firebase-admin-edge 1.1.1 → 2.0.0

package/README.md

@@ -1,45 +1,56 @@
 # Firebase Admin Edge
 
-Lightweight helpers to use Firebase Admin features in edge runtimes and serverless
-environments. Built on top of the Firebase REST APIs, with `jose` for token signing
-and verification.
+Use Firebase Authentication, Firestore, Cloud Storage, and App Check from your
+server or edge runtime. `firebase-admin-edge` is a TypeScript library built on
+Firebase REST APIs, standard web APIs, and `jose` for token signing and verification.
 
-Supported runtimes:
-
-- Vercel Edge
-- Cloudflare Workers
-- Deno (Edge)
-- Bun
-- Node.js
+Designed for Cloudflare Workers, Vercel Edge, Deno, Bun, and Node.js. Bring your
+framework's cookie helpers to connect authentication to your app.
 
 ## Contents
 
-- [Setup](#setup)
-- [Sign in](#sign-in)
-- [Users and sessions](#users-and-sessions)
-- [Link and unlink accounts](#link-and-unlink-accounts)
-- [All server methods](#all-server-methods)
-- [Auth classes](#auth-classes)
 - [Features](#features)
-- [Planned work](#planned-work)
+- [Installation](#installation)
+- [Setup](#setup)
+- [Demo](#demo)
+- [Class Guides](#class-guides)
+- [Auth Emulator](#auth-emulator)
+- [Compatibility](#compatibility)
+- [Contributing and Reporting Issues](#contributing-and-reporting-issues)
+- [License](#license)
+
+## Features
+
+- **Authentication:** Provider sign-in, magic links, session cookies, account
+  linking, and password reset flows.
+- **User Administration:** Manage users, verify tokens, and configure projects
+  and authentication tenants.
+- **Firestore:** Read and write documents, query collections, and use
+  transactions, batches, and document converters.
+- **Cloud Storage:** Manage buckets and files, stream uploads and downloads,
+  and create signed URLs.
+- **App Check:** Create and verify tokens, with replay protection support.
+- **TypeScript:** Typed APIs with configurable cookies, token caching, and fetch.
 
 ## Installation
 
-```bash
-npm i firebase-admin-edge
+```sh
+npm install firebase-admin-edge
 ```
 
 ## Setup
 
-For user lookups, token checks, and sessions, see the
-[FirebaseAdminAuth guide](FIREBASE_ADMIN_AUTH.md).
+You'll need a Firebase project, its web app configuration, and a service account.
+Load the service account from your server's secret storage; keep it out of browser
+code and source control.
+
+Create the server API with cookie helpers for the current request. In this
+example, `serviceAccount` is your loaded service-account object, and `getCookie`
+and `setCookie` are supplied by your framework:
 
-```typescript
+```ts
 import { createFirebaseEdgeServer } from 'firebase-admin-edge';
-import { getCookie, setCookie } from 'your-framework-library';
 
-// Load serviceAccount and client secrets from your server's secrets.
-// Cookie helpers must read and write cookies for the current request.
 const firebaseServer = createFirebaseEdgeServer({
     serviceAccount,
     firebaseConfig: {
@@ -47,272 +58,102 @@ const firebaseServer = createFirebaseEdgeServer({
         authDomain: 'your-project.firebaseapp.com',
         projectId: 'your-project-id'
     },
-    providers: {
-        google: {
-            client_id: 'your-google-oauth-client-id',
-            client_secret: 'your-google-oauth-client-secret'
-        },
-        github: {
-            client_id: 'your-github-oauth-client-id',
-            client_secret: 'your-github-oauth-client-secret'
-        }
-    },
     cookies: {
-        // Provide your framework's cookie helpers
         getSession: (name) => getCookie(name),
         saveSession: (name, value, options) => setCookie(name, value, options)
     },
-    // Optional: Custom session cookie name (defaults to '__session')
-    cookieName: '__session',
-    // Optional: Custom cookie options
-    cookieOptions: {
-        httpOnly: true,
-        secure: true,
-        sameSite: 'lax',
-        path: '/',
-        maxAge: 60 * 60 * 24 * 5 // 5 days
-    },
-    // OAuth callback URL (registered with your provider)
-    redirectUri: 'https://example.com/auth/callback',
-    // Optional: Tenant ID for multi-tenancy
-    tenantId: 'your-tenant-id',
-    // Optional: Automatically link accounts with same email
-    autoLinkProviders: false
+    redirectUri: 'https://example.com/auth/callback'
 });
 ```
 
-Replace the cookie helpers and redirects in these examples with your framework's
-functions. Enable the providers you use in Firebase and register your callback URL
-with Google or GitHub.
-
-Optional settings:
-
-| Setting              | Purpose                                                                                     |
-| -------------------- | ------------------------------------------------------------------------------------------- |
-| `cookieName`         | Session cookie name. Defaults to `__session`.                                               |
-| `cookieOptions`      | Cookie settings. Defaults to secure, HTTP-only, `sameSite: 'lax'`, path `/`, and five days. |
-| `tenantId`           | Select a Firebase Auth tenant.                                                              |
-| `autoLinkProviders`  | Try to link accounts with the same email. Defaults to off.                                  |
-| `fetch`              | Supply your own HTTP request function.                                                      |
-| `cache`, `cacheName` | Supply token cache callbacks and a cache key. See [TokenCache](TOKEN_CACHE.md).             |
-
-## Sign in
-
-### 1. Send the user to Google or GitHub
-
-```ts
-// Create an OAuth login URL for the `next` state.
-// `next` should be the URL or path to return to after successful login.
-const next = '/dashboard';
-
-// Generate provider-specific login URLs (server uses configured redirectUri)
-const loginUrlGoogle = await firebaseServer.getGoogleLoginURL(next);
-const loginUrlGithub = await firebaseServer.getGitHubLoginURL(next);
-
-// Redirect the user to the provider's login page
-redirect(302, loginUrlGoogle);
-```
-
-These login methods clear the current session. Both accept an optional second
-argument with `customParameters` and `addScopes`. Google also accepts
-`languageCode`.
-
-### 2. Handle the callback
-
-The callback completes sign-in, saves the session cookie, and returns the path to
-send the user back to.
+To start Google sign-in, enable Google in Firebase Console and authorize your
+app's domain. Use HTTPS for the login and callback routes so the authentication
+cookies can be sent.
 
 ```ts
-const { data: returnTo, error } = await firebaseServer.signInWithCallback(
-    new URL(request.url)
+const loginURL = await firebaseServer.getProviderLoginURL(
+    'google',
+    '/dashboard'
 );
-
-if (error) {
-    throw error;
-}
-
-redirect(302, returnTo || '/');
+// Redirect to loginURL using your framework.
 ```
 
-## Users and sessions
+Your callback route completes sign-in and saves the session cookie. Follow the
+[provider callback guide](docs/FIREBASE_EDGE_SERVER.md#provider-login-and-linking)
+for the route implementation, or use the [demo](app-demo/README.md) as a working
+example.
 
-### Get the signed-in user
+The same server object exposes `auth`, `adminAuth`, `firestore`, `storage`, and
+`appCheck`. See the [server guide](docs/FIREBASE_EDGE_SERVER.md) for configuration,
+providers, session handling, and examples. For Storage, also set
+`firebaseConfig.storageBucket` to your bucket name.
 
-```ts
-const { data: user, error } = await firebaseServer.getUser();
+## Demo
 
-if (error) {
-    throw error;
-}
+The [SvelteKit demo](app-demo/README.md) shows Google and GitHub sign-in, magic
+links, password resets, account linking, and Firestore reads. Its README covers
+local setup and the required Firebase configuration.
 
-// user is null when there is no session. user.sub is the Firebase user ID.
-```
+## Class Guides
 
-This returns the details inside the session token. To look up the full user
-record, use `firebaseServer.adminAuth.getUser(uid)`.
+Start with the guide for the feature you're adding:
 
-### Get Firebase tokens
+| Guide                                                                          | What It Covers                                             |
+| ------------------------------------------------------------------------------ | ---------------------------------------------------------- |
+| [Firebase Edge Server](docs/FIREBASE_EDGE_SERVER.md)                           | App setup, sign-in, callbacks, and sessions                |
+| [FirebaseAdminAuth](docs/FIREBASE_ADMIN_AUTH.md)                               | User management, token verification, and session cookies   |
+| [FirebaseAuth](docs/FIREBASE_AUTH.md)                                          | Authentication operations and provider credentials         |
+| [Firestore](docs/FIRESTORE.md)                                                 | Documents, queries, transactions, and related class guides |
+| [Storage](docs/STORAGE.md), [Bucket](docs/BUCKET.md), and [File](docs/FILE.md) | File transfers, signed URLs, and bucket administration     |
+| [AppCheck](docs/APP_CHECK.md)                                                  | Token creation, verification, and replay protection        |
+| [ProjectConfigManager](docs/PROJECT_CONFIG_MANAGER.md)                         | Project authentication settings                            |
+| [TenantManager](docs/TENANT_MANAGER.md)                                        | Tenant management and authentication                       |
+| [TokenCache](docs/TOKEN_CACHE.md)                                              | In-memory token caching                                    |
+| [FirebaseEdgeError](docs/FIREBASE_EDGE_ERROR.md)                               | Error codes, causes, and context                           |
 
-Use this when you need a Firebase ID token and refresh token for the current user.
+See [Standalone Functions](docs/FUNCTIONS.md) for the function reference and
+[Integration Testing](docs/INTEGRATION_TESTING.md) for local runtime checks and
+live Firebase tests.
 
-```ts
-const { data: tokens, error } = await firebaseServer.getToken();
-
-if (error) {
-    throw error;
-}
+## Auth Emulator
 
-// tokens is null when there is no session.
-// Otherwise, it contains idToken, refreshToken, and expiresIn.
-```
+For local authentication development, follow the
+[Auth Emulator setup](docs/FIREBASE_EDGE_SERVER.md#auth-emulator). The guide covers
+configuration and how emulator behavior differs from production.
 
-### Sign out
+## Compatibility
 
-```ts
-firebaseServer.signOut();
-redirect(302, '/');
-```
+This package provides its own REST-based API and error conventions; it is not a
+drop-in replacement for the Firebase Admin Node.js SDK. Check the guides when
+porting existing code, especially for `{ error, data }` results and Web Streams.
 
-This clears the session cookie. It does not revoke existing Firebase client tokens.
+The [Firestore parity audit](docs/FIRESTORE_PARITY.md) and
+[Storage compatibility checklist](docs/STORAGE_PARITY.md) describe the compared
+API surfaces and runtime differences. The
+[integration testing guide](docs/INTEGRATION_TESTING.md) documents the runtime
+checks and their scope.
 
-## Link and unlink accounts
+## Contributing and Reporting Issues
 
-### Link through Google or GitHub
+Contributions are welcome! Open a pull request with bug fixes, improvements, or
+documentation updates. For code changes, include relevant tests and usage examples.
 
-Start this flow while the user is signed in. Use the same callback handler shown
-in [Sign in](#2-handle-the-callback).
+To get started locally:
 
-```ts
-// 1) Start link: redirect to provider
-const next = '/dashboard';
-const linkURL = await firebaseServer.getGoogleLinkURL(next);
-// or: linkURL = await firebaseServer.getGitHubLinkURL(next);
-redirect(302, linkURL);
+```sh
+npm install
+npm run ci
 ```
 
-### Link with a provider token
-
-If you already have a provider token, pass it directly. Use a Google ID token with
-`google.com`, or a GitHub access token with `github.com`.
-
-```ts
-const { data, error } = await firebaseServer.linkProvider(
-    githubAccessToken,
-    'github.com'
-);
-
-if (error) {
-    throw error;
-}
-```
-
-### Unlink a provider
-
-```ts
-const { error } = await firebaseServer.unlinkProvider('google.com');
-
-if (error) {
-    throw error;
-}
-```
-
-## All server methods
-
-These are all ten methods returned by `createFirebaseEdgeServer()`.
-
-| Method                                     | What it does                                        |
-| ------------------------------------------ | --------------------------------------------------- |
-| `getGoogleLoginURL(next, options?)`        | Builds a Google login URL.                          |
-| `getGitHubLoginURL(next, options?)`        | Builds a GitHub login URL.                          |
-| `signInWithCallback(url, expiresInMs?)`    | Completes login or linking and saves the session.   |
-| `getUser(checkRevoked?)`                   | Reads and checks the current session.               |
-| `getToken()`                               | Creates Firebase login tokens for the current user. |
-| `signOut()`                                | Clears the session cookie.                          |
-| `getGoogleLinkURL(next, options?)`         | Builds a Google account linking URL.                |
-| `getGitHubLinkURL(next, options?)`         | Builds a GitHub account linking URL.                |
-| `linkProvider(providerToken, providerId)`  | Links a provider using its token.                   |
-| `unlinkProvider(providerId, expiresInMs?)` | Removes a provider and replaces the session cookie. |
-
-URL methods return a string and can throw errors. `signOut()` returns nothing.
-The other methods return a result with `data` and/or `error`; check `error` first.
-Session durations are in milliseconds and default to five days.
-
-`getUser(true)` also looks up the user and rejects disabled accounts or sessions
-authenticated before the user's refresh tokens were revoked. See the
-[session verification details](FIREBASE_ADMIN_AUTH.md#sessions).
-
-## Auth classes
-
-The server exposes configured instances of the two auth classes:
-
-| Property                   | Class guide                                                                         |
-| -------------------------- | ----------------------------------------------------------------------------------- |
-| `firebaseServer.auth`      | [FirebaseAuth](FIREBASE_AUTH.md): sign-in and provider linking.                     |
-| `firebaseServer.adminAuth` | [FirebaseAdminAuth](FIREBASE_ADMIN_AUTH.md): user management, tokens, and sessions. |
-
-## Class guides
-
-Each class has its own guide:
-
-- [FirebaseAdminAuth](FIREBASE_ADMIN_AUTH.md): user management, tokens, and sessions.
-- [FirebaseAuth](FIREBASE_AUTH.md): sign-in and provider linking.
-- [TokenCache](TOKEN_CACHE.md): in-memory caching.
-- [FirebaseEdgeError](FIREBASE_EDGE_ERROR.md): error codes, causes, and context.
-
-See [Standalone functions](FUNCTIONS.md) for the function reference.
-
-## Features
-
-- ✅ **Edge Runtime Compatible** - Works in Vercel Edge, Cloudflare Workers, Deno, and Bun
-- ✅ **Lightweight** - Uses the fetch API and jose
-- ✅ **TypeScript Support** - Full type safety and IntelliSense
-- ✅ **Session Management** - Secure HTTP-only cookies
-- ✅ **OAuth Support** - Google and GitHub OAuth 2.0 flows
-- ✅ **Token Management** - Generate client tokens from server sessions
-- ✅ **Token Caching** - Optional caching for service account tokens (1-hour TTL)
-- ✅ **Multi-Tenancy** - Support for Firebase Auth tenant IDs
-- ✅ **Flexible Configuration** - Customizable cookie options and cache implementations
-- ✅ **Link and Unlink Providers** - Link and unlink oauth providers
-
-## Planned work
-
-Completed admin capabilities are marked below. End-to-end login and account
-flows through the main server API are tracked separately.
-
-### Firebase Auth
-
-- ☐ Magic Link Login (auto save email option)
-- ☐ Email / Password / Annonymous Login
-- ☐ Reset Password Flow (email delivery and completion)
-- ☐ Self-Service Change Email Flow
-- ☐ Custom User Listing Order By (queryUsers)
-- ☐ Add All Providers
-- ☐ Add App Check
-- ☐ RBAC
-
-### OIDC / SAML provider configuration
-
-- ☐ Create Provider Config (`adminAuth.createProviderConfig()`)
-- ☐ Get Provider Config (`adminAuth.getProviderConfig()`)
-- ☐ Update Provider Config (`adminAuth.updateProviderConfig()`)
-- ☐ Delete Provider Config (`adminAuth.deleteProviderConfig()`)
-- ☐ List Provider Configs (`adminAuth.listProviderConfigs()`)
-
-### Project / tenant management
-
-- ☐ Project Config Manager (`adminAuth.projectConfigManager()`)
-- ☐ Tenant Manager (`adminAuth.tenantManager()`)
-
-### Firestore
+`npm run ci` builds the package, checks formatting, and runs the unit tests. See
+[Integration Testing](docs/INTEGRATION_TESTING.md) for checks that need a Firebase
+project or additional runtime tooling.
 
-- ☐ Get Document By ID
-- ☐ Create Document
-- ☐ Update Document (merge option)
-- ☐ Delete Document
-- ☐ Query Documents
+If you run into a problem or have a feature request,
+[open a GitHub issue](https://github.com/jdgamble555/firebase-admin-edge/issues).
+For bugs, include your package version, runtime, steps to reproduce, and relevant
+error messages. A small reproduction helps others investigate.
 
-### Firebase Storage
+## License
 
-- ☐ Create File
-- ☐ Delete File
-- ☐ Get File
+[MIT](LICENSE)

package/dist/app-check/app-check-endpoints.d.ts

@@ -0,0 +1,31 @@
+/** @internal A reusable resolver with bounded caching and key rotation. */
+export declare function createAppCheckKeyResolver(fetch: typeof globalThis.fetch): {
+    (protectedHeader?: import("jose").JWSHeaderParameters, token?: import("jose").FlattenedJWSInput): Promise<import("jose").CryptoKey>;
+    coolingDown: boolean;
+    fresh: boolean;
+    reloading: boolean;
+    reload: () => Promise<void>;
+    jwks: () => import("jose").JSONWebKeySet | undefined;
+};
+/** @internal Authenticated App Check operations. */
+export declare function appCheckRequest(projectId: string, accessToken: string, operation: {
+    appId: string;
+    customToken: string;
+    limitedUse?: boolean;
+    jti?: string;
+} | {
+    token: string;
+}, fetch: typeof globalThis.fetch): Promise<{
+    token?: string;
+    ttl?: string;
+    alreadyConsumed?: boolean;
+}>;
+/** @internal Convert the exchange response's protobuf duration. */
+export declare function parseAppCheckToken(data: {
+    token?: string;
+    ttl?: string;
+}): {
+    token: string;
+    ttlMillis: number;
+};
+//# sourceMappingURL=app-check-endpoints.d.ts.map

package/dist/app-check/app-check-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-endpoints.d.ts","sourceRoot":"","sources":["../../src/app-check/app-check-endpoints.ts"],"names":[],"mappings":"AAIA,2EAA2E;AAC3E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;EAOvE;AAED,oDAAoD;AACpD,wBAAsB,eAAe,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EACH;IACI,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK;YAQhB,MAAM;UAAQ,MAAM;sBAAoB,OAAO;GAyChE;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;;;EAoBxE"}

package/dist/app-check/app-check-endpoints.js

@@ -0,0 +1,75 @@
+import { createRemoteJWKSet, customFetch } from 'jose';
+import { restFetch } from '../rest-fetch.js';
+import { FirebaseEdgeError } from '../auth/errors.js';
+/** @internal A reusable resolver with bounded caching and key rotation. */
+export function createAppCheckKeyResolver(fetch) {
+    return createRemoteJWKSet(new URL('https://firebaseappcheck.googleapis.com/v1/jwks'), {
+        [customFetch]: fetch
+    });
+}
+/** @internal Authenticated App Check operations. */
+export async function appCheckRequest(projectId, accessToken, operation, fetch) {
+    const project = encodeURIComponent(projectId);
+    const exchange = 'appId' in operation;
+    const path = exchange
+        ? `v1/projects/${project}/apps/${encodeURIComponent(operation.appId)}:exchangeCustomToken`
+        : `v1beta/projects/${project}:verifyAppCheckToken`;
+    const { error, data } = await restFetch(`https://firebaseappcheck.googleapis.com/${path}`, {
+        method: 'POST',
+        bearerToken: accessToken,
+        body: exchange
+            ? {
+                customToken: operation.customToken,
+                ...(operation.limitedUse !== undefined && {
+                    limitedUse: operation.limitedUse
+                }),
+                ...(operation.jti !== undefined && { jti: operation.jti })
+            }
+            : { app_check_token: operation.token },
+        global: { fetch }
+    });
+    if (error !== null) {
+        const status = typeof error === 'object' ? error?.error?.status : undefined;
+        const codes = {
+            INVALID_ARGUMENT: 'invalid-argument',
+            PERMISSION_DENIED: 'permission-denied',
+            UNAUTHENTICATED: 'unauthenticated',
+            NOT_FOUND: 'not-found',
+            RESOURCE_EXHAUSTED: 'resource-exhausted'
+        };
+        throw new FirebaseEdgeError({
+            code: `app-check/${codes[status ?? ''] ?? 'unknown-error'}`,
+            message: typeof error === 'string'
+                ? error
+                : (error?.error?.message ?? 'App Check request failed.')
+        });
+    }
+    if (!data || typeof data !== 'object') {
+        throw new FirebaseEdgeError({
+            code: 'app-check/internal-error',
+            message: 'Invalid App Check response.'
+        });
+    }
+    return data;
+}
+/** @internal Convert the exchange response's protobuf duration. */
+export function parseAppCheckToken(data) {
+    if (typeof data.token !== 'string' ||
+        !data.token ||
+        typeof data.ttl !== 'string' ||
+        !/^\d+(?:\.\d{1,9})?s$/.test(data.ttl)) {
+        throw new FirebaseEdgeError({
+            code: 'app-check/internal-error',
+            message: 'Invalid App Check token response.'
+        });
+    }
+    const ttlMillis = Math.floor(Number(data.ttl.slice(0, -1)) * 1000);
+    if (!Number.isSafeInteger(ttlMillis) || ttlMillis <= 0) {
+        throw new FirebaseEdgeError({
+            code: 'app-check/internal-error',
+            message: 'Invalid App Check token lifetime.'
+        });
+    }
+    return { token: data.token, ttlMillis };
+}
+//# sourceMappingURL=app-check-endpoints.js.map

package/dist/app-check/app-check-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-endpoints.js","sourceRoot":"","sources":["../../src/app-check/app-check-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACpE,OAAO,kBAAkB,CACrB,IAAI,GAAG,CAAC,iDAAiD,CAAC,EAC1D;QACI,CAAC,WAAW,CAAC,EAAE,KAAK;KACvB,CACJ,CAAC;AACN,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,SAAiB,EACjB,WAAmB,EACnB,SAOuB,EACvB,KAA8B;IAE9B,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ;QACjB,CAAC,CAAC,eAAe,OAAO,SAAS,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,sBAAsB;QAC1F,CAAC,CAAC,mBAAmB,OAAO,sBAAsB,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAGrC,2CAA2C,IAAI,EAAE,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,WAAW;QACxB,IAAI,EAAE,QAAQ;YACV,CAAC,CAAC;gBACI,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI;oBACtC,UAAU,EAAE,SAAS,CAAC,UAAU;iBACnC,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;aAC7D;YACH,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,KAAK,EAAE;QAC1C,MAAM,EAAE,EAAE,KAAK,EAAE;KACpB,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,MAAM,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,KAAK,GAA2B;YAClC,gBAAgB,EAAE,kBAAkB;YACpC,iBAAiB,EAAE,mBAAmB;YACtC,eAAe,EAAE,iBAAiB;YAClC,SAAS,EAAE,WAAW;YACtB,kBAAkB,EAAE,oBAAoB;SAC3C,CAAC;QACF,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,aAAa,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,eAAe,EAAE;YAC3D,OAAO,EACH,OAAO,KAAK,KAAK,QAAQ;gBACrB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC;SACnE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,6BAA6B;SACzC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,IAAsC;IACrE,IACI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,CAAC,IAAI,CAAC,KAAK;QACX,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAC5B,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EACxC,CAAC;QACC,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,mCAAmC;SAC/C,CAAC,CAAC;IACP,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,mCAAmC;SAC/C,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC"}

package/dist/app-check/app-check-jwt.d.ts

@@ -0,0 +1,16 @@
+import { type JWTPayload } from 'jose';
+import type { ServiceAccount } from '../auth/firebase-types.js';
+import type { createAppCheckKeyResolver } from './app-check-endpoints.js';
+export interface DecodedAppCheckToken extends JWTPayload {
+    app_id: string;
+    sub: string;
+    aud: string[];
+    iss: string;
+    iat: number;
+    exp: number;
+}
+/** @internal Sign the short-lived assertion used by a custom provider. */
+export declare function signAppCheckToken(account: ServiceAccount, appId: string, ttlMillis?: number): Promise<string>;
+/** @internal Verify signatures before trusting any App Check claims. */
+export declare function verifyAppCheckToken(token: string, projectId: string, keys: ReturnType<typeof createAppCheckKeyResolver>): Promise<DecodedAppCheckToken>;
+//# sourceMappingURL=app-check-jwt.d.ts.map

package/dist/app-check/app-check-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-jwt.d.ts","sourceRoot":"","sources":["../../src/app-check/app-check-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1E,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,mBAiCrB;AAED,wEAAwE;AACxE,wBAAsB,mBAAmB,CACrC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,GACnD,OAAO,CAAC,oBAAoB,CAAC,CAgC/B"}

package/dist/app-check/app-check-jwt.js

@@ -0,0 +1,59 @@
+import { importPKCS8, SignJWT, jwtVerify } from 'jose';
+import { FirebaseEdgeError } from '../auth/errors.js';
+/** @internal Sign the short-lived assertion used by a custom provider. */
+export async function signAppCheckToken(account, appId, ttlMillis) {
+    if (typeof appId !== 'string' ||
+        !appId.trim() ||
+        (ttlMillis !== undefined &&
+            (!Number.isFinite(ttlMillis) ||
+                ttlMillis < 1800000 ||
+                ttlMillis > 604800000))) {
+        throw new FirebaseEdgeError({
+            code: 'app-check/invalid-argument',
+            message: 'Provide an app ID and a TTL between 30 minutes and 7 days.'
+        });
+    }
+    const key = await importPKCS8(account.private_key.replace(/\\n/g, '\n'), 'RS256');
+    return new SignJWT({
+        app_id: appId,
+        ...(ttlMillis !== undefined && { ttl: `${ttlMillis / 1000}s` })
+    })
+        .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
+        .setIssuer(account.client_email)
+        .setSubject(account.client_email)
+        .setAudience('https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.TokenExchangeService')
+        .setIssuedAt()
+        .setExpirationTime('5m')
+        .sign(key);
+}
+/** @internal Verify signatures before trusting any App Check claims. */
+export async function verifyAppCheckToken(token, projectId, keys) {
+    if (typeof token !== 'string' || !token.trim()) {
+        throw new FirebaseEdgeError({
+            code: 'app-check/invalid-argument',
+            message: 'Provide an App Check token.'
+        });
+    }
+    const { payload, protectedHeader } = await jwtVerify(token, keys, {
+        algorithms: ['RS256'],
+        audience: `projects/${projectId}`,
+        requiredClaims: ['iss', 'sub', 'aud', 'iat', 'exp']
+    });
+    if (typeof protectedHeader.kid !== 'string' ||
+        !protectedHeader.kid ||
+        !Array.isArray(payload.aud) ||
+        typeof payload.iss !== 'string' ||
+        !/^https:\/\/firebaseappcheck\.googleapis\.com\/[^/]+$/.test(payload.iss) ||
+        typeof payload.sub !== 'string' ||
+        !payload.sub.trim() ||
+        typeof payload.iat !== 'number' ||
+        payload.iat > Date.now() / 1000 ||
+        payload.exp <= payload.iat) {
+        throw new FirebaseEdgeError({
+            code: 'app-check/invalid-argument',
+            message: 'Invalid App Check token claims.'
+        });
+    }
+    return { ...payload, app_id: payload.sub };
+}
+//# sourceMappingURL=app-check-jwt.js.map

package/dist/app-check/app-check-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-jwt.js","sourceRoot":"","sources":["../../src/app-check/app-check-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAYtD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,OAAuB,EACvB,KAAa,EACb,SAAkB;IAElB,IACI,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,IAAI,EAAE;QACb,CAAC,SAAS,KAAK,SAAS;YACpB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACxB,SAAS,GAAG,OAAO;gBACnB,SAAS,GAAG,SAAS,CAAC,CAAC,EACjC,CAAC;QACC,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EACH,4DAA4D;SACnE,CAAC,CAAC;IACP,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,WAAW,CACzB,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EACzC,OAAO,CACV,CAAC;IACF,OAAO,IAAI,OAAO,CAAC;QACf,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;KAClE,CAAC;SACG,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;SAC/B,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC;SAChC,WAAW,CACR,0FAA0F,CAC7F;SACA,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,KAAa,EACb,SAAiB,EACjB,IAAkD;IAElD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,6BAA6B;SACzC,CAAC,CAAC;IACP,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC9D,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,YAAY,SAAS,EAAE;QACjC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACtD,CAAC,CAAC;IACH,IACI,OAAO,eAAe,CAAC,GAAG,KAAK,QAAQ;QACvC,CAAC,eAAe,CAAC,GAAG;QACpB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,sDAAsD,CAAC,IAAI,CACxD,OAAO,CAAC,GAAG,CACd;QACD,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;QACnB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;QAC/B,OAAO,CAAC,GAAI,IAAI,OAAO,CAAC,GAAG,EAC7B,CAAC;QACC,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,iCAAiC;SAC7C,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAA0B,CAAC;AACvE,CAAC"}