_SKEW_MARGIN_MS = 60 * 1000;
+function isJwtExpired(token) {
+    try {
+        const payload = token.split('.')[1];
+        const { exp } = JSON.parse(atob(payload.replace(/[-_]/g, (c) => c === '-' ? '+' : '/')));
+        return !exp || exp * 1000 - CLOCK_SKEW_MARGIN_MS <= Date.now();
+    }
+    catch {
+        return true;
+    }
+}
+// Refreshing an ID token is a real network round-trip to Google on the
+// Edge middleware's critical path, on every request where the session
+// cookie has expired — which, for any session older than the ~1hr ID-token
+// lifetime, is every request until the client re-syncs. Firebase refresh
+// tokens don't rotate on use (the API returns the same refresh_token back)
+// — THIS is the precondition that makes caching by refresh-token identity
+// safe: if Firebase ever changed that behavior, this cache would hand out
+// a refresh token the client no longer holds. Given that precondition,
+// caching a successful refresh result is a pure memoization: a cache hit
+// skips the round-trip entirely, a miss falls through to the exact same
+// fetch this function always made. Only available on Cloudflare Workers
+// (`caches.default`); everywhere else this is a no-op and every request
+// pays the full round-trip, same as before this change. The synthetic
+// origin below is safe as a Cache API key specifically because
+// `.internal` is a non-resolvable TLD reserved by convention — no real
+// `fetch()` in this Worker could ever have populated (or could ever
+// collide with) an entry under it.
+const REFRESH_CACHE_TTL_SECONDS = 50 * 60;
+const REFRESH_CACHE_KEY_ORIGIN = 'https://firebase-auth-refresh-cache.internal';
+function getEdgeCache() {
+    const cachesApi = globalThis.caches;
+    return cachesApi?.default;
+}
+async function hashRefreshToken(refreshToken) {
+    const data = new TextEncoder().encode(refreshToken);
+    const digest = await crypto.subtle.digest('SHA-256', data);
+    return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+async function getCachedRefresh(refreshToken) {
+    const cache = getEdgeCache();
+    if (!cache)
+        return null;
+    try {
+        const key = `${REFRESH_CACHE_KEY_ORIGIN}/${await hashRefreshToken(refreshToken)}`;
+        const cached = await cache.match(key);
+        if (!cached)
+            return null;
+        return await cached.json();
+    }
+    catch {
+        return null;
+    }
+}
+async function setCachedRefresh(refreshToken, refreshed) {
+    const cache = getEdgeCache();
+    if (!cache)
+        return;
+    try {
+        const key = `${REFRESH_CACHE_KEY_ORIGIN}/${await hashRefreshToken(refreshToken)}`;
+        await cache.put(key, new Response(JSON.stringify(refreshed), {
+            headers: { 'Cache-Control': `max-age=${REFRESH_CACHE_TTL_SECONDS}` },
+        }));
+    }
+    catch {
+        // Best-effort: a caching failure must never affect the actual
+        // refresh result already returned to the caller.
+    }
+}
+/**
+ * Mints a fresh ID token from a stored refresh token via Google's Secure
+ * Token API. No `firebase/auth` import: this runs in the Edge middleware
+ * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
+ * bundles even though this function never touches that module.
+ */
+async function refreshIdToken(apiKey, refreshToken) {
+    const cached = await getCachedRefresh(refreshToken);
+    if (cached)
+        return cached;
+    try {
+        const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${apiKey}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
+        });
+        if (!res.ok)
+            return null;
+        const data = await res.json();
+        const refreshed = { idToken: data.id_token, refreshToken: data.refresh_token };
+        // Not awaited: the cache write is a pure optimization for FUTURE
+        // requests, not this one — blocking this response on it would
+        // reintroduce the exact latency this fix exists to remove.
+        // setCachedRefresh already swallows its own errors, so a rejected
+        // write here would otherwise surface as an unhandled rejection.
+        void setCachedRefresh(refreshToken, refreshed);
+        return refreshed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Layers Firebase session-cookie validation/refresh and auth redirects onto
+ * an already-built middleware response. Called internally by `intlMiddleware`
+ * (via dynamic import) when `config.firebaseAuth` is set and
+ * `middlewareEnabled !== false` — not intended to be called directly unless
+ * that auto-wiring is opted out of.
+ *
+ * @param baseResponse The response `intlMiddleware` already produced for
+ *   locale routing (its own next()/rewrite()/redirect(), with the locale
+ *   cookie / bot cookie / `Content-Language` header already set). On the
+ *   pass-through path this function returns `baseResponse` itself (with
+ *   Firebase cookies layered on) so none of that is dropped; on the
+ *   guest/auth-page redirect paths it returns a NEW response instead, since
+ *   a redirect response can't also carry forward a rewrite/next decision —
+ *   its cookies/headers are copied across from `baseResponse` so locale
+ *   state still survives the redirect.
+ * @param locale The effective locale `intlMiddleware` resolved for this request.
+ */
+export default async function updateSession(request, baseResponse, locale) {
+    const fa = config.firebaseAuth;
+    if (!fa || fa.middlewareEnabled === false)
+        return baseResponse;
+    const rawPath = request.nextUrl.pathname;
+    const requestPrefix = `/${locale}`;
+    const path = rawPath === requestPrefix || rawPath.startsWith(`${requestPrefix}/`)
+        ? rawPath.slice(requestPrefix.length) || '/'
+        : rawPath;
+    const lastSegment = rawPath.slice(rawPath.lastIndexOf('/') + 1);
+    if (rawPath.startsWith('/_next') || /\.[a-zA-Z0-9]+$/.test(lastSegment)) {
+        return baseResponse;
+    }
+    const localePrefix = locale === config.locales[0] ? '' : requestPrefix;
+    const localeUrl = (target) => new URL(`${localePrefix}${target === '/' ? '' : target}` || '/', request.url);
+    const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
+    if (isWhiteListed)
+        return baseResponse;
+    const isAuthPage = fa.isAuthPath(path);
+    let token = request.cookies.get(sessionCookieName)?.value;
+    let refreshedToken = null;
+    let clearInvalidSession = false;
+    if (token && isJwtExpired(token)) {
+        token = undefined;
+    }
+    if (!token) {
+        const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
+        if (refreshToken) {
+            refreshedToken = await refreshIdToken(fa.apiKey, refreshToken);
+            if (refreshedToken) {
+                token = refreshedToken.idToken;
+            }
+            else {
+                clearInvalidSession = true;
+            }
+        }
+        else if (request.cookies.get(sessionCookieName)) {
+            clearInvalidSession = true;
+        }
+    }
+    const hasSession = !!token;
+    let response;
+    if (!hasSession) {
+        response = isAuthPage ? baseResponse : buildRedirect(baseResponse, localeUrl(fa.redirectAuthPath));
+    }
+    else if (isAuthPage) {
+        response = buildRedirect(baseResponse, localeUrl(fa.homePath));
+    }
+    else {
+        response = baseResponse;
+    }
+    if (clearInvalidSession) {
+        response.cookies.delete(sessionCookieName);
+        response.cookies.delete(refreshTokenCookieName);
+    }
+    if (refreshedToken) {
+        response.cookies.set(sessionCookieName, refreshedToken.idToken, {
+            // Not httpOnly: the client provider also writes this cookie
+            // directly (via document.cookie) after `getIdToken(true)`, so it
+            // must stay client-writable — a JS cookie write can never carry
+            // httpOnly anyway, and two same-name cookies with conflicting
+            // flags is what actually caused ambiguity here.
+            secure: request.nextUrl.protocol === 'https',
+            sameSite: 'lax',
+            path: '/',
+            maxAge: fa.sessionCookieMaxAge ?? DEFAULT_SESSION_MAX_AGE,
+        });
+        response.cookies.set(refreshTokenCookieName, refreshedToken.refreshToken, {
+            httpOnly: true,
+            secure: request.nextUrl.protocol === 'https',
+            sameSite: 'lax',
+            path: '/',
+            maxAge: fa.refreshTokenCookieMaxAge ?? DEFAULT_REFRESH_MAX_AGE,
+        });
+    }
+    return response;
+}
+/** A redirect response can't carry forward `baseResponse`'s rewrite/next decision, so this copies its cookies/headers across instead of dropping them. */
+function buildRedirect(baseResponse, url) {
+    const redirectResponse = NextResponse.redirect(url);
+    baseResponse.cookies.getAll().forEach((cookie) => redirectResponse.cookies.set(cookie));
+    baseResponse.headers.forEach((value, key) => redirectResponse.headers.set(key, value));
+    return redirectResponse;
+}

package/dist/src/firebase_auth/require_config.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/firebase_auth/require_config.bench.js

@@ -0,0 +1,24 @@
+import { bench, describe } from 'vitest';
+import requireFirebaseAuthConfig from './require_config';
+const fa = {
+    apiKey: 'key',
+    authDomain: 'domain',
+    projectId: 'proj',
+    appId: 'app',
+    redirectAuthPath: '/login',
+    homePath: '/',
+    isAuthPath: () => false,
+};
+describe('requireFirebaseAuthConfig', () => {
+    bench('valid config: passes the assertion', () => {
+        requireFirebaseAuthConfig(fa);
+    });
+    bench('missing config: throws', () => {
+        try {
+            requireFirebaseAuthConfig(undefined);
+        }
+        catch {
+            // expected
+        }
+    });
+});

package/dist/src/firebase_auth/require_config.d.ts

@@ -0,0 +1,8 @@
+import type { FirebaseAuthRoutingConfig } from '../types/types';
+/**
+ * Every firebase_auth export calls this before touching `firebase/*`. Throws
+ * instead of silently no-op'ing so a consumer who calls e.g. `useAuthUser()`
+ * without setting `firebaseAuth` on their `RoutingConfig` gets an immediate,
+ * actionable error rather than a silent null/undefined.
+ */
+export default function requireFirebaseAuthConfig(fa: FirebaseAuthRoutingConfig | undefined): asserts fa is FirebaseAuthRoutingConfig;

package/dist/src/firebase_auth/require_config.js

@@ -0,0 +1,13 @@
+/**
+ * Every firebase_auth export calls this before touching `firebase/*`. Throws
+ * instead of silently no-op'ing so a consumer who calls e.g. `useAuthUser()`
+ * without setting `firebaseAuth` on their `RoutingConfig` gets an immediate,
+ * actionable error rather than a silent null/undefined.
+ */
+export default function requireFirebaseAuthConfig(fa) {
+    if (!fa) {
+        throw new Error('firebase_auth: `firebaseAuth` is not set on your RoutingConfig. ' +
+            'Add a `firebaseAuth` object (Firebase project config + route config) ' +
+            'to the config passed to `setIntlConfig` before using any firebase_auth export.');
+    }
+}

package/dist/src/firebase_auth/server/auth_user_server_provider.d.ts

@@ -0,0 +1,24 @@
+import type { SerializedAuthUser } from '../types';
+/**
+ * Resolves the signed-in user from the session cookie and performs the
+ * authoritative pre-render redirect (guest→`redirectAuthPath`, signed-in→
+ * `homePath` on auth pages) — middleware only checks cookie *presence*, not
+ * validity. Plain async function, not a component: callers decide
+ * where/how to use the resolved user relative to their own component tree
+ * (see `AuthUserServerProvider` below for the simple case, and
+ * `IntlProvider`'s auto-wiring for the case where ordering against
+ * `LocaleContext` matters).
+ */
+export declare function resolveAuthUserAndRedirect(): Promise<SerializedAuthUser | null>;
+/**
+ * Convenience component for the manual-override path
+ * (`firebaseAuth.middlewareEnabled: false`-style manual wiring): resolves +
+ * redirects, then wraps `children` in the client `AuthUserProvider`
+ * directly. NOT used by the default auto-wiring path — `IntlProvider`/
+ * `LocationzationClientProvider` call `resolveAuthUserAndRedirect` and the
+ * client `AuthUserProvider` separately instead, so the client provider can
+ * render inside `LocaleContext.Provider` rather than outside it.
+ */
+export default function AuthUserServerProvider({ children }: {
+    children: React.ReactNode;
+}): Promise<import("react").JSX.Element>;

package/dist/src/firebase_auth/server/auth_user_server_provider.js

@@ -0,0 +1,51 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import dynamic from 'next/dynamic';
+import { headers } from 'next/headers';
+import { redirect } from 'next/navigation';
+import config from '@intl-config';
+import requireFirebaseAuthConfig from '../require_config';
+import { getAuthenticatedAppForUser } from './firebase_server';
+const AuthUserProvider = dynamic(() => import('../client/auth_user_provider'));
+/**
+ * Resolves the signed-in user from the session cookie and performs the
+ * authoritative pre-render redirect (guest→`redirectAuthPath`, signed-in→
+ * `homePath` on auth pages) — middleware only checks cookie *presence*, not
+ * validity. Plain async function, not a component: callers decide
+ * where/how to use the resolved user relative to their own component tree
+ * (see `AuthUserServerProvider` below for the simple case, and
+ * `IntlProvider`'s auto-wiring for the case where ordering against
+ * `LocaleContext` matters).
+ */
+export async function resolveAuthUserAndRedirect() {
+    const fa = config.firebaseAuth;
+    requireFirebaseAuthConfig(fa);
+    const { currentUser } = await getAuthenticatedAppForUser();
+    const path = (await headers()).get('x-pathname') ?? '/';
+    const isAuthPage = fa.isAuthPath(path);
+    const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
+    if (!isWhiteListed) {
+        if (!currentUser && !isAuthPage)
+            redirect(fa.redirectAuthPath);
+        if (currentUser && isAuthPage)
+            redirect(fa.homePath);
+    }
+    return currentUser && {
+        uid: currentUser.uid,
+        email: currentUser.email,
+        emailVerified: currentUser.emailVerified,
+        displayName: currentUser.displayName,
+    };
+}
+/**
+ * Convenience component for the manual-override path
+ * (`firebaseAuth.middlewareEnabled: false`-style manual wiring): resolves +
+ * redirects, then wraps `children` in the client `AuthUserProvider`
+ * directly. NOT used by the default auto-wiring path — `IntlProvider`/
+ * `LocationzationClientProvider` call `resolveAuthUserAndRedirect` and the
+ * client `AuthUserProvider` separately instead, so the client provider can
+ * render inside `LocaleContext.Provider` rather than outside it.
+ */
+export default async function AuthUserServerProvider({ children }) {
+    const initialUser = await resolveAuthUserAndRedirect();
+    return _jsx(AuthUserProvider, { initialUser: initialUser, children: children });
+}

package/dist/src/firebase_auth/server/firebase_server.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/firebase_auth/server/firebase_server.bench.js

@@ -0,0 +1,27 @@
+import { bench, describe, vi } from 'vitest';
+const fa = {
+    apiKey: 'bench-key',
+    authDomain: 'domain',
+    projectId: 'proj',
+    appId: 'app',
+    redirectAuthPath: '/login',
+    homePath: '/',
+    isAuthPath: () => false,
+};
+vi.mock('@intl-config', () => ({ default: { firebaseAuth: fa } }));
+vi.mock('next/headers', () => ({
+    cookies: vi.fn(async () => ({ get: () => ({ value: 'bench-token-123456' }) })),
+}));
+vi.mock('firebase/app', () => ({
+    initializeApp: vi.fn(() => ({ name: 'bench-app' })),
+    initializeServerApp: vi.fn(() => ({ name: 'bench-server-app' })),
+}));
+vi.mock('firebase/auth', () => ({
+    getAuth: vi.fn(() => ({ currentUser: { uid: 'bench-user' }, authStateReady: vi.fn(async () => { }) })),
+}));
+describe('getAuthenticatedAppForUser', () => {
+    bench('resolves a validated session (mocked Firebase)', async () => {
+        const { getAuthenticatedAppForUser } = await import('./firebase_server');
+        await getAuthenticatedAppForUser();
+    });
+});

package/dist/src/firebase_auth/server/firebase_server.d.ts

@@ -0,0 +1,15 @@
+import type { FirebaseApp } from 'firebase/app';
+import type { User } from 'firebase/auth';
+/**
+ * Resolves the signed-in user on the server from the session cookie.
+ * `initializeServerApp` validates the token with the Auth service, so a
+ * missing, expired, or forged token yields `currentUser === null`.
+ * Wrapped in React's `cache()` so multiple server components in one request
+ * share a single Auth service lookup. Lazily imports `firebase/app`/
+ * `firebase/auth` — never touched unless this is actually called, and
+ * throws if `firebaseAuth` is missing from `RoutingConfig`.
+ */
+export declare const getAuthenticatedAppForUser: () => Promise<{
+    firebaseServerApp: FirebaseApp | null;
+    currentUser: User | null;
+}>;

package/dist/src/firebase_auth/server/firebase_server.js

@@ -0,0 +1,50 @@
+import { cookies } from 'next/headers';
+import { cache } from 'react';
+import config from '@intl-config';
+import requireFirebaseAuthConfig from '../require_config';
+import { sessionCookieName } from '../middleware/update_session';
+let baseApp;
+/**
+ * Resolves the signed-in user on the server from the session cookie.
+ * `initializeServerApp` validates the token with the Auth service, so a
+ * missing, expired, or forged token yields `currentUser === null`.
+ * Wrapped in React's `cache()` so multiple server components in one request
+ * share a single Auth service lookup. Lazily imports `firebase/app`/
+ * `firebase/auth` — never touched unless this is actually called, and
+ * throws if `firebaseAuth` is missing from `RoutingConfig`.
+ */
+export const getAuthenticatedAppForUser = cache(async function getAuthenticatedAppForUser() {
+    const fa = config.firebaseAuth;
+    requireFirebaseAuthConfig(fa);
+    const authIdToken = (await cookies()).get(sessionCookieName)?.value;
+    if (!authIdToken) {
+        return { firebaseServerApp: null, currentUser: null };
+    }
+    try {
+        const { initializeApp, initializeServerApp } = await import('firebase/app');
+        const { getAuth } = await import('firebase/auth');
+        const firebaseConfig = {
+            apiKey: fa.apiKey,
+            authDomain: fa.authDomain,
+            projectId: fa.projectId,
+            storageBucket: fa.storageBucket,
+            messagingSenderId: fa.messagingSenderId,
+            appId: fa.appId,
+            measurementId: fa.measurementId,
+        };
+        // One shared base app per process (keyed by nothing but existence —
+        // a single RoutingConfig means a single Firebase project), not one
+        // named app per token: `initializeServerApp` derives a distinct,
+        // token-scoped auth context from this same base app without
+        // registering a new named app in Firebase's global app registry.
+        if (!baseApp)
+            baseApp = initializeApp(firebaseConfig, 'firebase-auth-server-base');
+        const firebaseServerApp = initializeServerApp(baseApp, { authIdToken });
+        const auth = getAuth(firebaseServerApp);
+        await auth.authStateReady();
+        return { firebaseServerApp, currentUser: auth.currentUser };
+    }
+    catch {
+        return { firebaseServerApp: null, currentUser: null };
+    }
+});

package/dist/src/firebase_auth/server/use_auth_user_server.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/firebase_auth/server/use_auth_user_server.bench.js

@@ -0,0 +1,14 @@
+// @vitest-environment node
+import { bench, describe, vi } from 'vitest';
+vi.mock('./firebase_server', () => ({
+    getAuthenticatedAppForUser: vi.fn(async () => ({
+        firebaseServerApp: null,
+        currentUser: { uid: 'bench-user' },
+    })),
+}));
+describe('useAuthUser (server)', () => {
+    bench('resolves the authenticated user', async () => {
+        const { default: useAuthUser } = await import('./use_auth_user_server');
+        await useAuthUser();
+    });
+});

package/dist/src/firebase_auth/server/use_auth_user_server.d.ts

@@ -0,0 +1,39 @@
+import type { User } from 'firebase/auth';
+/**
+ * Resolves the current request's authenticated Firebase user.
+ * @returns `{ user, loading: false }` — `loading` is always `false` here;
+ *   server resolution is synchronous with respect to the awaited call.
+ */
+declare function iGetAuthUser(): Promise<{
+    user: User | null;
+    loading: false;
+}>;
+/**
+ * Server Component/Action only: resolves the current request's
+ * authenticated Firebase user, same style as {@link getLocale}/
+ * {@link getTranslations} — an unconditional, always-`async` export
+ * (`cloudflare-next-intl/getFirebaseAuthUser`), so the `await` requirement
+ * is visible from the type itself in every editor.
+ *
+ * Returns the same `{ user, loading }` shape the client `useAuthUser()`
+ * hook's context exposes, so `const { user } = await getAuthUser()`
+ * generalizes correctly from `const { user } = useAuthUser()` on the client.
+ *
+ * @example
+ * ```tsx
+ * const { user } = await getAuthUser();
+ * ```
+ */
+export declare const getAuthUser: typeof iGetAuthUser;
+/**
+ * Server Component counterpart of the client `useAuthUser()` hook, reached
+ * via `cloudflare-next-intl/useFirebaseAuthUser`'s `react-server` condition
+ * (resolved automatically — not meant to be imported directly by name).
+ * Prefer {@link getAuthUser} for an unconditional, editor-typed-as-async
+ * equivalent.
+ */
+export default function useAuthUser(): Promise<{
+    user: User | null;
+    loading: false;
+}>;
+export {};

package/dist/src/firebase_auth/server/use_auth_user_server.js

@@ -0,0 +1,37 @@
+import { getAuthenticatedAppForUser } from './firebase_server';
+/**
+ * Resolves the current request's authenticated Firebase user.
+ * @returns `{ user, loading: false }` — `loading` is always `false` here;
+ *   server resolution is synchronous with respect to the awaited call.
+ */
+async function iGetAuthUser() {
+    const { currentUser } = await getAuthenticatedAppForUser();
+    return { user: currentUser, loading: false };
+}
+/**
+ * Server Component/Action only: resolves the current request's
+ * authenticated Firebase user, same style as {@link getLocale}/
+ * {@link getTranslations} — an unconditional, always-`async` export
+ * (`cloudflare-next-intl/getFirebaseAuthUser`), so the `await` requirement
+ * is visible from the type itself in every editor.
+ *
+ * Returns the same `{ user, loading }` shape the client `useAuthUser()`
+ * hook's context exposes, so `const { user } = await getAuthUser()`
+ * generalizes correctly from `const { user } = useAuthUser()` on the client.
+ *
+ * @example
+ * ```tsx
+ * const { user } = await getAuthUser();
+ * ```
+ */
+export const getAuthUser = iGetAuthUser;
+/**
+ * Server Component counterpart of the client `useAuthUser()` hook, reached
+ * via `cloudflare-next-intl/useFirebaseAuthUser`'s `react-server` condition
+ * (resolved automatically — not meant to be imported directly by name).
+ * Prefer {@link getAuthUser} for an unconditional, editor-typed-as-async
+ * equivalent.
+ */
+export default async function useAuthUser() {
+    return getAuthUser();
+}

package/dist/src/firebase_auth/types.d.ts

@@ -0,0 +1,22 @@
+import type { User } from 'firebase/auth';
+/**
+ * Plain, RSC-serializable projection of `firebase/auth`'s `User` — enough
+ * for first paint on the server; superseded by the real `User` once the
+ * client's `onIdTokenChanged` listener fires.
+ */
+export interface SerializedAuthUser {
+    uid: string;
+    email: string | null;
+    emailVerified: boolean;
+    displayName: string | null;
+}
+export type AuthFormState = {
+    error?: string;
+    success?: boolean;
+};
+/** Overrides for the default English auth error/status messages. */
+export interface AuthActionMessages {
+    success?: string;
+    mismatch?: string;
+}
+export type AuthUser = User | SerializedAuthUser;

package/dist/src/firebase_auth/types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/general/cache_variables.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/general/cache_variables.bench.js

@@ -0,0 +1,19 @@
+import { bench, describe } from 'vitest';
+import { setLocaleCache, getLocaleCache, setMessageForLocaleCache, getMessageCache, setTranslationCache, getTranslationCache, } from './cache_variables';
+describe('cache_variables', () => {
+    bench('setLocaleCache + getLocaleCache round-trip', () => {
+        setLocaleCache('en');
+        getLocaleCache();
+    });
+    bench('setMessageForLocaleCache + getMessageCache hit', () => {
+        setMessageForLocaleCache('en', { common: { hello: 'Hello' } });
+        getMessageCache('en');
+    });
+    bench('getMessageCache miss (no locale provided)', () => {
+        getMessageCache(undefined);
+    });
+    bench('setTranslationCache + getTranslationCache hit', () => {
+        setTranslationCache('en-common', (k) => k);
+        getTranslationCache('en-common');
+    });
+});

package/dist/src/general/cache_variables.d.ts

@@ -11,3 +11,4 @@ export declare function getLocaleCache(): string | undefined;
 export declare function setMessageForLocaleCache(locale: string, message: TranslationObject): void;
 export declare function getMessageCache(locale?: string): TranslationObject | undefined;
 export declare function setTranslationCache(cache: string, value: TranslatorReturnType): void;
+export declare function getTranslationCache(cacheKey: string): TranslatorReturnType | undefined;

package/dist/src/general/cache_variables.js

@@ -20,13 +20,11 @@ export function setMessageForLocaleCache(locale, message) {
     loadedTranslations.set(locale, message);
 }
 export function getMessageCache(locale) {
-    if (locale && loadedTranslations.has(locale)) {
-        return loadedTranslations.get(locale);
-    }
-    else {
-        return undefined;
-    }
+    return locale ? loadedTranslations.get(locale) : undefined;
 }
 export function setTranslationCache(cache, value) {
     translationFunctionsCache.set(cache, value);
 }
+export function getTranslationCache(cacheKey) {
+    return translationFunctionsCache.get(cacheKey);
+}

package/dist/src/general/general_functions.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/general/general_functions.bench.js

@@ -0,0 +1,18 @@
+import { bench, describe } from 'vitest';
+import { getTranslationsImpl } from './general_functions';
+const shallowMessages = { common: { hello: 'Hello' } };
+const deepMessages = { a: { b: { c: { d: { e: { hello: 'Deeply nested hello' } } } } } };
+describe('getTranslationsImpl', () => {
+    bench('shallow namespace, cold (new cacheKey each call)', () => {
+        getTranslationsImpl('en', shallowMessages, 'common', `cold-${Math.random()}`);
+    });
+    bench('shallow namespace, warm (same cacheKey, cache hit)', () => {
+        getTranslationsImpl('en', shallowMessages, 'common', 'warm-shallow');
+    });
+    bench('deep namespace (5 levels), cold', () => {
+        getTranslationsImpl('en', deepMessages, 'a.b.c.d.e', `cold-deep-${Math.random()}`);
+    });
+    bench('deep namespace (5 levels), warm', () => {
+        getTranslationsImpl('en', deepMessages, 'a.b.c.d.e', 'warm-deep');
+    });
+});