feat(auth)!: remove the deprecated AuthCheck and ClaimsCheck components

[tyler-reitz]

Draft only because GitHub Actions is down (incident opened 15:22 UTC 2026-08-06, major outage). No workflow runs were created for this branch, so the CLEAN merge state reflects absent CI rather than passing CI, and v5 is unprotected. The work is finished. Undrafting once checks actually run.

Verified locally in the meantime: both typechecks pass, npm run test:auth is 12/12, the rewritten test is mutation-verified, and eslint reports 17 warnings against 18 on the base.

Group 3 of #754. Refs #754, which stays open for Groups 1 and 2.

What this removes

AuthCheck and ClaimsCheck, plus their exported AuthCheckProps and ClaimsCheckProps types.

They were deprecated in #368 on 2021-05-14, which shipped useSigninCheck as the replacement in the same commit and migrated docs/use.md and example/withoutSuspense/Auth.tsx off them. Four years and three months. Nothing in the repo has pointed at them since.

They also only ever worked with <FirebaseAppProvider suspense={true}>. In non-suspense mode they logged a deprecation warning and rendered anyway, which means a suspense-mode user has had no runtime signal at all. That is an argument for a clear upgrade-guide entry rather than for keeping them, and there is one in this PR.

Removing them is a runtime break for a plain JS importer (an import error at load), not just a type error, which is why this rides the major rather than a minor.

Deliberately kept

⚠️ ClaimCheckErrors stays. It sits directly between the two removed interfaces in src/auth.tsx and is easy to take by accident, but it belongs to the SigninCheckResult shape that useSigninCheck returns. It also sits between the two removed entries in the generated reference index, which is why the docs were regenerated rather than hand-edited.

useIdTokenResult stays too. Its only in-repo caller was ClaimsCheck, but it is public API in its own right.

Two consequences worth reading

1. src/auth.tsx loses two imports, and a naive removal would not build. tsconfig.json sets noUnusedLocals, and every React. reference in the file (React.ReactNode ×4 in the removed props, React.ReactElement in AuthCheck) plus every use of useSuspenseEnabledFromConfigAndContext lived inside the removed code. Both imports go. The file now contains no JSX; I kept the .tsx extension anyway, since renaming emits the same auth.js and only costs blame history.

2. One of the tests I had to touch was vacuous, and it is now real. it('always returns a user if inside an <AuthCheck> component') was not about AuthCheck at all, so it needed rewriting rather than deleting. While rewriting it: beforeEach signs out, so the gate rendered its fallback, UserDetails never mounted, and both of its expect calls never executed. The test's own comment said as much.

It now signs in first and awaits the gated testid, so it fails if the gate never renders. Mutation-verified: removing the signIn() makes it fail. This is the third inert-check of this shape found in this repo, after the entry-load canary list and the @ts-expect-error in the options type test.

Verification

Check	Result
tsc -p tsconfig.json	pass, and it is what catches the two dead imports
tsc -p tsconfig.test.json	pass
npm run test:auth	12/12 (the 4 AuthCheck tests and 1 test.todo are gone)
Mutation check on the rewritten test	fails without the sign-in, as intended
npm run docs:fork	4 pages deleted, 4 index lines dropped
eslint	0 errors, 17 warnings, against 18 on the base

The reference docs show 9 more modified files than the deletions alone. Every one is a source-link line number moving because src/auth.tsx lost 89 lines (src/auth.tsx:22 becomes :20). No content changed in any of them.

Test changes, in detail

• The describe('AuthCheck') block goes: 4 tests plus a test.todo, all of which existed only to exercise the removed component.
• Two other tests used the old AuthCheckWrapper without being about AuthCheck. They now share a SigninGateWrapper built on useSigninCheck that renders the same signed-in / signed-out testids and keeps the suspense mode and Suspense boundary the old wrapper had, so does not show a logged-out user after navigating away still tests what it tested.

Noted, not fixed

The auth tests are coupled through the global observable cache. Under the mutation above, a second unrelated test also failed (returns the same value as getAuth(app).currentUser), because the auth:user: cache entry persists across tests. Everything is green normally, and this is pre-existing rather than introduced here, but it is the same globalThis cache that per-request SSR scoping has to address, so it is worth knowing about before someone reorders these tests.

One unrelated fix, folded in deliberately (second commit)

test/auth.test.tsx had an afterAll nested inside an afterAll, so the inner console.info.mockRestore() was only registered once teardown was already running and never ran. The mock leaked past the suite.

Pre-existing and nothing to do with AuthCheck. It is two lines in a file this branch already edits, and it is a separate commit so it can be read or reverted on its own. The @ts-expect-error above it is still required, which the test typecheck confirms.

Not in this PR

Groups 1 and 2 of #754. Group 1 (checkOptions, checkinitialData) is blocked: checkIdField still calls checkOptions on v5, and the rewrite that removes it lives on #740's branch, which targets main and has not merged. Group 2 (startWithValue) is a behavior change with three live call sites and wants its own PR. #754 cannot close until Group 1 unblocks.