firebase-admin-edge 1.1.0 → 2.0.0

package/README.md

@@ -1,45 +1,56 @@
 # Firebase Admin Edge
 
-Lightweight helpers to use Firebase Admin features in edge runtimes and serverless
-environments. Built on top of the Firebase REST APIs, with `jose` for token signing
-and verification.
+Use Firebase Authentication, Firestore, Cloud Storage, and App Check from your
+server or edge runtime. `firebase-admin-edge` is a TypeScript library built on
+Firebase REST APIs, standard web APIs, and `jose` for token signing and verification.
 
-Supported runtimes:
-
-- Vercel Edge
-- Cloudflare Workers
-- Deno (Edge)
-- Bun
-- Node.js
+Designed for Cloudflare Workers, Vercel Edge, Deno, Bun, and Node.js. Bring your
+framework's cookie helpers to connect authentication to your app.
 
 ## Contents
 
-- [Setup](#setup)
-- [Sign in](#sign-in)
-- [Users and sessions](#users-and-sessions)
-- [Link and unlink accounts](#link-and-unlink-accounts)
-- [All server methods](#all-server-methods)
-- [Firebase Auth helpers](#firebase-auth-helpers)
 - [Features](#features)
-- [Planned work](#planned-work)
+- [Installation](#installation)
+- [Setup](#setup)
+- [Demo](#demo)
+- [Class Guides](#class-guides)
+- [Auth Emulator](#auth-emulator)
+- [Compatibility](#compatibility)
+- [Contributing and Reporting Issues](#contributing-and-reporting-issues)
+- [License](#license)
+
+## Features
+
+- **Authentication:** Provider sign-in, magic links, session cookies, account
+  linking, and password reset flows.
+- **User Administration:** Manage users, verify tokens, and configure projects
+  and authentication tenants.
+- **Firestore:** Read and write documents, query collections, and use
+  transactions, batches, and document converters.
+- **Cloud Storage:** Manage buckets and files, stream uploads and downloads,
+  and create signed URLs.
+- **App Check:** Create and verify tokens, with replay protection support.
+- **TypeScript:** Typed APIs with configurable cookies, token caching, and fetch.
 
 ## Installation
 
-```bash
-npm i firebase-admin-edge
+```sh
+npm install firebase-admin-edge
 ```
 
 ## Setup
 
-For user lookups, token checks, and sessions, see the
-[FirebaseAdminAuth guide](FIREBASE_ADMIN_AUTH.md).
+You'll need a Firebase project, its web app configuration, and a service account.
+Load the service account from your server's secret storage; keep it out of browser
+code and source control.
+
+Create the server API with cookie helpers for the current request. In this
+example, `serviceAccount` is your loaded service-account object, and `getCookie`
+and `setCookie` are supplied by your framework:
 
-```typescript
+```ts
 import { createFirebaseEdgeServer } from 'firebase-admin-edge';
-import { getCookie, setCookie } from 'your-framework-library';
 
-// Load serviceAccount and client secrets from your server's secrets.
-// Cookie helpers must read and write cookies for the current request.
 const firebaseServer = createFirebaseEdgeServer({
     serviceAccount,
     firebaseConfig: {
@@ -47,416 +58,102 @@ const firebaseServer = createFirebaseEdgeServer({
         authDomain: 'your-project.firebaseapp.com',
         projectId: 'your-project-id'
     },
-    providers: {
-        google: {
-            client_id: 'your-google-oauth-client-id',
-            client_secret: 'your-google-oauth-client-secret'
-        },
-        github: {
-            client_id: 'your-github-oauth-client-id',
-            client_secret: 'your-github-oauth-client-secret'
-        }
-    },
     cookies: {
-        // Provide your framework's cookie helpers
         getSession: (name) => getCookie(name),
         saveSession: (name, value, options) => setCookie(name, value, options)
     },
-    // Optional: Custom session cookie name (defaults to '__session')
-    cookieName: '__session',
-    // Optional: Custom cookie options
-    cookieOptions: {
-        httpOnly: true,
-        secure: true,
-        sameSite: 'lax',
-        path: '/',
-        maxAge: 60 * 60 * 24 * 5 // 5 days
-    },
-    // OAuth callback URL (registered with your provider)
-    redirectUri: 'https://example.com/auth/callback',
-    // Optional: Tenant ID for multi-tenancy
-    tenantId: 'your-tenant-id',
-    // Optional: Automatically link accounts with same email
-    autoLinkProviders: false
+    redirectUri: 'https://example.com/auth/callback'
 });
 ```
 
-Replace the cookie helpers and redirects in these examples with your framework's
-functions. Enable the providers you use in Firebase and register your callback URL
-with Google or GitHub.
-
-Optional settings:
-
-| Setting              | Purpose                                                                                     |
-| -------------------- | ------------------------------------------------------------------------------------------- |
-| `cookieName`         | Session cookie name. Defaults to `__session`.                                               |
-| `cookieOptions`      | Cookie settings. Defaults to secure, HTTP-only, `sameSite: 'lax'`, path `/`, and five days. |
-| `tenantId`           | Select a Firebase Auth tenant.                                                              |
-| `autoLinkProviders`  | Try to link accounts with the same email. Defaults to off.                                  |
-| `fetch`              | Supply your own HTTP request function.                                                      |
-| `cache`, `cacheName` | Supply token cache callbacks and a cache key. See [TokenCache](TOKEN_CACHE.md).             |
-
-## Sign in
-
-### 1. Send the user to Google or GitHub
+To start Google sign-in, enable Google in Firebase Console and authorize your
+app's domain. Use HTTPS for the login and callback routes so the authentication
+cookies can be sent.
 
 ```ts
-// Create an OAuth login URL for the `next` state.
-// `next` should be the URL or path to return to after successful login.
-const next = '/dashboard';
-
-// Generate provider-specific login URLs (server uses configured redirectUri)
-const loginUrlGoogle = await firebaseServer.getGoogleLoginURL(next);
-const loginUrlGithub = await firebaseServer.getGitHubLoginURL(next);
-
-// Redirect the user to the provider's login page
-redirect(302, loginUrlGoogle);
-```
-
-These login methods clear the current session. Both accept an optional second
-argument with `customParameters` and `addScopes`. Google also accepts
-`languageCode`.
-
-### 2. Handle the callback
-
-The callback completes sign-in, saves the session cookie, and returns the path to
-send the user back to.
-
-```ts
-const { data: returnTo, error } = await firebaseServer.signInWithCallback(
-    new URL(request.url)
+const loginURL = await firebaseServer.getProviderLoginURL(
+    'google',
+    '/dashboard'
 );
-
-if (error) {
-    throw error;
-}
-
-redirect(302, returnTo || '/');
-```
-
-## Users and sessions
-
-### Get the signed-in user
-
-```ts
-const { data: user, error } = await firebaseServer.getUser();
-
-if (error) {
-    throw error;
-}
-
-// user is null when there is no session. user.sub is the Firebase user ID.
+// Redirect to loginURL using your framework.
 ```
 
-This returns the details inside the session token. To look up the full user
-record, use `firebaseServer.adminAuth.getUser(uid)`.
+Your callback route completes sign-in and saves the session cookie. Follow the
+[provider callback guide](docs/FIREBASE_EDGE_SERVER.md#provider-login-and-linking)
+for the route implementation, or use the [demo](app-demo/README.md) as a working
+example.
 
-### Get Firebase tokens
+The same server object exposes `auth`, `adminAuth`, `firestore`, `storage`, and
+`appCheck`. See the [server guide](docs/FIREBASE_EDGE_SERVER.md) for configuration,
+providers, session handling, and examples. For Storage, also set
+`firebaseConfig.storageBucket` to your bucket name.
 
-Use this when you need a Firebase ID token and refresh token for the current user.
+## Demo
 
-```ts
-const { data: tokens, error } = await firebaseServer.getToken();
+The [SvelteKit demo](app-demo/README.md) shows Google and GitHub sign-in, magic
+links, password resets, account linking, and Firestore reads. Its README covers
+local setup and the required Firebase configuration.
 
-if (error) {
-    throw error;
-}
+## Class Guides
 
-// tokens is null when there is no session.
-// Otherwise, it contains idToken, refreshToken, and expiresIn.
-```
+Start with the guide for the feature you're adding:
 
-### Sign out
+| Guide                                                                          | What It Covers                                             |
+| ------------------------------------------------------------------------------ | ---------------------------------------------------------- |
+| [Firebase Edge Server](docs/FIREBASE_EDGE_SERVER.md)                           | App setup, sign-in, callbacks, and sessions                |
+| [FirebaseAdminAuth](docs/FIREBASE_ADMIN_AUTH.md)                               | User management, token verification, and session cookies   |
+| [FirebaseAuth](docs/FIREBASE_AUTH.md)                                          | Authentication operations and provider credentials         |
+| [Firestore](docs/FIRESTORE.md)                                                 | Documents, queries, transactions, and related class guides |
+| [Storage](docs/STORAGE.md), [Bucket](docs/BUCKET.md), and [File](docs/FILE.md) | File transfers, signed URLs, and bucket administration     |
+| [AppCheck](docs/APP_CHECK.md)                                                  | Token creation, verification, and replay protection        |
+| [ProjectConfigManager](docs/PROJECT_CONFIG_MANAGER.md)                         | Project authentication settings                            |
+| [TenantManager](docs/TENANT_MANAGER.md)                                        | Tenant management and authentication                       |
+| [TokenCache](docs/TOKEN_CACHE.md)                                              | In-memory token caching                                    |
+| [FirebaseEdgeError](docs/FIREBASE_EDGE_ERROR.md)                               | Error codes, causes, and context                           |
 
-```ts
-firebaseServer.signOut();
-redirect(302, '/');
-```
+See [Standalone Functions](docs/FUNCTIONS.md) for the function reference and
+[Integration Testing](docs/INTEGRATION_TESTING.md) for local runtime checks and
+live Firebase tests.
 
-This clears the session cookie. It does not revoke existing Firebase client tokens.
+## Auth Emulator
 
-## Link and unlink accounts
+For local authentication development, follow the
+[Auth Emulator setup](docs/FIREBASE_EDGE_SERVER.md#auth-emulator). The guide covers
+configuration and how emulator behavior differs from production.
 
-### Link through Google or GitHub
+## Compatibility
 
-Start this flow while the user is signed in. Use the same callback handler shown
-in [Sign in](#2-handle-the-callback).
+This package provides its own REST-based API and error conventions; it is not a
+drop-in replacement for the Firebase Admin Node.js SDK. Check the guides when
+porting existing code, especially for `{ error, data }` results and Web Streams.
 
-```ts
-// 1) Start link: redirect to provider
-const next = '/dashboard';
-const linkURL = await firebaseServer.getGoogleLinkURL(next);
-// or: linkURL = await firebaseServer.getGitHubLinkURL(next);
-redirect(302, linkURL);
-```
+The [Firestore parity audit](docs/FIRESTORE_PARITY.md) and
+[Storage compatibility checklist](docs/STORAGE_PARITY.md) describe the compared
+API surfaces and runtime differences. The
+[integration testing guide](docs/INTEGRATION_TESTING.md) documents the runtime
+checks and their scope.
 
-### Link with a provider token
+## Contributing and Reporting Issues
 
-If you already have a provider token, pass it directly. Use a Google ID token with
-`google.com`, or a GitHub access token with `github.com`.
+Contributions are welcome! Open a pull request with bug fixes, improvements, or
+documentation updates. For code changes, include relevant tests and usage examples.
 
-```ts
-const { data, error } = await firebaseServer.linkProvider(
-    githubAccessToken,
-    'github.com'
-);
+To get started locally:
 
-if (error) {
-    throw error;
-}
+```sh
+npm install
+npm run ci
 ```
 
-### Unlink a provider
+`npm run ci` builds the package, checks formatting, and runs the unit tests. See
+[Integration Testing](docs/INTEGRATION_TESTING.md) for checks that need a Firebase
+project or additional runtime tooling.
 
-```ts
-const { error } = await firebaseServer.unlinkProvider('google.com');
+If you run into a problem or have a feature request,
+[open a GitHub issue](https://github.com/jdgamble555/firebase-admin-edge/issues).
+For bugs, include your package version, runtime, steps to reproduce, and relevant
+error messages. A small reproduction helps others investigate.
 
-if (error) {
-    throw error;
-}
-```
-
-## All server methods
-
-These are all ten methods returned by `createFirebaseEdgeServer()`.
-
-| Method                                     | What it does                                        |
-| ------------------------------------------ | --------------------------------------------------- |
-| `getGoogleLoginURL(next, options?)`        | Builds a Google login URL.                          |
-| `getGitHubLoginURL(next, options?)`        | Builds a GitHub login URL.                          |
-| `signInWithCallback(url, expiresInMs?)`    | Completes login or linking and saves the session.   |
-| `getUser(checkRevoked?)`                   | Reads and checks the current session.               |
-| `getToken()`                               | Creates Firebase login tokens for the current user. |
-| `signOut()`                                | Clears the session cookie.                          |
-| `getGoogleLinkURL(next, options?)`         | Builds a Google account linking URL.                |
-| `getGitHubLinkURL(next, options?)`         | Builds a GitHub account linking URL.                |
-| `linkProvider(providerToken, providerId)`  | Links a provider using its token.                   |
-| `unlinkProvider(providerId, expiresInMs?)` | Removes a provider and replaces the session cookie. |
-
-URL methods return a string and can throw errors. `signOut()` returns nothing.
-The other methods return a result with `data` and/or `error`; check `error` first.
-Session durations are in milliseconds and default to five days.
-
-In the current implementation, `getUser(true)` also looks up the user, but does
-not check disabled status or revocation time. See the
-[session verification details](FIREBASE_ADMIN_AUTH.md#sessions).
-
-## Firebase Auth helpers
-
-The server also exposes two helper objects:
-
-| Object                     | Use it for                                                                                      |
-| -------------------------- | ----------------------------------------------------------------------------------------------- |
-| `firebaseServer.auth`      | Sign in with tokens and link or unlink providers using a Firebase ID token.                     |
-| `firebaseServer.adminAuth` | Look up users, verify tokens, create sessions, create custom tokens, and revoke refresh tokens. |
-
-```ts
-const { data: user, error } = await firebaseServer.adminAuth.getUserByEmail(
-    'someone@example.com'
-);
-
-if (error) {
-    throw error;
-}
-```
-
-### Create a user
-
-Create a user from your server. Firebase generates a UID unless you provide one:
-
-```ts
-const { data: user, error } = await firebaseServer.adminAuth.createUser({
-    email: 'jane@example.com',
-    displayName: 'Jane Doe'
-});
-
-if (error) {
-    throw error;
-}
-
-console.log(user.uid, user.email);
-```
-
-You can also set `uid`, `password`, `phoneNumber`, `photoURL`, `emailVerified`,
-`disabled`, and phone-based `multiFactor` enrollments, using Firebase Admin's
-`CreateRequest` fields. An empty object creates a user with a generated UID.
-
-### Update a user
-
-Pass the user's UID and only the fields you want to change:
-
-```ts
-const { data: user, error } = await firebaseServer.adminAuth.updateUser(
-    'user-uid',
-    {
-        displayName: 'Jane Smith',
-        photoURL: null
-    }
-);
-
-if (error) {
-    throw error;
-}
-
-console.log(user.uid, user.displayName);
-```
-
-Use `null` to remove `displayName`, `photoURL`, or `phoneNumber`. Set `disabled`
-to `true` to disable the account, or `false` to enable it. Updates also support
-`providerToLink`, `providersToUnlink`, and replacing phone MFA enrollments with
-`multiFactor.enrolledFactors` (`null` or `[]` removes all enrolled factors).
-
-Create and update return the complete `UserRecord` after saving. Their
-`CreateRequest`, `UpdateRequest`, and `UserRecord` types can be imported from
-`firebase-admin-edge`.
-
-### Delete a user
-
-Delete a single user by UID:
-
-```ts
-const { error } = await firebaseServer.adminAuth.deleteUser('user-uid');
-
-if (error) {
-    throw error;
-}
-
-console.log('User deleted');
-```
-
-Deletion returns `{ data: undefined, error: null }` on success. All three
-methods return `{ data: null, error }` on failure and use the configured tenant
-when one is set. API errors are available through `error.cause`; a nonexistent
-UID is an error for update and delete.
-
-### Get several users
-
-Look up specific users in one request, using a mix of identifiers:
-
-```ts
-const { data, error } = await firebaseServer.adminAuth.getUsers([
-    { uid: 'user-uid' },
-    { email: 'jane@example.com' },
-    { phoneNumber: '+15555550100' },
-    { providerId: 'google.com', providerUid: 'google-user-id' }
-]);
-
-if (error) {
-    throw error;
-}
-
-console.table(data.users, ['uid', 'email', 'displayName']);
-console.log('Users not found:', data.notFound);
-```
-
-Each call accepts up to 100 identifiers. `users` contains full user records;
-`notFound` contains the original identifiers that did not match a user. Missing
-users are not an error. Results are not guaranteed to follow the input order,
-and multiple identifiers can match the same user. An empty array returns empty
-results without a request. Lookups use the configured tenant, if any.
-
-The `UserIdentifier` and `GetUsersResult` types are exported from
-`firebase-admin-edge`.
-
-### List users
-
-Load 25 users for the first page of a users table. Run this on your server:
-
-```ts
-const { data, error } = await firebaseServer.adminAuth.listUsers(25);
-
-if (error) {
-    throw error;
-}
-
-console.table(data.users, ['uid', 'email', 'displayName']);
-const nextPageToken = data.pageToken;
-```
-
-Keep `nextPageToken` with your pagination state. When the user clicks **Next**,
-pass that token to your server and fetch the next 25 users:
-
-```ts
-if (nextPageToken) {
-    const { data, error } = await firebaseServer.adminAuth.listUsers(
-        25,
-        nextPageToken
-    );
-
-    if (error) {
-        throw error;
-    }
-
-    console.table(data.users, ['uid', 'email', 'displayName']);
-    // Replace the displayed rows and save data.pageToken for the next click.
-}
-```
-
-Disable **Next** when there is no `pageToken`. Passing `undefined` starts again
-from the first page.
-
-The page size defaults to 1000 and accepts integers from 1 to 1000. Each call
-returns `{ data, error }`, where `data` contains `users` and an optional
-`pageToken`. If you configured a tenant, only that tenant's users are returned.
-User records include Firebase Admin fields such as `uid`, `email`, `metadata`,
-and `customClaims`. Use `user.toJSON()` for a plain object.
-
-## Class guides
-
-Each class has its own guide:
-
-- [FirebaseAdminAuth](FIREBASE_ADMIN_AUTH.md): user management, tokens, and sessions.
-- [FirebaseAuth](FIREBASE_AUTH.md): sign-in and provider linking.
-- [TokenCache](TOKEN_CACHE.md): in-memory caching.
-- [FirebaseEdgeError](FIREBASE_EDGE_ERROR.md): error codes, causes, and context.
-
-See [Standalone functions](FUNCTIONS.md) for the function reference.
-
-## Features
+## License
 
-- ✅ **Edge Runtime Compatible** - Works in Vercel Edge, Cloudflare Workers, Deno, and Bun
-- ✅ **Lightweight** - Uses the fetch API and jose
-- ✅ **TypeScript Support** - Full type safety and IntelliSense
-- ✅ **Session Management** - Secure HTTP-only cookies
-- ✅ **OAuth Support** - Google and GitHub OAuth 2.0 flows
-- ✅ **Token Management** - Generate client tokens from server sessions
-- ✅ **Token Caching** - Optional caching for service account tokens (1-hour TTL)
-- ✅ **Multi-Tenancy** - Support for Firebase Auth tenant IDs
-- ✅ **Flexible Configuration** - Customizable cookie options and cache implementations
-- ✅ **Link and Unlink Providers** - Link and unlink oauth providers
-
-## Planned work
-
-Some tasks below already have individual helpers. This list also tracks work to
-connect those helpers to the main server API.
-
-### Firebase Auth
-
-- ☐ Magic Link Login (auto save email option)
-- ☐ Email / Password / Annonymous Login
-- ☐ Reset Password
-- ☐ Change Email
-- ☐ Get All Users with Order By and Pagination
-- ✅ Create User
-- ✅ Delete User
-- ✅ Update User
-- ☐ Add / Remove Custom Claims
-- ☐ Disable User (Ban User)
-- ☐ Add All Providers
-- ☐ Add App Check
-- ☐ Ban Users
-- ☐ RBAC
-
-### Firestore
-
-- ☐ Get Document By ID
-- ☐ Create Document
-- ☐ Update Document (merge option)
-- ☐ Delete Document
-- ☐ Query Documents
-
-### Firebase Storage
-
-- ☐ Create File
-- ☐ Delete File
-- ☐ Get File
+[MIT](LICENSE)

package/dist/app-check/app-check-endpoints.d.ts

@@ -0,0 +1,31 @@
+/** @internal A reusable resolver with bounded caching and key rotation. */
+export declare function createAppCheckKeyResolver(fetch: typeof globalThis.fetch): {
+    (protectedHeader?: import("jose").JWSHeaderParameters, token?: import("jose").FlattenedJWSInput): Promise<import("jose").CryptoKey>;
+    coolingDown: boolean;
+    fresh: boolean;
+    reloading: boolean;
+    reload: () => Promise<void>;
+    jwks: () => import("jose").JSONWebKeySet | undefined;
+};
+/** @internal Authenticated App Check operations. */
+export declare function appCheckRequest(projectId: string, accessToken: string, operation: {
+    appId: string;
+    customToken: string;
+    limitedUse?: boolean;
+    jti?: string;
+} | {
+    token: string;
+}, fetch: typeof globalThis.fetch): Promise<{
+    token?: string;
+    ttl?: string;
+    alreadyConsumed?: boolean;
+}>;
+/** @internal Convert the exchange response's protobuf duration. */
+export declare function parseAppCheckToken(data: {
+    token?: string;
+    ttl?: string;
+}): {
+    token: string;
+    ttlMillis: number;
+};
+//# sourceMappingURL=app-check-endpoints.d.ts.map

package/dist/app-check/app-check-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-endpoints.d.ts","sourceRoot":"","sources":["../../src/app-check/app-check-endpoints.ts"],"names":[],"mappings":"AAIA,2EAA2E;AAC3E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;EAOvE;AAED,oDAAoD;AACpD,wBAAsB,eAAe,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EACH;IACI,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK;YAQhB,MAAM;UAAQ,MAAM;sBAAoB,OAAO;GAyChE;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;;;EAoBxE"}

package/dist/app-check/app-check-endpoints.js

@@ -0,0 +1,75 @@
+import { createRemoteJWKSet, customFetch } from 'jose';
+import { restFetch } from '../rest-fetch.js';
+import { FirebaseEdgeError } from '../auth/errors.js';
+/** @internal A reusable resolver with bounded caching and key rotation. */
+export function createAppCheckKeyResolver(fetch) {
+    return createRemoteJWKSet(new URL('https://firebaseappcheck.googleapis.com/v1/jwks'), {
+        [customFetch]: fetch
+    });
+}
+/** @internal Authenticated App Check operations. */
+export async function appCheckRequest(projectId, accessToken, operation, fetch) {
+    const project = encodeURIComponent(projectId);
+    const exchange = 'appId' in operation;
+    const path = exchange
+        ? `v1/projects/${project}/apps/${encodeURIComponent(operation.appId)}:exchangeCustomToken`
+        : `v1beta/projects/${project}:verifyAppCheckToken`;
+    const { error, data } = await restFetch(`https://firebaseappcheck.googleapis.com/${path}`, {
+        method: 'POST',
+        bearerToken: accessToken,
+        body: exchange
+            ? {
+                customToken: operation.customToken,
+                ...(operation.limitedUse !== undefined && {
+                    limitedUse: operation.limitedUse
+                }),
+                ...(operation.jti !== undefined && { jti: operation.jti })
+            }
+            : { app_check_token: operation.token },
+        global: { fetch }
+    });
+    if (error !== null) {
+        const status = typeof error === 'object' ? error?.error?.status : undefined;
+        const codes = {
+            INVALID_ARGUMENT: 'invalid-argument',
+            PERMISSION_DENIED: 'permission-denied',
+            UNAUTHENTICATED: 'unauthenticated',
+            NOT_FOUND: 'not-found',
+            RESOURCE_EXHAUSTED: 'resource-exhausted'
+        };
+        throw new FirebaseEdgeError({
+            code: `app-check/${codes[status ?? ''] ?? 'unknown-error'}`,
+            message: typeof error === 'string'
+                ? error
+                : (error?.error?.message ?? 'App Check request failed.')
+        });
+    }
+    if (!data || typeof data !== 'object') {
+        throw new FirebaseEdgeError({
+            code: 'app-check/internal-error',
+            message: 'Invalid App Check response.'
+        });
+    }
+    return data;
+}
+/** @internal Convert the exchange response's protobuf duration. */
+export function parseAppCheckToken(data) {
+    if (typeof data.token !== 'string' ||
+        !data.token ||
+        typeof data.ttl !== 'string' ||
+        !/^\d+(?:\.\d{1,9})?s$/.test(data.ttl)) {
+        throw new FirebaseEdgeError({
+            code: 'app-check/internal-error',
+            message: 'Invalid App Check token response.'
+        });
+    }
+    const ttlMillis = Math.floor(Number(data.ttl.slice(0, -1)) * 1000);
+    if (!Number.isSafeInteger(ttlMillis) || ttlMillis <= 0) {
+        throw new FirebaseEdgeError({
+            code: 'app-check/internal-error',
+            message: 'Invalid App Check token lifetime.'
+        });
+    }
+    return { token: data.token, ttlMillis };
+}
+//# sourceMappingURL=app-check-endpoints.js.map