firebase-admin-edge 1.1.1 → 2.0.0

package/dist/auth/google-oauth.js

@@ -2,87 +2,16 @@ import { restFetch } from '../rest-fetch.js';
 import { signJWT } from './firebase-jwt.js';
 import { FirebaseEdgeError, ensureError } from './errors.js';
 import { GoogleErrorInfo } from './auth-error-codes.js';
-export async function exchangeCodeForGoogleIdToken(code, redirect_uri, client_id, client_secret, fetchFn) {
-    const url = 'https://oauth2.googleapis.com/token';
-    const { data, error } = await restFetch(url, {
-        global: { fetch: fetchFn },
-        body: {
-            code,
-            client_id,
-            client_secret,
-            redirect_uri,
-            grant_type: 'authorization_code'
-        },
-        form: true
-    });
-    if (error?.error.message) {
-        const errorMessage = error.error.message.toLowerCase();
-        if (errorMessage.includes('invalid_grant')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_GRANT, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('invalid_client')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_CLIENT, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('invalid_request')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_REQUEST, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('access_denied')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_ACCESS_DENIED, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('unsupported_response_type')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_UNSUPPORTED_RESPONSE_TYPE, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        if (errorMessage.includes('invalid_scope')) {
-            return {
-                data: null,
-                error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_INVALID_SCOPE, {
-                    context: { originalError: error.error.message }
-                })
-            };
-        }
-        // Default case for unrecognized errors
-        return {
-            data: null,
-            error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_CODE_EXCHANGE_FAILED, {
-                context: { originalError: error.error.message }
-            })
-        };
-    }
-    if (!data) {
-        return {
-            data: null,
-            error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_TOKEN_REQUEST_FAILED)
-        };
-    }
-    return {
-        data,
-        error: null
-    };
+/** Read both OAuth and Firebase-style token endpoint failures. @internal */
+function googleErrorMessage(error) {
+    if (!error)
+        return undefined;
+    if (typeof error === 'string')
+        return error;
+    if (typeof error.error !== 'string')
+        return error.error?.message;
+    const description = 'error_description' in error ? error.error_description : undefined;
+    return [error.error, description].filter(Boolean).join(': ');
 }
 export async function getToken(serviceAccount, fetch) {
     const url = 'https://oauth2.googleapis.com/token';
@@ -115,14 +44,15 @@ export async function getToken(serviceAccount, fetch) {
             },
             form: true
         });
-        if (error?.error.message) {
-            const errorMessage = error.error.message.toLowerCase();
+        const originalError = googleErrorMessage(error);
+        if (originalError) {
+            const errorMessage = originalError.toLowerCase();
             if (errorMessage.includes('unavailable') ||
                 errorMessage.includes('503')) {
                 return {
                     data: null,
                     error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_TEMPORARILY_UNAVAILABLE, {
-                        context: { originalError: error.error.message }
+                        context: { originalError }
                     })
                 };
             }
@@ -131,7 +61,7 @@ export async function getToken(serviceAccount, fetch) {
                 return {
                     data: null,
                     error: new FirebaseEdgeError(GoogleErrorInfo.GOOGLE_SERVER_ERROR, {
-                        context: { originalError: error.error.message }
+                        context: { originalError }
                     })
                 };
             }
@@ -139,7 +69,7 @@ export async function getToken(serviceAccount, fetch) {
             return {
                 data: null,
                 error: new FirebaseEdgeError(GoogleErrorInfo.SERVICE_ACCOUNT_TOKEN_FAILED, {
-                    context: { originalError: error.error.message }
+                    context: { originalError }
                 })
             };
         }

package/dist/auth/google-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/auth/google-oauth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAYxD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAC9C,IAAY,EACZ,YAAoB,EACpB,SAAiB,EACjB,aAAqB,EACrB,OAAiC;IAEjC,MAAM,GAAG,GAAG,qCAAqC,CAAC;IAElD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,IAAI;YACJ,SAAS;YACT,aAAa;YACb,YAAY;YACZ,UAAU,EAAE,oBAAoB;SACnC;QACD,IAAI,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEvD,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,oBAAoB,EACpC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,qBAAqB,EACrC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,sBAAsB,EACtC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,oBAAoB,EACpC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACrD,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,gCAAgC,EAChD;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,oBAAoB,EACpC;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,uCAAuC;QACvC,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,EAC3C;gBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;aAClD,CACJ;SACJ,CAAC;IACN,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,CAC9C;SACJ,CAAC;IACN,CAAC;IAED,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,IAAI;KACd,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC1B,cAA8B,EAC9B,KAA+B;IAE/B,MAAM,GAAG,GAAG,qCAAqC,CAAC;IAElD,IAAI,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GACpC,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAElC,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,eAAe,EAAE;oBAC1D,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC;oBAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE;iBAC/C,CAAC;aACL,CAAC;QACN,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,gBAAgB,CAAC;aACjE,CAAC;QACN,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;YACH,MAAM,EAAE,EAAE,KAAK,EAAE;YACjB,IAAI,EAAE;gBACF,UAAU,EAAE,6CAA6C;gBACzD,SAAS,EAAE,OAAO;aACrB;YACD,OAAO,EAAE;gBACL,eAAe,EAAE,UAAU;gBAC3B,IAAI,EAAE,uBAAuB;aAChC;YACD,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAEvD,IACI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACpC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,8BAA8B,EAC9C;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;qBAClD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IACI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,mBAAmB,EACnC;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;qBAClD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,sDAAsD;YACtD,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,4BAA4B,EAC5C;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,CAC9C;aACJ,CAAC;QACN,CAAC;QAED,OAAO;YACH,IAAI;YACJ,KAAK,EAAE,IAAI;SACd,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,EAC3C;gBACI,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;gBACrB,OAAO,EAAE;oBACL,aAAa,EACT,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;iBACjD;aACJ,CACJ;SACJ,CAAC;IACN,CAAC;AACL,CAAC"}
+{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/auth/google-oauth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAOxD,4EAA4E;AAC5E,SAAS,kBAAkB,CACvB,KAA2D;IAE3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;IACjE,MAAM,WAAW,GACb,mBAAmB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC1B,cAA8B,EAC9B,KAA+B;IAE/B,MAAM,GAAG,GAAG,qCAAqC,CAAC;IAElD,IAAI,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GACpC,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAElC,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,eAAe,EAAE;oBAC1D,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC;oBAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE;iBAC/C,CAAC;aACL,CAAC;QACN,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC,eAAe,CAAC,gBAAgB,CAAC;aACjE,CAAC;QACN,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;YACH,MAAM,EAAE,EAAE,KAAK,EAAE;YACjB,IAAI,EAAE;gBACF,UAAU,EAAE,6CAA6C;gBACzD,SAAS,EAAE,OAAO;aACrB;YACD,OAAO,EAAE;gBACL,eAAe,EAAE,UAAU;gBAC3B,IAAI,EAAE,uBAAuB;aAChC;YACD,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;YAEjD,IACI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACpC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,8BAA8B,EAC9C;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE;qBAC7B,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IACI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACC,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,mBAAmB,EACnC;wBACI,OAAO,EAAE,EAAE,aAAa,EAAE;qBAC7B,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,sDAAsD;YACtD,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,4BAA4B,EAC5C;oBACI,OAAO,EAAE,EAAE,aAAa,EAAE;iBAC7B,CACJ;aACJ,CAAC;QACN,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,CAC9C;aACJ,CAAC;QACN,CAAC;QAED,OAAO;YACH,IAAI;YACJ,KAAK,EAAE,IAAI;SACd,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,eAAe,CAAC,2BAA2B,EAC3C;gBACI,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;gBACrB,OAAO,EAAE;oBACL,aAAa,EACT,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;iBACjD;aACJ,CACJ;SACJ,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/auth/project-config-manager.d.ts

@@ -0,0 +1,10 @@
+import type { AuthConfigExecutor, ProjectConfig, UpdateProjectConfigRequest } from './auth-config-types.js';
+/** Manage the configuration of the parent Identity Platform project. */
+export declare class ProjectConfigManager {
+    private readonly execute;
+    /** @internal Obtain this manager from adminAuth.projectConfigManager(). */
+    constructor(execute: AuthConfigExecutor);
+    getProjectConfig(): Promise<import("./auth-config-types.js").AuthConfigResult<ProjectConfig>>;
+    updateProjectConfig(properties: UpdateProjectConfigRequest): Promise<import("./auth-config-types.js").AuthConfigResult<ProjectConfig>>;
+}
+//# sourceMappingURL=project-config-manager.d.ts.map

package/dist/auth/project-config-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config-manager.d.ts","sourceRoot":"","sources":["../../src/auth/project-config-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,kBAAkB,EAClB,aAAa,EACb,0BAA0B,EAC7B,MAAM,wBAAwB,CAAC;AAEhC,wEAAwE;AACxE,qBAAa,oBAAoB;IAEjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IADpC,2EAA2E;gBAC9C,OAAO,EAAE,kBAAkB;IAExD,gBAAgB;IAOhB,mBAAmB,CAAC,UAAU,EAAE,0BAA0B;CAO7D"}

package/dist/auth/project-config-manager.js

@@ -0,0 +1,22 @@
+/** Manage the configuration of the parent Identity Platform project. */
+export class ProjectConfigManager {
+    execute;
+    /** @internal Obtain this manager from adminAuth.projectConfigManager(). */
+    constructor(execute) {
+        this.execute = execute;
+    }
+    getProjectConfig() {
+        return this.execute({
+            resource: 'project',
+            action: 'get'
+        });
+    }
+    updateProjectConfig(properties) {
+        return this.execute({
+            resource: 'project',
+            action: 'update',
+            properties
+        });
+    }
+}
+//# sourceMappingURL=project-config-manager.js.map

package/dist/auth/project-config-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config-manager.js","sourceRoot":"","sources":["../../src/auth/project-config-manager.ts"],"names":[],"mappings":"AAMA,wEAAwE;AACxE,MAAM,OAAO,oBAAoB;IAEA;IAD7B,2EAA2E;IAC3E,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAE5D,gBAAgB;QACZ,OAAO,IAAI,CAAC,OAAO,CAAgB;YAC/B,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,KAAK;SAChB,CAAC,CAAC;IACP,CAAC;IAED,mBAAmB,CAAC,UAAsC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAgB;YAC/B,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,QAAQ;YAChB,UAAU;SACb,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/auth/provider-credential.d.ts

@@ -0,0 +1,43 @@
+import type { FirebaseIdpSignInResponse } from './firebase-types.js';
+export declare const FIREBASE_PROVIDER_IDS: {
+    readonly google: "google.com";
+    readonly facebook: "facebook.com";
+    readonly apple: "apple.com";
+    readonly twitter: "twitter.com";
+    readonly github: "github.com";
+    readonly microsoft: "microsoft.com";
+    readonly yahoo: "yahoo.com";
+    readonly playgames: "playgames.google.com";
+};
+export type ProviderCredential = {
+    idToken?: string;
+    accessToken?: string;
+    rawNonce?: string;
+    secret?: string;
+    serverAuthCode?: string;
+};
+export type ProviderAuthorizationOptions = {
+    addScopes?: string[];
+    customParameters?: Record<string, string>;
+};
+export type ProviderCallback = {
+    requestUri: string;
+} & ({
+    sessionId: string;
+    postBody?: string;
+    pendingToken?: never;
+} | {
+    pendingToken: string;
+    sessionId?: never;
+    postBody?: never;
+});
+/** Resolve a provider slug or a configured Firebase provider ID. */
+export declare function resolveProviderId(provider: string): string;
+/** Serialize credentials for Firebase's signInWithIdp endpoint. @internal */
+export declare function providerCredentialBody(token: string | ProviderCredential, provider: string): string;
+/** Recover and validate the provider credential returned by Firebase. @internal */
+export declare function providerCredentialFromResponse(response: FirebaseIdpSignInResponse): {
+    providerId: string;
+    credential: ProviderCredential;
+};
+//# sourceMappingURL=provider-credential.d.ts.map

package/dist/auth/provider-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credential.d.ts","sourceRoot":"","sources":["../../src/auth/provider-credential.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAErE,eAAO,MAAM,qBAAqB;;;;;;;;;CASxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACvC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,CAClD;IACI,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;CACxB,GACD;IACI,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,QAAQ,CAAC,EAAE,KAAK,CAAC;CACpB,CACN,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAClC,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,QAAQ,EAAE,MAAM,GACjB,MAAM,CAsER;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC1C,QAAQ,EAAE,yBAAyB;;;EAkBtC"}

package/dist/auth/provider-credential.js

@@ -0,0 +1,107 @@
+import { FirebaseEdgeError } from './errors.js';
+export const FIREBASE_PROVIDER_IDS = {
+    google: 'google.com',
+    facebook: 'facebook.com',
+    apple: 'apple.com',
+    twitter: 'twitter.com',
+    github: 'github.com',
+    microsoft: 'microsoft.com',
+    yahoo: 'yahoo.com',
+    playgames: 'playgames.google.com'
+};
+/** Resolve a provider slug or a configured Firebase provider ID. */
+export function resolveProviderId(provider) {
+    if (Object.hasOwn(FIREBASE_PROVIDER_IDS, provider))
+        return FIREBASE_PROVIDER_IDS[provider];
+    if (Object.values(FIREBASE_PROVIDER_IDS).includes(provider) ||
+        /^(oidc|saml)\..+/.test(provider))
+        return provider;
+    throw new FirebaseEdgeError({
+        code: 'auth/invalid-provider-id',
+        message: 'Unsupported Firebase provider.'
+    });
+}
+/** Serialize credentials for Firebase's signInWithIdp endpoint. @internal */
+export function providerCredentialBody(token, provider) {
+    const providerId = resolveProviderId(provider);
+    const credential = typeof token === 'string'
+        ? providerId === 'github.com' || providerId === 'facebook.com'
+            ? { accessToken: token }
+            : providerId === 'playgames.google.com'
+                ? { serverAuthCode: token }
+                : { idToken: token }
+        : token;
+    if (!credential ||
+        ![
+            credential.idToken,
+            credential.accessToken,
+            credential.serverAuthCode
+        ].some((value) => typeof value === 'string' && value.trim().length > 0))
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'A provider credential is required.'
+        });
+    if (['microsoft.com', 'yahoo.com'].includes(providerId) &&
+        credential.accessToken &&
+        !credential.idToken)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Use a Firebase-managed authorization flow for this provider.'
+        });
+    if (providerId.startsWith('saml.'))
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'SAML requires an authorization callback.'
+        });
+    if (providerId === 'twitter.com' &&
+        (!credential.accessToken || !credential.secret))
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Twitter requires an access token and token secret.'
+        });
+    if (providerId === 'playgames.google.com' && !credential.serverAuthCode)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Play Games requires a server authorization code.'
+        });
+    const body = new URLSearchParams();
+    const fields = {
+        idToken: 'id_token',
+        accessToken: 'access_token',
+        rawNonce: 'nonce',
+        secret: 'oauth_token_secret',
+        serverAuthCode: 'code'
+    };
+    for (const [key, field] of Object.entries(fields)) {
+        const value = credential[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== 'string' || !value.trim())
+            throw new FirebaseEdgeError({
+                code: 'auth/invalid-credential',
+                message: 'Credential fields must be nonempty strings.'
+            });
+        body.set(field, value);
+    }
+    body.set('providerId', providerId);
+    return body.toString();
+}
+/** Recover and validate the provider credential returned by Firebase. @internal */
+export function providerCredentialFromResponse(response) {
+    if (!response.providerId)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-credential',
+            message: 'Firebase did not identify the provider for account linking.'
+        });
+    const providerId = resolveProviderId(response.providerId);
+    const credential = {
+        idToken: response.oauthIdToken,
+        accessToken: response.oauthAccessToken,
+        secret: response.oauthTokenSecret,
+        rawNonce: response.nonce
+    };
+    // Reuse provider-specific validation, including Twitter's token secret.
+    providerCredentialBody(credential, providerId);
+    return { providerId, credential };
+}
+//# sourceMappingURL=provider-credential.js.map

package/dist/auth/provider-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credential.js","sourceRoot":"","sources":["../../src/auth/provider-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACjC,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,sBAAsB;CAC3B,CAAC;AA4BX,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC;QAC9C,OAAO,qBAAqB,CACxB,QAA8C,CACjD,CAAC;IACN,IACK,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAuB,CAAC,QAAQ,CAChE,QAAQ,CACX;QACD,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAEjC,OAAO,QAAQ,CAAC;IACpB,MAAM,IAAI,iBAAiB,CAAC;QACxB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,gCAAgC;KAC5C,CAAC,CAAC;AACP,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAClC,KAAkC,EAClC,QAAgB;IAEhB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,UAAU,GACZ,OAAO,KAAK,KAAK,QAAQ;QACrB,CAAC,CAAC,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,cAAc;YAC1D,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;YACxB,CAAC,CAAC,UAAU,KAAK,sBAAsB;gBACrC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1B,CAAC,CAAC,KAAK,CAAC;IAChB,IACI,CAAC,UAAU;QACX,CAAC;YACG,UAAU,CAAC,OAAO;YAClB,UAAU,CAAC,WAAW;YACtB,UAAU,CAAC,cAAc;SAC5B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAEvE,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oCAAoC;SAChD,CAAC,CAAC;IACP,IACI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnD,UAAU,CAAC,WAAW;QACtB,CAAC,UAAU,CAAC,OAAO;QAEnB,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACH,8DAA8D;SACrE,CAAC,CAAC;IACP,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9B,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACP,IACI,UAAU,KAAK,aAAa;QAC5B,CAAC,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAE/C,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oDAAoD;SAChE,CAAC,CAAC;IACP,IAAI,UAAU,KAAK,sBAAsB,IAAI,CAAC,UAAU,CAAC,cAAc;QACnE,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,kDAAkD;SAC9D,CAAC,CAAC;IACP,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG;QACX,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,oBAAoB;QAC5B,cAAc,EAAE,MAAM;KAChB,CAAC;IACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAA+B,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC1C,MAAM,IAAI,iBAAiB,CAAC;gBACxB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,6CAA6C;aACzD,CAAC,CAAC;QACP,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAC1C,QAAmC;IAEnC,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpB,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACH,6DAA6D;SACpE,CAAC,CAAC;IACP,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAuB;QACnC,OAAO,EAAE,QAAQ,CAAC,YAAY;QAC9B,WAAW,EAAE,QAAQ,CAAC,gBAAgB;QACtC,MAAM,EAAE,QAAQ,CAAC,gBAAgB;QACjC,QAAQ,EAAE,QAAQ,CAAC,KAAK;KAC3B,CAAC;IACF,wEAAwE;IACxE,sBAAsB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC"}

package/dist/auth/provider-session.d.ts

@@ -0,0 +1,10 @@
+export type ProviderSession = {
+    sessionId: string;
+    next: string;
+    intent: 'signin' | 'link';
+};
+/** Validate redirect paths at both flow creation and callback consumption. @internal */
+export declare function isLocalRedirectPath(value: unknown): value is string;
+/** Read an untrusted serialized authorization session. @internal */
+export declare function parseProviderSession(stored: string): ProviderSession | null;
+//# sourceMappingURL=provider-session.d.ts.map

package/dist/auth/provider-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-session.d.ts","sourceRoot":"","sources":["../../src/auth/provider-session.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC7B,CAAC;AAEF,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAOnE;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAkB3E"}

package/dist/auth/provider-session.js

@@ -0,0 +1,28 @@
+/** Validate redirect paths at both flow creation and callback consumption. @internal */
+export function isLocalRedirectPath(value) {
+    if (typeof value !== 'string')
+        return false;
+    return (value.startsWith('/') &&
+        !value.startsWith('//') &&
+        !/[\\\r\n]/.test(value));
+}
+/** Read an untrusted serialized authorization session. @internal */
+export function parseProviderSession(stored) {
+    let value;
+    try {
+        value = JSON.parse(stored);
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const flow = value;
+    if (typeof flow.sessionId !== 'string' ||
+        !flow.sessionId ||
+        !isLocalRedirectPath(flow.next) ||
+        (flow.intent !== 'signin' && flow.intent !== 'link'))
+        return null;
+    return { sessionId: flow.sessionId, next: flow.next, intent: flow.intent };
+}
+//# sourceMappingURL=provider-session.js.map

package/dist/auth/provider-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-session.js","sourceRoot":"","sources":["../../src/auth/provider-session.ts"],"names":[],"mappings":"AAMA,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CACH,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACvB,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAC1B,CAAC;AACN,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,MAAc;IAC/C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3D,OAAO,IAAI,CAAC;IAChB,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,IAAI,CAAC,SAAS;QACf,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QAEpD,OAAO,IAAI,CAAC;IAChB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC/E,CAAC"}

package/dist/auth/tenant-manager.d.ts

@@ -0,0 +1,17 @@
+import type { FirebaseAdminAuth } from './firebase-admin-auth.js';
+import type { AuthConfigExecutor, CreateTenantRequest, UpdateTenantRequest, Tenant, ListTenantsResult } from './auth-config-types.js';
+/** Manage tenants and obtain tenant-scoped authentication instances. */
+export declare class TenantManager {
+    private readonly execute;
+    private readonly createAuth;
+    private readonly instances;
+    /** @internal Obtain this manager from adminAuth.tenantManager(). */
+    constructor(execute: AuthConfigExecutor, createAuth: (tenantId: string) => FirebaseAdminAuth);
+    authForTenant(tenantId: string): FirebaseAdminAuth;
+    createTenant(properties: CreateTenantRequest): Promise<import("./auth-config-types.js").AuthConfigResult<Tenant>>;
+    getTenant(tenantId: string): Promise<import("./auth-config-types.js").AuthConfigResult<Tenant>>;
+    updateTenant(tenantId: string, properties: UpdateTenantRequest): Promise<import("./auth-config-types.js").AuthConfigResult<Tenant>>;
+    deleteTenant(tenantId: string): Promise<import("./auth-config-types.js").AuthConfigResult<void>>;
+    listTenants(maxResults?: number, pageToken?: string): Promise<import("./auth-config-types.js").AuthConfigResult<ListTenantsResult>>;
+}
+//# sourceMappingURL=tenant-manager.d.ts.map

package/dist/auth/tenant-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-manager.d.ts","sourceRoot":"","sources":["../../src/auth/tenant-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EACR,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,EACN,iBAAiB,EACpB,MAAM,wBAAwB,CAAC;AAGhC,wEAAwE;AACxE,qBAAa,aAAa;IAKlB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAElE,oEAAoE;gBAE/C,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,iBAAiB;IAGxE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB;IASlD,YAAY,CAAC,UAAU,EAAE,mBAAmB;IAQ5C,SAAS,CAAC,QAAQ,EAAE,MAAM;IAQ1B,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB;IAS9D,YAAY,CAAC,QAAQ,EAAE,MAAM;IAQ7B,WAAW,CAAC,UAAU,SAAO,EAAE,SAAS,CAAC,EAAE,MAAM;CAQpD"}

package/dist/auth/tenant-manager.js

@@ -0,0 +1,59 @@
+import { validateTenantId } from './auth-config.js';
+/** Manage tenants and obtain tenant-scoped authentication instances. */
+export class TenantManager {
+    execute;
+    createAuth;
+    instances = new Map();
+    /** @internal Obtain this manager from adminAuth.tenantManager(). */
+    constructor(execute, createAuth) {
+        this.execute = execute;
+        this.createAuth = createAuth;
+    }
+    authForTenant(tenantId) {
+        validateTenantId(tenantId);
+        const existing = this.instances.get(tenantId);
+        if (existing)
+            return existing;
+        const auth = this.createAuth(tenantId);
+        this.instances.set(tenantId, auth);
+        return auth;
+    }
+    createTenant(properties) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'create',
+            properties
+        });
+    }
+    getTenant(tenantId) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'get',
+            id: tenantId
+        });
+    }
+    updateTenant(tenantId, properties) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'update',
+            id: tenantId,
+            properties
+        });
+    }
+    deleteTenant(tenantId) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'delete',
+            id: tenantId
+        });
+    }
+    listTenants(maxResults = 1000, pageToken) {
+        return this.execute({
+            resource: 'tenant',
+            action: 'list',
+            maxResults,
+            pageToken
+        });
+    }
+}
+//# sourceMappingURL=tenant-manager.js.map

package/dist/auth/tenant-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-manager.js","sourceRoot":"","sources":["../../src/auth/tenant-manager.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,wEAAwE;AACxE,MAAM,OAAO,aAAa;IAKD;IACA;IALJ,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IAElE,oEAAoE;IACpE,YACqB,OAA2B,EAC3B,UAAmD;QADnD,YAAO,GAAP,OAAO,CAAoB;QAC3B,eAAU,GAAV,UAAU,CAAyC;IACrE,CAAC;IAEJ,aAAa,CAAC,QAAgB;QAC1B,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,YAAY,CAAC,UAA+B;QACxC,OAAO,IAAI,CAAC,OAAO,CAAS;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,UAAU;SACb,CAAC,CAAC;IACP,CAAC;IAED,SAAS,CAAC,QAAgB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAS;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,KAAK;YACb,EAAE,EAAE,QAAQ;SACf,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,UAA+B;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAS;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,QAAQ;YACZ,UAAU;SACb,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAO;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,QAAQ;SACf,CAAC,CAAC;IACP,CAAC;IAED,WAAW,CAAC,UAAU,GAAG,IAAI,EAAE,SAAkB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAoB;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,UAAU;YACV,SAAS;SACZ,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/db/aggregate.d.ts

@@ -0,0 +1,49 @@
+import { type FirestoreResult } from './firestore-results.js';
+import type { DocumentData } from './firestore-document.js';
+import { FieldPath } from './field-path.js';
+import type { Query } from './query.js';
+import { Timestamp } from './timestamp.js';
+import { type ExplainOptions, type ExplainResults } from './explain.js';
+export declare const aggregateReadTime: unique symbol;
+export declare const aggregateMetrics: unique symbol;
+export declare class AggregateField<T = number | null> {
+    readonly aggregateType: 'count' | 'sum' | 'avg';
+    readonly field?: string | undefined;
+    readonly _resultType: T;
+    readonly type = "AggregateField";
+    private constructor();
+    static count(): AggregateField<number>;
+    static sum(field: string | FieldPath): AggregateField<number>;
+    static average(field: string | FieldPath): AggregateField;
+    private static forField;
+    isEqual(other: AggregateField): boolean;
+}
+export type AggregateSpec = Record<string, AggregateField>;
+export type AggregateData = Record<string, number | null>;
+export declare class AggregateQuery<S extends AggregateSpec = AggregateSpec, AppModelType = DocumentData, DbModelType extends DocumentData = DocumentData> {
+    readonly query: Query<AppModelType, DbModelType>;
+    private readonly execute;
+    explain(options?: ExplainOptions): Promise<FirestoreResult<ExplainResults<AggregateQuerySnapshot<S, AppModelType, DbModelType>>>>;
+    isEqual(other: unknown): boolean;
+    private readonly spec;
+    /** @internal Use query.aggregate() or query.count(). */
+    constructor(query: Query<AppModelType, DbModelType>, spec: S, execute: (spec: S, transaction?: string, explain?: ExplainOptions) => Promise<AggregateData>);
+    get(): Promise<FirestoreResult<AggregateQuerySnapshot<S, AppModelType, DbModelType>>>;
+    /** @internal Transaction-bound aggregate reads. */
+    _get(transaction?: string): Promise<AggregateQuerySnapshot<S, AppModelType, DbModelType>>;
+}
+export declare class AggregateQuerySnapshot<S extends AggregateSpec = AggregateSpec, AppModelType = DocumentData, DbModelType extends DocumentData = DocumentData> {
+    readonly query: AggregateQuery<S, AppModelType, DbModelType>;
+    private readonly result;
+    readonly readTime: Timestamp;
+    isEqual(other: unknown): boolean;
+    /** @internal Obtain from AggregateQuery.get(). */
+    constructor(query: AggregateQuery<S, AppModelType, DbModelType>, result: AggregateData, readTime?: Timestamp);
+    data(): AggregateSpecData<S>;
+}
+export type AggregateType = 'count' | 'avg' | 'sum';
+export type AggregateFieldType = AggregateField<number> | AggregateField<number | null>;
+export type AggregateSpecData<S extends AggregateSpec> = {
+    [K in keyof S]: S[K] extends AggregateField<infer T> ? T : never;
+};
+//# sourceMappingURL=aggregate.d.ts.map

package/dist/db/aggregate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregate.d.ts","sourceRoot":"","sources":["../../src/db/aggregate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAG5D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAEH,KAAK,cAAc,EAEnB,KAAK,cAAc,EACtB,MAAM,cAAc,CAAC;AACtB,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAC7D,eAAO,MAAM,gBAAgB,eAA6B,CAAC;AAE3D,qBAAa,cAAc,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI;IAIrC,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,KAAK,GAAG,KAAK;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;IAJ3B,SAAiB,WAAW,EAAE,CAAC,CAAC;IAChC,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO;IAIP,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC,MAAM,CAAC;IAGtC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC;IAG7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc;IAGzD,OAAO,CAAC,MAAM,CAAC,QAAQ;IAOvB,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO;CAO1C;AACD,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAC3D,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;AAE1D,qBAAa,cAAc,CACvB,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,YAAY,GAAG,YAAY,EAC3B,WAAW,SAAS,YAAY,GAAG,YAAY;IA0D3C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,OAAO;IA1DtB,OAAO,CACT,OAAO,GAAE,cAAmB,GAC7B,OAAO,CACN,eAAe,CACX,cAAc,CAAC,sBAAsB,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CACvE,CACJ;IAwCD,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAOhC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAI;IACzB,wDAAwD;gBAE3C,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,EAChD,IAAI,EAAE,CAAC,EACU,OAAO,EAAE,CACtB,IAAI,EAAE,CAAC,EACP,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,cAAc,KACvB,OAAO,CAAC,aAAa,CAAC;IAczB,GAAG,IAAI,OAAO,CAChB,eAAe,CAAC,sBAAsB,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CACxE;IAUD,mDAAmD;IAC7C,IAAI,CACN,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;CAanE;AAED,qBAAa,sBAAsB,CAC/B,CAAC,SAAS,aAAa,GAAG,aAAa,EACvC,YAAY,GAAG,YAAY,EAC3B,WAAW,SAAS,YAAY,GAAG,YAAY;IAW3C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS;IAXhC,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAOhC,kDAAkD;gBAErC,KAAK,EAAE,cAAc,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,EAC3C,MAAM,EAAE,aAAa,EAC7B,QAAQ,GAAE,SAA2B;IAElD,IAAI,IAAI,iBAAiB,CAAC,CAAC,CAAC;CAG/B;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AACpD,MAAM,MAAM,kBAAkB,GACxB,cAAc,CAAC,MAAM,CAAC,GACtB,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,aAAa,IAAI;KACpD,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CACnE,CAAC"}