@dereekb/firebase-server 13.11.1 → 13.11.3

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.11.1",
+  "version": "13.11.3",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.1",
-    "@dereekb/date": "13.11.1",
-    "@dereekb/firebase": "13.11.1",
-    "@dereekb/firebase-server": "13.11.1",
-    "@dereekb/model": "13.11.1",
-    "@dereekb/nestjs": "13.11.1",
-    "@dereekb/rxjs": "13.11.1",
-    "@dereekb/util": "13.11.1",
+    "@dereekb/analytics": "13.11.3",
+    "@dereekb/date": "13.11.3",
+    "@dereekb/firebase": "13.11.3",
+    "@dereekb/firebase-server": "13.11.3",
+    "@dereekb/model": "13.11.3",
+    "@dereekb/nestjs": "13.11.3",
+    "@dereekb/rxjs": "13.11.3",
+    "@dereekb/util": "13.11.3",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/model/src/lib/notification/notification.action.server.d.ts

@@ -1,4 +1,4 @@
-import { type AsyncNotificationSummaryCreateAction, type AsyncNotificationUserCreateAction, type AsyncNotificationUserUpdateAction, type CleanupSentNotificationsParams, type CreateNotificationBoxParams, type CreateNotificationSummaryParams, type CreateNotificationUserParams, type NotificationSummaryDocument, type NotificationUser, type NotificationUserDocument, type SendNotificationParams, type SendQueuedNotificationsParams, type UpdateNotificationBoxParams, type UpdateNotificationBoxRecipientParams, type UpdateNotificationUserParams, type AsyncNotificationBoxCreateAction, type AsyncNotificationBoxUpdateAction, type CleanupSentNotificationsResult, type FirestoreContextReference, type NotificationBox, type NotificationBoxDocument, type NotificationDocument, type NotificationFirestoreCollections, type SendNotificationResult, type SendQueuedNotificationsResult, type Transaction, type ResyncAllNotificationUserParams, type ResyncAllNotificationUsersResult, type ResyncNotificationUserResult, type ResyncNotificationUserParams, type AppNotificationTemplateTypeInfoRecordServiceRef, type AsyncNotificationSummaryUpdateAction, type UpdateNotificationSummaryParams, type NotificationBoxDocumentReferencePair } from '@dereekb/firebase';
+import { type AsyncNotificationSummaryCreateAction, type AsyncNotificationUserCreateAction, type AsyncNotificationUserUpdateAction, type CleanupSentNotificationsParams, type CleanupOldNotificationLoggedEventDaysParams, type CleanupOldNotificationLoggedEventDaysResult, type CreateNotificationBoxParams, type CreateNotificationSummaryParams, type CreateNotificationUserParams, type NotificationSummaryDocument, type NotificationUser, type NotificationUserDocument, type SendNotificationParams, type SendQueuedNotificationsParams, type UpdateNotificationBoxParams, type UpdateNotificationBoxRecipientParams, type UpdateNotificationUserParams, type AsyncNotificationBoxCreateAction, type AsyncNotificationBoxUpdateAction, type CleanupSentNotificationsResult, type FirestoreContextReference, type NotificationBox, type NotificationBoxDocument, type NotificationDocument, type NotificationFirestoreCollections, type SendNotificationResult, type SendQueuedNotificationsResult, type Transaction, type ResyncAllNotificationUserParams, type ResyncAllNotificationUsersResult, type ResyncNotificationUserResult, type ResyncNotificationUserParams, type AppNotificationTemplateTypeInfoRecordServiceRef, type AsyncNotificationSummaryUpdateAction, type UpdateNotificationSummaryParams, type NotificationBoxDocumentReferencePair } from '@dereekb/firebase';
 import { type FirebaseServerActionsContext, type FirebaseServerAuthServiceRef } from '@dereekb/firebase-server';
 import { type TransformAndValidateFunctionResult } from '@dereekb/model';
 import { type Maybe } from '@dereekb/util';
@@ -58,6 +58,7 @@ export declare abstract class NotificationServerActions {
     abstract sendNotification(params: SendNotificationParams): Promise<TransformAndValidateFunctionResult<SendNotificationParams, (notificationDocument: NotificationDocument) => Promise<SendNotificationResult>>>;
     abstract sendQueuedNotifications(params: SendQueuedNotificationsParams): Promise<TransformAndValidateFunctionResult<SendQueuedNotificationsParams, (sendQueuedNotificationsInput?: Maybe<SendQueuedNotificationsInput>) => Promise<SendQueuedNotificationsResult>>>;
     abstract cleanupSentNotifications(params: CleanupSentNotificationsParams): Promise<TransformAndValidateFunctionResult<CleanupSentNotificationsParams, () => Promise<CleanupSentNotificationsResult>>>;
+    abstract cleanupOldNotificationLoggedEventDays(params: CleanupOldNotificationLoggedEventDaysParams): Promise<TransformAndValidateFunctionResult<CleanupOldNotificationLoggedEventDaysParams, () => Promise<CleanupOldNotificationLoggedEventDaysResult>>>;
 }
 /**
  * Creates a concrete {@link NotificationServerActions} implementation by wiring each action
@@ -314,3 +315,17 @@ export declare function sendQueuedNotificationsFactory(context: NotificationServ
  * @returns a transform-and-validate function that cleans up sent notification documents and returns aggregate results
  */
 export declare function cleanupSentNotificationsFactory(context: NotificationServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<CleanupSentNotificationsParams, () => Promise<CleanupSentNotificationsResult>, object, unknown>;
+/**
+ * Factory for the `cleanupOldNotificationLoggedEventDays` action.
+ *
+ * Queries the {@link NotificationLoggedEventDayFirestoreCollectionGroup} for day documents whose
+ * ISO day string ID is older than `now - retentionDays`, then deletes each old day's wrapper doc
+ * and all of its nested page documents (the paged `_index` plus every page).
+ *
+ * For each old day, all docs in the day's paged subcollection are deleted before the wrapper doc
+ * itself, so a partial failure leaves the index pointing at zero pages rather than orphaned ones.
+ *
+ * @param context - the notification server actions context with paged-items collection access
+ * @returns a transform-and-validate function that purges old logged-event days and returns aggregate counts
+ */
+export declare function cleanupOldNotificationLoggedEventDaysFactory(context: NotificationServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<CleanupOldNotificationLoggedEventDaysParams, () => Promise<CleanupOldNotificationLoggedEventDaysResult>, object, unknown>;

package/model/src/lib/notification/notification.module.d.ts

@@ -31,6 +31,10 @@ export declare function notificationServerActionsContextFactory(context: BaseNot
     notificationCollectionGroup: import("@dereekb/firebase").NotificationFirestoreCollectionGroup;
     notificationWeekCollectionFactory: import("@dereekb/firebase").NotificationWeekFirestoreCollectionFactory;
     notificationWeekCollectionGroup: import("@dereekb/firebase").NotificationWeekFirestoreCollectionGroup;
+    notificationLoggedEventDayCollectionFactory: import("@dereekb/firebase").NotificationLoggedEventDayFirestoreCollectionFactory;
+    notificationLoggedEventDayCollectionGroup: import("@dereekb/firebase").NotificationLoggedEventDayFirestoreCollectionGroup;
+    notificationLoggedEventDayPagedItemsCollectionFactory: import("@dereekb/firebase").NotificationLoggedEventDayPagedItemsFirestoreCollectionFactory;
+    notificationLoggedEventDayPageCollectionGroup: import("@dereekb/firebase").NotificationLoggedEventDayPageFirestoreCollectionGroup;
     authService: import("dist/packages/firebase-server/src").FirebaseServerAuthService<import("dist/packages/firebase-server/src").FirebaseServerAuthUserContext, import("dist/packages/firebase-server/src").FirebaseServerAuthContext<import("dist/packages/firebase-server/src").FirebaseServerAuthUserContext>>;
     firestoreContext: import("@dereekb/firebase").FirestoreContext<import("@dereekb/firebase").Firestore>;
 };

package/oidc/index.cjs.js

@@ -5812,51 +5812,6 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-/**
- * Prefix shared by every callModel OIDC scope (e.g., `model.create`).
- *
- * Kept stable so OAuth consent screens render consistent labels and so
- * future per-resource scopes (e.g., `model.create:profile`) compose cleanly.
- */ var CALL_MODEL_OIDC_SCOPE_PREFIX = 'model.';
-/**
- * Canonical CRUD scopes enforced on the `callModel` API.
- *
- * Each scope corresponds 1:1 to a {@link KnownOnCallFunctionType}; see
- * {@link CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE}.
- */ var CALL_MODEL_OIDC_SCOPES = [
-    'model.create',
-    'model.read',
-    'model.update',
-    'model.delete',
-    'model.query'
-];
-/**
- * Maps each known CRUD call type to the scope an OIDC token must carry to invoke it.
- */ var CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE = {
-    create: 'model.create',
-    read: 'model.read',
-    update: 'model.update',
-    delete: 'model.delete',
-    query: 'model.query'
-};
-/**
- * Resolves the OIDC scope that an OIDC-authenticated caller must hold to invoke
- * the given callModel `call` type.
- *
- * Returns `undefined` for non-CRUD (custom) call types so that scope enforcement
- * is opt-in for app-specific verbs — apps can still gate them via their own
- * `preAssert` if needed.
- *
- * @param call - The CRUD call type from {@link OnCallTypedModelParams.call}.
- * @returns The required scope, or `undefined` if `call` is not one of the known CRUD verbs.
- */ function callModelOidcScopeForCallType(call) {
-    var result = call == null ? undefined : CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE[call];
-    return result;
-}
-/**
- * Error code used when an OIDC-authenticated caller is missing the required
- * `model.*` scope for a callModel CRUD operation.
- */ var CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE = 'CALL_MODEL_MISSING_OIDC_SCOPE';
 /**
  * Builds a {@link AssertModelCrudRequestFunction} that rejects callModel requests
  * lacking the OIDC scope mapped from the call type.
@@ -5874,13 +5829,13 @@ function _unsupported_iterable_to_array(o, minLen) {
  * @returns The pre-assertion function ready to plug into `OnCallModelConfig.preAssert`.
  */ function oidcCallModelScopePreAssert() {
     var fn = function fn(context) {
-        var requiredScope = callModelOidcScopeForCallType(context.call);
+        var requiredScope = firebase.callModelOidcScopeForCallType(context.call);
         var scopes = requiredScope == null ? undefined : getOidcScopesFromRequest(context.request);
         var isMissingScope = requiredScope != null && scopes != null && !scopes.has(requiredScope);
         if (isMissingScope) {
             throw firebaseServer.forbiddenError({
                 status: 403,
-                code: CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,
+                code: firebase.CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,
                 message: "Missing required OIDC scope for callModel: ".concat(requiredScope),
                 data: {
                     requiredScope: requiredScope,
@@ -5892,10 +5847,6 @@ function _unsupported_iterable_to_array(o, minLen) {
     return fn;
 }
 
-exports.CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE = CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE;
-exports.CALL_MODEL_OIDC_SCOPES = CALL_MODEL_OIDC_SCOPES;
-exports.CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE = CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE;
-exports.CALL_MODEL_OIDC_SCOPE_PREFIX = CALL_MODEL_OIDC_SCOPE_PREFIX;
 exports.DEFAULT_APP_OAUTH_CONSENT_PATH_PART = DEFAULT_APP_OAUTH_CONSENT_PATH_PART;
 exports.DEFAULT_APP_OAUTH_INTERACTION_PATH = DEFAULT_APP_OAUTH_INTERACTION_PATH;
 exports.DEFAULT_APP_OAUTH_LOGIN_PATH_PART = DEFAULT_APP_OAUTH_LOGIN_PATH_PART;
@@ -5926,7 +5877,6 @@ exports.OidcServerFirestoreCollections = OidcServerFirestoreCollections;
 exports.activeJwksKeysQuery = activeJwksKeysQuery;
 exports.appOidcModelModuleMetadata = appOidcModelModuleMetadata;
 exports.applyOidcAuthMiddleware = applyOidcAuthMiddleware;
-exports.callModelOidcScopeForCallType = callModelOidcScopeForCallType;
 exports.createAdapterFactory = createAdapterFactory;
 exports.createOidcClientFactory = createOidcClientFactory;
 exports.deleteOidcClientFactory = deleteOidcClientFactory;

package/oidc/index.esm.js

@@ -1,7 +1,7 @@
 import { createParamDecorator, Injectable, Inject, Optional, Logger, UnauthorizedException, Get, Param, Req, Res, Post, HttpCode, HttpStatus, Body, Controller, HttpException, All } from '@nestjs/common';
 import { generateKeyPairSync, randomBytes } from 'node:crypto';
 import { resolveEncryptionKey, encryptValue, decryptValue, createAesStringEncryptionProvider, isValidAES256GCMEncryptionSecret } from '@dereekb/nestjs';
-import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, oidcEntryFirestoreCollection } from '@dereekb/firebase';
+import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, oidcEntryFirestoreCollection, callModelOidcScopeForCallType, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE } from '@dereekb/firebase';
 import { cachedGetter, unixDateTimeSecondsNumberToDate, unixDateTimeSecondsNumberForNow, selectiveFieldEncryptor, filterUndefinedValues, websiteUrlFromPaths, firstValue, hasHttpPrefix } from '@dereekb/util';
 import { firestoreEncryptedField, firebaseServerActionsContext, FirebaseServerEnvService, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FirebaseServerFirestoreContextModule, forbiddenError } from '@dereekb/firebase-server';
 import { nanoid } from 'nanoid';
@@ -5810,51 +5810,6 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-/**
- * Prefix shared by every callModel OIDC scope (e.g., `model.create`).
- *
- * Kept stable so OAuth consent screens render consistent labels and so
- * future per-resource scopes (e.g., `model.create:profile`) compose cleanly.
- */ var CALL_MODEL_OIDC_SCOPE_PREFIX = 'model.';
-/**
- * Canonical CRUD scopes enforced on the `callModel` API.
- *
- * Each scope corresponds 1:1 to a {@link KnownOnCallFunctionType}; see
- * {@link CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE}.
- */ var CALL_MODEL_OIDC_SCOPES = [
-    'model.create',
-    'model.read',
-    'model.update',
-    'model.delete',
-    'model.query'
-];
-/**
- * Maps each known CRUD call type to the scope an OIDC token must carry to invoke it.
- */ var CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE = {
-    create: 'model.create',
-    read: 'model.read',
-    update: 'model.update',
-    delete: 'model.delete',
-    query: 'model.query'
-};
-/**
- * Resolves the OIDC scope that an OIDC-authenticated caller must hold to invoke
- * the given callModel `call` type.
- *
- * Returns `undefined` for non-CRUD (custom) call types so that scope enforcement
- * is opt-in for app-specific verbs — apps can still gate them via their own
- * `preAssert` if needed.
- *
- * @param call - The CRUD call type from {@link OnCallTypedModelParams.call}.
- * @returns The required scope, or `undefined` if `call` is not one of the known CRUD verbs.
- */ function callModelOidcScopeForCallType(call) {
-    var result = call == null ? undefined : CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE[call];
-    return result;
-}
-/**
- * Error code used when an OIDC-authenticated caller is missing the required
- * `model.*` scope for a callModel CRUD operation.
- */ var CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE = 'CALL_MODEL_MISSING_OIDC_SCOPE';
 /**
  * Builds a {@link AssertModelCrudRequestFunction} that rejects callModel requests
  * lacking the OIDC scope mapped from the call type.
@@ -5890,4 +5845,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     return fn;
 }
 
-export { CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_OIDC_SCOPE_PREFIX, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, applyOidcAuthMiddleware, callModelOidcScopeForCallType, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, applyOidcAuthMiddleware, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.11.1",
+  "version": "13.11.3",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.1",
-    "@dereekb/date": "13.11.1",
-    "@dereekb/firebase": "13.11.1",
-    "@dereekb/firebase-server": "13.11.1",
-    "@dereekb/model": "13.11.1",
-    "@dereekb/nestjs": "13.11.1",
-    "@dereekb/rxjs": "13.11.1",
-    "@dereekb/util": "13.11.1",
-    "@dereekb/zoho": "13.11.1",
+    "@dereekb/analytics": "13.11.3",
+    "@dereekb/date": "13.11.3",
+    "@dereekb/firebase": "13.11.3",
+    "@dereekb/firebase-server": "13.11.3",
+    "@dereekb/model": "13.11.3",
+    "@dereekb/nestjs": "13.11.3",
+    "@dereekb/rxjs": "13.11.3",
+    "@dereekb/util": "13.11.3",
+    "@dereekb/zoho": "13.11.3",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/scope.d.ts

@@ -1,45 +1,5 @@
-import { type Maybe } from '@dereekb/util';
-import { type KnownOnCallFunctionType, type OnCallFunctionType, type OnCallTypedModelParams } from '@dereekb/firebase';
+import { type OnCallTypedModelParams } from '@dereekb/firebase';
 import { type AssertModelCrudRequestFunction } from '@dereekb/firebase-server';
-/**
- * Prefix shared by every callModel OIDC scope (e.g., `model.create`).
- *
- * Kept stable so OAuth consent screens render consistent labels and so
- * future per-resource scopes (e.g., `model.create:profile`) compose cleanly.
- */
-export declare const CALL_MODEL_OIDC_SCOPE_PREFIX = "model.";
-/**
- * Canonical CRUD scopes enforced on the `callModel` API.
- *
- * Each scope corresponds 1:1 to a {@link KnownOnCallFunctionType}; see
- * {@link CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE}.
- */
-export declare const CALL_MODEL_OIDC_SCOPES: readonly ["model.create", "model.read", "model.update", "model.delete", "model.query"];
-/**
- * Union of the five canonical callModel CRUD scope strings.
- */
-export type CallModelOidcScope = (typeof CALL_MODEL_OIDC_SCOPES)[number];
-/**
- * Maps each known CRUD call type to the scope an OIDC token must carry to invoke it.
- */
-export declare const CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE: Readonly<Record<KnownOnCallFunctionType, CallModelOidcScope>>;
-/**
- * Resolves the OIDC scope that an OIDC-authenticated caller must hold to invoke
- * the given callModel `call` type.
- *
- * Returns `undefined` for non-CRUD (custom) call types so that scope enforcement
- * is opt-in for app-specific verbs — apps can still gate them via their own
- * `preAssert` if needed.
- *
- * @param call - The CRUD call type from {@link OnCallTypedModelParams.call}.
- * @returns The required scope, or `undefined` if `call` is not one of the known CRUD verbs.
- */
-export declare function callModelOidcScopeForCallType(call: Maybe<OnCallFunctionType>): Maybe<CallModelOidcScope>;
-/**
- * Error code used when an OIDC-authenticated caller is missing the required
- * `model.*` scope for a callModel CRUD operation.
- */
-export declare const CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE = "CALL_MODEL_MISSING_OIDC_SCOPE";
 /**
  * Builds a {@link AssertModelCrudRequestFunction} that rejects callModel requests
  * lacking the OIDC scope mapped from the call type.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.11.1",
+  "version": "13.11.3",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -44,15 +44,15 @@
   "main": "./index.cjs.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.1",
-    "@dereekb/date": "13.11.1",
-    "@dereekb/dbx-core": "13.11.1",
-    "@dereekb/firebase": "13.11.1",
-    "@dereekb/model": "13.11.1",
-    "@dereekb/nestjs": "13.11.1",
-    "@dereekb/rxjs": "13.11.1",
-    "@dereekb/util": "13.11.1",
-    "@dereekb/zoho": "13.11.1",
+    "@dereekb/analytics": "13.11.3",
+    "@dereekb/date": "13.11.3",
+    "@dereekb/dbx-core": "13.11.3",
+    "@dereekb/firebase": "13.11.3",
+    "@dereekb/model": "13.11.3",
+    "@dereekb/nestjs": "13.11.3",
+    "@dereekb/rxjs": "13.11.3",
+    "@dereekb/util": "13.11.3",
+    "@dereekb/zoho": "13.11.3",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",

package/src/lib/firestore/array.d.ts

@@ -13,5 +13,6 @@ import { type UpdateData, type FirestoreAccessorArrayUpdate } from '@dereekb/fir
  *   remove: { tags: ['old-tag'] }
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreServerArrayUpdateToUpdateData<T extends object>(input: FirestoreAccessorArrayUpdate<T>): UpdateData<T>;

package/src/lib/firestore/driver.accessor.batch.d.ts

@@ -41,6 +41,7 @@ export declare class WriteBatchFirestoreDocumentDataAccessor<T> implements Fires
  * await accessor.set({ name: 'Alice' });
  * await batch.commit();
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function writeBatchAccessorFactory<T>(writeBatch: GoogleCloudWriteBatch): FirestoreDocumentDataAccessorFactory<T>;
 /**

package/src/lib/firestore/driver.accessor.default.d.ts

@@ -32,6 +32,7 @@ export declare class DefaultFirestoreDocumentDataAccessor<T> implements Firestor
  * const factory = defaultFirestoreAccessorFactory<User>();
  * const accessor = factory.accessorFor(userDocRef);
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function defaultFirestoreAccessorFactory<T>(): FirestoreDocumentDataAccessorFactory<T>;
 /**

package/src/lib/firestore/driver.accessor.transaction.d.ts

@@ -43,6 +43,7 @@ export declare class TransactionFirestoreDocumentDataAccessor<T> implements Fire
  *   await accessor.update({ name: 'Updated' });
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function transactionAccessorFactory<T>(transaction: GoogleCloudTransaction): FirestoreDocumentDataAccessorFactory<T>;
 /**

package/src/lib/firestore/driver.query.d.ts

@@ -16,6 +16,7 @@ export declare const FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING: FullFire
  * Translates abstract query constraints into Google Cloud Firestore query builder calls.
  *
  * @returns A {@link FirestoreQueryConstraintFunctionsDriver} for the server SDK.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreClientQueryConstraintFunctionsDriver(): FirestoreQueryConstraintFunctionsDriver;
 /**

package/src/lib/firestore/increment.d.ts

@@ -15,5 +15,6 @@ import { type UpdateData, type FirestoreAccessorIncrementUpdate } from '@dereekb
  *   likeCount: -1
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreServerIncrementUpdateToUpdateData<T extends object>(input: FirestoreAccessorIncrementUpdate<T>): UpdateData<T>;

package/src/lib/firestore/snapshot/snapshot.field.encrypt.d.ts

@@ -44,6 +44,7 @@ export interface OptionalFirestoreEncryptedFieldConfig<T> {
  * @template T - The JSON-serializable value type.
  * @param config - Encryption field configuration.
  * @returns A field mapping configuration for encrypted values.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreEncryptedField<T>(config: FirestoreEncryptedFieldConfig<T>): FirestoreModelFieldMapFunctionsConfig<T, string>;
 /**
@@ -62,5 +63,6 @@ export declare function firestoreEncryptedField<T>(config: FirestoreEncryptedFie
  * @template T - The JSON-serializable value type.
  * @param config - Encryption field configuration.
  * @returns A field mapping configuration for optional encrypted values.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function optionalFirestoreEncryptedField<T>(config: OptionalFirestoreEncryptedFieldConfig<T>): FirestoreModelFieldMapFunctionsConfig<Maybe<T>, Maybe<string>>;

package/src/lib/nest/app.module.d.ts

@@ -121,5 +121,6 @@ export interface NestServerRootModuleResult {
  *
  * @param config - Shared configuration
  * @returns The root module and resolved prefix config
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function buildNestServerRootModule(config: NestServerRootModuleConfig): NestServerRootModuleResult;

package/src/lib/nest/auth/auth.module.d.ts

@@ -38,6 +38,7 @@ export type ProvideFirebaseServerAuthService<T extends FirebaseServerAuthService
  *   useFactory: (auth) => new MyAuthService(auth)
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function provideFirebaseServerAuthService<T extends FirebaseServerAuthService>(provider: ProvideFirebaseServerAuthService<T>): [ProvideFirebaseServerAuthService<T>, Provider<T>];
 export interface FirebaseServerAuthModuleMetadataConfig<T extends FirebaseServerAuthService> extends AdditionalModuleMetadata {

package/src/lib/nest/development/development.app.function.d.ts

@@ -78,5 +78,6 @@ export interface FirebaseServerDevFunctions {
  *
  * export const { dev } = devFunctions;
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firebaseServerDevFunctions<N extends AbstractFirebaseNestContext<any, any>, S extends NestApplicationScheduleConfiguredFunctionMap>(config: FirebaseServerDevFunctionsConfig<N, S>): FirebaseServerDevFunctions;

package/src/lib/nest/development/development.function.d.ts

@@ -53,6 +53,7 @@ export interface OnCallDevelopmentConfig<N> {
  *   resetData: resetDataFunction
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onCallDevelopmentFunction<N>(map: OnCallDevelopmentFunctionMap<N>, config?: OnCallDevelopmentConfig<N>): OnCallWithNestContext<N, OnCallDevelopmentParams>;
 /**

package/src/lib/nest/development/development.schedule.function.d.ts

@@ -34,5 +34,6 @@ export interface MakeScheduledFunctionDevelopmentFunctionConfig {
  *   [SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER]: scheduleDev
  * };
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function makeScheduledFunctionDevelopmentFunction(config: MakeScheduledFunctionDevelopmentFunctionConfig): OnCallDevelopmentFunction<unknown, ScheduledFunctionDevelopmentFirebaseFunctionParams, ScheduledFunctionDevelopmentFirebaseFunctionResult>;

package/src/lib/nest/development/development.schedule.function.error.d.ts

@@ -7,6 +7,7 @@ export declare const NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FU
  * without specifying which scheduled function to execute.
  *
  * @returns A bad-request error indicating the missing run name.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function noRunNameSpecifiedForScheduledFunctionDevelopmentFunction(): import("firebase-functions/https").HttpsError;
 /**

package/src/lib/nest/function/call.d.ts

@@ -98,6 +98,7 @@ export interface OnCallWithAuthAwareNestRequireAuthRef {
  *
  * @param fn
  * @param request
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function assertRequestRequiresAuthForFunction(fn: OnCallWithAuthAwareNestRequireAuthRef, request: OnCallWithNestContextRequest<any, any>): void;
 /**

package/src/lib/nest/function/context.d.ts

@@ -124,5 +124,6 @@ export interface FirebaseServerActionsTransformFactoryOptions {
  *
  * @param options - Optional configuration for error logging behavior.
  * @returns A factory that creates type-safe transform functions from ArkType schemas.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firebaseServerActionsTransformFactory(options?: FirebaseServerActionsTransformFactoryOptions): TransformAndValidateObjectFactory;

package/src/lib/nest/function/v2/blocking.d.ts

@@ -74,6 +74,7 @@ export interface BlockingFunctionBuilder<E extends object, O> {
  * @param handler - The handler logic to execute on each event.
  * @param opts - Optional {@link BlockingOptions} passed to the builder.
  * @returns A {@link BlockingFunctionWithHandler} with the handler accessible via `__handler`.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function makeBlockingFunctionWithHandler<E extends object, O>(blockingFunctionBuilder: BlockingFunctionBuilder<E, O>, handler: BlockingFunctionHandler<E, O>, opts?: Maybe<BlockingOptions>): BlockingFunctionWithHandler<E, O>;
 /**
@@ -128,5 +129,6 @@ export type BlockingFunctionHandlerWithNestContextFactory<N> = <E extends object
  *
  * @param makeNestContext - Factory that creates the typed context from the NestJS application context.
  * @returns A factory for creating nest-context-aware blocking function handlers.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function blockingFunctionHandlerWithNestContextFactory<N>(makeNestContext: MakeNestContext<N>): BlockingFunctionHandlerWithNestContextFactory<N>;

package/src/lib/nest/function/v2/call.d.ts

@@ -31,6 +31,7 @@ export type OnCallHandlerWithNestApplicationFactory = <I = unknown, O = unknown>
  *
  * @param defaultOpts - Default {@link https.CallableOptions} applied to all functions created by this factory.
  * @returns A factory that creates nest-application-aware callable functions.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onCallHandlerWithNestApplicationFactory(defaultOpts?: https.CallableOptions): OnCallHandlerWithNestApplicationFactory;
 /**
@@ -57,5 +58,6 @@ export type OnCallHandlerWithNestContextFactory<C> = <I = unknown, O = unknown>(
  * @param appFactory - The base application-level callable factory.
  * @param makeNestContext - Factory that creates the typed context from the application context.
  * @returns A factory that creates typed-context-aware callable functions.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onCallHandlerWithNestContextFactory<C>(appFactory: OnCallHandlerWithNestApplicationFactory, makeNestContext: MakeNestContext<C>): OnCallHandlerWithNestContextFactory<C>;

package/src/lib/nest/function/v2/event.d.ts

@@ -89,5 +89,6 @@ export type CloudEventHandlerWithNestContextFactory<N> = <E extends CloudEvent<a
  *
  * @param makeNestContext - Factory that creates the typed context from the NestJS application context.
  * @returns A factory for creating nest-context-aware event function handlers.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function cloudEventHandlerWithNestContextFactory<N>(makeNestContext: MakeNestContext<N>): CloudEventHandlerWithNestContextFactory<N>;

package/src/lib/nest/function/v2/schedule.d.ts

@@ -15,6 +15,7 @@ export type OnScheduleConfigWithGlobalOptions = OnScheduleConfig & Omit<Schedule
  * @param nestApplication - The initialized NestJS application context.
  * @param scheduleContext - The optional Firebase scheduler event, absent when invoked via `_runNow()`.
  * @returns A request object ready for schedule function handlers.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function makeOnScheduleHandlerWithNestApplicationRequest(nestApplication: INestApplicationContext, scheduleContext?: scheduler.ScheduledEvent): OnScheduleWithNestApplicationRequest<scheduler.ScheduledEvent>;
 /**
@@ -46,6 +47,7 @@ export type OnScheduleHandlerWithNestApplicationFactory = (schedule: OnScheduleC
  *
  * @param baseScheduleConfig - Optional default schedule options merged into every function created by this factory.
  * @returns A factory for creating nest-application-aware scheduled functions.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onScheduleHandlerWithNestApplicationFactory(baseScheduleConfig?: OnScheduleConfigWithGlobalOptions): OnScheduleHandlerWithNestApplicationFactory;
 /**
@@ -61,5 +63,6 @@ export type OnScheduleHandlerWithNestContextFactory<N> = (schedule: OnScheduleCo
  * @param appFactory
  * @param makeNestContext
  * @returns
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onScheduleHandlerWithNestContextFactory<N>(appFactory: OnScheduleHandlerWithNestApplicationFactory, makeNestContext: MakeNestContext<N>): OnScheduleHandlerWithNestContextFactory<N>;

package/src/lib/nest/function/v2/taskqueue.d.ts

@@ -17,5 +17,6 @@ export type TaskQueueFunctionHandlerWithNestContextFactory<N> = <I = unknown>(fn
  * @param appFactory
  * @param makeNestContext
  * @returns
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function taskQueueFunctionHandlerWithNestContextFactory<N>(makeNestContext: MakeNestContext<N>): TaskQueueFunctionHandlerWithNestContextFactory<N>;

package/src/lib/nest/model/analytics.handler.d.ts

@@ -73,6 +73,7 @@ export declare const ON_CALL_MODEL_ANALYTICS_SERVICE: InjectionToken<OnCallModel
  * service is registered.
  *
  * @returns An {@link OnCallModelAnalyticsService} that discards all analytics events.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function noopOnCallModelAnalyticsService(): OnCallModelAnalyticsService;
 /**

package/src/lib/nest/model/call.model.function.d.ts

@@ -120,5 +120,6 @@ export interface OnCallWithCallTypeModelConfig<N> {
  * @param config - Configuration including call type, crud type, and error factory.
  * @returns A callable function that dispatches to the correct model-type handler.
  * @internal Not intended for direct use outside the model CRUD module.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function _onCallWithCallTypeFunction<N>(map: OnCallWithCallTypeModelMap<N>, config: OnCallWithCallTypeModelConfig<N>): OnCallWithAuthAwareNestContext<N, OnCallTypedModelParams, unknown> & OnCallApiDetailsRef;

package/src/lib/nest/model/create.model.function.d.ts

@@ -90,5 +90,6 @@ export declare function onCallCreateModel<N>(map: OnCallCreateModelMap<N>, confi
  *
  * @param modelType - The unrecognized model type string.
  * @returns A bad-request error with {@link UNKNOWN_MODEL_TYPE_ERROR_CODE} code.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createModelUnknownModelTypeError(modelType: FirestoreModelType): import("firebase-functions/https").HttpsError;

package/src/lib/nest/storage/storage.module.d.ts

@@ -58,6 +58,7 @@ export type ProvideFirebaseServerStorageService<T extends FirebaseServerStorageS
  *
  * @param provider - The storage service provider configuration.
  * @returns An array of NestJS providers for the storage service.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function provideFirebaseServerStorageService<T extends FirebaseServerStorageService = FirebaseServerStorageService>(provider: ProvideFirebaseServerStorageService<T>): Provider<T>[];
 export interface FirebaseServerStorageModuleMetadataConfig<T extends FirebaseServerStorageService = FirebaseServerStorageService> extends AdditionalModuleMetadata {

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.11.1",
+  "version": "13.11.3",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.1",
-    "@dereekb/date": "13.11.1",
-    "@dereekb/firebase": "13.11.1",
-    "@dereekb/firebase-server": "13.11.1",
-    "@dereekb/firebase-server/oidc": "13.11.1",
-    "@dereekb/model": "13.11.1",
-    "@dereekb/nestjs": "13.11.1",
-    "@dereekb/rxjs": "13.11.1",
-    "@dereekb/util": "13.11.1",
+    "@dereekb/analytics": "13.11.3",
+    "@dereekb/date": "13.11.3",
+    "@dereekb/firebase": "13.11.3",
+    "@dereekb/firebase-server": "13.11.3",
+    "@dereekb/firebase-server/oidc": "13.11.3",
+    "@dereekb/model": "13.11.3",
+    "@dereekb/nestjs": "13.11.3",
+    "@dereekb/rxjs": "13.11.3",
+    "@dereekb/util": "13.11.3",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.11.1"
+    "@dereekb/nestjs": "13.11.3"
   },
   "exports": {
     "./package.json": "./package.json",