firebase-admin-edge 1.1.0 → 2.0.0

package/dist/auth/google-oauth.js

@@ -2,87 +2,16 @@ import { restFetch } from '../rest-fetch.js';
 import { signJWT } from './firebase-jwt.js';
 import { FirebaseEdgeError, ensureError } from './errors.js';
 import { GoogleErrorInfo } from './auth-error-codes.js';
-export async function exchangeCodeForGoogleIdToken(code, redirect_uri, client_id, client_secret, fetchFn) {
-    const url = 'https://oauth2.googleapis.com/token';
-    const { data, error } = await restFetch(url, {
-        global: { fetch: fetchFn },
-        body: {
-            code,
-            client_id,
-            client_secret,
-            redirect_uri,
-            grant_type: 'authorization_code'
-        },
-        form: true
-    });
-    if (error?.error.message) {
-        const errorMessage = error.error.message.toLowerCase();
-        if (errorMessage.includes('invalid_grant')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_GRANT, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('invalid_client')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_CLIENT, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('invalid_request')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_REQUEST, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('access_denied')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_ACCESS_DENIED, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('unsupported_response_type')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_UNSUPPORTED_RESPONSE_TYPE, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('invalid_scope')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_SCOPE, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        // Default case for unrecognized errors
-        return {
-            data: null,
-            error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_CODE_EXCHANGE_FAILED, {
-                context: { originalError: error.error.message }
-            })
-        };
-    }
-    if (!data) {
-        return {
-            data: null,
-            error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_TOKEN_REQUEST_FAILED)
-        };
-    }
-    return {
-        data,
-        error: null
-    };
+/** Read both OAuth and Firebase-style token endpoint failures. @internal */
+function googleErrorMessage(error) {
+    if (!error)
+        return undefined;
+    if (typeof error === 'string')
+        return error;
+    if (typeof error.error !== 'string')
+        return error.error?.message;
+    const description = 'error_description' in error ? error.error_description : undefined;
+    return [error.error, description].filter(Boolean).join(': ');
 }
 export async function getToken(serviceAccount, fetch) {
     const url = 'https://oauth2.googleapis.com/token';
@@ -115,14 +44,15 @@ export async function getToken(serviceAccount, fetch) {
             },
             form: true
         });
-        if (error?.error.message) {
-            const errorMessage = error.error.message.toLowerCase();
+        const originalError = googleErrorMessage(error);
+        if (originalError) {
+            const errorMessage = originalError.toLowerCase();
             if (errorMessage.includes('unavailable') ||
                 errorMessage.includes('503')) {
                 return {
                     data: null,
                     error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_TEMPORARILY_UNAVAILABLE, {
-                        context: { originalError: error.error.message }
+                        context: { originalError }
                     })
                 };
             }
@@ -131,7 +61,7 @@ export async function getToken(serviceAccount, fetch) {
                 return {
                     data: null,
                     error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_SERVER_ERROR, {
-                        context: { originalError: error.error.message }
+                        context: { originalError }
                     })
                 };
             }
@@ -139,7 +69,7 @@ export async function getToken(serviceAccount, fetch) {
             return {
                 data: null,
                 error: new FirebaseEdgeError(GoogleErrorInfo.SERVICE_ACCOUNT_TOKEN_FAILED, {
-                    context: { originalError: error.error.message }
+                    context: { originalError }
                 })
             };
         }

package/dist/auth/google-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/auth/google-oauth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAYxD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,IAAY,EACZ,YAAoB,EACpB,SAAiB,EACjB,aAAqB,EACrB,OAAiC;IAEjC,MAAM,GAAG,GAAG,qCAAqC,CAAC;IAElD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,IAAI;YACJ,SAAS;YACT,aAAa;YACb,YAAY;YACZ,UAAU,EAAE,oBAAoB;SACnC;QACD,IAAI,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEvD,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,oBAAoB,EACpC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,qBAAqB,EACrC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,sBAAsB,EACtC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,oBAAoB,EACpC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACrD,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,gCAAgC,EAChD;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,oBAAoB,EACpC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,uCAAuC;QACvC,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,EAC3C;gBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;aAClD,CACJ;SACJ,CAAC;IACN,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,CAC9C;SACJ,CAAC;IACN,CAAC;IAED,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,IAAI;KACd,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC1B,cAA8B,EAC9B,KAA+B;IAE/B,MAAM,GAAG,GAAG,qCAAqC,CAAC;IAElD,IAAI,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GACpC,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAElC,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,eAAe,EAAE;oBAC1D,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC;oBAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE;iBAC/C,CAAC;aACL,CAAC;QACN,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,gBAAgB,CAAC;aACjE,CAAC;QACN,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;YACH,MAAM,EAAE,EAAE,KAAK,EAAE;YACjB,IAAI,EAAE;gBACF,UAAU,EAAE,6CAA6C;gBACzD,SAAS,EAAE,OAAO;aACrB;YACD,OAAO,EAAE;gBACL,eAAe,EAAE,UAAU;gBAC3B,IAAI,EAAE,uBAAuB;aAChC;YACD,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAEvD,IACI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACpC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,8BAA8B,EAC9C;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;qBAClD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IACI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,mBAAmB,EACnC;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;qBAClD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,sDAAsD;YACtD,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,4BAA4B,EAC5C;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,CAC9C;aACJ,CAAC;QACN,CAAC;QAED,OAAO;YACH,IAAI;YACJ,KAAK,EAAE,IAAI;SACd,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,EAC3C;gBACI,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;gBACrB,OAAO,EAAE;oBACL,aAAa,EACT,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;iBACjD;aACJ,CACJ;SACJ,CAAC;IACN,CAAC;AACL,CAAC"}
+{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/auth/google-oauth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAOxD,4EAA4E;AAC5E,SAAS,kBAAkB,CACvB,KAA2D;IAE3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;IACjE,MAAM,WAAW,GACb,mBAAmB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC1B,cAA8B,EAC9B,KAA+B;IAE/B,MAAM,GAAG,GAAG,qCAAqC,CAAC;IAElD,IAAI,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GACpC,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAElC,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,eAAe,EAAE;oBAC1D,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC;oBAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE;iBAC/C,CAAC;aACL,CAAC;QACN,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,gBAAgB,CAAC;aACjE,CAAC;QACN,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;YACH,MAAM,EAAE,EAAE,KAAK,EAAE;YACjB,IAAI,EAAE;gBACF,UAAU,EAAE,6CAA6C;gBACzD,SAAS,EAAE,OAAO;aACrB;YACD,OAAO,EAAE;gBACL,eAAe,EAAE,UAAU;gBAC3B,IAAI,EAAE,uBAAuB;aAChC;YACD,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;YAEjD,IACI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACpC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,8BAA8B,EAC9C;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE;qBAC7B,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IACI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,mBAAmB,EACnC;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE;qBAC7B,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,sDAAsD;YACtD,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,4BAA4B,EAC5C;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE;iBAC7B,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,CAC9C;aACJ,CAAC;QACN,CAAC;QAED,OAAO;YACH,IAAI;YACJ,KAAK,EAAE,IAAI;SACd,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,EAC3C;gBACI,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;gBACrB,OAAO,EAAE;oBACL,aAAa,EACT,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;iBACjD;aACJ,CACJ;SACJ,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/auth/project-config-manager.d.ts

@@ -0,0 +1,10 @@
+import type { AuthConfigExecutor, ProjectConfig, UpdateProjectConfigRequest } from './auth-config-types.js';
+/** Manage the configuration of the parent Identity Platform project. */
+export declare class ProjectConfigManager {
+    private readonly execute;
+    /** @internal Obtain this manager from adminAuth.projectConfigManager(). */
+    constructor(execute: AuthConfigExecutor);
+    getProjectConfig(): Promise<import("./auth-config-types.js").AuthConfigResult<ProjectConfig>>;
+    updateProjectConfig(properties: UpdateProjectConfigRequest): Promise<import("./auth-config-types.js").AuthConfigResult<ProjectConfig>>;
+}
+//# sourceMappingURL=project-config-manager.d.ts.map

package/dist/auth/project-config-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config-manager.d.ts","sourceRoot":"","sources":["../../src/auth/project-config-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,kBAAkB,EAClB,aAAa,EACb,0BAA0B,EAC7B,MAAM,wBAAwB,CAAC;AAEhC,wEAAwE;AACxE,qBAAa,oBAAoB;IAEjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IADpC,2EAA2E;gBAC9C,OAAO,EAAE,kBAAkB;IAExD,gBAAgB;IAOhB,mBAAmB,CAAC,UAAU,EAAE,0BAA0B;CAO7D"}

package/dist/auth/project-config-manager.js

@@ -0,0 +1,22 @@
+/** Manage the configuration of the parent Identity Platform project. */
+export class ProjectConfigManager {
+    execute;
+    /** @internal Obtain this manager from adminAuth.projectConfigManager(). */
+    constructor(execute) {
+        this.execute = execute;
+    }
+    getProjectConfig() {
+        return this.execute({
+            resource: 'project',
+            action: 'get'
+        });
+    }
+    updateProjectConfig(properties) {
+        return this.execute({
+            resource: 'project',
+            action: 'update',
+            properties
+        });
+    }
+}
+//# sourceMappingURL=project-config-manager.js.map

package/dist/auth/project-config-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config-manager.js","sourceRoot":"","sources":["../../src/auth/project-config-manager.ts"],"names":[],"mappings":"AAMA,wEAAwE;AACxE,MAAM,OAAO,oBAAoB;IAEA;IAD7B,2EAA2E;IAC3E,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAE5D,gBAAgB;QACZ,OAAO,IAAI,CAAC,OAAO,CAAgB;YAC/B,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,KAAK;SAChB,CAAC,CAAC;IACP,CAAC;IAED,mBAAmB,CAAC,UAAsC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAgB;YAC/B,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,QAAQ;YAChB,UAAU;SACb,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/auth/provider-credential.d.ts

@@ -0,0 +1,43 @@
+import type { FirebaseIdpSignInResponse } from './firebase-types.js';
+export declare const FIREBASE_PROVIDER_IDS: {
+    readonly google: "google.com";
+    readonly facebook: "facebook.com";
+    readonly apple: "apple.com";
+    readonly twitter: "twitter.com";
+    readonly github: "github.com";
+    readonly microsoft: "microsoft.com";
+    readonly yahoo: "yahoo.com";
+    readonly playgames: "playgames.google.com";
+};
+export type ProviderCredential = {
+    idToken?: string;
+    accessToken?: string;
+    rawNonce?: string;
+    secret?: string;
+    serverAuthCode?: string;
+};
+export type ProviderAuthorizationOptions = {
+    addScopes?: string[];
+    customParameters?: Record<string, string>;
+};
+export type ProviderCallback = {
+    requestUri: string;
+} & ({
+    sessionId: string;
+    postBody?: string;
+    pendingToken?: never;
+} | {
+    pendingToken: string;
+    sessionId?: never;
+    postBody?: never;
+});
+/** Resolve a provider slug or a configured Firebase provider ID. */
+export declare function resolveProviderId(provider: string): string;
+/** Serialize credentials for Firebase's signInWithIdp endpoint. @internal */
+export declare function providerCredentialBody(token: string | ProviderCredential, provider: string): string;
+/** Recover and validate the provider credential returned by Firebase. @internal */
+export declare function providerCredentialFromResponse(response: FirebaseIdpSignInResponse): {
+    providerId: string;
+    credential: ProviderCredential;
+};
+//# sourceMappingURL=provider-credential.d.ts.map

package/dist/auth/provider-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credential.d.ts","sourceRoot":"","sources":["../../src/auth/provider-credential.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAErE,eAAO,MAAM,qBAAqB;;;;;;;;;CASxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACvC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,CAClD;IACI,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;CACxB,GACD;IACI,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,QAAQ,CAAC,EAAE,KAAK,CAAC;CACpB,CACN,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAClC,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,QAAQ,EAAE,MAAM,GACjB,MAAM,CAsER;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC1C,QAAQ,EAAE,yBAAyB;;;EAkBtC"}

package/dist/auth/provider-credential.js

@@ -0,0 +1,107 @@
+import { FirebaseEdgeError } from './errors.js';
+export const FIREBASE_PROVIDER_IDS = {
+    google: 'google.com',
+    facebook: 'facebook.com',
+    apple: 'apple.com',
+    twitter: 'twitter.com',
+    github: 'github.com',
+    microsoft: 'microsoft.com',
+    yahoo: 'yahoo.com',
+    playgames: 'playgames.google.com'
+};
+/** Resolve a provider slug or a configured Firebase provider ID. */
+export function resolveProviderId(provider) {
+    if (Object.hasOwn(FIREBASE_PROVIDER_IDS, provider))
+        return FIREBASE_PROVIDER_IDS[provider];
+    if (Object.values(FIREBASE_PROVIDER_IDS).includes(provider) ||
+        /^(oidc|saml)\..+/.test(provider))
+        return provider;
+    throw new FirebaseEdgeError({
+        code: 'auth/invalid-provider-id',
+        message: 'Unsupported Firebase provider.'
+    });
+}
+/** Serialize credentials for Firebase's signInWithIdp endpoint. @internal */
+export function providerCredentialBody(token, provider) {
+    const providerId = resolveProviderId(provider);
+    const credential = typeof token === 'string'
+        ? providerId === 'github.com' || providerId === 'facebook.com'
+            ? { accessToken: token }
+            : providerId === 'playgames.google.com'
+                ? { serverAuthCode: token }
+                : { idToken: token }
+        : token;
+    if (!credential ||
+        ![
+            credential.idToken,
+            credential.accessToken,
+            credential.serverAuthCode
+        ].some((value) => typeof value === 'string' && value.trim().length > 0))
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'A provider credential is required.'
+        });
+    if (['microsoft.com', 'yahoo.com'].includes(providerId) &&
+        credential.accessToken &&
+        !credential.idToken)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Use a Firebase-managed authorization flow for this provider.'
+        });
+    if (providerId.startsWith('saml.'))
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'SAML requires an authorization callback.'
+        });
+    if (providerId === 'twitter.com' &&
+        (!credential.accessToken || !credential.secret))
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Twitter requires an access token and token secret.'
+        });
+    if (providerId === 'playgames.google.com' && !credential.serverAuthCode)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Play Games requires a server authorization code.'
+        });
+    const body = new URLSearchParams();
+    const fields = {
+        idToken: 'id_token',
+        accessToken: 'access_token',
+        rawNonce: 'nonce',
+        secret: 'oauth_token_secret',
+        serverAuthCode: 'code'
+    };
+    for (const [key, field] of Object.entries(fields)) {
+        const value = credential[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== 'string' || !value.trim())
+            throw new FirebaseEdgeError({
+                code: 'auth/invalid-credential',
+                message: 'Credential fields must be nonempty strings.'
+            });
+        body.set(field, value);
+    }
+    body.set('providerId', providerId);
+    return body.toString();
+}
+/** Recover and validate the provider credential returned by Firebase. @internal */
+export function providerCredentialFromResponse(response) {
+    if (!response.providerId)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Firebase did not identify the provider for account linking.'
+        });
+    const providerId = resolveProviderId(response.providerId);
+    const credential = {
+        idToken: response.oauthIdToken,
+        accessToken: response.oauthAccessToken,
+        secret: response.oauthTokenSecret,
+        rawNonce: response.nonce
+    };
+    // Reuse provider-specific validation, including Twitter's token secret.
+    providerCredentialBody(credential, providerId);
+    return { providerId, credential };
+}
+//# sourceMappingURL=provider-credential.js.map

package/dist/auth/provider-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credential.js","sourceRoot":"","sources":["../../src/auth/provider-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACjC,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,sBAAsB;CAC3B,CAAC;AA4BX,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC;QAC9C,OAAO,qBAAqB,CACxB,QAA8C,CACjD,CAAC;IACN,IACK,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAuB,CAAC,QAAQ,CAChE,QAAQ,CACX;QACD,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAEjC,OAAO,QAAQ,CAAC;IACpB,MAAM,IAAI,iBAAiB,CAAC;QACxB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,gCAAgC;KAC5C,CAAC,CAAC;AACP,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAClC,KAAkC,EAClC,QAAgB;IAEhB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,UAAU,GACZ,OAAO,KAAK,KAAK,QAAQ;QACrB,CAAC,CAAC,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,cAAc;YAC1D,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;YACxB,CAAC,CAAC,UAAU,KAAK,sBAAsB;gBACrC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1B,CAAC,CAAC,KAAK,CAAC;IAChB,IACI,CAAC,UAAU;QACX,CAAC;YACG,UAAU,CAAC,OAAO;YAClB,UAAU,CAAC,WAAW;YACtB,UAAU,CAAC,cAAc;SAC5B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAEvE,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oCAAoC;SAChD,CAAC,CAAC;IACP,IACI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnD,UAAU,CAAC,WAAW;QACtB,CAAC,UAAU,CAAC,OAAO;QAEnB,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACH,8DAA8D;SACrE,CAAC,CAAC;IACP,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9B,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACP,IACI,UAAU,KAAK,aAAa;QAC5B,CAAC,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAE/C,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oDAAoD;SAChE,CAAC,CAAC;IACP,IAAI,UAAU,KAAK,sBAAsB,IAAI,CAAC,UAAU,CAAC,cAAc;QACnE,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,kDAAkD;SAC9D,CAAC,CAAC;IACP,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG;QACX,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,oBAAoB;QAC5B,cAAc,EAAE,MAAM;KAChB,CAAC;IACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAA+B,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC1C,MAAM,IAAI,iBAAiB,CAAC;gBACxB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,6CAA6C;aACzD,CAAC,CAAC;QACP,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAC1C,QAAmC;IAEnC,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpB,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACH,6DAA6D;SACpE,CAAC,CAAC;IACP,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAuB;QACnC,OAAO,EAAE,QAAQ,CAAC,YAAY;QAC9B,WAAW,EAAE,QAAQ,CAAC,gBAAgB;QACtC,MAAM,EAAE,QAAQ,CAAC,gBAAgB;QACjC,QAAQ,EAAE,QAAQ,CAAC,KAAK;KAC3B,CAAC;IACF,wEAAwE;IACxE,sBAAsB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC"}

package/dist/auth/provider-session.d.ts

@@ -0,0 +1,10 @@
+export type ProviderSession = {
+    sessionId: string;
+    next: string;
+    intent: 'signin' | 'link';
+};
+/** Validate redirect paths at both flow creation and callback consumption. @internal */
+export declare function isLocalRedirectPath(value: unknown): value is string;
+/** Read an untrusted serialized authorization session. @internal */
+export declare function parseProviderSession(stored: string): ProviderSession | null;
+//# sourceMappingURL=provider-session.d.ts.map

package/dist/auth/provider-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-session.d.ts","sourceRoot":"","sources":["../../src/auth/provider-session.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC7B,CAAC;AAEF,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAOnE;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAkB3E"}

package/dist/auth/provider-session.js

@@ -0,0 +1,28 @@
+/** Validate redirect paths at both flow creation and callback consumption. @internal */
+export function isLocalRedirectPath(value) {
+    if (typeof value !== 'string')
+        return false;
+    return (value.startsWith('/') &&
+        !value.startsWith('//') &&
+        !/[\\\r\n]/.test(value));
+}
+/** Read an untrusted serialized authorization session. @internal */
+export function parseProviderSession(stored) {
+    let value;
+    try {
+        value = JSON.parse(stored);
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const flow = value;
+    if (typeof flow.sessionId !== 'string' ||
+        !flow.sessionId ||
+        !isLocalRedirectPath(flow.next) ||
+        (flow.intent !== 'signin' && flow.intent !== 'link'))
+        return null;
+    return { sessionId: flow.sessionId, next: flow.next, intent: flow.intent };
+}
+//# sourceMappingURL=provider-session.js.map

package/dist/auth/provider-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-session.js","sourceRoot":"","sources":["../../src/auth/provider-session.ts"],"names":[],"mappings":"AAMA,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CACH,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACvB,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAC1B,CAAC;AACN,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,MAAc;IAC/C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3D,OAAO,IAAI,CAAC;IAChB,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,IAAI,CAAC,SAAS;QACf,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QAEpD,OAAO,IAAI,CAAC;IAChB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC/E,CAAC"}

package/dist/auth/tenant-manager.d.ts

@@ -0,0 +1,17 @@
+import type { FirebaseAdminAuth } from './firebase-admin-auth.js';
+import type { AuthConfigExecutor, CreateTenantRequest, UpdateTenantRequest, Tenant, ListTenantsResult } from './auth-config-types.js';
+/** Manage tenants and obtain tenant-scoped authentication instances. */
+export declare class TenantManager {
+    private readonly execute;
+    private readonly createAuth;
+    private readonly instances;
+    /** @internal Obtain this manager from adminAuth.tenantManager(). */
+    constructor(execute: AuthConfigExecutor, createAuth: (tenantId: string) => FirebaseAdminAuth);
+    authForTenant(tenantId: string): FirebaseAdminAuth;
+    createTenant(properties: CreateTenantRequest): Promise<import("./auth-config-types.js").AuthConfigResult<Tenant>>;
+    getTenant(tenantId: string): Promise<import("./auth-config-types.js").AuthConfigResult<Tenant>>;
+    updateTenant(tenantId: string, properties: UpdateTenantRequest): Promise<import("./auth-config-types.js").AuthConfigResult<Tenant>>;
+    deleteTenant(tenantId: string): Promise<import("./auth-config-types.js").AuthConfigResult<void>>;
+    listTenants(maxResults?: number, pageToken?: string): Promise<import("./auth-config-types.js").AuthConfigResult<ListTenantsResult>>;
+}
+//# sourceMappingURL=tenant-manager.d.ts.map

package/dist/auth/tenant-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-manager.d.ts","sourceRoot":"","sources":["../../src/auth/tenant-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EACR,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,EACN,iBAAiB,EACpB,MAAM,wBAAwB,CAAC;AAGhC,wEAAwE;AACxE,qBAAa,aAAa;IAKlB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAElE,oEAAoE;gBAE/C,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,iBAAiB;IAGxE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB;IASlD,YAAY,CAAC,UAAU,EAAE,mBAAmB;IAQ5C,SAAS,CAAC,QAAQ,EAAE,MAAM;IAQ1B,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB;IAS9D,YAAY,CAAC,QAAQ,EAAE,MAAM;IAQ7B,WAAW,CAAC,UAAU,SAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAQpD"}

package/dist/auth/tenant-manager.js

@@ -0,0 +1,59 @@
+import { validateTenantId } from './auth-config.js';
+/** Manage tenants and obtain tenant-scoped authentication instances. */
+export class TenantManager {
+    execute;
+    createAuth;
+    instances = new Map();
+    /** @internal Obtain this manager from adminAuth.tenantManager(). */
+    constructor(execute, createAuth) {
+        this.execute = execute;
+        this.createAuth = createAuth;
+    }
+    authForTenant(tenantId) {
+        validateTenantId(tenantId);
+        const existing = this.instances.get(tenantId);
+        if (existing)
+            return existing;
+        const auth = this.createAuth(tenantId);
+        this.instances.set(tenantId, auth);
+        return auth;
+    }
+    createTenant(properties) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'create',
+            properties
+        });
+    }
+    getTenant(tenantId) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'get',
+            id: tenantId
+        });
+    }
+    updateTenant(tenantId, properties) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'update',
+            id: tenantId,
+            properties
+        });
+    }
+    deleteTenant(tenantId) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'delete',
+            id: tenantId
+        });
+    }
+    listTenants(maxResults = 1000, pageToken) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'list',
+            maxResults,
+            pageToken
+        });
+    }
+}
+//# sourceMappingURL=tenant-manager.js.map

package/dist/auth/tenant-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-manager.js","sourceRoot":"","sources":["../../src/auth/tenant-manager.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,wEAAwE;AACxE,MAAM,OAAO,aAAa;IAKD;IACA;IALJ,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IAElE,oEAAoE;IACpE,YACqB,OAA2B,EAC3B,UAAmD;QADnD,YAAO,GAAP,OAAO,CAAoB;QAC3B,eAAU,GAAV,UAAU,CAAyC;IACrE,CAAC;IAEJ,aAAa,CAAC,QAAgB;QAC1B,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,YAAY,CAAC,UAA+B;QACxC,OAAO,IAAI,CAAC,OAAO,CAAS;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,UAAU;SACb,CAAC,CAAC;IACP,CAAC;IAED,SAAS,CAAC,QAAgB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAS;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,KAAK;YACb,EAAE,EAAE,QAAQ;SACf,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,UAA+B;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAS;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,QAAQ;YACZ,UAAU;SACb,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAO;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,QAAQ;SACf,CAAC,CAAC;IACP,CAAC;IAED,WAAW,CAAC,UAAU,GAAG,IAAI,EAAE,SAAkB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAoB;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,UAAU;YACV,SAAS;SACZ,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/auth/user-batch.d.ts

@@ -0,0 +1,21 @@
+import { FirebaseEdgeError } from './errors.js';
+export interface FirebaseArrayIndexError {
+    index: number;
+    error: FirebaseEdgeError;
+}
+export interface DeleteUsersResult {
+    successCount: number;
+    failureCount: number;
+    errors: FirebaseArrayIndexError[];
+}
+export interface UserImportResult extends DeleteUsersResult {
+}
+export interface BatchUserError {
+    index: number;
+    message?: string;
+}
+/** Validate the entire delete batch before making any changes. */
+export declare function validateDeleteUsers(uids: string[]): FirebaseEdgeError | null;
+/** Merge API failures with local import failures, retaining original input indices. */
+export declare function createBatchUserResult(indices: number[], failures?: BatchUserError[], localErrors?: FirebaseArrayIndexError[], operation?: 'delete' | 'import'): DeleteUsersResult;
+//# sourceMappingURL=user-batch.d.ts.map

package/dist/auth/user-batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-batch.d.ts","sourceRoot":"","sources":["../../src/auth/user-batch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA8B,MAAM,aAAa,CAAC;AAG5E,MAAM,WAAW,uBAAuB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,iBAAiB,CAAC;CAC5B;AACD,MAAM,WAAW,iBAAiB;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,uBAAuB,EAAE,CAAC;CACrC;AACD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;CAAG;AAC9D,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,GAAG,IAAI,CAY5E;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CACjC,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,GAAE,cAAc,EAAO,EAC/B,WAAW,GAAE,uBAAuB,EAAO,EAC3C,SAAS,GAAE,QAAQ,GAAG,QAAmB,GAC1C,iBAAiB,CAgCnB"}

package/dist/auth/user-batch.js

@@ -0,0 +1,49 @@
+import { FirebaseEdgeError, FirebaseAdminAuthErrorInfo } from './errors.js';
+import { validateUserUid } from './user-request.js';
+/** Validate the entire delete batch before making any changes. */
+export function validateDeleteUsers(uids) {
+    if (!Array.isArray(uids) || uids.length > 1000) {
+        return new FirebaseEdgeError({
+            ...FirebaseAdminAuthErrorInfo.ADMIN_API_INVALID_ARGUMENT,
+            message: 'uids must be an array of at most 1000 UIDs.'
+        });
+    }
+    for (const uid of uids) {
+        const error = validateUserUid(uid);
+        if (error)
+            return error;
+    }
+    return null;
+}
+/** Merge API failures with local import failures, retaining original input indices. */
+export function createBatchUserResult(indices, failures = [], localErrors = [], operation = 'delete') {
+    if (!Array.isArray(failures))
+        throw new Error('Invalid batch error response.');
+    const errors = [...localErrors];
+    const seen = new Set();
+    for (const failure of failures) {
+        if (!failure ||
+            !Number.isInteger(failure.index) ||
+            indices[failure.index] === undefined ||
+            seen.has(failure.index)) {
+            throw new Error('Invalid batch error index.');
+        }
+        seen.add(failure.index);
+        errors.push({
+            index: indices[failure.index],
+            error: new FirebaseEdgeError({
+                code: operation === 'import'
+                    ? 'auth/admin-invalid-user-import'
+                    : 'auth/admin-delete-user-failed',
+                message: failure.message || `Failed to ${operation} user.`
+            })
+        });
+    }
+    errors.sort((a, b) => a.index - b.index);
+    return {
+        successCount: indices.length - failures.length,
+        failureCount: errors.length,
+        errors
+    };
+}
+//# sourceMappingURL=user-batch.js.map

package/dist/auth/user-batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-batch.js","sourceRoot":"","sources":["../../src/auth/user-batch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAiBpD,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC7C,OAAO,IAAI,iBAAiB,CAAC;YACzB,GAAG,0BAA0B,CAAC,0BAA0B;YACxD,OAAO,EAAE,6CAA6C;SACzD,CAAC,CAAC;IACP,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CACjC,OAAiB,EACjB,WAA6B,EAAE,EAC/B,cAAyC,EAAE,EAC3C,YAAiC,QAAQ;IAEzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IACI,CAAC,OAAO;YACR,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS;YACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EACzB,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACR,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAE;YAC9B,KAAK,EAAE,IAAI,iBAAiB,CAAC;gBACzB,IAAI,EACA,SAAS,KAAK,QAAQ;oBAClB,CAAC,CAAC,gCAAgC;oBAClC,CAAC,CAAC,+BAA+B;gBACzC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,aAAa,SAAS,QAAQ;aAC7D,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO;QACH,YAAY,EAAE,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC9C,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,MAAM;KACT,CAAC;AACN,CAAC"}

package/dist/auth/user-import.d.ts

@@ -0,0 +1,55 @@
+import { FirebaseEdgeError } from './errors.js';
+import { type CreateRequest, type UpdateRequest, type UserProvider } from './user-request.js';
+import type { FirebaseArrayIndexError } from './user-batch.js';
+export type HashAlgorithmType = 'SCRYPT' | 'STANDARD_SCRYPT' | 'HMAC_SHA512' | 'HMAC_SHA256' | 'HMAC_SHA1' | 'HMAC_MD5' | 'MD5' | 'PBKDF_SHA1' | 'BCRYPT' | 'PBKDF2_SHA256' | 'SHA512' | 'SHA256' | 'SHA1';
+export interface UserImportOptions {
+    hash: {
+        algorithm: HashAlgorithmType;
+        key?: Uint8Array;
+        saltSeparator?: Uint8Array;
+        rounds?: number;
+        memoryCost?: number;
+        parallelization?: number;
+        blockSize?: number;
+        derivedKeyLength?: number;
+    };
+}
+export interface UserMetadataRequest {
+    creationTime?: string;
+    lastSignInTime?: string;
+}
+export interface UserProviderRequest extends UserProvider {
+    uid: string;
+    providerId: string;
+}
+export interface UserImportRecord extends Omit<CreateRequest, 'password' | 'multiFactor'> {
+    uid: string;
+    metadata?: UserMetadataRequest;
+    providerData?: UserProviderRequest[];
+    customClaims?: Record<string, unknown>;
+    passwordHash?: Uint8Array;
+    passwordSalt?: Uint8Array;
+    tenantId?: string;
+    multiFactor?: UpdateRequest['multiFactor'];
+}
+export interface PreparedUserImport {
+    body: {
+        users: Record<string, unknown>[];
+        [key: string]: unknown;
+    };
+    indices: number[];
+    errors: FirebaseArrayIndexError[];
+}
+/** Translate the supported Firebase Admin hash options without hashing on the edge. */
+export declare function buildImportHashOptions(options?: UserImportOptions): Record<string, unknown>;
+/** Convert one imported record, reusing the existing profile and MFA validation. */
+export declare function buildImportUser(user: UserImportRecord, tenantId?: string): Record<string, unknown>;
+/** Prepare valid records while collecting per-user errors and preserving original indices. */
+export declare function prepareUserImport(users: UserImportRecord[], options?: UserImportOptions, tenantId?: string): {
+    data: PreparedUserImport;
+    error: null;
+} | {
+    data: null;
+    error: FirebaseEdgeError;
+};
+//# sourceMappingURL=user-import.d.ts.map

package/dist/auth/user-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-import.d.ts","sourceRoot":"","sources":["../../src/auth/user-import.ts"],"names":[],"mappings":"AACA,OAAO,EACH,iBAAiB,EAGpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIH,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GACvB,QAAQ,GACR,iBAAiB,GACjB,aAAa,GACb,aAAa,GACb,WAAW,GACX,UAAU,GACV,KAAK,GACL,YAAY,GACZ,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AACb,MAAM,WAAW,iBAAiB;IAC9B,IAAI,EAAE;QACF,SAAS,EAAE,iBAAiB,CAAC;QAC7B,GAAG,CAAC,EAAE,UAAU,CAAC;QACjB,aAAa,CAAC,EAAE,UAAU,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL;AACD,MAAM,WAAW,mBAAmB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,gBACb,SAAQ,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,aAAa,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,YAAY,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAC9C;AACD,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAYD,uFAAuF;AACvF,wBAAgB,sBAAsB,CAClC,OAAO,CAAC,EAAE,iBAAiB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkEzB;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAC3B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,CAAC,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8FzB;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,gBAAgB,EAAE,EACzB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,QAAQ,CAAC,EAAE,MAAM,GAEf;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAuD7C"}